Privacy

Squall is a running-training app for iPhone and Apple Watch. This page explains what it does with your information. It is written to be read, not to be survived.

No account

Squall has no sign-up, no login and no password. You do not give us an email address to use the app, and we do not create one for you. The beta list on this website is the one place an email address is asked for, it is entirely optional, and it has nothing to do with the app — joining it does not make an account, and the app never sees it.

Where your training data lives

Your plan, your sessions, your paces, your completed runs and your settings are stored on your iPhone and Apple Watch.

They also sync through your own iCloud account, so the same training appears on your other devices. That is Apple’s storage, under your Apple Account and subject to Apple’s terms — not ours, and we cannot see it. Sync is on by default and needs you to be signed in to iCloud. You can turn it off in Settings, and your training then stays on the device.

Your data is also included in your device backup if you back your device up, under whatever protection you have set for that backup.

Apple Health

With your permission, Squall reads workouts and recovery data — such as heart rate variability, resting heart rate and sleep — from Apple Health, and writes the runs you record with Squall back to it.

• Health access is requested when you first use a feature that needs it, and you can decline.
• You can change or withdraw that access at any time in the Health app, under Sources.
• Health data read by Squall is used to show you your own training and recovery. It is not sold, and it is not shared for advertising.

No AI coach

Squall launches without an AI coach. The morning forecast, the plan and every change to it are worked out on your iPhone, from rules applied to your own readings. Nothing about your training or your health is sent to an AI service, or to a server of ours, to make any of that happen.

The coach is off for now, not for good. When it comes back it will be optional and off until you turn it on, and this page will say exactly what it sends before it can send anything.

Helping improve the plans

Squall has an optional feature called “Help improve Squall plans”. It is off unless you switch it on. You are asked once, on Forecast, after your first finished plan week, and you can change your mind at any time in More › Connections › Help improve plans, which also has “See what’s sent” and “Delete my data”. It needs Squall’s server, which is not running yet, so for now nothing is sent even if it is on.

If you switch it on, Squall sends one short record a week describing how the plan went:

• The plan itself — its goal, engine, phase, level, which week of how many, weeks until your race, and the runs it planned.
• Sessions planned, done, skipped and moved; kilometres planned and run.
• Your average effort score for the week, and on tempo runs how your pace compared with the target.
• The long run planned against the long run you did.
• How you answered the daily adjustment card.
• Race and time-trial results, against what the plan predicted for that distance.
• The app's build number, so a change in the numbers can be matched to a change in the app.

Never in it: your name, email or Apple Account. No GPS or routes. No dates finer than the week — a record is stamped “2026-W41”, not with the days you ran. No heart rate, heart rate variability or sleep figures.

It carries a random identifier made on your phone when you switch the feature on. It is linked to nothing else — not your Apple Account, not your iCloud data. “Delete my data” removes every row stored against it and discards the identifier, so what you send afterwards cannot be joined to what you sent before.

The record goes to Squall’s server on Vercel, which checks the request came from a genuine copy of the app and records only that a send happened and how many records were in it — never their contents. It is then stored in a Supabase database owned by Veylor Studio, in Sydney, Australia.

It is used for one thing: judging Squall’s training rules against what actually happened, so the plans get better. Never advertising, never sold, never shared with anyone else. It is kept until you delete it — there is no automatic expiry yet, and this page will say so when there is.

Strava

Squall does not connect to Strava yet. Nothing from Squall reaches Strava, and nothing from Strava reaches Squall. If that changes, this section will say exactly what is sent before the option appears in the app.

The race list

When you pick a race, the list comes from Squall’s own server. The app downloads the same public file everyone gets, keeps it for an hour, and falls back to the copy it last downloaded — or the one it shipped with — when there is no network. The request is a plain download: it carries no identifier, no name, nothing about you, and it is not signed or counted against your installation.

It is still a request to a server, so as with any website the host sees the IP address it came from and when. That is the one connection Squall makes without being asked; everything else below is yours to switch on.

Who else is involved

• Apple — iCloud sync, Apple Health, and App Attest (which lets Squall's server check a plan record came from a genuine copy of the app).
• Vercel — hosts Squall's server and this website, in the United States, and counts the website's visits.
• Supabase — stores the optional weekly plan outcomes described above, in Sydney, Australia.
• Kit — runs the beta mailing list, in the United States, if you join it.

Nothing goes to advertisers or data brokers, and your information is not sold. The app sends nothing to an analytics service; this website counts its visits, which is described below.

From the app, one thing sends your information anywhere, described above and off until you turn it on: the weekly plan outcome. Besides that, the app downloads the race list, which tells the server nothing about you.

Analytics on this website

This website counts its visits, using Vercel Web Analytics. Vercel already serves every page of this site, so this tells no one new that you were here. There are no advertising pixels, no third-party trackers, no cookies and no cross-site tracking. The fonts are served from this site, so your browser does not ask a font network for them.

With each page view Vercel records:

• The page you looked at, and the page you came from.
• A rough location from your IP address — country, region and city, not your address and not the IP itself.
• Your device type, operating system and browser, with their versions.
• The time.

There is no cookie and nothing is kept on your device. Repeat views within a visit are matched by a hash Vercel makes from the request itself, which is discarded after 24 hours. It cannot be turned back into you, and it does not follow you to any other site.

What you type in the race search is not part of it. Vercel normally keeps the query string with each page view, and the race list puts your search in the address so a filtered list can be linked. The address recorded for a view is cut off before the question mark, so a search for a race is counted as a visit to the race list and the words are not recorded.

The pace calculator is not part of this. It does its arithmetic in your browser: what you type is never sent to a server, never written into the address, and never saved — reload the page and it is gone.

The beta list

If you put your address in the beta list on the home page, it goes straight from your browser to Kit, which runs the list. It does not pass through this website, and it is not stored here.

Kit emails you a link to confirm you meant it, and you are on the list only once you follow that link. The list is used for one thing: to tell you when the beta opens. Every email has an unsubscribe link, which removes you from Kit, and you can ask at the address below to be taken off it instead.

Kit is Kit.com, in the United States, and it holds your address and what it records about the emails it sends you, under its own privacy policy. The confirmation email comes from Squall (hello@squall.run), is sent through Kit, and shows Kit’s postal address in its footer, as the law requires of a mailing list.

This is the website. The app is separate: it has no analytics at all, and the only thing it sends is the weekly plan outcome described above, off until you turn it on.

Children

Squall is not directed at children and is not intended for use by anyone under 13.

Not medical advice

Squall is a training tool, not a medical device. It does not diagnose, treat or prevent any condition, and nothing it shows you is medical advice. If something hurts, or you are unsure whether training is safe for you, speak to a qualified professional.

Changes

If this policy changes in a way that matters, the date at the top of this page changes with it.

Contact

Questions about privacy can go to support@squall.run.