Privacy Policy

1. Introduction

Vici Performance Inc. ("Vici," "we," "us," or "our"), a Delaware corporation, operates the Vici mobile application and related services (the "Service"). This Privacy Policy explains how we collect, use, protect, and share your personal information when you use the Service.

By creating an account or using the Service, you consent to the data practices described in this policy. If you do not agree, please do not use the Service.

2. Data Controller

Vici Performance Inc. is the data controller for personal data processed through the Service. For privacy-related inquiries:

• Email: support@vici.run

3. Information We Collect

3a. Account Information

When you create an account, we collect:

• Identity: Name, email address, date of birth, sex, and height and weight where you enter or import them
• Profile: Profile picture (where you add one or it comes from a connected platform), city, country, time zone
• Authentication: Encrypted password hash or Apple Sign-In identifier
• Fitness Profile: Experience level, fitness level, training preferences, goal race distance and date

3b. Training & Activity Data

From your connected fitness platforms, we collect:

• Activity Details: Distance, duration, pace (average and max), elapsed time, moving time
• Heart Rate: Average and max heart rate during activities
• Precise Location and GPS Routes: The precise location track (GPS coordinates) of runs you record in the Vici app or import from Apple Health or a connected platform, stored as route lines and map thumbnails so we can show your runs. Your route is stored with your account and is never shown to other people in teams (see Section 3h)
• Weather Lookup: The starting coordinates and time of a run are sent to a weather provider (Apple WeatherKit and, where enabled, OpenWeather) to record the conditions you ran in. Apple WeatherKit also receives the start point of your most recent run (within the last 30 days) to build your weather forecasts
• Elevation: Elevation gain and altitude data
• Performance: Personal bests, Vici Score calculations, pace zones, training load metrics (ATL, CTL, TSB)
• Activity Metadata: Activity type, device name, location (city, country), photos

3c. Health & Wellness Data

From connected devices and your self-reported check-ins, we collect:

• Heart Rate & HRV: Resting heart rate, heart rate variability, max heart rate
• Sleep: Duration, stages (light, deep, REM), quality, efficiency, consistency, respiratory rate
• Recovery: Recovery scores, daily strain, blood oxygen (SpO2), skin temperature
• Daily Wellness (Self-Reported): Sleep quality rating, stress level, mood, fatigue, motivation — submitted through in-app wellness check-ins

3d. Coaching Interaction Data

• Journal Entries: Your written reflections on training activities
• Ask Vici Conversations: Messages you send to our AI coach and the responses generated
• Voice Input: If you use the microphone button in Ask Vici, your speech is converted to text by Apple's speech recognition on your device or, depending on your device and language, on Apple's servers under Apple's Privacy Policy. We receive and store only the resulting text, never the audio. You can turn off microphone and speech recognition access in iPhone Settings
• Coaching Feedback: Your ratings and feedback on AI-generated coaching content
• Feedback & Interaction Signals: We review your coaching feedback, survey responses, and coaching interactions — including Ask Vici conversations, your answers to in-app coach questions, and journal entries — to identify bugs, recurring issues, and opportunities to improve the Service. For this analysis, your data is pseudonymized: direct identifiers such as your email address are replaced with a coded reference, and conversation excerpts are minimized to short classified summaries wherever possible. Where this content references health information (for example, a possible injury), we retain only a minimal flag for safety follow-up and handle the underlying data as described in Section 3c. You can object to this analysis at any time (see Section 12).

3e. Connected Platform Data

You choose which platforms to connect. Each requires your explicit authorization (via OAuth 2.0 or HealthKit permissions, depending on the platform). The specific data we receive from each platform:

