1. Operator and scope
ORBIQ operates Running Coach Lab (Runcoaching), https://runcoaching.kr. This policy covers accounts, race and record management, training analysis, community features, notifications and race-package generation.
This policy also applies from 17 November 2026 to accounts created before that date. Processing requiring new consent will not start until that consent is obtained. Contact choi@orbiq.kr for privacy questions and rights requests.
2. Minimum age
Membership is for people aged 14 and over. We do not offer membership services to children under 14. Contact choi@orbiq.kr to request deletion if an account or personal data belongs to a child under 14.
The registration screen displays an age-confirmation notice. It currently has no separate age-confirmation checkbox and does not individually store an age confirmation or general terms-consent version.
3. Data and purposes
The current video demonstration uses file name, size and type to return example results; it does not upload or analyze the video itself. The current goal-summary input is not stored or transmitted.
Kakao sign-in is separate from marketing or external-calendar write consent. Declining optional data may limit the relevant feature. We do not treat any required separate consent for health-related data such as heart rate as obtained before the necessary consent procedure exists. The Garmin integration is not currently active.
| Category | Data | Purpose |
|---|---|---|
| Email accounts | Name, email, password hash, verification status | Identification, sign-in, account protection |
| Optional contact | Phone number, contact-storage consent status and time | Selected notification contact |
| Kakao connection | Account identifier, authorized email and nickname, applicable channel relationship and consent information | Kakao sign-in, linking and selected channel features |
| Profile and records | Nickname, region, introduction, optional profile, race entries and results, bib, name and crew for record matching | Personal record management, verification and selected display |
| Certificates | File name, type, size, contents and linked record | Owner access and storage; reading records at the user's request |
| Training and activities | Date, sport, distance, duration, heart rate, elevation and related fields supplied through selected input or connection features | Training history, statistics and analysis; future Garmin processing follows Section 7 |
| Notifications and calendars | Preferences, channels, delivery history, push endpoints and keys, calendar identifiers, scope and encrypted tokens | Requested notifications and calendar connections |
| Community | Posts, timestamps, reports and moderation history | Community operation and disputes |
| Race packages | Account identifier, email, device, course, target time and pace, fueling settings, status, files and download identifiers | Package creation, delivery and downloads |
| Authentication and security | Hashed session, verification and reset tokens and expiry times, browser information, hashed rate-limit identifiers, infrastructure access and error records | Authentication, security, abuse prevention and troubleshooting |
| Inquiries | Reply address, message and information needed to handle it | Support, rights requests and content disputes |
4. Providers and operator-managed processing
The Mac is ORBIQ's own environment, not an outside contractor. The current worker uses user-entered settings and is separate from Garmin activity collection. A Seoul region does not mean every support, security, logging or subprocessor operation occurs only in Korea.
| Provider or environment | Data handled | Purpose and primary location |
|---|---|---|
| Vercel Inc. | Account and input data in requests, responses, access and error metadata | Hosting, server functions, security and troubleshooting; current function execution in Seoul (icn1) |
| Supabase Pte. Ltd. | Database records including accounts, profiles, records, consent, connections, encrypted tokens, package requests and outputs | Managed PostgreSQL; primary database storage in Seoul (ap-northeast-2) |
| Plus Five Five, Inc. (Resend) | Email addresses, sender and reply details, subject, body, verification, reset and download links, delivery metadata | Transactional email; message and delivery data stored in the United States |
| Operator-managed Mac | Job identifiers, user-entered course, target and fueling settings, necessary download identifiers, outputs and status | Local compilation, speech synthesis, conversion and upload |
5. International processing and transfers
The following distinguishes the foreign contracting entity's country from primary storage and execution. It does not mean that every database record is replicated to the entity's country.
