Privacy notice

Who is responsible

OINK is operated by Kekeno Tech Ltd. For privacy questions, account requests, or data rights requests, contact us through the support form or email enquire@kekeno.tech.

Data we collect

We collect and store the information needed to provide OINK's run coordination, profile, messaging, training planner, integration, and support features. Depending on how you use OINK, this may include:

• Account and profile details, such as name, email address, optional phone number, profile image, region, public visibility preferences, profile links, theme preference, email preferences, password login status, and account activity timestamps.
• Optional social sign-in details, such as the selected Apple or Google provider, a provider-linked account identifier (subject), the verified email address and name supplied for the link, the Terms acknowledgement timestamp when social sign-in creates an account, and link and last-use timestamps. OINK verifies short-lived identity tokens but does not store Apple or Google access tokens.
• Weather lookup data, such as the display name of your saved profile region used for automatic mobile Home weather, upcoming run meeting points and regions used for run forecasts, and returned regional forecast data. Mobile Home weather does not use your device's GPS location.
• Run coordination and mission report data, such as runs you create, typed meeting-point search text and selected place details when you use location autocomplete, saved meeting points, route links or GPX files, uploaded run and report images, post-run photo gallery uploads and captions, invite lists, RSVP status, attendee visibility preferences, reminders, comments, reactions, post-run reviews, mission report stories, Strava links, report access settings, Mission Report of the Month award records, and voucher provider preferences.
• Creator Picks data, such as submitted running links, moderation status, and reactions to published links.
• Event page and event signup data, such as event details, organiser details, event images, route files, signup answers, attendee display preferences, phone number, emergency contact details, medical issue flags and details you choose to provide, consent acceptance, participant messages, participant comments, comment images, reactions, and entrant export records.
• Payment-related event data, such as requested entry fee, assigned Stripe Product/Price metadata, payment method, payment status, Stripe Checkout session IDs, Stripe payment intent IDs, payment timestamps, and bank transfer instructions where an organiser provides them. OINK does not store full card numbers, CVCs, or card expiry details.
• Directory, buddy, group, and message data, such as run buddy requests, private invite groups, direct messages, and related message metadata.
• Training planner data, such as calendar sessions, weekly focus notes, imported workout details, completion status, completion notes, private scoped notes, private note display preferences, cached private note AI summaries where enabled, comments on shared training calendar events, training goals, comments on shared goals, mission and race plans, planner chat sessions, chat messages, expiring public training and chat link records, saved AI memory preferences, and AI-generated draft suggestions you choose to save.
• Nutrition tracker data, such as daily nutrition targets, daily calorie goals, day-completion markers and streak status, logged meals and meal items, planned/completed log status, calories, macro and hydration values, activity calorie-burn logs and linked Training Planner activity references, saved foods and meals, food library lists, barcodes, food database search queries and selected provider food identifiers when you use external lookup, nutrition lookup sources, learned food-calorie day associations and per-food completed-day observation summaries generated from days you mark complete, nutrition sharing settings, private scoped notes, food-photo analysis request metadata, and body-weight logs and notes.
• Notification data, such as notification titles, bodies, read status, links, unread counts, email and push delivery preferences, optional scheduled-topic choices, selected delivery time and timezone, notification digest status, a random mobile app-installation identifier, encrypted Firebase Cloud Messaging registration token, device platform, app version/build, delivery attempts, and revocation status.
• Optional private athlete context for AI, such as gender, age, height, and weight, when you add those details to your profile.
• Integration data, such as Strava athlete profile details, OAuth scopes, access and refresh tokens, cached recent activity summaries, sync attempt and success timestamps, Google Calendar account details, calendar IDs, OAuth scopes, access and refresh tokens, linked calendar event IDs, Final Surge calendar sync URLs and imported workout metadata, and—if you connect Garmin—your stable Garmin API user identifier, permission choices, encrypted OAuth access and rotating refresh tokens and their expiry, selected OINK data categories, planner-matching preference, push receipt and processing status, device/source metadata, and normalized activity, daily health, sleep, HRV, heart-rate, stress/Body Battery, respiration/Pulse Ox, and body-composition records.
• Security, abuse-control, and diagnostic data, such as login method, IP address, user agent, mobile session device name, mobile session expiry/revocation/last-used timestamps, trusted account and admin device records, short-lived rate-limit counters stored under one-way hashed scope keys, support enquiries, and operational logs.
• Analytics data, such as Firebase Analytics events and technical identifiers when analytics is enabled.

