Privacy Notice

Effective Date: October 1, 2026 · Last updated: October 11, 2026

1. Who we are

Ruckaroo is operated by Cincy Labs LLC ("we", "us"), a limited liability company organised in Ohio, United States. Cincy Labs LLC is registered with the UK Information Commissioner's Office, registration reference ZC192926. Contact for anything privacy-related: privacy@ruckaroo.app. We aim to answer within one month. For content on Ruckaroo, including content you believe is illegal, and for authorities under the EU Digital Services Act, the contact is dsa@cincylabs.ai (you do not need an account to write to us; we communicate in English).

Representatives in the EU/EEA and the UK. We are appointing a representative in the EU/EEA (Article 27 GDPR) and in the UK (Article 27 UK GDPR). Their names and contact details will appear here as soon as the appointments are confirmed, and you will then be able to contact either representative instead of us on any matter relating to your personal data.

2. What we collect

  • Account: email address, display name, handle, profile photo, country at sign-up, date of birth (used for the age check in section 8 and for calorie scoring).
  • Profile: gender, height, weight, activity level, rucking experience, goals, gear preferences, nutrition preference, veteran status, city. We do not collect health conditions or dietary restrictions.
  • Activity: rucks (distance, duration, pack weight, terrain, calories, score), the full-precision GPS trail of each outdoor ruck, weather at the start point, the device you recorded with, and any photos, notes, location label or mood you attach. HealthKit and Health Services data stays on your phone; only derived ruck metrics are sent to us.
  • Health data (only with your explicit consent, wherever you live): per-second heart-rate samples synced from a connected watch (Apple Watch, Wear OS, Garmin), step counts, your maximum heart rate, and calorie estimates from your device. Without health consent your rucks are saved without them, and any already stored are removed — see section 3.
  • Location: GPS trails as above; the precise position of trail-hazard reports you submit; the exact meeting point of events you create; and a short-lived position ping (kept 5 minutes) used to check that you are near a hazard you vote on. We derive your region from your IP address on our own servers to pick the right consent defaults and age rule; the IP address is not stored for this purpose or sent to a third party.
  • Community: feed posts and captions, comments, reactions, likes, connections, blocks, groups ("mobs"), challenges and patches, events and RSVPs, training plans, referral invitations, Trail Karma, trail-hazard reports (category, description, photo, position) and votes, and abuse reports you file.
  • AI coach: your conversations with the Ruck Coach assistant. Message content is encrypted at rest with a dedicated key.
  • Support: messages you send through the in-app support form, with your email address.
  • Device & usage: device type and OS, push token, app version; usage events (with analytics consent), crash reports (with crash-reporting consent), and the advertising identifier for install attribution (with ad-measurement consent and, on iOS, only if you also allow tracking in the system prompt, which appears at the moment you give that consent). Referral attribution uses a device fingerprint that is dropped when your account is deleted.
  • Subscription: subscription plan and purchase receipts via the app stores.

3. Why and on what basis

  • Providing the service (contract): account, ruck tracking and scoring, community features, the AI coach, push notifications about your account and activity, subscriptions, support.
  • Your explicit consent (everyone, everywhere) for health data: heart-rate samples from your watch, step counts, your maximum heart rate and device calorie estimates, and their use in scoring and AI coaching. If you decline or later withdraw it: your phone stops sending them, new rucks are saved without them, they are removed from your past rucks (calories are recalculated without heart rate), the step counter is off, and your step totals are hidden from step-challenge leaderboards. The rucks themselves (distance, time, load, score) stay. Turn it on or off in Settings → Privacy Choices → Health data.
  • Your consent (everyone, everywhere) for each of: product analytics, crash reporting, ad measurement (install attribution), and marketing notifications (streak, near-miss and challenge reminders; account and social notifications are not affected). You are asked on first launch with equal Accept and Reject buttons; nothing optional runs until you choose, and a choice made on an earlier version of the screen is asked again once. Change any choice in Settings → Privacy Choices. Withdrawing consent does not affect processing that already happened.
  • Legitimate interests: service security, rate limiting, abuse prevention and content moderation, fraud checks on referrals, anonymised trail-traffic statistics, error tracking, and answering support requests.
  • Legal obligations: retaining pseudonymised abuse reports and erasure receipts (section 6), responding to lawful requests.

We do not sell your personal information, and we do not use it for automated decisions with legal or similarly significant effects.

