Privacy Policy

Wilmy Fit Guide ("we") collects only what we need. We do not sell personal information.

Newsletter & forms

If you subscribe, your email is processed by our email provider (e.g. beehiiv). Business and sign-up forms (claims, prize offers, Passport partners, BNI sign-ups, Crew+ waitlist) are stored in our own database on Cloudflare (D1) and used only to manage your listing or request. We store a one-way hash of your IP address for spam and rate limiting, never the raw IP.

Payments

Business plans and Passports are paid through Stripe. We never see full card numbers.

Ask Wilmy (AI helper)

Questions you type may be sent to an AI provider (OpenAI or Anthropic) to find matching listings. We log questions anonymously: no IP address, and email addresses or phone numbers are removed. Don't enter sensitive health details.

Wilmy Run Crew accounts

What we collect: email (for magic-link sign-in), first name and last initial, town (never a street address), pace range, distances, goal race, availability, interests, optional Strava profile link, an 18+ confirmation, check-ins, Crew Points, prize redemptions, buddy/pacer requests, blocks and reports.
Who sees what: other members see only your first name, last initial, town, pace range, availability and running interests, plus your name on the leaderboard if you opt in. The contact detail you choose is shown only to a runner after both of you accept a match. Partners see only a one-time prize code, not your miles.
Strava: if you connect Strava, we read your activities (scope activity:read) to count running miles. Strava data is shown only to you, is never shown to other users or partners, and is never used with AI tools. You can disconnect anytime in Strava settings or here; we then delete your Strava tokens and imported activities, and confirm when that's done.
Deleting your account: email [email protected] or use "Delete account" in your profile. We delete your profile, activities and requests within 30 days.
Age: the Run Crew is for adults 18+.
Storage: account data is stored with our database provider (e.g. Supabase). In demo mode, data stays in your browser's local storage.

Partner accounts & sign-in

Business partners can sign in with email and password (stored only as a salted PBKDF2 hash), Google, Instagram or Facebook. We keep a login session cookie (HttpOnly, Secure) for up to 30 days. From Google we receive your name, email and a Google account ID.

What we access: with Instagram (Instagram API with Instagram Login, permission instagram_business_basic) we read your professional account's username, name, profile picture, bio, website and recent posts. With Facebook (permissions pages_show_list, pages_read_engagement, email, public_profile) we read your name and email and, for the Page you choose, its name, about text, phone, website, address, hours, profile/cover picture and photos.
How we use it: only to fill in your business profile and show the posts and photos you tick on your Wilmy profile page and (after review) the Live Wall, always credited and linked to the original post. We don't post on your behalf, read messages, or sell or share this data.
Storage: access tokens are encrypted (AES-256-GCM) in our Cloudflare D1 database. Imported image links are refreshed periodically because Instagram and Facebook links expire.
Disconnect & deletion: use "Disconnect" on your partner import page, or remove Wilmy Fit Guide in your Instagram/Facebook settings (Apps and websites). Either way we delete the stored tokens and all imported posts and photos. Removing the app on Meta sends us an automatic data deletion request; you'll get a confirmation code and can check its status at wilmyfit.com/api/meta/deletion-status. You can also email [email protected].

Maps

Map tiles load from OpenStreetMap servers, which receive your IP address.

Questions or deletion requests: [email protected].

Last updated October 23, 2026. Template — have counsel review before launch.