Privacy Policy

This privacy policy applies to the Allvallee mobile application and related services (collectively, the "Application") operated by Antti Uusitalo (the "Service Provider").

DATA CONTROLLER

• Name: Antti Uusitalo
• Address: Kaukolantie 17, 02140 Espoo, Finland
• Email: [email protected]

DATA COLLECTION AND USAGE

The Service Provider collects and processes the following data categories to fulfill contract performance (providing fitness recommendations) and based on your explicit consent:

1. User-Provided Data

• Account Information: Email address and birthdate collected during registration.
• Apple HealthKit Data: Fitness and running workout history accessed via Apple’s HealthKit framework. This data is processed solely to execute running simulation models and provide training recommendations. It is never used for marketing or advertising purposes, and is never sold or shared with data brokers or advertising networks.

2. Automatically Collected Data

• Technical Identifiers: Device ID, IP address, operating system, and browser type.
• Location Data: Precise location coordinates collected during workouts to track routes, calculate distance, and compute pace analytics.

DATA SHARING AND THIRD-PARTY PROCESSORS

Personal data is disclosed to third parties only as required by law, or to the following service providers acting as data processors:

• Amazon Web Services (AWS): For cloud data storage (S3) and database management (DynamoDB) on servers located within the European Union.
• RevenueCat: For in-app purchase and subscription processing. RevenueCat Privacy Policy

DATA RETENTION AND DELETION

• Retention: Account and workout data are retained for the duration of your active use of the Application plus 12 months thereafter, unless erasure is requested sooner. Technical logs are retained for up to 24 months.
• Account Deletion: Users may permanently delete their account and data by emailing [email protected].

CHILDREN'S PRIVACY

The Application is restricted to individuals aged 16 years or older. The Application collects the user's birthdate during onboarding to enforce this restriction. If an applicant is detected to be under 16, registration is blocked, and no personal data or HealthKit metrics are transmitted to the servers.

SECURITY AND INTERNATIONAL TRANSFERS

Data transmission between the Application and cloud servers is encrypted using Transport Layer Security (TLS). Data at rest is encrypted within the AWS infrastructure. Where data is transferred outside your home country by third-party processors, Standard Contractual Clauses approved by the European Commission are utilized.

REGIONAL RIGHTS

1. United States Residents (CCPA/CPRA)

• Right to Know & Access collected personal data.
• Right to Delete personal data.
• Right to Correct inaccurate information.
• Right to Limit the use of sensitive personal data (health and precise location) to necessary infrastructure purposes.
• The Service Provider does not sell personal data or share it for cross-context behavioral advertising.

2. European Union & United Kingdom Residents (GDPR)

• Right of Access, Rectification, and Erasure ("Right to be Forgotten").
• Right to Restrict or Object to processing.
• Right to Data Portability and Right to Withdraw Consent.
• Right to lodge a complaint with a Data Protection Authority. In Finland: https://tietosuoja.fi.

CHANGES TO POLICY

The Service Provider may update this Privacy Policy by posting the revised version on this webpage.

Effective Date: 2026-07-09