Privacy Policy

This Privacy Policy describes how Rebound Running LLC (“Rebound,” “we,” “us”) collects, uses, shares, and protects information when you use the Rebound web application, the Rebound app for iPhone, and related websites (the “Service”). It applies to information we collect through the Service, not to third-party sites or services that may be linked from the Service.

Rebound is a consumer fitness product, not a healthcare provider or health plan. We are not a “covered entity” or “business associate” under the U.S. Health Insurance Portability and Accountability Act (HIPAA), and the information you provide to us is not considered protected health information (PHI) under HIPAA. We nevertheless treat the information you share with the care described in this policy.

Account information. When you create an account we collect your email address and, for signed-in access, the authentication tokens required to keep you logged in.

Intake and profile. To generate a plan we ask for information about your knee condition (for example, the injury area you name, how long ago it happened, whether you had surgery and when, current pain baseline, activity level, and goal). You choose what to enter.

Session logs. After each session we ask for effort, pain during and after the session, and a quick red-flag check. A morning check-in captures how your knee settled overnight. For a completed run you also enter how long it took and how far you went, and whether it was indoors or outdoors. You can optionally add free-text notes.

Apple Health. If you connect Apple Health in the Rebound app for iPhone, Rebound reads the workouts recorded on your device (the activity type, start and end time, duration, and distance) and the heart rate recorded during them, including workouts another app such as Garmin Connect wrote to Health. Apple's own permission prompt governs that access. Connecting is also your consent, separate from these terms, for Rebound to keep a summary of each workout it reads (when it started and ended, how long it was, how far, and the heart rate summary) on your account, so that a run can fill in the time and distance on your log for you to confirm or change. We never keep a route, location samples, or heart rate readings beyond that summary. Rebound never writes anything to Apple Health. What we read never decides whether your plan progresses, holds, or pauses. Those decisions come only from what you report. Disconnecting Apple Health in the app withdraws that consent, stops the reading, and deletes the workout summaries we hold; a time or distance you confirmed on a log stays as your own record. You can also withdraw Rebound's permission in the Health app at any time.

Location during a phone-tracked run. If you start an outdoor run from the Rebound app for iPhone, the app uses your phone's location while the run is on to show live distance and pace and to cue each interval. That happens on your phone only. No location, route, or pace samples are sent to us or stored anywhere; when the run ends, only what you then type into your log is kept.

Payment information. If you make a purchase or subscribe, our payment processor (currently Stripe) collects and processes your payment card details on our behalf. Rebound receives a customer reference, your purchase or subscription status, and the payment event records Stripe sends us, which can include the name, email address, phone number, and billing address you give Stripe and your card's brand and last four digits. Rebound never receives or stores your full card number or CVC.

HSA / FSA documents. If you generate a Letter of Medical Necessity template or receipts through the Service, we store the information you enter (for example, patient name, provider name, and the condition label you selected at intake).

Automatic data. Like most web applications, we collect basic technical information such as browser type, operating system, IP address, and interaction events needed to run and secure the Service. We do not use tracking cookies for advertising. We use a small number of cookies necessary to authenticate your session and to keep checkout state stable across a page refresh.

We use the information we collect to:

• Provide, personalize, and adapt your plan;
• Apply the safety rules that decide when to progress, hold, regress, or pause your plan;
• Process payments and manage subscriptions;
• Prepare Letter of Medical Necessity templates and itemized receipts you can share with your provider and administrator;
• Communicate with you about your account, changes to the Service, and (when you have opted in) product updates;
• Secure the Service, prevent abuse, and comply with our legal obligations;
• Improve the Service in aggregate, using data in a de-identified form wherever possible.

We do not sell your personal information. We share information only with service providers that need it to run the Service, and only for the purposes described below.

