Privacy Policy

Apex is a running and riding app for iPhone. Where you run, how your heart beats and who you run with are personal, so this policy explains in plain English what Apex collects, why, who else handles it, how long we keep it and how you stay in control.

Apex is a free, non-commercial passion project made by Mohan Prakash Jeyasankar, an individual developer based in the United Kingdom ("Apex", "we", "us" or "our"). Apex is not a company: "we" and "us" in this policy mean Mohan Prakash Jeyasankar. This Privacy Policy describes how we process personal information that we collect through the Apex iPhone app, its Apple Watch app and widgets, our website at apexapp.site, and when you contact us (together, the "Service").

Notice to UK and European users: extra information for people in the United Kingdom and the European Economic Area ("Europe") is in the Notice to UK and European users section below.

Notice to US users: see the US state privacy rights notice section below for information about your rights under US state privacy laws.

Personal information we collect

We collect only what Apex needs to work.

Information you provide to us

• Account data. You sign in with Apple; Apex has no other way to sign in. Apple gives us a unique identifier for your Apple account and an email address. If you choose "Hide My Email", we only receive an Apple relay address. We receive your name only if you let Apple share it. We never see your Apple password. When you sign in we also store a token from Apple so that we can cancel your Sign in with Apple link when you delete your account. We give your account an internal Apex user ID.
• Profile data. Your display name; the illustrated avatar you pick (Apex does not ask for a profile photo); your birth year, so we can confirm you are 18 or over (we don't ask for your full date of birth or your gender); and your training preferences: main goal, activity level, interests, how many days a week you want to train, units (km or miles), step goal, weekly distance goals whether you run the story on your own or as a couple, and your story progress.
• Workout data. For each run or ride you record: start and end time, duration, distance, pace or speed, splits and intervals, elevation gain, estimated calories, cadence and power (from a Bluetooth sensor you pair or an imported file), whether it was indoors, the weather at the time, and the GPS route (trimmed as described in What stays on your iPhone). Also runs you record on your Apple Watch, activities you import from GPX, TCX or FIT files, cross-training you log, your training plan, race goals, custom interval workouts and planned sessions.
• Health and fitness data. Heart rate during workouts (average and maximum) and daily totals from Apple Health. See Health data from Apple Health.
• Data we work out from your workouts. Personal records, training load and fitness trend, fitness estimates used for your pace and heart-rate zones (such as estimated VO2max, threshold pace, and resting and maximum heart rate), achievements, XP and level, streaks, and short coaching summaries of finished workouts.
• Story data. Which story you chose (Couples, Duo or Summit) and the chapters you unlock (the chapter number and the week it was for). If you pair with someone for Couples or Duo: the pairing record (who created it, who joined, which of the two stories it is, the roles you picked, the invite code, the shared weekly minutes goal, the time zone it uses, when you joined or left). Couples and Duo use the same pairing and share the same data. We also keep a short record of attempts to join a pairing, to stop people guessing invite codes. See The story modes. We keep a similar short record of failed attempts to join a club or a challenge with a code.
• User-generated content. Posts, photos, comments and likes in your clubs; the clubs you create (name, description, colour, glyph and focus) and your membership and role in each club; invites you create; challenges you create or join and your progress in them; and the date you accepted the Club rules. If you attach a workout to a post, we store its type, distance, duration, pace or speed, elevation and calories, never its route. Photos are re-encoded on your iPhone before upload, which removes all hidden information in the file (EXIF data, including GPS location, time and camera details).
• Safety data. Reports you make about posts, comments or members (what you reported, the reason and any note you add), the members you block, and a record of who was removed from a club (so that a removed person can't rejoin it).
• Planned routes. Routes you draw in the route builder or import from a GPX file: the name, whether it is for a run or a ride, the points you placed, the route line, its distance, and when you made or changed it. A planned route is stored as you drew it (it is not trimmed, because it is a plan, not a record of where you went). See Routes you share.
• Route shares. Only if you share a planned route with a club or your partner: a read-only copy of the route (name, run or ride, the route line with its first and last 200 metres removed unless you switch that off, distance), the club or couple you shared it with, and your first name.
• Segments and segment times. Only if you use segments: the segments you make from your own runs and rides (name, run or ride, the segment's line and distance, and whether it is private or public), where you shared each one (a club or your couple), and for each time you set on a segment, the time, the date, your average speed, the activity it came from and whether it was flagged (for example as too fast or as poor GPS). Your board settings: whether public leaderboards are on (off by default) and whether you appear on club and partner boards. See Segments and leaderboards.
• Privacy zones. Only if you set them: up to 10 circles (a label such as Home or Work, the centre rounded to about 10 metres, and a radius of 200 metres to 1 kilometre). Privacy zones are never shown or shared with anyone. To apply the segment rules, we also keep the first and last point of each run or ride's saved (already trimmed) route.
• Route times. For new runs and rides we also store the time you passed each point of your saved route. It is visible only to you and is used to time segments you create.
• Live share data. Only if you start a live share: the share itself (run or ride, when it started and ended, an optional expected-back time, the people you chose, and a one-way hash of the private link's code), and your positions while it runs (latitude, longitude, GPS accuracy, speed, distance so far, elapsed time and your phone's battery level). If you add people to your "always share with" list, that list is kept on your iPhone only. See Live sharing.
• Communications data. What you send us when you email us for support, privacy requests or anything else, and our replies.
• Feedback. Only if you use the feedback form on our website: what you write and the optional details you add. See Feedback form.

Third-party sources

• Apple. Sign in with Apple (above), and Apple Health on your iPhone, if you allow it. Apple Health brings together data from many sources, so it can include workouts and readings that a Garmin or other watch, or another app, has written into Apple Health. Apex does not connect to Garmin directly. Garmin and other watches can also reach Apex as a FIT, GPX or TCX file that you export from their app and import yourself.