4. AI transparency

The Ruck Coach is an AI assistant built on OpenAI models. Its replies are machine-generated and labelled as such in the app. Messages that look like a medical emergency, crisis or request for a diagnosis get a fixed safety response from our own server and are never sent to the AI provider.

What we send to OpenAI for each coach reply: your message and conversation history; your display name, age, gender, BMI, fitness level, rucking experience, goals, typical pack load, weekly goal and nutrition preference; lifetime stats and badges; your last 10 rucks including distance, load, score, the first 50 characters of any notes and, only if you have given health consent, heart-rate averages, maxima and zones; and your active training plan. We do not send your email address or any account identifier to OpenAI. OpenAI also generates optional feed captions from your ruck stats, and screens trail-hazard reports (photo, description, category and nearby reports) before they are published. OpenAI processes this data under a data processing agreement we signed in July 2026. OpenAI does not use it to train its models and deletes it within 30 days, keeping it only that long to check for misuse.

AWS Bedrock (also in the US) screens comments and captions for abusive content and, once a week, extracts anonymous product insights from coach conversations. Those insights are keyed to a salted hash of your account, quotes are scrubbed of names, contact details, locations and dates, and they are kept for 2 years.

5. Who processes your data

  • Amazon Web Services (US) — hosting, media storage, sign-in (Cognito), account emails, AI moderation and insights (Bedrock).
  • MongoDB Atlas (US) — primary database.
  • OpenAI (US) — AI coach, captions and hazard screening, as in section 4.
  • Google Firebase Crashlytics (US) — crash reports tagged with your user id; with consent off, unsent reports are discarded. *Crash-reporting consent.*
  • Meta (US) — ad install attribution for Ruckaroo's own advertising. *Ad-measurement consent.*
  • Singular (US) — install attribution and referral deep links. Referral short links carry the inviting user's id and display name. *Ad-measurement consent.*
  • Mixpanel (US) — product analytics identified by your user id. For EEA and UK users, events go to Mixpanel's EU servers and IP-based location is off. *Analytics consent.*
  • OneSignal (US) — push notifications keyed to your user id. Account and social pushes (activity, comments, events, export ready) are sent to everyone; streak, near-miss and challenge reminders are sent only with your marketing consent.
  • RevenueCat (US) — subscription entitlements, identified by your user id and email. Superwall (US) — paywalls, identified by your user id only.
  • Sentry (US) — backend error tracking; no emails, request bodies or account identifiers; a salted pseudonym of the account may appear in error messages.
  • Open-Meteo (Germany) — current temperature and humidity for calorie scoring; receives only the coordinates of your ruck's start point, with no identifier.
  • OpenStreetMap public tile servers — map tiles; like any map, the tile server receives your IP address and the map area you view.
  • Garmin — only if you connect a Garmin device, under Garmin's own terms.
  • Strava — only if you link your own Strava account and choose to send a ruck there. For each ruck you choose to send we pass the route, start time, duration, distance, altitude, calories, the ruck's title and your notes (plus the pack weight and Ruck Score) and, only if you have given health consent, heart-rate data to your Strava account, where Strava's own privacy policy applies. We ask Strava only for permission to write activities. We store your Strava athlete id and encrypted access tokens until you unlink or delete your account, and we revoke the connection at Strava when you do.

The maintained list with purposes and regions lives at ruckaroo.app/sub-processors; we update it before adding any new provider. Our own staff can see account data, support messages and coach transcripts when needed for support and moderation; those admin actions are logged.

Trail-hazard sharing with partners. We do not currently share hazard reports with trail or land-management partners. If we start, we will update this notice first, and any sharing will carry no reporter identity (category, position, description, photo and timestamps only).

6. How long we keep things

  • Account and profile: for the life of your account.
  • Coach conversations: deleted 3 years after their last message.
  • Rucks (including GPS trails and heart-rate samples), feed posts, comments, reactions, likes, and Trail Karma history: kept for as long as you have an account, and deleted with it. Social-interaction logs (an internal activity log, not your content): 2 years.
  • Notifications: 90 days. Hazard-vote position pings: 5 minutes. Referral short links: 48 hours.
  • Data-export files: 7 days; the export request record: 30 days.
  • Released handles: held 90 days before reuse.
  • Trail-hazard reports: kept for the community until cleared, and retained afterwards; permanently anonymised when you delete your account.
  • Abuse reports and support tickets: pseudonymised on account deletion and kept for up to 6 years. Erasure receipts (pseudonymised): 6 years.
  • Admin audit log: 400 days.
  • Events, group memberships, connected devices and referral records: for the life of your account, and deleted with it.
  • Deleted accounts: erased across our systems after the 7-day grace period (section 7). Database backups can hold erased data for up to 3 months and are then overwritten; deleted photos are removed from storage immediately. Backups are not used to restore individual accounts.