Purposes and lawful basis

We process personal data for the following purposes:

• To create and manage your account, authenticate you, and keep the service secure. If you choose Apple or Google sign-in, we use Firebase Authentication and the selected identity provider to verify and link that identity to your OINK account. Lawful basis: performance of a contract and legitimate interests in account security; provider processing is initiated by your choice to use social sign-in.
• To organise runs, suggest meeting-point addresses when you choose to use location autocomplete, send invites, manage RSVPs, show attendee status, support comments, reminders, reviews, post-run photo galleries, groups, buddy requests, and run-related messages. Lawful basis: performance of a contract, your explicit use of autocomplete, and legitimate interests in providing run coordination features.
• To create event pages, manage event signups, collect event safety and consent information, send participant updates, export entrant lists for organisers, and record event payment status. Lawful basis: performance of a contract and legitimate interests in event coordination, safety, payment reconciliation, accounting, manual organiser settlement, and dispute handling.
• To show profile, directory, buddy, and attendee information according to your visibility settings and the run context. Lawful basis: performance of a contract and legitimate interests in helping runners coordinate safely.
• To show weather forecasts for upcoming runs and, when your profile has a saved region, automatically show a coarse regional forecast on mobile Home. Lawful basis: performance of a contract and legitimate interests in providing contextual weather information from your saved settings.
• To provide the training planner, save and import training calendar entries, track weekly focus notes and completion notes, support comments on shared training calendar events and shared goals where enabled, support training goals, create read-only public links for selected weeks, workouts, or goals, and let you keep race or mission planning details. Lawful basis: performance of a contract, your explicit action in creating public links, and legitimate interests in supporting planning.
• To provide the nutrition tracker, save meals and library foods, track calorie, activity burn, macro, hydration, day-completion streaks, and body-weight information, learn meal feedback signals from completed nutrition days, support food-photo analysis, activity calorie-burn estimates, barcode lookup, and external food database autocomplete when you choose to use them, and let you share nutrition tracking or saved libraries with accepted run buddies. Lawful basis: performance of a contract, your explicit action in using lookup, AI estimate, autocomplete, completion marking, meal logging, and sharing features, and legitimate interests in providing requested tracking and collaboration features.
• To provide AI planner chat, user-created read-only chat snapshots, AI food-photo analysis, AI nutrition and activity calorie-burn estimates, draft suggestions, and optional private note summaries using the relevant prompt or note text, basic athlete profile identity and saved Strava or UTMB profile links, recent conversation history from the active chat session, saved AI memory preferences, planner context, weekly focus notes, completion notes, optional private athlete context, nutrition targets, recent calorie and macro logs, activity details for calorie-burn estimates, latest body-weight log, linked Strava summaries where available, and bounded latest and seven-day Garmin summaries plus Garmin-matched planner totals. Raw Garmin samples, payloads, identifiers, and device metadata are excluded from AI systems. Lawful basis: your choice to use the AI feature or create a public chat link and our legitimate interests in providing the feature; for optional private athlete context, AI memory, food-photo analysis, private note AI summaries, and nutrition data, your consent or action in using the disclosed feature.
• To connect optional integrations such as Strava, Google Calendar, Final Surge calendar import, and the Garmin Connect Developer Program. Garmin processing is limited to your own account, the permissions you grant in Garmin Connect, and the data categories you select in OINK, with a separate planner-matching control. Lawful basis: your consent or explicit action in connecting and configuring the integration, and performance of the requested integration feature.
• To show your owner-only Personal Trends view by calculating bounded recovery, completed training, completed-day nutrition, body-weight, and goal summaries from records already held in your OINK account. The view does not create a separate retained health profile or send its metric values to analytics providers. Lawful basis: performance of the requested account feature and legitimate interests in presenting your records consistently.
• To send service emails, account emails, invite emails, run coordination emails, weekly unread-notification and regional regular-run digest emails where enabled, optional product updates, optional morning training reminders and daily inspiration, optional goal completion follow-up reminders, optional monthly Mission Report draw reminders, and mobile push notifications according to your preferences. Regional digests, goal-completion reminders, and Mission Report draw reminders require an explicit opt-in; scheduled reminder channels can be changed independently in notification settings. Lawful basis: performance of a contract for account and coordination messages, legitimate interests for necessary service notices and notification digests, and consent or preference-based controls for optional scheduled notifications, update emails, and push notifications.
• To respond to support requests and privacy requests. Lawful basis: legitimate interests in support and compliance with legal obligations.
• To understand usage, diagnose issues, improve the product, and protect the service from abuse. Lawful basis: legitimate interests, except where consent is required for analytics or similar technologies.