Automatic data collection

• Device and diagnostics data. Apex contains no third-party analytics, advertising or crash-reporting tools, and we do not collect your advertising identifier. App logs stay on your device. If you have chosen in iOS Settings to share analytics with app developers, Apple may send us anonymous crash reports; Apple controls that setting.
• Location data, only while you record a workout that you started, including when the screen is locked, so your route and distance are accurate. If you start a live share, your position is also sent to our servers while the share runs, so the people you chose can follow it. When you add a privacy zone with "Use my current location", Apex reads your location once. Apex does not ask for "Always" location access.
• Website server logs. Our website is hosted on Cloudflare Pages. When you visit it, Cloudflare processes your IP address and basic request details (such as the page requested, time, browser type) in its server logs to deliver the page and protect the site against attacks. We do not use these logs to identify or profile visitors. The website sets no cookies. See our Cookie Notice.
• Website visit statistics (Cloudflare Web Analytics). The website counts visits with Cloudflare Web Analytics, a privacy-first, cookieless tool. See Website visit statistics below.

What stays on your iPhone

Some features are designed so that the data never reaches us:

• The AI coach uses Apple's on-device Foundation Models (Apple Intelligence). Your questions, its answers and the workout context it reads are processed on your iPhone and are not sent to us or to any AI provider. On iPhones without Apple Intelligence, the coach is not shown.
• Route trimming. When you finish a run or ride, Apex removes the first and last 200 metres of the route on your iPhone, so it doesn't reveal where you start and finish (usually your front door). Routes shorter than 600 metres are saved without a map. This setting is on by default; you can change it in Settings → Your data → "Hide the start and end of my routes". If you set privacy zones (You → Safety & privacy → Privacy zones), a route that starts or ends inside one is also cut back to the edge of that zone, even if the 200 metre setting is off. Changing or deleting a zone does not change routes already saved. The trimmed route is the only copy Apex keeps of a finished workout, on your iPhone and on our servers. A live share is the one exception: it shows the people you choose where you are while you move, so its positions are not trimmed and privacy zones don't apply to it unless you switch on "Hide my location inside privacy zones", and they are deleted 24 hours after the share ends (see Live sharing).
• The story map. Every story is set in fixed public places (Verona, the Cinque Terre and the Yoshida Trail on Mount Fuji), so the story map never uses or stores where you are. Walking directions between those places come from Apple Maps and are cached on your iPhone.
• Summit receipts. In Summit, each stamp on your walking stick carries one line about your week (for example, your fastest 5 km yet). Apex works it out on your iPhone from your own workouts, when the chapter unlocks, and keeps it on your iPhone. It is not uploaded to our servers or shown to anyone else.
• Some setup choices: where and when you like to train, the nickname and sticker you give your couple or duo, and avatar choices for the story. These are saved on your iPhone only.
• Motion sensors are used on your iPhone to measure cadence and recognise your activity. We do not store raw motion data.
• Reminders are scheduled by your iPhone.
• Exports and imports. Export files are created on your iPhone and you choose where they go. Files you import (FIT, GPX or TCX, from the share sheet or the Files app) are read on your iPhone and are not uploaded. Apex saves the workout in them the same way as one you record: summary numbers, the trimmed route and, if you allowed health data, average and maximum heart rate. The file itself is not kept.
• Bluetooth sensors. If you pair a heart-rate strap, foot pod, bike sensor, power meter or smart trainer, Apex connects to it only on the Sensors screen and while you record. The name and Bluetooth identifier of a paired sensor are remembered on your iPhone only. During a workout the readings are shown live and not stored second by second; what is saved with the workout is the average and maximum heart rate, average cadence and average, maximum and normalised power, plus distance from a foot pod or trainer. Heart rate from a sensor is ignored unless you have agreed to health data use.
• Your personal heatmap. The heatmap on Home (also under You → Maps) is drawn on your iPhone from your own outdoor runs and rides, using their saved (trimmed) routes. It is never uploaded or shown to anyone else, and the copy it keeps to load quickly is in your iPhone's cache, cleared when you sign out.
• Segment matching. When you finish an outdoor run or ride, Apex compares your GPS track with nearby segments on your iPhone. Only the resulting times are uploaded, never the track itself. To make sure no segment starts or ends near where you really started or finished, Apex also keeps the true first and last point of your recent activities on your iPhone only.
• Privacy zones and planned routes, offline. Apex keeps a copy of your privacy zones and planned routes on your iPhone, so routes are trimmed and can be followed without a signal.
• Following a route. The off-route alert is worked out on your iPhone.
• Runs you record on your Apple Watch. The Watch measures time, distance and heart rate (it does not record a GPS route) and sends the finished run to your iPhone, which saves it like any other workout.
• Workouts you send to your Apple Watch. A training session or workout you choose is sent from your iPhone to the Workout app on your Apple Watch through Apple's WorkoutKit. It does not go through our servers.

Health data from Apple Health

Only if you allow it, Apex reads from Apple Health: steps, walking and running distance, cycling distance, running speed, cycling speed and cadence, active energy, exercise minutes, workouts and heart rate. Apex only reads from Apple Health. It never writes or saves anything to Apple Health.

Heart rate can also come from a Bluetooth heart-rate strap you pair or from a FIT, GPX or TCX file you import. It is handled exactly like heart rate from Apple Health: only with your health data consent, never written to Apple Health, and only the average and maximum for each workout are stored on our servers.

Most of this is used on your iPhone to show your day and coach you live. What we store on our servers is your daily step totals, the heart-rate summary (average and maximum) of each workout, workouts you choose to import, and the fitness estimates we work out from them, so that your history, training load and coaching are there when you need them.

