Privacy policy

Last updated: 18 October 2026

This notice, provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”), explains how the Endurian app for Apple Watch and iPhone (“the app”) and the endurian.app website process your personal data.

1. Data controller

Pietro Senoner, an individual, Viale Sabotino 19/2, 20135 Milan (MI), Italy.
Contact for any privacy matter: support@endurian.app.

No Data Protection Officer (DPO) has been appointed, as none is required.

2. Data we process, purposes and legal bases

2.1 Account and Sign in with Apple

Data: Apple user identifier, email address (only if you choose to share it; it may be an anonymous address from Apple's private relay service) and session tokens.
Purpose: to create your account, authenticate you and keep your session.
Legal basis: performance of a contract, i.e. providing the app (Art. 6(1)(b) GDPR).

2.2 Workouts, Health (HealthKit), location and sensors on your device

The app reads and writes Health (Apple HealthKit) data on your iPhone and Apple Watch, only after you grant the relevant permissions, and uses GPS and Bluetooth sensors to record your activity. This data stays on your device and in Health, and leaves the device only in the cases described in 2.3 and 2.4.

HealthKit data is never used for advertising or marketing, is not sold and is not passed to data brokers. You can change or withdraw permissions at any time in iOS Settings or in the Health app.

Legal basis: your consent, given through the iOS permissions (Art. 6(1)(a) and, for health data, Art. 9(2)(a) GDPR).

2.3 Delivering workout files to partner services

Data: workout files in FIT format, which may contain GPS route, heart rate, speed, times and other activity data; a delivery log (activity identifiers, date and time, destination service, status).
When: files are uploaded to Endurian's servers only if you have connected a partner service that works through our servers (currently Strava), and only to deliver them to that service. They are not used for any other purpose.
Retention: files are deleted automatically 30 days after delivery, or 30 days after upload if they are never delivered. The delivery log (which does not contain the content of your workouts) is kept for as long as your account exists, so that we know what was delivered and where and can diagnose delivery errors.
Legal basis: your consent, which you give by connecting the service and can withdraw by disconnecting it (Art. 6(1)(a) and, for any health data contained in the files, Art. 9(2)(a) GDPR); for the delivery log, performance of the service you requested (Art. 6(1)(b)).

2.4 Connecting partner services

At your request, Endurian connects to Strava through our servers. Dropbox and Xert currently connect directly from your iPhone: their tokens are stored only in your iPhone's Keychain. TrainingPeaks, Komoot and Trailforks are coming soon (not yet available).

• Access tokens: connections use OAuth authorization. Strava tokens are stored encrypted (AES-256-GCM) on our servers; Dropbox and Xert tokens only in your iPhone's Keychain. For Xert, sign-in currently uses a username and password: the password is never stored, only the tokens obtained through that sign-in.
• Data imported from partners (for example routes and planned workouts): passed to your device and not kept on our servers for more than 7 days.
• Data obtained from Strava: shown only to the user it belongs to, and never used to train or run artificial intelligence or machine learning systems, nor for analytics.
• Disconnecting or revoking: when you disconnect a service, or revoke its authorization from the service itself, tokens are deleted immediately and related data within 30 days.
• Role of partners: once delivered, data is processed by the partner service as an independent controller under its own privacy policy (for example Strava, Dropbox; for the others, see the service's website). Endurian does not control what a partner does with the data after delivery.

Legal basis: your consent, which you can withdraw at any time by disconnecting the service (Art. 6(1)(a) GDPR). Withdrawal does not affect processing already carried out.

2.5 Maps

Offline maps are downloaded from maps.endurian.app, served by Cloudflare (R2). To deliver the files and protect the service, Cloudflare processes technical request data, in particular your IP address (server logs). We do not use these requests to profile you. Map and elevation data sources are described on the Credits page.
Legal basis: legitimate interest in providing and securing the download service (Art. 6(1)(f) GDPR).

2.6 Push notifications

If you enable them, push notifications are delivered through Apple's push notification service. Legal basis: your consent (Art. 6(1)(a)), which you manage in iOS Settings.

2.7 Email support

If you write to support@endurian.app we process your email address and the content of your message in order to reply. Legal basis: steps taken at your request prior to or under a contract, and legitimate interest in handling requests (Art. 6(1)(b) and (f)).

2.8 Website

The endurian.app website uses no cookies, analytics tools or advertising. As with any website, the hosting provider (Cloudflare) may process technical browsing data, such as your IP address, to deliver and protect the service (Art. 6(1)(f)).

3. Recipients and service providers

• Cloudflare (Cloudflare, Inc. and group companies): hosting, Workers, D1 database and R2 file storage; the database and file storage are located in the European Union (Cloudflare's EU jurisdiction).
• Apple (Apple Inc. and group companies): Sign in with Apple and push notifications.
• Partner services you choose to connect (section 2.4), as independent controllers.

To the extent they process data on our behalf, providers are appointed as processors under Art. 28 GDPR. We do not sell data or pass it to third parties for those parties' own purposes. We may disclose data where required by law or by an authority.

4. Transfers outside the EEA

Cloudflare and Apple are part of US-based groups; Cloudflare may also process technical data (for example your IP address) globally to deliver and protect the service. Transfers to the United States rely on the European Commission's adequacy decision on the EU-US Data Privacy Framework (10 July 2023) for providers that participate in it, and in any case on the standard contractual clauses approved by the European Commission, with supplementary measures where needed. If you connect a partner service based outside the EEA, data is transferred to that service at your request.

5. What we don't do

We don't show ads, we don't use analytics or tracking tools, we don't profile users, we don't sell data and we don't use it to train artificial intelligence systems.

6. Retention

7. Security

Communication with our servers uses an encrypted connection (HTTPS) and the tokens of partner services are stored encrypted (AES-256-GCM). No system is perfectly secure: in the event of a data breach that presents a risk to you, we will make the notifications required by Articles 33 and 34 GDPR.

8. Your rights

You have the right to access your data, have it rectified or erased, restrict its processing, receive it in a structured, commonly used format (portability) and object to processing based on legitimate interest (Articles 15-21 GDPR). Where processing is based on consent, you can withdraw it at any time without affecting earlier processing.

To exercise your rights write to support@endurian.app; we reply within one month, extendable by two further months in the complex cases provided for by the GDPR. You also have the right to lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali (Piazza Venezia 11, 00187 Rome, garanteprivacy.it), or with the supervisory authority of the EU country where you live or work.

9. Deleting your account

You can delete your account at any time directly in the app. When you do, we delete your account and all your data on our servers (account data, the delivery log and any files still held), which from your point of view happens immediately. We immediately attempt to revoke the Apple and partner-service authorizations; if a partner is temporarily unreachable, the attempt is retried automatically for up to 7 days, using only the encrypted token (we keep no other data about you). Data in Health on your device and data already delivered to partner services are outside our control: for the latter, contact the service concerned.

10. Children

Endurian is not directed at children under 14. In Italy, a minor aged 14 or over can give valid consent to the processing of their data for information society services (Art. 2-quinquies of Legislative Decree 196/2003); below that age, authorization from whoever holds parental responsibility is required. Other EU countries may set different thresholds (between 13 and 16). We do not knowingly collect data from children under 14: if you believe a child has created an account, write to us and we will delete it.

11. Obligation to provide data and automated decisions

Providing your account data is necessary to use the features that require an account; connecting partner services and granting Health permissions are optional. We do not make decisions based solely on automated processing that produce legal effects concerning you.

12. Changes

We may update this notice, for example when we add features or partner services. We will publish the new version on this page with the update date and, for significant changes, notify you appropriately.