Privacy Policy

Miles (the “Miles” app) is made by Duane Labs Inc. (“Duane Labs,” “we,” “our,” “us”), a company based in New York, NY, USA. This Privacy Policy describes how we collect, use, and share information when you use the Miles mobile app and related services at racewithmiles.com (collectively, the “Service”).

If you have questions about this policy or your data, contact us at privacy@duanelabs.com.

When you connect Garmin Connect™ to Miles, we receive the activity and fitness information covered by your authorization. This may include activity dates and types, distance, duration, pace, heart rate, GPS routes, elevation, cadence, power, splits, and recording-device information.

Terra processes this information to connect Garmin Connect™ with Miles and deliver your authorized data. Miles uses Vercel for application hosting and processing and Supabase for database storage. Our application data is stored in the United States.

We use Garmin data to display your activities, calculate fitness and training metrics, estimate race performance, and provide personalized running coaching. We may combine it with your other activity sources, training goals, planned workouts, and coaching conversations to provide these features to you.

With your explicit consent to AI processing, relevant Garmin data and information derived from it may be sent to Anthropic or OpenAI to generate personalized coaching, as described in AI processing and consent.

We do not sell Garmin data, disclose it to advertisers, or use it for advertising. We do not use Garmin data or derived information to train, fine-tune, evaluate, benchmark, or improve AI models, or include it in datasets for those purposes. These restrictions also cover prompts, coaching responses, summaries, recommendations, and other information derived from Garmin data.

We retain imported Garmin data and related coaching information while your Miles account remains active, unless you request deletion sooner. Retention supports your activity history and ongoing personalized coaching; it is not for future AI training or development.

You can disconnect Garmin through Miles' account settings or revoke access through Garmin Connect™. Disconnecting stops future collection but does not automatically delete previously imported activities or coaching information. You may request deletion by contacting privacy@duanelabs.com or deleting your Miles account. To withdraw consent to future AI processing, use the process described in our AI disclosure.

This section governs our handling of Garmin data wherever other general language in this policy might suggest a broader use. References to improving the Service do not authorize using Garmin data for AI model training or development.

Providers and purposes. Miles uses existing AI models from Anthropic, Inc. (the Claude API) and, where enabled, OpenAI (the OpenAI API) to generate activity feedback, coaching responses, training recommendations, and summaries.

Information sent to AI providers. Depending on the feature, we send relevant workout measurements and history, fitness summaries, training goals, planned workouts, and coaching conversation context. This may include information received from Garmin Connect™ and information derived from it.

We do not deliberately attach your account email or name to these requests. Information you enter into coaching messages may nevertheless contain identifying information, and removing account identifiers does not make workout information anonymous.

Your consent. Before enabling AI processing, Miles asks for your explicit agreement through an in-app disclosure. If we add or change AI providers, we will update this policy and obtain any additional consent required before the new processing begins.

Restrictions on model training and development. Under their standard commercial API policies, Anthropic and OpenAI exclude API inputs and outputs from model training by default. Miles does not authorize training on Garmin data or submit Garmin-containing information to optional training or feedback programs. See Anthropic's model-training policy and OpenAI's API data controls.

Miles does not use Garmin data or derived information to train, fine-tune, evaluate, benchmark, or improve AI models, or include it in datasets for those purposes. These restrictions also cover prompts, coaching responses, summaries, recommendations, and other information derived from Garmin data.

Retention. AI providers may temporarily retain inputs and outputs for safety, abuse monitoring, legal obligations, and operation of their services. Anthropic generally deletes API inputs and outputs within 30 days, with exceptions for certain services, contractual arrangements, policy enforcement, and legal obligations. OpenAI generally retains abuse-monitoring logs for up to 30 days, with exceptions for legal and safety needs. API processing does not automatically provide zero data retention. See Anthropic's API retention policy and OpenAI's API data controls.

Miles separately retains activity history, coaching conversations, and related summaries to support ongoing personalized coaching, as described in How long we keep your data. Retention of Garmin data and derived information is not for future AI training or development.

Withdrawing consent and requesting deletion. You may withdraw consent to future AI processing by contacting privacy@duanelabs.com. We will disable further AI processing for your account, including pending coaching work. AI coaching features will be unavailable while consent is withdrawn.