Our commitments for data from Apple Health (HealthKit):

• We use it only to provide Apex's health and fitness features to you.
• We never use it for advertising, marketing or data mining, and we never sell it or give it to advertising platforms, data brokers or information resellers.
• We never use it to train AI or machine-learning models.
• We never share it with third parties except our hosting provider, as our processor.
• We never store it in iCloud.

You can change what Apex can read at any time in the Health app or iOS Settings.

Our Consumer Health Data Privacy Policy brings together, in one place, all the health-related data Apex handles. It explains the separate consent we ask for, who the data is shared with, and how to access or delete it or withdraw your consent. It is written for the US state consumer health data laws, but it applies to everyone.

Tracking and other technologies

Cookies and similar technologies. We do not use cookies, tracking pixels, software development kits (SDKs) for analytics or advertising, session replay, device fingerprinting or similar tracking technologies, on the website or in the app. The one exception to "no analytics" is the website's cookieless visit counter, Cloudflare Web Analytics, described in the next section; it sets no cookies and does not fingerprint or track individuals. The app stores some data on your iPhone so it can work (for example, your settings and keeping you signed in). Our Cookie Notice explains this.

No tracking across apps and websites. We do not track you across other companies' apps and websites, and Apex does not ask for App Tracking Transparency permission because it doesn't need it.

Website visit statistics (Cloudflare Web Analytics)

• What it is. The website uses Cloudflare Web Analytics, a privacy-first tool that counts visits without cookies. It does not use cookies or local storage, does not fingerprint your device, and does not track individuals across websites or build profiles. Cloudflare says it does not track individual end users across its customers' websites.
• What is measured. Page views, the page or site that sent you (the referrer), your country, your browser and device type, and page performance. It runs through a small script that loads from Cloudflare (static.cloudflareinsights.com) and reports to Cloudflare (cloudflareinsights.com).
• Why. To count visits and understand which pages and links work. We see aggregate figures, not who visited, and we keep no visitor-level data ourselves.
• Legal basis (UK GDPR and EU GDPR). Our legitimate interests (Article 6(1)(f)) in understanding how the website is used and improving it. Because it sets no cookies and stores nothing on your device, we do not show a cookie banner.
• Who processes it. Cloudflare, Inc., our hosting provider, as our processor.
• How long. According to Cloudflare's own aggregate reporting: Cloudflare keeps the detailed readings for a short time and then reduces them to aggregate figures. We keep nothing about individual visitors ourselves.
• How to avoid it. Use a content blocker or a browser setting that blocks analytics scripts. The website works the same without it. We can't promise that Cloudflare's script honours Do Not Track, so don't rely on that signal for this. You can also object to this processing by emailing privacy@apexapp.site.

AI technologies. The AI coach runs entirely on your iPhone (see above). We do not send your personal information to any AI provider.

How we use your personal information

We use your personal information for these purposes, or as otherwise described when we collect it:

Service delivery and operations, to:

• provide Apex: record and save your runs and rides, show your history, maps, splits and records, and keep your data in sync;
• coach you: build and adapt training plans, estimate training load, set heart-rate and pace zones, suggest sessions around the weather, and celebrate milestones;
• plan and follow routes, and draw your personal heatmap on your iPhone;
• run the social features you choose to use: your private clubs (posts, comments, likes and each club's weekly leaderboard), challenges, the Couples and Duo stories, routes and segments you share, segment leaderboards, and live sharing when you start it;
• keep leaderboards fair: flag segment times that are too fast for the sport, come from poor GPS or don't fit the activity, so they are never ranked;
• confirm you are 18 or over;
• communicate with you about Apex, including important changes, security alerts, and support and administrative messages; and
• answer your requests, questions and feedback.

Service improvement. We may use what you tell us (for example in support emails) and aggregated, non-identifying information about how many people use features to fix problems and improve Apex. We do not use analytics tools to do this.

Compliance, safety and protection, to:

• keep Apex safe: protect accounts, prevent abuse and spam (including daily limits on posting and rate limits on invite codes), review reports, and enforce our Terms of Use;
• comply with applicable laws, lawful requests and legal process, such as responding to requests from government authorities;
• protect our, your or others' rights, privacy, safety or property, including by making and defending legal claims; and
• prevent, identify, investigate and deter fraudulent, harmful, unauthorised or illegal activity.

Data sharing in the context of corporate events. See How we share your personal information.

Aggregated or de-identified data. We may create aggregated or de-identified data from personal information (for example, the total number of runs recorded in a month) by removing anything that identifies you, and we will not try to re-identify it. We may use it to understand and improve Apex. We do not use it, or your health data, to train AI models.

Further uses. If we want to use your personal information for a new purpose that is not compatible with the purpose we collected it for, we will ask for your consent first.

What we don't do. We do not use your personal information for marketing emails, advertising, interest-based advertising, contests or promotions, and we don't sell it. We do not make automated decisions about you that have legal or similarly significant effects. Training suggestions are just suggestions; you are always in charge.

Retention

We keep personal information only as long as we need it for the purposes above.

When you delete your account (tap your avatar, then Settings → Delete Account), we delete your profile, workouts and their routes, health summaries, training data, records, achievements, planned routes and the copies you shared, live shares and their positions, segments, segment shares and times, privacy zones and board settings, Club posts, photos, comments and likes, your club memberships, the invites you created, challenges you created, and your sign-in record (your Apple identifier and email). We also delete your story progress, end any couple or duo you are in, and cancel your Sign in with Apple link. If you own a club, we hand it to its longest-serving admin (or, if it has none, its longest-serving member), and we delete the club, with all its posts, comments, likes, invites and club challenges, only if nobody else is in it. Photo files of deleted posts are no longer readable by anyone and are removed from storage during routine clean-up. Apex also clears the data it keeps on your iPhone, including saved routes, your heatmap, privacy zones and paired sensors. This normally happens straight away. If any step fails, we finish it by hand. Either way, your data is deleted from our systems within 30 days. We do not keep separate backups of our database, so nothing is restored from a backup after that.

