Effective 30 August 2026 · Version 2026-08-30
The short version
Tapir is a running coach. It needs your training data to coach you and it does not need anything else.
- We do not sell your personal information, and we do not share it for advertising.
- We do not use your data to train machine-learning models, ours or anybody else's. That is still true now the app has a conversational coach: what you type is sent to Anthropic to answer you and is not used to train anything.
- Most of what Tapir does happens on your phone. Your plan is generated there and stored there, encrypted.
- You can use the whole app without an account.
- You can delete everything from inside the app, in one step, without asking us.
The rest of this document is the detail behind those five lines.
1. Who we are
Tapir ("Tapir", "we", "us") is the controller of the personal data described here. We are based in New York, United States. Reach us at privacy@tapirapp.com for anything about your data, or support@tapirapp.com for anything else. Both are read by a person. If you need a postal address for a formal notice, ask and we will give you one.
2. What we collect, and why
Everything below is collected because a coaching feature needs it. Where a category is optional, the app works without it and you lose only the feature it feeds.
| Category | What it is | Why | Optional? |
|---|---|---|---|
| Training data | Sessions we prescribed, what you logged, effort ratings, context tags, notes you write. | It is the coaching. Without it there is no plan to adapt. | No |
| Health and fitness data | Age, height, weight, sex, resting and maximum heart rate, injuries and where they hurt. | Sets your heart-rate zones and your carbohydrate targets. | Yes, both features degrade gracefully |
| Location, while you record a run or a ride | Your position, several times a minute, for as long as a recording is running and not one second longer. Nothing is read when you are not recording. Swims are not recorded at all, because a phone in a locker cannot receive satellites; they are entered by hand like any other session. | To measure distance, pace and climb. The positions are turned into those three numbers on your phone as they arrive; the route itself is never stored once the session ends and never leaves the device. | Yes, entirely. Log your sessions by hand instead and nothing else changes |
| Imported activities | Nothing today. Tapir imports from no provider: every run it knows about is one you logged in the app. If that changes, this row and the permission that goes with it change first. | Not applicable yet. | Not collected |
| Recovery data | From a wearable: sleep, heart-rate variability, resting heart rate. | Feeds the daily readiness score that trims a session when you are underslept. | Yes, only if you connect a device |
| Account data | An opaque identifier from Apple, Google or your email address, plus a record of which version of these documents you accepted and when. If you choose a password, we store a scrypt hash of it, never the password itself, in a table the application cannot read. | Backup, syncing between devices, and proving we obtained consent. | Yes, the app works signed out |
| What you ask the coach | Your question, and the reply. Sent to Anthropic with a summary of your plan and any injury you have reported, so it can answer. | To answer you, and to see what people actually ask so the app can answer it better. | Yes, only if you use it |
| Feedback you write | What you type into the feedback box, and when it arrived. Nothing about the session, the plan or your body goes with it. | So we can fix what you told us about. | Yes, only if you write something |
| Diagnostics | Crash reports and coarse usage events, with credentials and health values stripped on the device before sending. | Finding and fixing crashes. | Yes, switchable in settings |
What we deliberately do not collect
Your location, except where it is already inside an activity you chose to import. Your contacts. Your photos. Advertising identifiers. We do not track you across other apps or websites, and Tapir contains no advertising SDK, no analytics SDK belonging to an advertising company, and no third-party tracker.
How we measure whether Tapir is working
We do want to know whether people come back and which parts of the app they use, so we collect two things, both of them first-party. Nothing here goes to a third party, and there is no analytics product involved.
A date on your account recording the last day you opened the app. A date, not a time: which hour you train is your business. Together with the day you signed up, it tells us whether people stay, which is the only retention measure we keep.
Counts of things that happened, stored with no account attached to them. Your phone tallies how many times you did a handful of things on a given day (opened the app, logged a check-in, asked the coach a question) and sends the totals. They are added to a running figure for everyone. The table they live in has three columns: the day, the name of the thing, and how many times it happened. There is no column for who did it, so these numbers cannot be traced back to you or to anyone, by us or by anybody who obtained them.