• Strava: Activity records (date, time, type), distance, duration, splits, average and per-segment pace, average and maximum heart rate, GPS routes and elevation profiles, calories, athlete profile (name, location, profile photo if shared), race history, and personal records
• Apple Health (HealthKit) — beta: Specifically, the data types you authorize through HealthKit permissions: workouts (type, distance, duration, heart rate samples and the GPS route), resting heart rate, heart rate variability (SDNN), blood oxygen (SpO2), respiratory rate, sleep analysis (in-bed time, sleep stages), step count, and running form measures recorded by Apple Watch (stride length, running power, ground contact time, vertical oscillation). We do not request access to data unrelated to running and recovery coaching. Apple Health integration is currently available to select users in beta release.
• WHOOP: Recovery score, sleep performance and stages, HRV, resting heart rate, daily strain, workout records, and cycles.
• Garmin Connect — coming soon: Upon connecting Garmin, we receive activity records (date, time, type), distance, duration, laps and splits, average and per-lap pace, average and maximum heart rate, GPS routes, elevation profiles, and calories; and, where you authorize wellness data, sleep, heart rate variability (HRV), resting heart rate, and stress/Body Battery, used to personalize your daily coaching. We request only the data needed for running and recovery coaching. With your permission, we may also send structured workouts to your Garmin device (we do not read unrelated data in order to do so). Garmin integration is in progress and not yet generally available.
• COROS — limited testing: COROS is in testing with a small group and is not generally available. If you connect COROS, we receive activity records (date, time, type), distance, duration, laps and splits, heart rate and the activity file; and, where you authorize it, sleep, resting heart rate, heart rate variability (HRV), used to personalize your coaching. With your permission we may send structured workouts to your COROS watch. COROS's own privacy policy also applies to data held by COROS
• Other Providers: We may add support for additional fitness platforms (for example Polar or Suunto) in the future. Neither is available to users today. Each will require explicit authorization before any data is shared, and we will update this Policy to list the data fields received before it launches

You can disconnect any integration at any time from your account settings, or revoke access directly through the Connected Platform (e.g., your Strava account settings, your Garmin Connect account settings, your iPhone Settings → Privacy & Security → Health). Disconnecting immediately stops all data syncing from that platform. Data we have already imported stays with your account until you delete your account or ask us to delete it by email.

If you delete data on a connected platform, the copy we already imported is not removed automatically. Email support@vici.run and we will delete it.

Scope changes: If we expand the categories of data we collect from a Connected Platform, we will notify you and obtain your renewed consent before doing so.

3f. Device & Technical Data

• Device Information: Device type, operating system version, app version
• Push Notification Tokens: Device tokens for delivering notifications. They are stored securely and shared only with Apple, whose push service delivers the notification
• Email Delivery Data: Whether emails we send are delivered and opened (via our email service provider)
• Crash and Error Reports (iOS app): When the app crashes, freezes or hits an error, a report is sent to our error-monitoring service (Sentry). It includes technical details about your device and the app, a short trail of recent screens and network requests, a screenshot of the app screen at that moment, and your Vici user ID and email address so we can match the report to your account. A screenshot can show whatever was on screen, including training or health information

3g. Usage Analytics

• In-App Analytics: Screen views, feature usage and actions you take (for example, saving or sharing a card) within the iOS app, linked to your account, to help us understand which features are valuable and where users encounter issues. We copy these records, identified by a coded user reference, to our analytics warehouse (Google BigQuery, EU region); records from before 24 August 2026 may also include your name and email address. Coded is not anonymous: we can link it back to your account
• Website Analytics: We use Vercel Analytics on our website (vici.run) which collects page views, referrers, and anonymous visitor data. No cookies are used for tracking; analytics are privacy-focused and do not track individual users across sites

3h. Shared Cards and Teams

• Share Cards: When you share a run, week or plan card, the card image is created on your device. If you use a share link, the image is uploaded to our servers and published at a public web address (vici.run) that anyone who has the link can open. The public page shows the card image together with its title and a result line. If you added your own photo to the card, that photo is part of the image. Ask us to remove a link at any time (see Section 10)
• Share Records: We record that you saved or shared a card (which card, image format, and a category for where it was sent, for example Instagram or Messages), so we can see which cards runners value. We do not store the recipient or any caption
• Teams: If you join a coached team, you agree at joining that everyone in the team sees which team sessions you did, how your runs compared with what Vici set for you, and your paces. Nobody else sees your routes, maps or where you run. You can leave with one tap, and sharing stops immediately