We may keep a minimal record for longer if the law requires it, or to deal with a safety report or legal claim. Your data in Apple Health is not affected, because Apex only reads from Apple Health and never writes to it.

How we share your personal information

We share personal information only with these parties:

• Service providers. Third parties that host and run Apex for us, under contracts that only let them use your data to provide their service to us:
  • Supabase (supabase.com) hosts our database, sign-in and file storage, and runs the small service that answers private live links, as our processor. Your account, profile, workouts, planned routes, segments, privacy zones, club content, couples data and live shares are stored with Supabase in the West EU (Ireland) region.
  • Cloudflare (cloudflare.com) hosts our website.
  • Cloudflare Email Routing forwards emails you send to our apexapp.site addresses to the founder's personal mailbox, where they are kept and answered. The email itself is stored by that mailbox's provider.
• Apple. Sign in with Apple; Apple Health on your iPhone; Apple Maps (MapKit) for maps, walking and cycling directions (the route builder sends Apple the points you place, so it can follow paths between them), walking directions between the public places in the story map, and the map in the app's live share viewer; WeatherKit for weather, which receives the location you ask about; and Apple Intelligence, which runs on your iPhone. Apple handles this data under Apple's Privacy Policy (apple.com/legal/privacy).
• Third parties designated by you. When you share a workout card using the iOS share sheet, you choose who receives it. When you start a live share and send a private link, the people you send it to (and anyone they pass it on to) can see what is described in Live sharing.
• Other Apex members, only as described in What other members can see, Routes you share and Segments and leaderboards. Club content is visible only to the members of that club.
• Professional advisors, such as lawyers, accountants and insurers, when they need it to advise us.
• Authorities and others. Law enforcement, government authorities and private parties, if the law requires it, or where we believe in good faith that it is necessary to protect someone's safety or to establish, exercise or defend legal claims. Where we can, we'll tell you first.
• Business transferees. If Apex is ever sold, merged or reorganised, or in an insolvency, your personal information may be transferred to the buyer or successor. They would have to honour this policy, and we would tell you before your data became subject to a different one.

We do not sell your personal information and we do not share it with advertising partners, data brokers or anyone else for advertising.

What other members can see

Only signed-in Apex members can see any of this. It is never public on the web.

Clubs are private and invite-only. A club is a private group of up to 50 people. You can be in several clubs and own up to 10. Nobody outside a club can see it, its members, its posts or even that it exists. There is no search, no discovery, no public feed and no public club page. You can only join with an invite code (or link) from a member you know.

What other members of your club can see about you:

• Your display name, your avatar and your role in the club (owner, admin or member).
• What you post in that club: text, a photo, or a run or ride summary card (distance, time, pace or speed, elevation and calories). Never the route, never where it started or ended, never your location (live sharing, route shares and segments are separate, and only happen when you choose them), never your heart rate or other health data, and never your body measurements. They also see your comments and likes in that club.
• Your weekly totals on that club's leaderboard: for each member, the minutes and distance of their runs and rides from the current Monday-to-Sunday week (in the club's time zone), counting only activities after they joined, with distance rounded down to 100 metres. These totals are worked out on our servers, and only these totals are shared: no routes, places or start times. Other members' activities appear on the board about 2 hours after they finish (your own show straight away), so the board can't be used to watch where someone is right now. Only members of the club can see it.
• Challenges: a challenge created in a club is visible only to the members of that club. A challenge that isn't in a club is visible only to the person who created it and the people who joined it with its invite code. Participants see your name and progress. The invite code of a challenge is visible only to the person who created it.
• Your profile card and headline stats (total runs and rides, total distance and time, streaks, weekly goals, XP and level) can appear alongside your name in a club, on a leaderboard or in a challenge. Your birth year, heart rate, health data and routes are never part of them.
• Your partner in Couples or Duo sees only your first name and weekly minutes (see below), unless you start a live share and choose them (see Live sharing), or share a route or segment with them.
• Routes and segments you share with that club, as described in Routes you share and Segments and leaderboards.

Photos are stored in a private place on our servers. They can only be read by members of that club, and only while the post exists, through links that expire after a short time.

Roles and what owners and admins can do. Each club has one owner and, optionally, admins. The owner and admins can create and cancel invites, remove members (a removed person can't rejoin that club), delete any post or comment in the club, and change the club's name, description, colour, glyph and focus. Only the owner can promote or demote admins, switch invites on or off, hand the club to someone else, and delete the club. This means owners and admins can see everything that is posted in their club, and can delete it. Anyone can leave a club at any time; an owner must hand it over or delete it first. The club records who invited each member, but only owners and admins can see invite codes.

Invite codes and links. An invite code is made on our servers, is 10 characters long, works for 48 hours, can have a maximum number of uses and can be cancelled by the owner or an admin. Anyone who has a valid code can join the club until the code expires or is cancelled, so only share an invite with people you know. Before you confirm, you see a preview (for example "You're joining Sunday Striders, 12 members, invited by Priya"). Joining is rate limited to 10 failed tries per hour.

Who else can see club content. The only party outside the club who can see club content is us (Apex moderation), to deal with reports, safety issues and legal requests. Content that is reported, including its text and photo, is visible to us.

Messages. Apex has no real-time chat, no direct messages and no voice or video. Clubs are feed-based: posts, comments and likes. You can't message anyone privately.