The list of things we count is fixed in the software and the server refuses anything not on it. It is: opening the app, creating a plan, a plan being regenerated, a plan being reshaped, logging a check-in, opening a session, reporting pain, asking the coach, the coach failing to answer, applying a change the coach suggested, sending feedback, granting or withdrawing health-data consent, being shown the review prompt, and connecting an import. Nothing about your body, your pace, your injuries or what you typed is in that list, and none of it leaves your phone as part of this.
3. Why we are allowed to hold it
Where the UK GDPR or the EU GDPR applies, our lawful bases under Article 6 and, for health data, Article 9 are:
| Data | Lawful basis |
|---|---|
| Health and fitness data, recovery data, injuries | Your explicit consent, Article 9(2)(a), on top of Article 6(1)(a). This is special category data, so it is asked for on its own, when a feature needs it, and never as a condition of having an account. Declining costs you the features that need it and nothing else. You can withdraw at any time, and withdrawal is recorded rather than simply forgotten. |
| Training data, account data | Performance of a contract, Article 6(1)(b). You asked us to coach you; this is what that takes. |
| Diagnostics, security logs, abuse prevention | Legitimate interests, Article 6(1)(f), being our interest in a working and un-abused service, balanced against your interests. You can object. |
| Consent records, deletion records, tax and accounting records | Legal obligation, Article 6(1)(c). We keep proof that we asked and proof that we deleted. |
Withdrawing consent. In the app, wherever the feature that uses it lives, and in You → Privacy. Withdrawal is not retroactive (it does not undo processing that was lawful when it happened) but it stops the processing from continuing, it is recorded as a withdrawal rather than as an absence, and you can delete the data in the same place.
4. Automated decisions
Tapir generates and adapts your training plan automatically. That is the product, so we want to be explicit about it: an algorithm decides what you are asked to run and how fast, using the data described above.
These decisions do not produce legal effects or similarly significant effects within the meaning of Article 22. Nothing Tapir decides affects your employment, your credit, your insurance, your access to a service, or any legal right. Every session it prescribes can be ignored, edited or replaced by you, and the app tells you in plain language why each change was made. There is no profiling for advertising, pricing or eligibility of any kind.
4a. Talking to the coach
The coach is the one part of Tapir that does its thinking somewhere else. Everything the app does to build and adapt your plan runs on your phone or on our own server. When you send a message to the coach, that message leaves both.
It goes to Anthropic, who run the model that writes the reply. With it goes enough of your training for the answer to be about you: your current plan, your goal and race date, your recent sessions, and any injury you have logged. What does not go is your name, your email address, your account identifier, or the free-text notes you write on check-ins.
Anthropic act as our processor under a written contract. They return the reply to us and may not use what you send to train their models. We keep the conversation only for as long as the chat is open on your device.
We ask you about this separately, inside the app, before your first message rather than when you sign up. Declining costs you the coach and nothing else: your plan, the adjustments, the check-ins and the science all keep working, because none of them need it. You can withdraw at any time by declining the next time you open the chat.
The coach cannot change your training by itself. It proposes a change, our own engine decides whether that change is safe, and nothing happens until you accept it.
5. Who else sees it
We do not sell personal information and we have never disclosed it for anybody's advertising. Two different kinds of company touch it, and the difference matters because it is what the phrase above rests on.
Processors, acting on our instructions
These handle data on our behalf, under a written contract, and may not use it for anything else:
- Cloud hosting and database. Storing the account backup you asked for.
- Crash and error reporting. Receiving diagnostics, already stripped of health values.
- Email delivery. Sending your sign-in code, and nothing else.
- Nobody else. Tapir reads no other app's data and sends no health data out to any other service.
| Processor | What it handles | Where |
|---|---|---|
| Cloud host and managed database | Account backup and sync, if you have an account | United States |
| Error reporting | Crash reports, health values already stripped | United States |
| Transactional email | Your sign-in code, and nothing else | United States |
| Anthropic | The conversational coach. Receives your question and a summary of your plan, goal and any active injury, to answer you. Never your notes, your name, or your contact details. | United States |
A current list of named sub-processors is available on request, and we will give reasonable notice before adding one that handles health data.
Independent services you choose to use
These are not our processors and we do not instruct them. You interact with them directly, and their own privacy policies govern what they do:
- Apple and Google, if you sign in with them. They confirm who you are. The information travels from them to us, not the other way, and they receive no training or health data from us at all.