• Database and authentication: Supabase, which handles sign-in and stores your account, profile, plan, session, and billing rows under row-level security so that a signed-in user can only read their own data.
• Hosting and analytics: Vercel, which hosts and serves the web application, so the requests your browser makes to the Service pass through it. Its Web Analytics feature receives page paths, the referring page, browser and device type, and an approximate location derived from your IP address, along with a few milestone events (such as saving a plan draft, starting checkout, completing a first session, replacing a plan, or an Apple Watch sync step failing) that carry only the plan type, the billing option, a fixed label for how that step ended (for example "completed" or "failed") and the address of the page they were sent from (which can include a training session or checkout reference), and that we review only in aggregate. Web Analytics uses no cookies and receives no account identifiers or training data.
• Apple Health: no one. The workout summaries Rebound keeps with your consent are stored with our database provider like the rest of your account, under the same row-level security, and shown only to you. We do not send them to Anthropic's Claude API, our analytics provider, or our error monitoring provider, we never use them for advertising or marketing, and we do not sell or share them with anyone else.
• Payments: Stripe, which processes payments and stores your card details subject to its own terms and privacy policy.
• HSA / FSA processing: when applicable and at your direction, Truemed, whose clinician network reviews an intake you submit and issues a Letter of Medical Necessity directly to you.
• Language-model processing: Anthropic's Claude API, which we use to personalize and explain your plan and structure free-text notes and plan-change requests. Depending on the task, a request can include:
  • Personalizing a new recovery plan: your age, gender (if you gave one), injury area (and, for an Achilles tendinopathy, where on the tendon it hurts), time since the injury, time since any physical therapy ended, current pain baseline, current activity level, pre-injury weekly running volume, goal and weeks until a race, and the distance unit you use, together with the plan limits our rules set from your answers.
  • Personalizing a new training plan: your age, goal (a race distance and race date, a weekly volume target and target date, or for base training both), recent race result, comfortable pace, current weekly running volume, schedule preferences (running days per week, which weekdays, and long-run day), and the distance unit you use, together with the weeks and runs our rules already built for the plan.
  • Explaining a plan change in plain language: the effort and pain numbers you logged for a session (effort, pain during, pain after, and next-morning pain), together with the decision our rules made and what it changed.
  • Structuring what you write: the free-text notes you add after a session and the text of a plan-change request, which it sorts into simple flags.

  We never attach your name, email address or any account identifier to a language-model request. This information is not used by Anthropic to train foundation models, and the Service functions with this integration disabled.

• Error monitoring: Sentry, which receives technical error reports (stack traces, page paths, browser type) when something in the Service breaks. We configure it to exclude request bodies, cookies, and account identifiers, so your training data and pain scores are never sent.
• Email delivery: a transactional email provider that sends account and receipt emails on our behalf.
• Legal: we may disclose information if required by law, subpoena, or other legal process, or where we believe disclosure is necessary to protect the rights, property, or safety of Rebound, our users, or the public.

We keep your information for as long as your account is active, and for a reasonable period afterward so that we can meet legal, tax, and audit obligations, resolve disputes, and enforce our agreements. You can request deletion at any time (see Section 8); some limited information (for example, billing records) may be retained where legally required. Apple Health workout summaries are kept only while Apple Health is connected: disconnecting it in the app deletes them, and deleting your training data or your account deletes them too.

We protect information in transit using industry-standard transport encryption. Data at rest is stored with our database provider under managed encryption. Application-level access is controlled by row-level security, so a signed-in user can only read their own rows. No system is perfectly secure, and we cannot guarantee absolute security; you are responsible for protecting your login credentials.

You can, at any time:

• Access and update your profile from your settings page;
• Cancel a subscription from the billing portal;
• Request a copy of the information we hold about you, or request that we correct or delete it, by contacting us at the address in Section 13.

Depending on where you live, you may have additional rights under laws such as the California Consumer Privacy Act (CCPA) or the EU / UK General Data Protection Regulation (GDPR). We honor those rights where they apply. If you are in the European Economic Area or the United Kingdom, our legal basis for processing your information is your consent (for account creation and optional communications) and the performance of our contract with you (for delivering the Service).

The Service is intended for adults 18 years of age and older. We do not knowingly collect personal information from children under 18. If you believe a child has provided us with information, please contact us and we will delete it.

Rebound is operated from the United States. If you access the Service from outside the United States, you understand that your information will be processed in the United States and other jurisdictions that may have different data protection laws than your home country.

We use a small number of first-party cookies that are strictly necessary to run the Service: an authentication cookie that keeps you signed in, and a short-lived cookie during checkout that keeps a Stripe session stable across a page refresh. We do not use cookies or similar technologies for advertising or cross-site tracking.

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date at the top of this page and, for material changes, provide reasonable notice (for example, by email or in the app) before the change takes effect.

Questions about this policy or about your information can be sent to:

Rebound Running LLC
2293 Hawes Avenue, Dallas, TX 75235
ethan@reboundrunning.com