Blocking. People you block, and people who block you, can't see each other's posts or comments, or each other's entries in a club's member list, and can't join each other's clubs. Other members can screenshot or copy what they see, and we are not responsible for that.

Older public posts. Club posts made before clubs became private are no longer visible to anyone except their author. We have not deleted them.

The story modes

Apex has three stories. Couples (Romeo and Juliet, for you and a partner) and Duo (Bea and Juno, for a friend or family member) let two people unlock a story together by moving. Summit (a solo climb up Mount Fuji) is just for you. We built the paired stories so that they can't be used to watch someone. Couples and Duo work exactly the same way and share exactly the same data; only the story differs. In this policy, your partner means the other person in your couple or duo.

• Pairing needs both of you. One person creates an invite code (it expires after 48 hours). The other enters it, sees who invited them (first name only) and confirms. Nobody can be added without entering a code themselves.
• Exactly two things are shared with the other person: your first name (the first word of your display name) and your total workout minutes for the current week, rounded down to 5 minutes, counting only workouts since you paired. Through Couples or Duo, the other person never sees your location, routes, distances, heart rate, individual workouts or anything else on your profile. They can follow your live position only if you separately start a live share and choose them (see Live sharing). Because the weekly total goes up when you finish a workout, they may be able to tell that you have just exercised.
• You also share a weekly minutes goal that either of you can change, and the chapters you unlock together. The nickname you give your couple or duo stays on your iPhone.
• Leave any time in Story settings (the gear on the Story tab). Leaving ends the pairing straight away and we don't notify the other person. From then on, neither of you can see the other's minutes or name, and you each keep your own workouts.
• Summit (solo): nothing is shared with anyone. Your receipts are worked out and kept on your iPhone, from your own workouts. They only ever compare you with your own past, never with other people, and never mention your body or weight.
• If you used Apex's earlier solo story, Apex moved you to Summit. Chapters you unlocked before stay with your account until you delete it, and are no longer shown.

Routes you share

Planned routes are private: only you can see the routes you draw or import. You can choose to share one, as a read-only copy, with one private club you belong to or with your partner.

• What they see: the route's name, whether it is for a run or a ride, its line and distance, and your first name ("Shared by ..."). By default the first and last 200 metres of the line are removed, so a route that starts at your door doesn't show it. You can switch that off for a share; a route of 600 metres or less can't be trimmed.
• Who sees it: members of that club while you are both members, or your partner while the couple lasts. People who have blocked you, or whom you have blocked, can't see it. Routes are never public.
• It is a snapshot. Editing your route doesn't change a copy you already shared. Stop sharing at any time; the club's owner and admins can also remove it from their club. Anyone who could see it may have saved their own copy to their routes (and exported it as GPX) before you stopped, and that copy is theirs.

Recorded runs and rides are never shared through routes. Only planned routes can be shared.

Segments and leaderboards

A segment is a stretch of road or path that you race on. Segments in Apex are private by default.

• Made from your own runs and rides. You can create a segment (400 metres to 50 kilometres) from one of your own outdoor runs or rides. A segment can't start or end inside one of your privacy zones, or within 200 metres of where any of your activities started or ended. A segment you share or make public must also stay out of your privacy zones along its whole length, and adding a privacy zone turns any shared or public segment that passes through it back to private.
• Matched on your iPhone. When you finish an outdoor run or ride, Apex finds your times on segments on your iPhone and uploads only the times (see What stays on your iPhone). Indoor workouts and workouts without a route are never matched.
• Your own board shows your own times. It is always available and nobody else sees it.
• Club and partner boards. You can share a segment with a private club you belong to or with your partner. Then members of that club, or your partner, can see the segment's name, line and distance, your first name as its creator, and a board of times on it. Each row shows a first name, an avatar, the time and the date, never a route or a place. You appear on these boards by default; switch "Show me on club and partner boards" off in You → Safety & privacy → Segment leaderboards to leave them. Other people's times appear about 2 hours after they finish.
• Public boards are opt-in. Public leaderboards are off until you switch them on in Segment boards. Only then can you make a segment public, and only people who have also switched public boards on can see public segments (name, line, distance and your first name as creator) and their boards, with the same first name, avatar, time and date. Public segments are not shown on the web. Switching public boards off makes all your public segments private again.
• Fair times. Times that are too fast for the sport, come from poor GPS, have a long gap or don't fit the activity are kept for you, marked with the reason, and never ranked. Blocked people never see each other on a board. Apex does not store your gender, so there are no gender boards.
• Delete any time. You can delete a single time, or a whole segment (with every time on it, for everyone it was shared with). Deleting your account deletes all of it.

Live sharing

"Share my run" lets you show chosen people where you are while you run or ride. It is off by default, and nothing is shared unless you start a share. Apex never shares your location unless you start a share.

