Privacy Policy

Leer en español

This policy describes how Zonda ("we", "the platform") collects, uses and protects your personal information when you use any of our products: Zonda Run (app for athletes and running coaches), Zonda Strength (strength-training app) and Zonda Coach (web platform for coaches).

1. Who we are

Zonda is a product of Rush Gaming Co LLC, a limited liability company registered in Wyoming, United States, which is the entity responsible for the processing of your personal data. Our team is based in Buenos Aires, Argentina. We operate the services accessible through zonda.fit and our mobile and web applications.

Registered address: Rush Gaming Co LLC, 321 W 2nd St #1187, Casper, WY 82601, United States.

Contact email: soporte@zonda.fit

2. Information we collect

2.1 Account data

First name, last name, email, password (stored hashed with bcrypt — never in plain text).
Role (athlete / coach / admin).
Profile photo (optional).

2.2 Physical profile data

Sex, date of birth, height, body weight.
Activity level, years of training experience.
Previous injuries, relevant medical conditions (medical clearance, where applicable).

2.3 Training data

Goals, target races, disciplines, available days.
Completed sessions, distance, pace, heart rate, cadence, power, elevation.
Strength sets logged (weight, reps, RPE).
Subjective feedback (perceived effort, pain, mood).

2.4 Connected wearable data

If you connect an external device or service, we receive the activity data that service sends us through its official API:

Garmin Connect: activities, heart-rate streams, pace, cadence, power.
Strava: activities and associated metrics. We process this information in accordance with the Strava API terms.
intervals.icu: activities and planned workouts, exchanged through its official API only after you explicitly authorize the connection. We read your activities and, at your coach's direction, write planned workouts to your calendar.
Google Health Connect (Android): exercise sessions you share from your device.
Apple HealthKit (iOS): exercise sessions and associated metrics, only if you expressly authorize each data category.

2.4.1 Strava connection

What data we receive: your basic Strava profile data and your activities (type, date, distance, duration, pace, heart rate, cadence, power, elevation and route).
How we receive it: only after you authorize the connection with the "Connect with Strava" button, through Strava's official API. When you connect we import your recent activities, and afterwards we receive new ones as Strava notifies us that you uploaded them.
How to withdraw consent: at any time, with the Strava "Disconnect" button in the app or from strava.com, under Settings → My Apps.
How to request deletion: when you disconnect Strava, revoke access from strava.com or delete your Zonda account, we automatically delete the activities and credentials obtained from Strava. You can also request it by writing to soporte@zonda.fit.
Confirmation: once deletion is complete, we confirm it to you in writing by email.
Your coach: the coach of the team you joined sees your activities to review your training. We do not sell Strava data.
The Strava Privacy Policy still applies to the data you keep on Strava and prevails over any difference with this policy.
Strava may monitor and collect usage data related to our use of its API and may use it for any business purpose, internal or external, including improving its API and platform, providing support and ensuring compliance with its API Agreement.

2.5 Payment data (only for coaches and athletes with a paid subscription)

MercadoPago transaction identifiers and data on payments received/made.
Bank transfer receipts you upload to the platform.
We never store full card numbers, CVV or banking credentials — processing is MercadoPago's responsibility.

2.6 Technical data

Device identifier and push token for notifications (if you authorize them).
Error logs and anonymized usage metrics for diagnostics (via Sentry).
IP, browser and operating system for security and fraud prevention.

3. How we use your information

Generate personalized training plans with artificial intelligence.
Let your coach review your progress and adjust your plan.
Show statistics and charts of load, form and fitness.
Send push notifications related to your routine (if you authorize them).
Process charges and reconcile payments between coaches and athletes.
Operate, maintain, secure and improve the platform.

4. Service providers (third parties that process data on our behalf)

We do not sell or share your information for commercial or advertising purposes. We use the following providers solely to operate the platform:

Google Cloud (Vertex AI, Gemini models): AI generation of training plans and race strategies. We send only the necessary training data (goals, level, disciplines, training metrics), not your contact details.
Anthropic (Claude API): other AI features of the Service, under the same rule of sending only the necessary data.
MercadoPago: payment processing. Their privacy policy applies to the handling of your payment methods.
Cloudflare: CDN, protection and encrypted backups.
Expo / EAS: hosting and delivery of push notifications.
Sentry: error tracking. We filter sensitive information before sending.

5. Information shared between athlete and coach

If you subscribe to a coach on Zonda Run, the coach has access to your training information (sessions, metrics, subjective feedback, connected wearable data) for the sole purpose of coaching you. The coach has no access to your payment data or to sensitive personal information unrelated to training.

When you end the relationship with a coach, you can revoke their access at any time from the app.

6. Sensitive health data (HealthKit, medical documents)

If you upload sensitive information — such as medical clearance, injury records, medical photographs or Apple HealthKit data — that information:

Is stored encrypted in private buckets with authorized access only.
Is accessible only to you, your coach (if you shared it with them) and Zonda administrators with justified cause.
Is never used for advertising, sales, cross-selling or AI model training.
Complies with Argentina's Personal Data Protection Act (Law 25.326) and, where applicable, with LGPD (Brazil).

7. Storage and security

Servers located in Argentina with encrypted HTTPS/TLS 1.2+ connections.
Daily encrypted backups with 30-day retention.
Authentication tokens with short expiry (access 2h, refresh 90d) and automatic rotation.
Auditing of access to sensitive data.
Adherence to the OWASP Top 10 framework throughout the development cycle.

8. Your rights

Regardless of where you are located, you may exercise the following rights over your data:

Access: obtain a copy of all your information.
Rectification: correct inaccurate data.
Erasure: delete your account and all associated data.
Portability: export your data in a readable format (JSON / CSV).
Restriction: restrict the use of certain data.
Objection: object to processing in specific cases.
Withdraw consent: disconnect wearables, deny notifications, etc.

To exercise any right, write to us at soporte@zonda.fit. We respond within 30 days.

9. Minimum age

Zonda is not directed to children under 13. If you are between 13 and 18, you need consent from a parent or guardian. If we discover that we have collected data from a minor without authorization, we delete it.

10. International transfers

Some of our providers (Google Cloud, Anthropic, Sentry, Cloudflare) process data outside Argentina. In all cases, they have contractual agreements with equivalent levels of protection and comply with the applicable international standards.

11. Changes to this policy

We may update this policy. If the changes are material, we will notify you by email and/or within the app before they take effect. The "Last updated" date above indicates the current version.

12. Contact

Company: Rush Gaming Co LLC, 321 W 2nd St #1187, Casper, WY 82601, United States
Privacy email: soporte@zonda.fit
WhatsApp: +54 9 11 2402-5614
Website: zonda.fit