Processing is limited to hosting, database and email services needed to provide the service. A transfer requiring separate consent must follow the required notice and consent process. The registration notice alone is not treated as separate international-transfer consent.
| Recipient and contact | Countries and locations | Data, purpose, timing and method | Retention |
|---|---|---|---|
| Vercel Inc. / privacy@vercel.com | Entity: United States. Primary server functions: Seoul, Korea. Support, security and operations may involve overseas access or processing | Account, input, request, response, access and error metadata. Encrypted transmission when serving requests; necessary access for support and incident response | As needed for the service; runtime logs: 1 hour. This does not specify retention of every provider support or security record. Deletion of separate support-case records is handled with the provider |
| Supabase Pte. Ltd. / privacy@supabase.io | Entity: Singapore. Primary database: Seoul, Korea. Official guidance describes necessary US-affiliate support/operations access and EU log processing | Account, record, connection and package database data and operational metadata. Encrypted service requests for storage and retrieval; necessary support/security access | Live account data until deletion is completed. Free API/database logs: 1 day. Individual account deletion is performed in the application database separately from project or supplier-account termination |
| Plus Five Five, Inc. (Resend) / https://resend.com/contact | Entity and message storage: United States. Sending region is distinct from storage country | Recipient, sender/reply details, subject, body, included links and delivery metadata. Encrypted transmission on an authentication, recovery or delivery email request | Email and delivery logs: 30 days; separate provider backups: 7 days. Supplier-account termination follows a separate process from an individual runner's withdrawal |
5-1. Refusal and choices
Email choi@orbiq.kr to request cessation of relevant processing or account deletion. Refusing hosting/database processing prevents account-based service provision; refusing email processing may prevent email authentication, recovery and package delivery.
Current delivery emails do not contain raw Garmin activities, GPS or heart-rate records. Garmin data and personal analysis are not sent to external AI or analytics services. Provider location and processing information is available through the official references below.
6. Retention, expiry and deletion
Public race-catalogue data is separate from account deletion. Sessions and cookies are valid for up to 30 days, verification links for 24 hours and reset links for 30 minutes. Validity or blocked download access is not physical deletion from every store.
Deleted live data may remain in recovery-only backups. The operational rule from the effective date is to reapply deletions made since a restored backup before service resumes. A minimal replay ledger will use account-identifier comparison values and deletion times, without names, emails or activity content. This ledger and automatic enforcement of absolute 35/60-day limits are not currently implemented.
Electronic records are removed from their stores and paper records shredded or otherwise destroyed. If separate legal retention is required, the records, basis and period will be identified.
| Data | Rule |
|---|---|
| Accounts and linked personal data | Deleted from the live database when withdrawal is completed; references in moderation records may be detached |
| Web package files and requests | Downloads available for 30 days after submission. Access is blocked at expiry; the next worker queue check deletes the request and dependent files. Physical deletion waits for resumption if the worker is stopped |
| Mac working files and job logs | Normal working files are removed when the temporary directory closes. A 30-day-after-request cleanup rule for abnormal leftovers and request-specific logs applies when that cleanup starts; this scheduled cleanup is not currently running |
| Inquiry emails and handling records | 1 year after the inquiry is closed |
| Vercel runtime logs | 1 hour |
| Supabase Free API/database logs | 1 day |
| Resend email and delivery logs | 30 days; separate provider backups: 7 days |
| Operator-managed encrypted backups | Retention limits to apply from this policy's effective date: rotating copies up to 35 days; last verified copy up to 60 days, including the recovery Mac copy |
7. Data from Garmin Connect
Status: The Garmin Connect™ integration is planned and is not currently active. The following applies when the feature launches and a runner connects their own Garmin account.
Collection: With the runner's authorization, we will obtain Activity API running activity summaries, laps and splits, and activity files. Files can include GPS tracks and heart rate recorded during the activity. We do not request all-day health data or women's health data. Connection identifiers, authorized scope and credentials are also processed. Connection credentials will be encrypted. Runcoaching will not ask for a Garmin password.
Purpose: We will provide a continuous training-history view and calculate realistic target times and race paces using the service's own deterministic analysis of data collected directly from the runner and the runner's race results. Results do not guarantee performance, health outcomes or injury prevention.
