Spring beta privacy notice · 26 October 2026 · record format 2
Spring is a personal AI running coach operated by BuildWorld. Contact jon@buildworld.ai for access, correction, deletion or a privacy question. This beta is not a medical device.
Spring stores your reported baseline, goals, preferences, accepted plan, saved workouts, effort and symptom reports, reflections, assessments and coaching memory to guide and review your training. Records preserve sources, units and available measurement and receipt times. Model interpretations are not measurements. Missing or stale information remains unknown.
Optional Health access reads running and walking workouts. A separate optional import reads stride length, ground contact time, vertical oscillation and running power for up to 20 recent imported running workouts within 90 days. Spring saves source-labelled summaries of these mechanics, not all underlying samples. You can decline access and enter activity manually.
With Health permission, the Spring Watch workout session sends live heart rate to the phone. Remembered Watch connections may reconnect on app launch; disable this in Wearables. Outside a run, preview ends when the app backgrounds. The Watch session is discarded when ended; Spring does not save a duplicate workout to Health.
Optional Bluetooth reads heart rate, treadmill speed and incline. Saved traces are thinned to at most one sample per metric/source/second. Outdoor location calculates speed, distance and approximate grade; movement observations are saved approximately every five seconds. GPS coordinates are processed in memory and are not saved or sent to the coach. No raw microphone recordings are saved by Spring. Location, microphone and Health permissions are controlled by iOS. Voice off stops streaming.
With memory consent, Spring retains recent conversation (approximately 100 messages plus supporting evidence), current self-reported facts and a dated history of changes. This can include goals, travel, health circumstances, reported clinical advice, equipment, barriers and other relevant life circumstances. Each memory retains its source evidence; prior reports are marked as superseded. Review dates prompt clarification and never establish medical clearance. Numeric baseline changes require confirmation. You can inspect, correct and forget memories in Privacy and data.
Descriptive analyses are calculated locally from eligible measurements and reports. The record includes an algorithm version, input digest, calculation date, sources and limitations. These are experimental coaching observations, not validated VO2max, injury predictions or a promise of improvement. Spring does not pool private records for research or train a model on them. Any future research use requires a separate, specific choice.
After the relevant consent, Spring sends bounded context through its authenticated Google Cloud service to OpenAI for conversation and live voice, and to Google Vertex AI for the separate bounded review and interpretation paths. Context can include sourced memories, recent conversations, goals, accepted steps, recent activity, symptoms, reflections, calculated insights and fresh heart rate, speed and incline/grade with freshness labels. The whole lifetime dataset and raw sensor traces are not sent on every turn. Account credentials and route coordinates are excluded. Names or sensitive circumstances you explicitly share in conversation may appear in coaching context.
Microphone audio streams through Spring to OpenAI; voice is AI-generated. Spring does not persist audio or full streaming transcripts. Short fragments are buffered while processing. With memory consent, delegated questions and replies enter the journal. OpenAI response/session storage is disabled, but this is not a promise of zero provider retention. Provider security/abuse retention and feature-specific retention may apply. Processing may occur outside Australia. See OpenAI data controls and Google retention documentation.
When subscriptions are available, Apple or Google handles payment details. Spring verifies purchase status with the store and stores the subscription product, expiry, renewal or refund status, store transaction reference and an account binding in private Google Cloud Firestore. Google purchase tokens are retained privately for verification; they are not returned to other users or included in coaching context. Spring does not receive your payment-card details. Store notifications and periodic verification keep access up to date. Deleting your Spring account removes its purchase links and tokens. A pseudonymous deletion marker is retained for up to 90 days, plus database expiry processing time, to reject delayed notifications. Store financial records are governed by the store's own policies. Deleting Spring does not cancel your subscription: cancel with the store where you subscribed.