• You start it, you choose who sees it. For each share you pick who can follow: a private link that you send yourself (for example in a message), and/or your partner and people from your clubs (only people you already share a couple or a club with, and not anyone who has blocked you or whom you have blocked), who see it inside the Apex app. You can pick up to 10 people. You can also set an optional "expected back by" time. In You → Safety & privacy → Live sharing you can keep an "always share with" list and, if you switch it on (it is off by default), have a share with those people start when you start recording. You can turn that off for any single run, and it never creates a private link.
• What is shared. Your position as you move (with its GPS accuracy and speed), plus distance so far, pace or speed, elapsed time, when the share started and ended, the expected-back time if you set one, your phone's battery level, your first name (the first word of your display name), your avatar, and whether it is a run or a ride. Heart rate, health summaries, your full name, email and your recorded routes are not part of a share. Live positions are not trimmed like saved routes are, and privacy zones don't apply: the people you share with see where you actually are, including where you start, so share only with people you trust.
• People with a link need no account. Anyone who has your private link can open it in any web browser and see exactly the items listed above, for as long as the share runs. Treat the link like a key: whoever has it can use it. You can stop the share, which switches the link off immediately.
• You can stop any time, and it ends by itself. A share never lasts more than 6 hours, and one that never sends a first position ends after 1 hour. When your run or ride ends, the link and the in-app view keep working for 15 more minutes so people can see you finished, then they stop. If you stop the share yourself, access stops immediately.
• Nothing is kept for long. Live positions and the share itself are deleted 24 hours after the share ends. Your private link's secret code is made on your iPhone and our servers keep only a one-way hash of it, so we cannot read it back. The code only reaches our servers when someone opens the link.
• If you are late. If you set an "expected back by" time, anyone following you sees a calm note if you have not finished by then. Apex does not call or message anyone, and it does not contact the emergency services.
• Where it is hosted. Live shares are stored and served by Supabase, in the same EU (Ireland) region as the rest of your account data. The web page that shows a link draws its map itself, with no map service or other third party involved (inside the app, partners and club friends see the share on an Apple Maps map), and it sets no cookies and stores nothing on the viewer's device. The only request it makes is to our own backend. If you open a link as a viewer, we use a one-way hash of your IP address, combined with a secret, only to limit how often requests can be made, and we do not store the address itself. Our code does not log link codes, positions or IP addresses, but Supabase and Cloudflare may keep standard short-term request logs.
• You confirm every share. Every live share needs your confirmation first, and the first share with a new person says so. Nobody should pressure you into sharing your location; You → Safety & privacy → Staying safe and getting help lists free, confidential helplines.
• Hiding your privacy zones. When you share a run or ride live, you can choose "Hide my location inside privacy zones". It is off by default, because the people you share with may need your exact position to keep you safe. When it is on, your position is not sent to our servers while you are inside one of your privacy zones, and the people you shared with see "Location hidden near a private place" and the last point outside the zone. Your zones are checked on your phone and are not sent for this.
• Alerts when someone shares with you. If you allow notifications, Apex stores your phone's push notification token, an identifier Apple gives your phone, so we can alert you when someone you are linked with in Apex (your partner or a club member) starts sharing a run or ride with you. We use it for nothing else. It is passed only to Apple's notification service to deliver the alert, removed when you sign out, and deleted with your account. You can turn these alerts off in Settings → Notifications → Live share alerts (or inside Live sharing), or in the iPhone Settings app.
• A share is not a safety service. It can be delayed, wrong or stop (no signal, flat battery). Don't rely on it to call for help.

You can stop a share from the app at any time. If you open a link and no longer want to see it, just close the page: nothing is stored on your device.

Beta sign-up

Before Apex launches on the App Store, you can ask to try it through Apple's TestFlight on our website at apexapp.site/beta. This is separate from the app: you don't need an Apex account to sign up.

• What we collect. Your name, the email address of your Apple ID, your country, and, only if you choose to give it, your iPhone model. We also record that you ticked the box agreeing to beta emails, and when.
• Where you came from. If you reach the sign-up page from a tagged link (for example ?src=tiktok), that short tag is saved with your sign-up, so we can see which channels work. It contains no personal information, and it is stored for the same period as the rest of your sign-up.
• Why. Only to invite you to the Apex beta on TestFlight and to send you emails about the beta. We don't use it for anything else, we don't sell it, and you can unsubscribe from beta emails any time.
• Who receives it. It is stored with Supabase, our hosting provider, in the EU (Ireland) region. When we invite you, we give your name and email to Apple in App Store Connect, because TestFlight sends the invite and Apple's privacy policy then applies to your use of TestFlight.
• How long we keep it. Until Apex launches publicly on the App Store, plus 6 months, or until you ask us to delete it, whichever is first.
• Deleting it. Email privacy@apexapp.site from the address you signed up with, and we'll delete your sign-up. If you were already invited, you can also remove yourself from testing in the TestFlight app.
• Protecting the form. To stop abuse, the sign-up service uses a one-way hash of your IP address, combined with a secret, to limit how many sign-ups can be sent per hour. We don't store the address itself, and the hash is deleted within 2 days. The page sets no cookies and loads nothing from third parties, other than the cookieless Cloudflare Web Analytics script from Cloudflare, our website host.

Feedback form

You can tell us about a bug, an idea, or something you love in Apex with the form on our website at apexapp.site/feedback. You don't need an Apex account to use it.

• What we collect. The kind of feedback you pick (bug, idea, love it or other), your message, and when you sent it. Only if you choose to give them: your name, your email address and your iPhone model or iOS version. We also save the page of this website you came from (for example /beta/), and, if you reached the form from a tagged link (for example ?src=tiktok), that short tag.
• Why. To fix bugs and improve Apex. If you give your email, we use it only to reply to your feedback, never for anything else.
• Legal basis. Our legitimate interests in fixing problems and making Apex better. For the optional email, your consent: you give it by adding your email so we can reply, and you can withdraw it at any time by asking us to delete it.
• Who receives it. It is stored with Supabase, our hosting provider, in the EU (Ireland) region. We don't share it with anyone else, and we never sell it.
• How long we keep it. 24 months from when you send it, then it is deleted. You can ask us to delete it sooner.
• Deleting it. Email privacy@apexapp.site and tell us the email you gave, or roughly when you sent your feedback and what it said, and we'll delete it.
• Please leave out anything private. The form is for feedback about Apex, so please don't include health details or other sensitive information. For a safety report or help with your account, email support@apexapp.site.
• Protecting the form. To stop abuse, the feedback service uses a one-way hash of your IP address, combined with a secret, to limit how many messages can be sent per hour. We don't store the address itself, and the hash is deleted within 2 days. The page sets no cookies and loads nothing from third parties, other than the cookieless Cloudflare Web Analytics script from Cloudflare, our website host.