Sending to Garmin: At the runner's request, the Courses API will send race courses with pacing and fueling checkpoints and the Training API will send structured workouts. We will identify the data and destination and obtain express authorization before transfer. Runners must not upload data they are restricted from transferring. Garmin Connect privacy notice: https://www.garmin.com/privacy/connect
Visibility and restrictions: Personal data and analysis will be displayed only to the owning runner, not automatically published to other users or the community. Necessary operational, security and rights-request staff access is restricted. We will not sell Garmin data, use it for advertising or AI model training, or transfer it to external AI or analytics providers. Activity content and personal analysis will not be sent to traffic or performance tools.
Storage: Necessary processing uses the hosting, database and operator environments in Sections 4 and 5. Garmin originals and personal derived analysis are not sent to Resend. The connection will launch only after the necessary consent, encryption, access-control and deletion features are in place.
Control and deletion: Email choi@orbiq.kr for disconnection and deletion. An account-page control can also be used when available; authorization can be revoked through Garmin's connected-service management. On disconnection or withdrawal, further collection stops and live Garmin-sourced records, credentials and personal derived analysis are deleted within 7 days. Any shorter period in the applicable Garmin agreement takes precedence. Backup remnants and restoration follow Section 6. Runcoaching deletion does not delete the runner's original records in their own Garmin Connect account.
Attribution and changes: Data views identify Garmin and the supplied device model, or Garmin when no model is supplied. Derived analysis identifies Garmin as a contributing data source without implying Garmin endorsement or a guarantee. We will update the policy and notify connected runners before a provider or purpose changes, and obtain any required additional consent before changed processing begins.
8. Cookies, measurement and advertising
Authentication cookies maintain sign-in. Blocking or deleting them may prevent sign-in features. We do not use personal data for advertising, personalized ads or cross-site advertising tracking.
Current public pages do not include Vercel Web Analytics or Speed Insights collection scripts. Configuration records remain in the project, so we do not assert that every administrative setting is disabled. Garmin activity content and personal analysis are not sent to these tools.
9. Rights and withdrawal
Use available account-page profile, export, session and deletion functions. Some require the current password. Kakao-only accounts currently cannot self-withdraw through the screen. Email choi@orbiq.kr for withdrawal or any access, correction, deletion, restriction or consent-withdrawal request the screen cannot complete.
We verify the account owner or authorized representative using only necessary information. Do not email passwords or Garmin credentials. If a request cannot be fulfilled, we explain the reason and next steps.
10. Security
We use password/authentication-token hashing, encryption of connection credentials, account access controls, secure cookies, rate limits and encrypted backups. Device and administrative access is limited. Garmin-specific safeguards will be in place before the integration launches.
11. Privacy officer
Privacy officer: Youngjin Choi, Owner Operator: ORBIQ Contact: choi@orbiq.kr
Contact the officer for privacy questions, complaints, remedies and rights requests.
12. Remedies for rights infringement
You may seek advice, report an infringement or request mediation independently of contacting ORBIQ.
- Personal Information Infringement Report Center (KISA): 118 in Korea / https://privacy.kisa.or.kr
- Personal Information Dispute Mediation Committee: 1833-6972 / https://www.kopico.go.kr
- Korean National Police Agency Electronic Cybercrime Report & Management: 182 / https://ecrm.police.go.kr/minwon/main
- Prosecution Service 1301 Call Center: 1301 in Korea / https://www.spo.go.kr
13. Changes and history
We publish changes and effective dates. Connected runners are notified before changes to Garmin processing providers or purposes take effect; any required additional consent is obtained separately.
| Version | Effective date | Summary |
|---|---|---|
| 2026-11-17 | Scheduled: 17 November 2026 | Data processing, international processing, retention/deletion, rights and planned Garmin Connect integration |
Related information
Vercel terms · Supabase terms · Supabase processing locations · Resend storage and retention
Garmin Connect privacy notice · Garmin attribution guidelines