AI and training context

If you use planner chat, AI calorie-burn estimates, or AI private note summaries, OINK may send your prompt, submitted activity details, private note text, and relevant context to an AI service provider so the feature can respond. Context can include your name and basic athlete profile details, saved Strava or UTMB profile links, upcoming planner entries, weekly focus notes, recent planner completion outcomes and completion notes, active goals, saved AI memory preferences, optional private athlete context, nutrition targets, recent calorie and macro logs, activity details for calorie-burn estimates, latest body-weight log, cached Strava activity summaries, bounded Garmin summaries, and recent chat history from the active chat session.

Planner Chat may use the latest available Garmin observation and a locally calculated seven-day aggregate for selected recovery categories, plus bounded totals from Garmin-matched planner activities. Raw Garmin samples, push payloads, credentials, user identifiers, source activity identifiers, and device metadata are not sent to the AI provider. This is a fixed product boundary with no separate Garmin AI toggle. When Garmin context materially influences a reply, OINK identifies Garmin as a contributing device-data source.

Planner chat may use the AI provider's hosted web search when current public information would materially improve a response. For a request about your own public race results or athlete profile, a query may use your saved name or Strava or UTMB profile link to identify the right runner. OINK instructs the provider not to include private planner, health, conversation, or unrelated profile details in search queries. Cited source titles and links are stored with the assistant message so they remain available in chat history.

If you create a public chat link, anyone who receives it can read the shared conversation without signing in. The link expires after 24 hours and captures messages only through the latest completed AI response at the time you create or replace it; later messages remain outside that snapshot. Review the conversation for private training, health, nutrition, or identifying details before sharing, and revoke the link if it should no longer be available.

If you use food-photo analysis, OINK sends the uploaded food image to an AI service provider to estimate meal items for your review. OINK stores analysis request metadata and any reviewed meal or library entries you choose to save; it does not keep a separate nutrition-photo record after analysis.

AI planner output is planning support only. Avoid entering medical, highly sensitive, or unnecessary private information into planner chat.

Who we share data with

We do not sell your personal data. We do not share your personal data with third parties for their own advertising. We use service providers and integration partners needed to operate OINK, including:

• Hosting, database, logging, and infrastructure providers.
• Private file storage providers for uploaded profile images, run images, post-run photo gallery images, event images, and route files.
• Email delivery providers for account, invite, notification, support, and product emails.
• Firebase Authentication and the Apple or Google identity provider you select, which process the provider-linked account identifier, verified email address, name where supplied, short-lived identity tokens, and provider or device authentication metadata needed for optional native account registration and sign-in. OINK verifies that the token belongs to the configured Firebase project and selected provider, and does not store Apple or Google access tokens. Social sign-in is optional and independent from Firebase Analytics consent.
• Firebase Cloud Messaging, which receives an app-installation registration token and notification delivery payload when device permission and your OINK notification preferences allow mobile push. Push permission and preferences are independent from Firebase Analytics consent.
• Analytics providers, such as Firebase Analytics, where analytics is enabled.
• AI service providers, such as OpenAI, when you use AI planner chat, hosted public web search within planner chat, AI-assisted planning features, food-photo analysis, AI activity calorie-burn estimates, or AI nutrition estimates.
• Nutrition lookup providers, such as Open Food Facts for barcode lookups and FatSecret for race-fuel nutrition lookup and Log nutrition food database autocomplete, when you choose to use those lookup features. FatSecret may receive typed food search text, selected provider food IDs, serving IDs, and returned nutrition facts needed to fill the food form.
• OpenWeather, which receives an upcoming run location for run forecasts or the display name of your saved profile region plus “New Zealand” when mobile Home automatically loads regional weather. The regional Home request does not include your OINK account identifier or device GPS location.
• Google Maps Platform, which receives meeting-point text you type after the autocomplete minimum is reached, an ephemeral autocomplete session token, and the selected place ID needed to return an address and region. OINK does not send your OINK account identifier or device GPS location for this feature. See the Google Privacy Policy.
• OpenStreetMap's standard tile service, which receives the tile coordinates for the visible route-map area, your IP address, and normal browser or app request metadata when a GPX route preview is shown. OINK does not send your OINK account identifier, device GPS location, or raw GPX file to the tile service. See the OpenStreetMap Foundation Privacy Policy.
• Strava, when you connect or refresh Strava activity data.
• Garmin Connect Developer Program, when you authorize OINK on Garmin's consent page. Garmin supplies a stable API user identifier, permission state, OAuth tokens, and supported summaries after your device syncs. OINK does not receive your Garmin password or a Personal API key. When you use Planner Chat, OINK's AI provider may receive bounded latest and seven-day Garmin summaries and Garmin-matched planner totals, but not raw Garmin samples, push payloads, credentials, identifiers, or device metadata.
• Google Calendar, when you connect calendar sync or mirror planner events to your calendar.
• Final Surge, when you connect a calendar sync URL and request workout import.
• Stripe, when you use Stripe Checkout for event entry payments. Stripe processes payment details and returns payment status metadata to OINK.