4. How We Use Your Data

• AI Coaching: Generate personalized training plans, coaching insights, and performance analysis
• Performance Tracking: Calculate your Vici Score, pace zones, training load, and fitness progression
• Recovery Assessment: Use HRV, sleep, and wellness data to assess training readiness and adjust recommendations
• Workout Delivery: With your permission, send structured workouts to connected devices when supported by an integration
• Service Communications: Send coaching notifications, training reminders, and important service updates
• Product Updates: Send occasional emails about new features and community news. You can turn these off at any time in the app's notification settings or with the unsubscribe link in the email. We also keep a contact list (your first name, email address, a short handle, how recently you have been active, where you are in getting started, and your sign-up date) that we use to reach out personally to runners, including to invite them to try new features or to check in if you have gone quiet. We use it only for runners who have product updates turned on
• Service Improvement: Analyze aggregated and de-identified usage patterns (e.g., feature engagement, error rates), and review your feedback and coaching interactions in pseudonymized form (see Section 3d), to find and fix bugs and improve the user experience. We do not use Connected Platform data — including data from Strava, Garmin, Apple Health, or WHOOP, in any form, including aggregated or de-identified — to train, fine-tune, or develop AI models.
• Safety & Security: Detect and prevent abuse, fraud, and unauthorized access

5. Legal Basis for Processing (GDPR)

Under the General Data Protection Regulation, we process your data based on the following legal grounds:

6. AI Processing & Automated Decision-Making

How AI Processes Your Data

Vici uses artificial intelligence to generate your training plans, coaching insights, and performance analysis. When generating coaching content, we send relevant context about your training to our AI providers, including:

• Your recent activity data (distances, paces, heart rate)
• Your fitness profile (experience level, goals, current fitness metrics)
• Your training plan structure and progress
• Wellness and recovery data when available
• Your coaching conversation history (for Ask Vici)

This data is sent with your first name, age and sex for personalized coaching language. We do not send your email address, date of birth, or other account credentials to AI providers.

AI Service Providers

We use the following AI provider to generate coaching content:

• Google (Gemini): Training plan generation, coaching insights and conversational responses, through Google's paid Gemini API service

If we add another AI provider we will update this policy first. AI-generated prompts and responses are logged for quality assurance and debugging. See Section 10 for how long we keep them.

Inference Only — No AI Model Training

We use AI for inference only. When we send your data to an AI provider, it is used solely to generate the coaching response, plan, or analysis for your individual account at the time of the request. We do not, and our AI providers do not on our behalf, use your personal data — including data from Connected Platforms (Strava, Garmin, Apple Health, WHOOP), your activities, your wellness check-ins, your journal entries, or your conversations with Ask Vici — to train, fine-tune, or develop artificial intelligence or machine-learning models. We use Google's Gemini API under its paid-services terms, under which Google does not use your prompts or responses to train its models.

Purpose Limitation

Data we collect for one purpose is not repurposed for another without your consent, except where explicitly permitted by law or disclosed in this policy (for example, the pseudonymized feedback and interaction analysis described in Sections 3d and 4).

Automated Decision-Making (GDPR Article 22)

Vici uses AI to generate training recommendations that directly affect your training experience. These are automated suggestions, not binding directives. You always have the right to:

• Disregard any AI-generated recommendation
• Modify your training plan through Ask Vici
• Request a human review of any AI decision by contacting support@vici.run

7. Third-Party Services & Data Sharing

We do not sell, rent, or share your personal data with third parties for their marketing purposes. Data is shared only in these limited circumstances:

• AI Provider: Training context sent to Google (Gemini) for coaching generation, on an inference-only basis under Google's paid-services terms (see Section 6)
• Connected Fitness Platforms: When you choose to send workouts to a connected device, only the workout structure is shared
• Email Service (SendGrid): Your email address and communication content are processed by our email service provider for delivery. SendGrid tracks delivery status (sent, delivered, bounced) for reliability
• Error Monitoring (Sentry): Crash and error reports are sent to our error-monitoring service for debugging. From the iOS app these include your user ID, email address and a screenshot of the screen (see Section 3f). Reports from our servers include your user ID and email address when you are signed in; passwords, access tokens and request contents are removed
• Analytics Warehouse (Google BigQuery): Usage records identified by a coded user reference, stored in the EU, used to measure how the app is used (see Section 3g)
• Contact List (Google Sheets): Your first name, email address, a short handle, how recently you have been active, where you are in getting started, and your sign-up date, in a contact list we use to reach out personally to runners who have product updates turned on
• Apple Services: Apple delivers our push notifications (APNs), provides weather for your runs (WeatherKit) and may process voice input (see Section 3d)
• Teams: Other members of a team you join see your team sessions, how your runs compared with plan, and your paces (see Section 3h)
• Website Analytics (Vercel): Anonymous page view data on vici.run is collected by Vercel Analytics (no cookies, no cross-site tracking)
• Legal Requirements: If required by law, regulation, or valid legal process
• Business Transfer: In connection with a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity

Third-Party Protection Standards

Any third party with whom we share user data — including AI providers, our email service, error monitoring, analytics, and any successor entity in a business transfer — is contractually required to provide the same or equal protection of user data as set out in this Privacy Policy and as required by applicable law.

Strava API — Disclosure

If you connect Strava, you acknowledge that Strava may monitor and collect certain usage data and information related to your use of the Strava API, including the data we receive from your Strava account on your behalf, as described in Strava's Privacy Policy. Where Strava's Privacy Policy and this Privacy Policy conflict with respect to data sourced from Strava, Strava's Privacy Policy controls.

Garmin Connect API — Disclosure

If you connect Garmin, the data we receive from your Garmin Connect account on your behalf is also governed by Garmin's Privacy Policy. Where Garmin's Privacy Policy and this Privacy Policy conflict with respect to data sourced from Garmin, Garmin's Privacy Policy controls. You can revoke Vici's access at any time from your Garmin Connect account settings, which immediately stops further data syncing.

8. International Data Transfers

Your data is primarily stored in the European Union (Google Cloud, europe-west4 region). However, our AI provider (Google) processes coaching requests in locations that may include the United States, and our error-monitoring, email and weather providers are also based outside the EU. These transfers are governed by:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Data Processing Agreements with each provider
• The provider's own data protection certifications and commitments

9. How We Protect Your Data

• Encryption: All data is encrypted in transit (TLS 1.2+) and at rest
• Secure Infrastructure: Enterprise-grade cloud hosting in the EU with access controls and audit logging
• Authentication: Secure JWT-based authentication with cryptographically generated secrets
• Minimal Access: We only request the specific data scopes needed for coaching from connected platforms
• On-Device Data: Apple Health data is read directly on your device and only synced to our servers with your explicit permission
• Regular Audits: Security vulnerability scanning and dependency auditing

10. Data Retention and Deletion

Coaching depends on your history, so we keep your data for as long as your account is active. We do not currently delete older training, health, wellness, coaching or analytics records automatically while your account is active, except routine technical logs (request logs after 45 days; sync and webhook records after 30 days). We may also clear completed training plans after two years and coaching insights after one year. If you want something removed sooner, ask us and we will delete it.

• Deleting your account: In the app, go to Profile → Settings → Delete Account. Your account and the data linked to it are deleted from our database immediately. There is no grace period and it cannot be undone. Copies held by our service providers (error monitoring, email delivery, our AI provider and our contact list) are not removed at that moment: they expire on the providers' own schedules, or email us and we will have them removed
• Backups: Copies of data may remain in our encrypted backups until they expire in the normal backup cycle.
• Analytics records: Usage records in our analytics warehouse are identified by a coded user reference (records from before 24 August 2026 may also include your name and email address); a separate access-restricted view can link the code to your account. Today these records are not deleted automatically with your account. Email support@vici.run and we will delete them
• Share links: Removing a share link stops it opening, but the image file itself is deleted only when your account is deleted. The app has no remove button yet: email us and we will revoke the link and delete its image by hand
• Data exports: A data export file you request is kept for 7 days and then deleted
• Records we must keep: When you ask us to delete your data, we keep a record that the request was made and completed, with your account ID, so we can show we complied

11. Cookies & Tracking Technologies

Website (vici.run)

Our website uses Vercel Analytics, a privacy-focused analytics service that does not use cookies and does not track users across websites. It collects anonymous page view data (pages visited, referrer, country-level geolocation) to help us understand website traffic.