Your choices

These choices are available to everyone. People in certain US states and in Europe have extra rights, described below.

• Access or update your information. Edit your profile in the app, or ask us.
• Export your data. Settings → Your data → Export my data lets you export your runs and rides as GPX, TCX, CSV or JSON at any time. "Export Everything" also includes your segments, segment times, privacy zones and board settings. Each planned route can be exported as GPX from its page. For a complete copy of everything we hold about you (including profile, posts and story data), email us at privacy@apexapp.site.
• Delete your content or close your account. Delete your own Club posts and comments, planned routes, route shares, segments, segment times and privacy zones in the app, leave any club at any time, or delete your whole account: tap your avatar (top right), then Settings → Delete Account. To delete a single recorded workout, email us.
• Health data. Change what Apex can read in the Health app or iOS Settings → Privacy & Security → Health.
• Location. Change Apex's location access in iOS Settings → Privacy & Security → Location Services. Without it, Apex can't record GPS routes.
• Privacy settings. Tap your avatar to open You, then Safety & privacy: turn route trimming on or off, set privacy zones, choose your segment board settings (public boards are off by default), manage live sharing and the people you have blocked. Route trimming is also in Settings → Your data.
• Bluetooth. Apex only uses Bluetooth if you pair a sensor in Sensors (You → Devices & imports, or the Sensors row on Record). You can forget a sensor there, or turn off Apex's Bluetooth access in iOS Settings.
• Clubs. Leave a club at any time. If you own a club, you can switch invites off or cancel an invite, and hand the club over or delete it.
• Couples and Duo. Leave a couple or duo at any time in Story settings.
• Live sharing. It is off unless you start it. Choose who sees it each time, stop it whenever you like, or switch the private link off. Nothing is shared in the background.
• Notifications. Turn reminders off in the app or in iOS Settings → Notifications.
• Communications. We don't send marketing emails. We may still send you messages about your account or important changes to Apex.
• Do Not Track and Global Privacy Control. We don't track you or sell your data, so there is nothing for these signals to switch off. The website's visit counter sets no cookies and builds no profiles. If that ever changed, we would honour Global Privacy Control signals as an opt-out where the law requires it.
• Declining to provide information. Some information is needed for Apex to work; for example, we need your birth year to confirm you are 18 or over. Health and location access are optional, but some features won't work without them.

Other sites and services

Apex links to, and works with, services run by others, such as Apple Health, Apple Maps and Apple Weather. We don't control them and are not responsible for what they do. Please read their privacy policies.

Security

We protect your data with technical and organisational safeguards, including:

• encryption in transit (HTTPS/TLS) and at rest, provided by our hosting provider;
• database access rules that let each member read only their own private data. Shared features go through narrow, purpose-built functions; for example, the Couples and Duo feature can only ever return a first name and a weekly total of minutes, and only to a member of that pair;
• photos stored privately, with all location and camera data stripped on your iPhone before upload, and readable only by the members of the club they were posted in, through short-lived links;
• club content visible only to club members, with invite codes made on our servers and rate limited;
• planned routes, privacy zones and segment board settings readable only by you, and route and segment shares readable only by the club members or partner you chose, with every table protected by row-level security in the database;
• live shares readable only by the people you chose and, for a private link, by whoever holds a secret code made on your iPhone, which we store only as a hash. Links stop working when the share ends and are rate limited;
• on your iPhone, sign-in and connected-app tokens kept in the encrypted Keychain; and
• collecting as little as we can, and keeping sensitive processing (the AI coach, Summit receipts, segment matching, your heatmap and the true start and end points of your activities) on your iPhone.

No system is perfectly secure, and we can't guarantee the security of your information. If a breach affects your data and puts you at risk, we will tell you and the relevant regulator as the law requires.

International data transfer

We are based in the United Kingdom. Your Apex account data is stored in the European Union (Ireland). Some of our service providers, and Apple, are based in or may process data in other countries, including the United States, where privacy laws may not be as protective as where you live. Users in the UK and Europe should read Data processing outside Europe below.

Children

Apex is for adults. You must be 18 or older to create an account, and we ask for your birth year at sign-up to check. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has an Apex account, please tell us at privacy@apexapp.site and we will delete the account and its data.

Changes to this Privacy Policy

We may change this Privacy Policy. When we do, we will update the date at the top. If a change is significant, for example a new kind of data or a new way of sharing it, we will tell you in the app before it takes effect and, where the law requires, ask for your consent again.

How to contact us

If you have questions about this policy or want to exercise any of your privacy rights, contact us:

• Privacy and data requests: privacy@apexapp.site
• Everything else: support@apexapp.site

Apex is run by one person, so we handle everything by email. We don't have a postal address for Apex.

US state privacy rights notice

This section applies to residents of US states with privacy laws that apply to us and give their residents the rights described below (together, the "State Privacy Laws"), including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). In this section, "Personal Information" and "Sensitive Personal Information" have the meanings given to them, or to similar terms, in the State Privacy Laws.

Your privacy rights. Depending on where you live, you may have the right to:

• Information: know the categories of Personal Information we have collected, the sources, the purposes, and the categories of third parties we disclose it to;
• Access: get a copy of the Personal Information we hold about you;
• Correction: ask us to correct inaccurate Personal Information;
• Deletion: ask us to delete your Personal Information;
• Appeal: appeal our decision on a request you made.

These rights are not absolute, and we may decline a request where the law allows.

