Privacy policy

Last updated: 12 September 2026.

Taper exists to read your training honestly, and that only works if we treat your data honestly too. This page says what we collect, why, and what control you have, in plain words. The short version: we collect what the product needs, we sell nothing, and you can delete everything yourself.

What we collect

Your email address and name, used to sign you in. If you sign in with Strava rather than by email, we get your name and email address from Strava for the same purpose. Your runs and other activities, imported from the services you connect - that includes distance, time, pace, heart rate, laps, cadence and the other measurements your watch records, the route you ran (GPS coordinates), and the second-by-second traces behind the charts. Plus the training plans, workouts, notes and corrections you create in Taper.

Where the service you connect sends it, we also import your daily wellness figures: sleep, heart rate variability, resting heart rate and body weight. Taper reads those to work out whether you are recovered, which is the readiness figure on your Home screen. Nothing in Taper needs them, so a provider that does not send them costs you only that reading, and you can delete them the same way you delete anything else - see Your control, below.

If you connect parkrun, we also read your public parkrun results - your official finish times and the events you ran - and match them to your runs.

Connecting Garmin, Strava or intervals.icu

Strava and intervals.icu connect the usual way: you approve Taper on their site and we hold the access key they issue us.

Garmin is different and you should know how. Garmin does not offer a limited connection to apps like ours, so connecting means signing in with your Garmin email and password. We do not keep your password, but the access tokens Garmin gives us in exchange are not restricted to your training - they carry the access your own login has. We store them on our server, readable only by the Taper application, and disconnecting in Profile deletes them. If that trade is not one you want to make, Strava works without it.

Connecting parkrun

parkrun is simpler than any of them, because it publishes every athlete's results as a public page. There is nothing to sign in to and no password: you give us your barcode (your parkrun ID) and we read that public page to bring in your official finish times. In the Taper app your own phone fetches the page directly. Disconnecting in Profile forgets your barcode.

What we use it for

To run the product: building your plan, working out your paces and predictions, and showing you your own history. Where you turn it on, we send planned workouts to your watch or calendar. We do not run ads, we do not sell or share your data with advertisers or data brokers, and we do not use your data to train AI models.

Why we are allowed to hold it

Your account, your activities and the plans built from them: because you asked us to run this service for you, and there is no service without them. Heart rate and the fitness measures worked out from it are health data, which the law treats more carefully than the rest, and so are the wellness figures above: your sleep, your heart rate variability, your resting heart rate and your weight. Taper holds those because you connected a provider that sends them, and you can stop that at any time by disconnecting it, which is also how you withdraw. You can delete what has already come in, along with the rest of your imported data, from Profile.

How long we keep it

For as long as you have an account. Deleting your account removes it immediately from the live database, and deleting individual activities works the same way. We do not delete dormant accounts on a schedule today; if that changes, this page will say so before it starts.

Who else sees any of it

Five services, all narrowly. Three whenever you use Taper:

• Brevo sends your sign-in codes and, if you turn it on, your weekly recap email, so it processes your email address and what that email says about your week.
• Open-Meteo tells us what the weather was on a run, so we send it the start coordinates and date of that run - no name, no email, nothing identifying you.
• CARTO draws the map background behind your route, and works differently from Brevo and Open-Meteo above: your browser fetches the map squares from CARTO directly, so they see your IP address and which part of the world you are looking at, and it only happens on a run with a route, when you open it. We send them nothing ourselves and they get no name, no email and none of your training.

Two only if you switch reminders on, and they are how a notification physically reaches your phone:

• In the Android app from Google Play, Firebase Cloud Messaging, which is Google's. It gets an anonymous handle for your device, and it does see the wording, which names your session and nothing else.
• In a browser or the Home Screen app, whichever push service your browser uses- Apple's for Safari, Google's for Chrome, Mozilla's for Firefox. It also gets an anonymous handle for your device, but a browser push is encrypted before it leaves our server, so the push service carries the reminder without being able to read it.

Neither push service gets your email address, your name or your training history. Turning reminders off in Profile stops it and deletes the handle. That is the whole list.

Where it lives

On Taper's own server in the EU, not a third-party analytics platform.

Your control

You can disconnect any provider at any time from your Profile. You can delete your imported activities, or your whole account, from Profile; deletion takes effect immediately in the live database. Anything already sent to your watch or calendar is removed where we can still reach it. If you want a copy of your data, or anything here is unclear, email info@taperapp.co.uk and a human will answer.

The law gives you more than that, and none of it needs a reason: a copy of what we hold, correction of anything wrong, deletion, your data in a portable form, and the right to object to or restrict what we do with it. Ask at the same address. If we get it wrong, you can complain to the Information Commissioner's Office at ico.org.uk, and you do not have to raise it with us first.

Cookies and what your browser keeps

One cookie, to keep you signed in. No tracking or advertising cookies, and no third-party analytics.

The welcome page counts visitors with a same-day hash of your connection, kept as a number only.

Taper also keeps a few things in your browser's own storage rather than on our server: your units, your light or dark choice, which notices you have dismissed, and a half-finished plan builder so a refresh does not lose it. None of it leaves your device, none of it identifies you, and clearing your browser data removes all of it.

Changes

If this policy changes in a way that matters, we will say so in the app rather than bury it here.