- Nobody. Tapir imports from no provider and reads no other app's data. Everything it knows, you told it.
We will also disclose data where we are legally compelled to, and we will tell you when we are permitted to tell you. If Tapir is ever acquired, personal data may transfer with it, and you will be told before any change of controller takes effect.
Apple's rule, which we also treat as ours. Health and fitness data is never used for advertising, never used for marketing, and never sold, traded, or disclosed to a data broker or for any purpose other than coaching you.
6. Where it goes
We are based in the United States, and our servers are in the United States. If you are in the UK, the EEA or Switzerland, your data is transferred outside your country. Where that transfer needs a safeguard, we rely on the European Commission's Standard Contractual Clauses and, for the UK, the International Data Transfer Addendum, together with the encryption and access controls described in section 8. You can ask us for a copy of the relevant clauses.
7. How long we keep it
| What | How long |
|---|---|
| Training data, health data, imported activities | Until you delete it, or 24 months after your last use of the app, whichever comes first. |
| Account records | Until you delete the account. |
| Diagnostics | 90 days. |
| Security and access logs | 12 months. |
| Encrypted backups | 30 days, then overwritten. Deleted data can survive here briefly; see section 9. |
| The record of what you agreed to, when, and whether you later took it back | 6 years. It is append-only: granting, declining and withdrawing each add a row rather than overwriting one, so the history is the proof. It contains no training or health data. |
8. How it is protected
- Data on your phone is stored in an encrypted store, with the key held in the device keychain and available only when the device is unlocked.
- Data in transit is encrypted with TLS. Data at rest on our servers is encrypted.
- Every row in our database is protected by database-level row-level security, so a query for somebody else's data returns nothing even if the application layer has a bug.
- Access to production data is limited to people who need it, and is logged.
- Nothing is perfectly secure. If a breach affects you we will tell you without unreasonable delay, and always within the deadline the law where you live sets. Because Tapir holds health data outside HIPAA, the FTC's Health Breach Notification Rule also applies to us: it requires us to notify affected people, and in a large enough breach the FTC and the media, within 60 days of discovery. Where the GDPR applies, the supervisory authority is told within 72 hours.
9. Your rights
Everywhere
You can delete everything from inside the app: You → Delete everything. It covers your phone and our live systems, it happens immediately, and it cannot be undone. You do not have to contact us, and we will not try to talk you out of it.
One honest caveat: encrypted backups are kept for 30 days so that a failure on our side is survivable. Deleted data can persist in those for up to 30 days before ageing out. It is not restored to the live system, it is not used for anything, and after 30 days it is gone from there too.
UK, EU and Switzerland
You have the right to access your data, to have it corrected, to have it erased, to restrict how we use it, to object to processing based on legitimate interests, to receive it in a portable machine-readable format, and to withdraw consent at any time.
Email privacy@tapirapp.com. We answer within one month, extendable by two further months for genuinely complex requests, in which case we will tell you why inside the first month. There is no charge unless a request is manifestly unfounded or excessive.
You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EEA it is the authority for the country where you live or work. We would rather you came to us first, but you do not have to.
California
Under the CCPA as amended by the CPRA, you have the right to know what we collect and why, to delete it, to correct it, to opt out of sale or sharing, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of those rights.
Two of those need no action from you: we do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not in the preceding twelve months. We use sensitive personal information, your health and fitness data, only to provide the service you asked for, which is a use the CPRA exempts from the right to limit. We do draw one inference from it, and it is the product: an estimate of your running fitness and a daily readiness score, both used to write your training and nothing else. We infer nothing about your health, your habits or your character, and we build no profile for advertising, pricing or eligibility of any kind.
In CCPA terms we collect identifiers, internet or network activity, geolocation inside imported activities, and sensitive personal information consisting of health data. We collect it from you and from services you connect. We disclose it for business purposes only, to the service providers listed in section 5.
You may use an authorised agent, who will need written permission from you and whose authority we may verify with you directly.
Washington, Nevada, and other consumer health laws
Washington's My Health My Data Act and Nevada's SB 370 give residents rights over consumer health data specifically, including the right to know, to delete, and to withdraw consent. Tapir's health data handling is described in section 2, its legal basis in section 3, and its deletion in section 9. We do not sell consumer health data, which under those laws would require a separate signed authorisation we have never sought. Requests go to the same address.