Other OINK users may see limited information according to the feature being used: organisers can see invite and RSVP details for their runs; eligible post-run RSVP holders can see run photos, uploader names, and captions shared to that run's photo gallery; event organisers can see entrant signup, safety, consent, payment status, and custom answer details for events they manage; attendees may see public attendee names unless someone chooses to appear anonymous; run buddies may see profile, training information, reactions, training calendar comments, shared nutrition tracking, or shared saved nutrition libraries only where your settings and relationship allow it.

Anyone given a user-created public training or chat link can view the bounded read-only information included in that link until it expires, is replaced, or is revoked. Public chat links include only messages through the assistant response captured when the link was created or replaced.

Mission and Race Plans are private to you unless you export the plan and share it yourself outside OINK. OINK does not store emergency contacts for Mission or Race Plans and does not send those plans to nominated contacts.

Retention

We keep personal data only for as long as needed for the purposes above, unless a longer period is required for security, legal, accounting, dispute resolution, or service integrity reasons.

• Account, profile, planner, nutrition tracker, private notes, body-weight, integration, message, group, invite, review, run, run photo, event, signup, notification, digest status, and event payment metadata is generally kept while your account remains active or while the related event or run record remains needed for coordination, accounting, dispute handling, or service integrity.
• Food-photo analysis request logs, saved nutrition records, and learned food-calorie association and observation records follow account and nutrition-tracker retention. Uploaded food images are processed for analysis and are not kept as separate nutrition-photo records by OINK after analysis.
• Mobile Home forecasts are cached by region for six hours and provider failures for 15 minutes by default. Upcoming run forecasts are cached with the run record and refreshed as configured. OpenWeather may retain request data under its own terms and account configuration.
• Event emergency contact and medical details are normally cleared 90 days after the event. Event participant messages are normally deleted 24 months after the event. Event comments, comment images, and reactions follow event/account retention. Event payment and accounting metadata may be retained separately where needed for accounting, dispute handling, or business record requirements.
• OAuth tokens and cached integration data are kept while the integration remains connected. If you unlink Strava or Google Calendar, OINK removes the local connection record and attempts to revoke access where supported. Inactive Strava links may also be deauthorized and removed after 7 days without OINK activity when OINK is at Strava's connected-athlete quota or when a verified super admin intentionally runs inactive-link reclaim.
• Normalized Garmin cache data is retained for 365 days by default and the configured period cannot be shorter than 90 days. Turning off a Garmin category deletes that category's normalized cache. Raw push payloads are kept only in the durable inbox until successful normalization or retry exhaustion, then erased. One-way payload digests and processing metadata remain for up to 30 days for idempotency, and one-time OAuth attempt records remain for up to 7 days. Disconnecting Garmin calls Garmin's registration-deletion endpoint and deletes encrypted credentials, processing state, and normalized Garmin cache. If Garmin cannot confirm remote withdrawal, OINK tells you to remove OINK from Garmin Connect account permissions. Existing planner completion or match-review records remain with planner history while your account is active so you can review outcomes and a dismissed activity is not silently reapplied; they are included in your personal-data export and deleted with your account where practical.
• Apple or Google social sign-in link metadata is kept while your OINK account remains active or until the link is removed following a support request. Deleting your OINK account deletes the local provider-link record where practical. Removing the OINK link does not delete your Apple or Google account or records retained by Firebase Authentication or those providers under their own terms.
• Support enquiries, security logs, login events, operational logs, and admin security records may be kept for a limited period needed to operate and protect the service. Expired rate-limit buckets are removed by scheduled retention cleanup.
• Public training and chat links expire after 24 hours. Replaced or revoked links are disabled immediately, their reusable raw token is cleared, and inactive link records are deleted by scheduled retention cleanup.
• If you delete your account, OINK deletes your profile and associated account data where practical. Some records may remain where deletion would affect another user's run history, message thread, legal rights, or service integrity; where practical, those records will be deleted or minimised.
• Backups may retain deleted data for a limited backup lifecycle before being overwritten.