Google Identity Platform handles Spring email/password sign-in. Spring keeps the resulting credentials in this device's Keychain, never the password. Consented account sync stores the accepted profile, plan, workout measurements, memory and analysis in a private Google Cloud Storage bucket in Australia. Build 45 transfers separate integrity-checked record parts and atomically publishes their index. Previous app versions cannot overwrite the new format. Active workouts, route coordinates, passwords and raw audio are excluded. Sync runs after changes and while idle; active runs defer it. Conflicts require review. The beta currently supports a 256 MB reconstructed account record and 20,000 entries per collection; unfinished and superseded record parts have a separate 512 MB account allowance. This is not an unlimited archive.
iOS file protection protects local working data. New working files are excluded from automatic device backups; previously created backups follow your Apple settings. Cloud objects use Google's encryption at rest and authenticated HTTPS access. This is not end-to-end encryption: authorised service operators and processors can access information needed to provide the service. Cloud bucket public access is blocked; object versioning and soft deletion are disabled.
Squads have separate sharing controls. Permitted activity summaries and encouragement are visible to the selected squad or coach. Spring Club membership starts privately. Leaving or withdrawing sharing removes the relevant current shared records; recipients may already have seen or copied them. Account deletion also removes memberships, shared records, encouragement and squads you organise.
Optional shared-world presence publishes current virtual course movement under a temporary alias. It excludes real GPS coordinates, heart rate and conversation. The Australian Firestore presence database keeps the current position, not movement history. Public visibility expires after 15 seconds without an update. Records are eligible for cleanup after five minutes; Firestore background deletion can take about 24 hours. Account deletion explicitly removes presence.
AI runners are labelled fictional characters. Their training, body responses and performances are simulated and excluded from human assessments and rankings. With your conversation consent, Spring sends only messages you write to that companion and its simulated profile to OpenAI. It does not receive your health data, personal coach journal or real location. The latest 30 exchanges per companion are stored privately in your account in Australia, with a maximum of 40 companions; the latest 12 exchanges are supplied to a reply. This conversation storage is separate from optional training-record sync. Provider response storage is disabled; provider retention still applies. Other people and public AI profiles cannot see these conversations. Daily usage counters are stored separately to enforce beta limits; forgetting chat text does not reset them, and account deletion removes them.
Use Squads → AI runners → Your conversations to export or forget these conversations. Account deletion also erases them. The main local training export is separate from this companion conversation export. Optional AI scenery sends the virtual course and virtual position to select nearby characters; Spring does not store those lookups as a movement history. All visible companions in AI scenery are synthetic. Human shared-world presence is a separate choice.
Application request/response bodies are not logged. Technical Cloud Run logs may include IP addresses, timestamps, paths and response codes; the verified default log bucket retention is 30 days; exceptional provider/legal retention can differ. Privacy worker logs contain generic success/failure events, not health content or receipt secrets. Provider retention is independent of Spring's deletion receipt.
Experimental builds may offer Real World scenery powered by Google Maps and rendered on your phone. On supported devices, the running world opens automatically. You can disable Google scenery in Profile settings independently of location access and coaching. Existing scenery-off choices remain off. Google receives requests for the viewed area and your network address. Both treadmill and outdoor runs start on the shared Sydney Harbour virtual route. If you choose My location after GPS and movement are reliable, scenery follows your private GPS position; you can return to Sydney at any time. Requests do not include your Spring account, conversation or health readings. Spring keeps geographic fixes transient, excludes them from shared-world presence and training backups, and uses a memory-only imagery request cache. Turn off Google scenery in Profile settings to stop new imagery requests. Coaching and workout recording remain available. Google processes service requests under its own Privacy Policy and Maps terms; Spring account deletion cannot erase provider records.
Use Privacy and data to inspect and correct memories, export your local record, check data permissions and track deletion. Use Account to request account deletion. Exported files contain personal data; keep them private. Deleting an account does not cancel a store subscription; manage subscriptions with Apple or Google Play. Voice and online coaching can be disabled separately. A random installation token authorises model access; deleting local data removes it from this device. Existing tokens are not a substitute for account-data authentication.
No advertising or third-party analytics SDK is used. An independent security assessment is still pending. Contact us if deletion remains pending, if you lose the receipt or if you need assistance accessing or removing your information.