Withdrawal does not undo processing already completed or automatically delete stored activities and coaching information. You may separately request deletion as described in Your rights and choices. Disconnecting Garmin stops future collection from Garmin but does not itself withdraw AI consent or delete previously imported information.

We use the information we collect to:

• Provide the Service: import your workouts, run analytics, generate coach feedback, and deliver push notifications
• Authenticate you (email OTP)
• Operate, maintain, and improve the Service
• Respond to your support requests
• Comply with legal obligations

We do not sell your personal information. We do not share your information with advertisers. We do not use your information for cross-context behavioral advertising.

We share information with the following service providers solely to operate the Service:

• Supabase Inc.(authentication and database hosting): your email, account record, and all workout, coaching, and schedule data are stored on Supabase’s PostgreSQL database in the United States.
• Anthropic, Inc. (LLM provider): workout summaries and coach messages are sent to the Claude API to generate personalized coach responses. Under its commercial API policies, Anthropic does not use API inputs and outputs for model training by default and generally deletes them within 30 days. Exceptions include services with longer retention, different contractual arrangements, usage-policy enforcement, and legal obligations. See Anthropic's model-training policy and API retention policy.
• OpenAI (LLM provider): workout summaries and coach messages are sent to the OpenAI API to generate personalized coach responses. OpenAI processes this data under its commercial API terms and does not train models on API data by default. We disable storage of responses for later retrieval. OpenAI may still retain data for abuse monitoring, generally for up to 30 days, with longer retention where required by law or reasonably necessary to protect its services or others from harm. See OpenAI’s API data controls.
• Apple Inc.(push notifications): your device push token and notification content (e.g., “Your coach posted a new note”) are transmitted via Apple Push Notification service.
• Vercel Inc. (web hosting and serverless functions): application requests and workout and coaching information are processed by Vercel to operate Miles. Standard request logs (IP address, request paths, user agent) are retained as part of normal hosting operations.
• Terra (tryterra.co) is our data aggregator and sub-processor: when you connect a watch ecosystem (Garmin, COROS, Apple Health, Polar, Wahoo, etc.), Terra receives the data from that service and forwards it to Miles. Terra has its own privacy policy that applies to its handling of your data.
• Third-party fitness services you connect (such as Garmin Connect™, COROS, Apple Health, Polar, Wahoo, and additional services we add over time): we receive your workout data from these services via Terra. We do not write data back to them. These services have their own privacy policies that apply to your relationship with them.

We do not transfer personal data to any other third parties for their own use.

We keep your data for as long as your account is active. When you delete your account from the iOS app (Settings → Account settings → Delete account), we permanently delete:

• Your email and authentication record
• All your workout data, coach history, planned workouts, and fitness models
• Your device push tokens
• Your authentication tokens for connected fitness services

Some operational logs (request logs at Vercel, error logs in our system) that do not contain personally identifying information may persist for up to 30 days for security and debugging purposes.

If you uninstall the app from your device but do not delete your account, your data remains. We do not currently auto-delete inactive accounts.

We use industry-standard practices to protect your data, including:

• HTTPS for all network traffic
• Encryption at rest for stored data (provided by Supabase)
• JWT-based authentication for the iOS app
• Scoped, refreshable access tokens for connected fitness services
• Rate limiting on authentication endpoints

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and applicable regulators in accordance with applicable law.

The data Miles collects is fitness and training data, not medical or clinical data. Miles:

• Is not a healthcare provider
• Is not a HIPAA-covered entity under the U.S. Health Insurance Portability and Accountability Act
• Reads workout and fitness data from Apple HealthKit only when you choose to connect Apple Health and grant permission
• Provides coaching analysis for informational purposes only

The coaching, race predictions, and training recommendations the Service provides are not medical advice. Consult a qualified healthcare professional before starting or modifying any training program.

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child under 13 has provided us with personal information, contact us at privacy@duanelabs.com and we will delete it.

The Service is operated from the United States and our service providers store data in the United States. By using the Service, you consent to the transfer of your information to the United States. Privacy laws in the United States may differ from those in your home country.

We may update this Privacy Policy from time to time. The “Effective” date at the top of this page reflects the most recent revision. For material changes, we will provide additional notice (such as via email or in-app notification) before the changes take effect.

If you have any questions about this Privacy Policy or our practices, please contact us at:

Duane Labs Inc.
159 Duane Street
New York, NY 10013
privacy@duanelabs.com