7. Your rights

You can: access and export your data (Settings → Download my data — a ZIP with your profile, rucks, posts, comments, reactions, connections, devices, karma, notifications, hazard reports and votes, events, challenges, patches, training plans, group memberships, referrals, support tickets, reports you filed, coach conversations, and download links for your media; the download link works for 7 days and the file itself is deleted within 30 days); correct your profile in-app; withdraw any consent in Settings → Privacy Choices; object to processing based on legitimate interests, ask us to restrict processing, or ask about anything else at privacy@ruckaroo.app.

Deleting your account (Settings → Delete Account, confirmed by email): we first offer you a download of your data, then your account is locked immediately and permanently erased after a 7-day grace period, which you can cancel in-app; during the grace period you can still download your data. If your subscription or trial has lapsed, the screen you land on still lets you download your data, delete your account or sign out, so deletion is never behind a paywall. Erasure removes your profile, sign-in, rucks, media, conversations, posts, comments, devices, karma, notifications, plans, challenge and event entries and blocks. Groups and challenges you own pass to another member. If you ask for a copy of your data and then delete your account, we deliver the copy first; deletion follows once the download window has closed. We ask RevenueCat, OneSignal and Mixpanel to delete their copies automatically and retry until they confirm. Superwall, Meta, Firebase Crashlytics and Singular offer no deletion interface we can call, so each erasure creates a task for us to submit those deletion requests by hand in each provider's console; write to privacy@ruckaroo.app if you want confirmation. What remains after deletion: hazard reports with your identity removed; abuse reports and support tickets with your identity replaced by a pseudonym and your email removed, for up to 6 years; referral records with both parties pseudonymised and the device fingerprint removed; a pseudonymised erasure receipt; and the account identifiers those four providers need to act on our deletion request, kept for up to 120 days after erasure, visible only to our administrators, then deleted.

We honour the Global Privacy Control signal on requests from your device as an opt-out from ad measurement and sharing; it stays in force until you turn it off. EEA/UK: you may lodge a complaint with your supervisory authority (in the UK, the Information Commissioner's Office). California: see section 9. Washington: see section 10.

8. Age requirements

You must be at least 13 to use Ruckaroo (16 in the EEA, 18 in the UK). We check your date of birth at sign-up and do not knowingly keep an account that fails the check for its region.

9. California residents

We do not sell personal information. Ad measurement through Meta and Singular may count as "sharing" under the CPRA; "Do Not Sell or Share My Personal Information" in Settings turns it off, and we treat a Global Privacy Control signal the same way. Your rights to know, delete and correct are served by the in-app export, deletion and profile tools, or by writing to privacy@ruckaroo.app; we will not discriminate against you for exercising them. An authorised agent may submit a request for you by writing to privacy@ruckaroo.app with your signed permission; we will confirm the request with you directly before acting on it.

10. Washington residents (My Health My Data)

Consumer health data we collect — heart-rate samples from your watch, step counts, your maximum heart rate and device calorie estimates — is collected only with your explicit consent, exactly as described in section 3. None of it is sold, and all of it is deleted with your account. Manage it in Settings → Consumer Health Data (WA) → Health data, or contact privacy@ruckaroo.app. Our standalone Consumer Health Data Privacy Policy is at ruckaroo.app/consumer-health-data.

11. International transfers

We process data in the United States. For EEA and UK users we rely on the European Commission's Standard Contractual Clauses with each processor in section 5, together with the UK International Data Transfer Addendum, and on data-processing agreements with each of them. Amazon Web Services, MongoDB, Google, Mixpanel, Singular, OneSignal and Sentry are additionally certified under the EU-US Data Privacy Framework and its UK Extension; Meta is certified for EU transfers and relies on the UK addendum for UK transfers. Open-Meteo receives no personal identifiers, and Mixpanel data for EEA/UK users stays on EU servers.

12. Changes

We'll notify you in-app of material changes before they take effect and record which version you accepted. Prior versions are available on request.