International transfers

OINK is operated from New Zealand and uses cloud, authentication, email, analytics, AI, nutrition lookup, weather, and integration providers that may process data in other countries. Optional Apple or Google sign-in may involve Firebase Authentication and the selected identity provider processing authentication data outside New Zealand under their terms. Garmin may process connected integration data outside New Zealand under its terms. Bounded Garmin summaries may be transferred to OINK's AI provider when you use Planner Chat; raw Garmin samples, push payloads, credentials, identifiers, and device metadata are not transferred for AI use. Where required, we rely on appropriate safeguards such as provider data processing terms, standard contractual clauses, adequacy decisions, or equivalent transfer mechanisms.

Your choices and rights

You can update much of your personal data from your profile and download a JSON copy of personal data linked to your account, including social sign-in link metadata, learned nutrition feedback signals linked to your nutrition tracker, Garmin cache records, and planner match-review records. You can also change visibility settings, set your profile region to “Choose later” to prevent automatic mobile Home regional weather lookup and regional run digest emails, manage private notes, email and mobile push preferences, iOS notification permission, Strava and Google Calendar connections, Garmin data categories and planner-matching control, training calendar sharing, public training and chat links, nutrition tracker sharing, saved nutrition library sharing, optional private AI profile details, and saved AI memory preferences. You can disconnect Garmin to ask Garmin to withdraw the registration and delete OINK's Garmin credentials, processing state, and normalized cache. Logging out revokes that app installation's push token where the service is reachable.

Depending on where you live, you may have rights to request access to your personal data, correction, deletion, restriction, objection, portability, withdrawal of consent, and review by a human where automated decisions have legal or similarly significant effects. OINK does not currently make automated decisions with legal or similarly significant effects about users.

You can delete your account from your profile. You can also contact us for help with data access, correction, deletion, export, objection, or privacy concerns.

Apple and Google sign-in are optional. There is currently no self-service control for removing a social sign-in link. Contact us through the support form to request removal of the local link. If it is your only sign-in method, we may need you to establish another available sign-in method and verify account ownership first so that unlinking does not lock you out. You may also need to manage OINK's access separately in your Apple or Google account. Firebase Authentication and your selected provider may retain records under their own terms; removing the local OINK link does not control provider-side retention.

Children

OINK is intended for runners who can responsibly use run coordination and training planning features. If you believe a child has provided personal data without appropriate permission, contact us so we can review and remove it where appropriate.

How we govern privacy internally

We maintain an internal data map that records the types of personal data we process, the purposes and lawful bases for that processing, the systems and third-party providers involved, retention periods, security controls, and known privacy risks. We use this data map to keep this notice accurate, review our processors, apply retention rules, and assess new features such as AI-assisted training support, Strava and Garmin integrations, Google Calendar sync, analytics, and email notifications.

We have designed OINK's privacy controls to align with GDPR principles, including transparency, data minimisation, purpose limitation, security, retention control, and user rights. We are working through the final operational steps toward GDPR compliance, including processor documentation, transfer safeguards, internal procedures, and ongoing review of retention and deletion handling.

The internal data map is not published in full because it contains operational and security details, but the key information relevant to you is summarised in this privacy notice. You can contact us if you would like more information about how your personal data is processed.

Changes to this notice

We may update this notice as OINK changes. The latest version will be posted on this page with the updated date above.

Contact

For privacy requests, use the support form or email enquire@kekeno.tech. If you are in a jurisdiction with a data protection authority, you may also have the right to complain to that authority.