Virginia, Colorado, Connecticut, Texas, Oregon, Montana, and other US states
A growing number of US states give residents broadly similar rights: to confirm whether we process your data and access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling that produces legal or similarly significant effects. We do none of those three things, so the opt-out is already the state you are in.
Most of these laws treat health data as sensitive and require opt-in consent before processing it. That is what Tapir already does, everywhere, for everybody.
If we refuse a request, you may appeal. Reply to our decision and say you are appealing. A different person reviews it and we respond within 45 days with a written explanation. If we deny the appeal we will give you a way to complain to your state Attorney General.
Opt-out preference signals
We honour the Global Privacy Control and other recognised browser opt-out signals on this website. In practice there is nothing for it to switch off: this site sets no cookies, runs no analytics, and contains no third-party tracker. The only third-party request it makes is to Google Fonts for the typefaces.
Verifying a request
Before acting on a request about a specific account we need to be reasonably sure it is yours, so we will ask you to make it from the email address on the account or to confirm through the app. We ask for the least we can, and we do not create an account for somebody who did not have one just to verify them. If we cannot verify you, we will say so and explain why rather than ignoring the request.
No financial incentives
We do not offer discounts, rewards, or different service levels in exchange for personal information, so there is no CCPA notice of financial incentive to give you.
10. Recording a run or a ride
If you press Record, Tapir reads your position from your phone until you press Finish. It asks for background location as well, because a session is twenty minutes to several hours with the phone in a pocket and the screen off, and a tracker that stops at the lock screen records nothing. That is the only thing the permission is used for.
The route does not leave your phone, and is not kept after the session. Positions are turned into a distance, a moving time and a climb figure as they arrive. What is saved is the same three numbers a session you typed in by hand would produce, plus your splits. There is no map stored, no list of coordinates, and nothing about where you were is uploaded to us or to anybody else.
Swims are never recorded. A phone in a locker cannot receive satellites and a phone at the poolside does not move, so Tapir does not offer to record one and does not read your location for one. Swims are entered by hand, which is how a counted pool distance is entered everywhere.
Recording is optional in the fullest sense: every part of Tapir works if you never grant location at all, and you can log the same session by hand in a few seconds. You can withdraw the permission in iOS Settings at any time, and only recording stops working.
11. Apple Health
Tapir does not read Apple Health. There is no HealthKit permission to grant and nothing is imported from it. Every session Tapir knows about is one you logged or recorded in the app.
Reading it is something we want to build. When it exists, these are the rules it will keep, and they are written here now so that they are on the record before the feature is rather than after: HealthKit data used only to coach you inside the app, never for advertising or marketing, never sold, never disclosed to a data broker, never shared with a third party except a processor acting for us, nothing written back that you did not ask for, and revocable in iOS Settings at any time. This section changes at the same time the feature ships, not later.
12. Notifications
Tapir's reminders are scheduled on your phone by your phone. There is no push service, no device token, and nothing about your training is sent anywhere in order to remind you of it: the app knows your plan because your plan is on the device, and it asks iOS to show you something at a time. Turn them off in iOS Settings or in the app and nothing else changes.
13. Children
Tapir is not for children. You must be at least 16 to use it, and we do not knowingly collect data from anybody under that age. If we learn that we have, we delete it. If you believe a child has given us data, email us and we will remove it.
14. Changes
If we change this policy in a way that materially affects you, we will tell you in the app before the change takes effect, and where the law requires it we will ask for your consent again rather than assuming it. Older versions are kept. So is every answer you have given: accepting, declining and withdrawing each add a record rather than replacing the last one, so what you agreed to and when is always recoverable.
15. Contact
Privacy questions and data subject requests go to privacy@tapirapp.com. General help is support@tapirapp.com. Either reaches us, and both are read by a person. Ask if you need a postal address for a formal notice.
16. Where Tapir is offered
Tapir is offered in the United States. It is not offered in the European Economic Area, the United Kingdom, or Switzerland, and we do not target anybody in those places. Offering it there requires a representative established in the region under Article 27 of the GDPR, and we have not appointed one.
The UK and EU sections above are written anyway, and we hold ourselves to them. If you reach Tapir from one of those places despite the above, the rights described in section 9 are still yours, and the same address answers them.