What we don't do, so there is nothing to opt out of:

• We do not sell your Personal Information and we do not "share" it for cross-context behavioural advertising, and we have not done so in the past 12 months.
• We do not process Personal Information for targeted advertising.
• We do not use Personal Information for profiling or automated decisions that produce legal or similarly significant effects.
• Sensitive Personal Information. We process precise location (workout routes, and live share positions if you start a share), health data and account sign-in details only to provide Apex to you and keep it secure. We don't use them to infer characteristics about you.
• Under-16s. Apex is for adults only, and we have no actual knowledge of selling or sharing the Personal Information of anyone under 16.

Consumer health data. Some states, such as Washington, Nevada and Connecticut, have laws on consumer health data. Our separate Consumer Health Data Privacy Policy describes the consumer health data Apex collects, where it comes from, why we use it, who we share it with, and how to access or delete it, withdraw your consent or appeal a decision. We collect it only with your consent, which we ask for separately in the app, and we never sell it.

Non-discrimination. We will not discriminate against you for exercising your rights.

How to make a request. Email privacy@apexapp.site from the email address linked to your Apex account (or your Apple relay address), or tell us your Apex display name so we can find your account. You can also delete your account and export your runs in the app. To protect your account, we may need to confirm your identity, for example by asking you to confirm details only the account holder would know. An authorised agent can make a request for you with your signed written permission; we may still ask you to confirm your identity with us directly. To appeal a decision, reply to our response with "Appeal" in the subject line.

Information practices. The following describes our practices now and during the past 12 months.

• Sources and purposes. We collect Personal Information from the sources, and use it for the purposes, described above.
• Retention. See Retention.
• De-identification. We do not try to re-identify de-identified information.

California "Shine the Light". We don't disclose personal information to third parties for their own direct marketing purposes.

Nevada. We do not sell covered information as defined by Nevada law.

Contact us. If you have questions about this section, see How to contact us.

Notice to UK and European users

General

Where this notice applies. This section applies only to individuals in the United Kingdom and the European Economic Area.

Personal information. References to "personal information" in this Privacy Policy include "personal data" as defined in the GDPR, meaning information about a person who can be identified, directly or indirectly.

Controller

Mohan Prakash Jeyasankar, an individual developer based in the United Kingdom who makes Apex as a free, non-commercial passion project, is the controller of your personal information covered by this Privacy Policy for the purposes of the UK GDPR and the EU General Data Protection Regulation (together, the "GDPR"). See How to contact us for our contact details.

Contacting us from the EU

If you are in the EU and want to contact us about your data, email privacy@apexapp.site.

Our legal bases for processing

The GDPR requires us to have a "legal basis" for each way we use your personal information. Ours are:

• Contractual Necessity: where we need it to provide the Apex service you signed up for (Article 6(1)(b)).
• Legitimate Interests: where it is necessary for our legitimate interests (or a third party's), and your interests and fundamental rights don't override those interests (Article 6(1)(f)).
• Compliance with Law: where we need it to comply with a legal obligation (Article 6(1)(c)).
• Consent: where you have given consent for a specific purpose (Article 6(1)(a)). For health data, which is "special category" data, we rely on your explicit consent (Article 9(2)(a)).

Retention

We keep personal information as described in Retention above. To decide how long to keep it, we consider its amount, nature and sensitivity, the risk of harm from unauthorised use or disclosure, why we process it and whether we can achieve that in other ways, and our legal obligations. When we no longer need it, we delete it or anonymise it. If we anonymise it so it can no longer be linked to you, we may keep using it without further notice.

Other information

Sensitive personal information. Apex processes health data, which is special category data under the GDPR, only with your explicit consent and only to provide Apex's health and fitness features to you. Please don't post other sensitive information (for example about your religion, ethnicity, sexual life or political opinions) in a club. The other members of that club, and its owner and admins, can see it.

No automated decision-making or profiling. We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. Training suggestions and the AI coach's answers are suggestions you are free to ignore.

Your rights

General. Under the GDPR you can ask us to:

• Access: tell you how we process your personal information and give you a copy of it.
• Correct: update or correct inaccurate personal information.
• Delete: delete your personal information where there is no good reason for us to keep processing it, including where you have objected to processing (see below).
• Transfer: give you, or a third party you choose, a machine-readable copy of your personal information.
• Restrict: limit how we process your personal information, for example while you ask us to check its accuracy.
• Object: object to processing based on our Legitimate Interests.
• Withdraw consent: where we rely on your consent, withdraw it at any time.

Exercising these rights. Email privacy@apexapp.site (see How to contact us). We may ask for information to confirm your identity. We will reply within one month, and it is free. If we can't fully meet your request, we will explain why, unless the law prevents us from doing so.

Your right to complain to a supervisory authority. If you are unhappy with our response or with how we process your personal information, please tell us first so we can put it right. You can also complain to the data protection regulator where you live or work.

• In the European Economic Area, you can find your regulator's contact details at edpb.europa.eu/about-edpb/about-edpb/members_en.
• In the UK, the regulator is the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Telephone: 0303 123 1113. Website: ico.org.uk.

Data processing outside Europe

Your Apex account data is stored in the European Union (Ireland). Some recipients of personal information are based outside the UK and the European Economic Area, mainly in the United States: Supabase (for example, for support and operations), Cloudflare and Apple. Where your personal information is transferred outside the UK or the EEA, we make sure one of these protections applies:

• Adequacy decisions. Transfers to countries that the European Commission or the UK Government has found to provide an adequate level of protection, such as transfers between the UK and the EEA, and transfers to US organisations certified under the EU-US Data Privacy Framework and its UK Extension.
• Appropriate safeguards. Where there is no adequacy decision, the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, built into our providers' data processing terms.
• Derogations. In limited cases, an exception the GDPR allows. For example, where a transfer is necessary to do something you have asked us to do.

You can contact us for more information about the protection we use, or for a copy of the relevant safeguards, at privacy@apexapp.site.