Email Communications

Emails sent through our service provider (SendGrid) may include a tracking pixel that records whether the email was opened, and delivery status. This helps us ensure our communications are being delivered. We do not track which links you click. You can disable image loading in your email client to prevent open tracking.

Mobile App

The Vici iOS app does not use cookies. Authentication is handled through secure token-based sessions. In-app analytics (screen views and feature usage) are collected to improve the Service, as described in Section 3g. The app does not use advertising identifiers, does not show ads, and does not track you across other companies' apps or websites.

12. Your Rights (GDPR)

If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under data protection law:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Delete your account in the app at any time (immediate and permanent), or ask us to delete specific data. See Section 10
• Right to Data Portability: Export your data in a machine-readable format
• Right to Restrict Processing: Limit how we use your data
• Right to Object: Object to processing based on legitimate interest, including the feedback and interaction analysis described in Section 3d
• Right to Withdraw Consent: Withdraw consent at any time for health data and connected device integrations
• Right Regarding Automated Decisions: Request human review of AI-generated training recommendations

To delete your account, use Profile → Settings → Delete Account in the app. For every other right, email support@vici.run. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority.

13. Your Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out of Sale: We do not sell your personal information. No opt-out is necessary
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To exercise your rights, email support@vici.run, or delete your account in the app.

14. Apple HealthKit

If you choose to grant Vici access to data through Apple HealthKit, the following commitments apply, in addition to the rest of this Privacy Policy. Where this section conflicts with anything else in this Privacy Policy with respect to HealthKit data, this section controls.

• Specific data only: We only request access to HealthKit data types relevant to running and recovery coaching (see Section 3e for the enumerated list). We do not request access to HealthKit data unrelated to those purposes
• Personal coaching only: HealthKit data is used solely to provide personalized coaching and display health metrics within the app for your individual account
• No advertising or marketing: We do not use HealthKit data — in any form, including aggregated or de-identified — for advertising, marketing, or use-based data mining, whether by us or by any third party
• No selling or trading: We do not sell, license, lease, or otherwise transfer HealthKit data to data brokers, advertisers, or any other third party in exchange for monetary or other consideration
• No AI/ML training: We do not use HealthKit data to train, fine-tune, or develop artificial intelligence or machine-learning models. Our AI provider processes HealthKit-derived inputs on an inference-only basis under paid-services terms that do not allow it to train on them
• No iCloud storage: We do not store HealthKit data in iCloud
• No false data writes: Where Vici writes data to HealthKit (e.g., logging a run), we write only data that is accurate and reflective of your actual activity. We do not write false or inaccurate data into HealthKit
• No profile-building from anonymized data: We do not attempt to build, reconstruct, or de-anonymize user profiles from HealthKit data. We do not combine HealthKit data with other data sources for profile-building purposes
• Purpose limitation: HealthKit data we collect for one purpose (e.g., recovery assessment) is not repurposed for another without your renewed consent
• Withdrawal of consent: You can revoke HealthKit access at any time via your iPhone Settings → Privacy & Security → Health, or via the Vici app. Revoking access immediately stops further data sync. HealthKit data we have already synced stays with your account until you delete your account or ask us to delete it by email

15. Children's Privacy

Vici is not directed to or intended for use by individuals under the age of 16. We do not knowingly collect personal information from anyone under 16. If you are a parent or guardian and believe your child under 16 has provided us with personal information, please contact us at support@vici.run and we will delete the information within 30 days. If we learn that an account belongs to someone under 16, we will delete it.

16. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app or via email at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes your acceptance of the updated policy.

17. Contact Us