Privacy
Last updated 5 November 2026
Naru holds training data, and some of it is about your body. This page says plainly what is collected, why, where it is kept and how to remove it. If anything here is unclear, ask us and we will fix the wording rather than explain it away.
What we collect
- Your account. Your email address. If you sign in with Google we receive your email address and name from Google; we never see your Google password.
- What you tell us to build a plan. Your event and its date, the days and hours you can train, your training history, and anything you report as sore or injured.
- Facts about you that the plan needs. Age, weight, and optionally height and sex. These are used to compute fuel targets and training zones. Sex is optional, and if you decline it the app computes a range instead of a figure rather than guessing.
- What you record. Sessions you complete, how they felt, your morning check-in, food you log, and weigh-ins.
- Activities from a service you connect. If you connect Strava, we read your activities so the plan can be measured against what you actually did.
What we do not do
We do not sell your data, share it with advertisers, or pass it to data brokers. There is no advertising in Naru. We do not use your training data to build products for anyone else.
Where it is kept
In a Supabase Postgres database hosted in the European Union (Frankfurt), and served by Vercel. Every table carries row-level security, so a signed-in athlete can read only their own rows — that is enforced by the database itself rather than by application code remembering to filter.
Where you connect another service, the access tokens for it are kept in an encrypted vault, separate from the rest of your data.
Who else processes it
- Supabase — database, authentication and file storage (EU).
- Vercel — application hosting.
- Google — only if you choose to sign in with Google.
- Strava, Garmin or COROS — only for an account you connect yourself, and only while it stays connected.
- A large language model provider — when you ask the coach a question. Your plan and a summary of your training are sent to answer it. It happens only when you ask, it is not used to train anyone’s model, and nothing is sent in the background.
Disconnecting and deleting
You can disconnect a linked service at any time from Connections, which removes our access and our stored tokens for it.
You can delete your account from Settings. That removes your plans, your recorded activity, your food and weight logs, and your sign-in identity. It is immediate and it is not recoverable — we would rather that than keep a copy you did not ask us to keep.
Your rights
If you are in the UK or the EU you have the right to access your data, correct it, have it erased, and object to how it is used. The delete described above covers erasure. For anything else, email us and we will do it; we are a small team and we will reply like one.
Cookies
Naru sets a cookie to keep you signed in. That is all it is for. There is no advertising or tracking cookie, and no third-party analytics script in the app.
Children
Naru is not intended for under-16s, and we do not knowingly create accounts for them.
Changes
If this changes materially we will say so in the app rather than quietly updating the date at the top of this page.