StaminaPrivacy policy
Version 1.7.0 · 2026-11-10
What data we keep, why, who we share it with, and how you can see, correct or delete it. We don't sell your data or use it for advertising.
1. Controller
The controller of your personal data is the Stamina team, a group of students at UADE (Universidad Argentina de la Empresa) in the Argentine Republic. You can contact us about any privacy matter at [email protected].
2. What data we keep
Account: first name, last name, email and your password encrypted with a one-way algorithm (we never store it in plain text). If you sign in with Google or Apple, the identifier that provider gives us and the email it shares, never your password for that account. Profile: photo (the one you upload or, if you sign in with Google, the one from that account), date of birth, biological sex, weight, height, sport, level, goals, race dates, training days, time zone and units. Training: your runs (date, duration, distance, pace, elevation, GPS route, the title and notes you write, the photos you add (up to 5 per run), the effort you mark, the songs that played if you allow it and, if you use a watch, heart rate), your personal records and completed goals, your gym sets, the meals you log and your daily steps. Records: which version of the health notice and of these texts you accepted, when, in which language and, for your consent and the medical clearance statement, the exact sentence you checked. Devices: model, operating system and a hashed identifier of the phones you sign in with, to alert you about new sign-ins; that email includes the approximate city of the connection, which we don't store. Technical: short-lived logs (date, requested path, IP address and app version) for security and to prevent abuse, without health data. Purchases: if you subscribe to Stamina Premium, the purchase identifier the store gives us (Apple or Google), the plan, the dates, whether it renews, the offer used and the price; never your card details, which stay with the store.
3. What we don't keep on our servers
Your medical clearance file and its expiry date stay only on your phone, protected. Only the record of the statement you check (the sentence, the version and the date) reaches our server, never the certificate. Your location is used only while you record a run or to get the weather for your area; we don't track it in the background outside a workout. We don't use third-party advertising or tracking tools.
4. What we use your data for
To create and maintain your account; build and adjust your plan; record and show you your runs, history and statistics; give you hydration estimates and weather alerts; send you the emails the service needs (verification codes and security notices); protect the service and prevent fraud or abuse; automatically review every photo you upload (your profile photo, your run photos and the one we bring from your Google account) so we don't keep inappropriate images; and comply with legal obligations. We don't make automated decisions with legal effects on you. Photos are reviewed by a system, not a person: it only decides whether a photo is kept, and it can make mistakes. If the EU General Data Protection Regulation, or another law that requires a legal basis, applies to you, ours are: our contract with you (providing the service), your explicit consent (health data, GPS route and international transfer), our legitimate interest (security, abuse prevention and photo review) and legal obligations.
5. Health data and consent
Weight, height, biological sex, heart rate and physical activity are health data, which the law treats as sensitive. The GPS route of your runs can reveal where you live and your routines. We process this data only with the express consent you give in a separate checkbox when you create your account, and only to provide the service. You can withdraw it at any time by deleting the data, the run (its route is deleted right away) or your account. Health data never appears in our technical logs.
6. Apple Health (HealthKit) and Health Connect
If you give us permission, we read your daily steps from Apple Health on iPhone or from Health Connect on Android, we receive your workout data from your watch, and we save your workouts to Health or Health Connect. That data is used only for Stamina's features: we don't use it for advertising or marketing, we don't sell it and we don't share it with third parties, except the server provider that stores it for us (section 7). You can remove the permission at any time from the Health app, from Health Connect or from your phone's settings.
7. Who we share it with
We don't sell or rent your data. We share it only with providers that help us run the service and that process it under their service terms: Amazon Web Services (servers, database and photos; email delivery with Amazon SES; and Amazon Rekognition, which reviews every photo you upload before it is kept), Cloudflare (network, protection and connection encryption), Apple (Sign in with Apple, App Store purchases, Apple Health and Apple Weather, which receives your location rounded to about 1 km for the forecast; on Android that request goes through our server, which doesn't store the location) and Google (Continue with Google, that account's photo, Google Play purchases, Google Maps, which receives your location to show you the map on Android, and Gmail, where we receive support emails). We ask Amazon not to use the photos it reviews to improve its services. If you share a run to another app, such as Instagram, you send that image yourself and that app's rules apply. We may also disclose it if a law or a competent authority requires it.
8. International transfer
Our servers are in the United States (Amazon Web Services). Your data is transferred to and stored there only if you consent in the sign-up checkbox. This applies worldwide: if you live in the European Union or any other country, your data also goes to the United States with that consent. That country is not on the Argentine authority's list of countries with adequate protection. We protect your data with the security measures in this policy and our providers' service terms.
9. How long we keep it
For as long as you have an account. If you delete it from the app, you have 30 days to change your mind: until then you can recover it by signing in, and after that we delete it with all its data and photos. If you want us to delete it sooner, write to [email protected] and we will do it within 5 business days at most. If you delete a run, its GPS route and photos are deleted right away and the rest is removed after 30 days. If you remove a photo, it is deleted right away; a photo rejected by the review is not kept. Encrypted backups are deleted after 7 days. You can also deactivate your account: your data stays stored and you can come back by signing in. Verification codes last 15 minutes and technical logs are kept for a limited time, only for security. Records of acceptance are deleted with your account.
10. Security
All communication is encrypted (TLS). Passwords are stored with argon2id, sessions use short-lived credentials stored encrypted on your phone, and access to the servers is restricted. No system is infallible: if we detect an incident that affects your data, we will let you know.
11. Your rights
You can ask to access your data, correct, update or delete it, get a copy in a reusable format, and withdraw your consent, by writing to [email protected] from your account's email. Under Argentine Law 25,326 we answer access requests within 10 calendar days and correction or deletion requests within 5 business days. You may exercise your right of access free of charge at intervals of no less than six months, unless you show a legitimate interest (article 14, section 3 of Law 25,326). Argentina's Agency for Access to Public Information (Agencia de Acceso a la Información Pública), as the supervisory authority of Law 25,326, handles complaints from anyone whose data protection rights have been affected. If you live in the European Union, the United Kingdom, Brazil, California or another place with its own data protection law, you also have the rights that law gives you, such as objecting to processing or asking us to restrict it, and you can complain to your local supervisory authority. We will never treat you worse for exercising them.
12. Phone permissions
The app may ask for access to your location (to record your route and get the weather), to Apple Health or Health Connect, to notifications, to Apple Music on iPhone (to show the songs of your run) and to your files, camera or photos (for your medical clearance, your profile photo and your run photos). Each permission is optional, and you can give or remove it at any time from your phone's settings; without some of them, certain features won't work.
13. Minors
Stamina is not aimed at people under 18 and we don't knowingly collect data from minors. If we find out that an account belongs to a minor, we close it and delete its data.
14. Changes to this policy
If we change this policy, we publish the new version with its date. If the change is significant, we will let you know in advance in the app or by email.
15. Contact
For any question about your privacy or to exercise your rights, write to us at [email protected].