Your running. Your record.

Spring Android privacy notice · candidate update, 9 November 2026

Spring is a personal running coach operated by BuildWorld. This notice describes the native Android preview. The fuller iPhone experience has its own detailed notice. Spring is for adults and is not a medical device.

Account and local record

Email/password sign-in uses Google Identity Platform. Spring stores the resulting account identifier and refresh credential, not your password, in an encrypted device record. Android Keystore protects its encryption key. Atomic writes retain the previous file if a write fails. Automatic Android app backup is disabled. Sign-in retrieves your existing Spring cloud record so you can use the same account on another device.

Running data

Guided and self-directed runs record their environment, dates, active duration and optional reported effort and symptoms. With precise-location permission, an outdoor run uses GPS for current speed, covered distance and observation quality. Location runs only after you start recording, with an Android foreground-service indicator. Coordinates remain in memory and are not saved or sent to Spring's coach by this preview. Covered distance, timestamped movement observations, source and sample-coverage counts can be saved. Missing data remains unavailable. Manual treadmill runs do not infer distance, heart rate or incline.

Optional live voice and Bluetooth measurements

After your agreement and microphone permission, Spring streams microphone audio through its authenticated Google Cloud gateway to OpenAI for live coaching. Relevant runner context accompanies the conversation. Completed conversational turns are stored in your coach history. Spring does not save raw audio recordings; processor security and abuse-retention policies can still apply. Voice off, pause/end, consent withdrawal and leaving without an active run stop the live connection. Android shows microphone and active-run indicators as appropriate.

With Nearby devices permission (or the required Bluetooth/location permissions on older Android versions), Spring can read standard Bluetooth heart-rate and FTMS treadmill notifications. Source-labelled heart rate, belt speed and incline are stored with timestamps in your encrypted run record and can join your consented cloud record and coach context. The selected device name/address is remembered locally for reconnection. Forget devices or revoke permission to stop reconnecting. Disconnecting does not delete saved runs. Spring never requests treadmill motor control. This is separate from Health Connect history and does not imply compatibility with every wearable.

Optional local reminders use your saved schedule and contact preferences. A small local contact ledger limits repeated notifications. Notifications contain generic encouragement, not health measurements. You can disable reminders in Spring or Android settings.

Optional wearable history

On Android 14 or later, you can allow Spring to read Exercise and optional Distance in Health Connect. When you request wearable sync, Spring imports dated, source-labelled workout history from Garmin, WHOOP or Oura if their apps have written compatible records. Availability depends on the provider. This Health Connect integration does not read routes, sleep, heart rate, HRV or recovery scores, and does not write to Health Connect. Optional live Bluetooth heart rate is described separately above. Imports join your encrypted local record and, with your consent, your Spring cloud record and relevant coaching context. Disconnect in Spring or revoke Health Connect permissions to stop future reads; saved imports remain until removed or your Spring account is deleted. Deleting Spring records does not remove the original Health Connect or provider records.

Optional online coaching and sync

After you enable coaching and cloud sync, your messages and bounded relevant context pass through Spring's Google Cloud gateway to its AI processors, including OpenAI. Context may include your saved profile, goals, accepted plan, recent activity, conversation, volunteered health circumstances and current run status. Names or sensitive details you type can be included. A random installation identifier authorises gateway access. A provider can make mistakes; generated suggestions are not measurements.

The preview saves conversation and completed runs locally. Explicit Sync uploads them to your authenticated Spring account in private Google Cloud Storage in Australia. Run finalization works offline; pending summaries upload later. Conflicts stop an upload instead of silently overwriting the other device. You review and agree to proposed training changes before they become your accepted plan. Saved workout timing and supported local controls remain available without online coaching. Suggested programme or memory changes are not automatically made executable.

Google Cloud encrypts stored records and transport uses HTTPS. This is not end-to-end encryption: authorised services process records. Processing by AI providers may occur outside Australia. Spring does not use private records to train a model or pool them for research. OpenAI storage is disabled for the supported conversation path, but provider security/abuse retention may still apply. See OpenAI data controls and the existing Spring notice for other processor paths used by the iPhone service.

Store membership

When membership is available, Apple or Google processes payment details. Spring keeps the store product, purchase reference or token, verified subscription status, expiry and an account binding in private Google Cloud Firestore. These records verify access across devices; they are excluded from coaching context. Deletion removes purchase tokens and account links. A pseudonymous deletion marker expires after 90 days plus database expiry processing time. Store financial records follow the store's policies. Deleting Spring does not cancel renewal; manage subscriptions with Apple or Google Play.

Retention and your choices

Current records remain until you remove them or delete the account. The local journal retains roughly 100 recent messages plus evidence for existing saved memories. Existing iPhone-created memories and accepted training are preserved. Turn off online coaching in You to stop new requests; a request already sent cannot be recalled. Timing and local run recording remain available.

You can export your record or request account deletion in You. Deletion requires password confirmation, records a durable request and blocks new account-data access. The server retries removing the identity and associated training, conversation, team and presence data. It waits at least two minutes for in-flight requests before a final sweep; maintenance normally runs every five minutes. This is not a guaranteed deadline. The app can check the receipt until every stage is complete.

Receipts are available for 90 days with a secret retained on the requesting device. Completed receipts retain a random reference, timestamps and stage results rather than your email or training history. Minimal account hashes prevent late writes restoring a deleted account. Unreferenced cloud record parts become eligible for cleanup after 24 hours and a subsequent daily sweep. Outages can delay cleanup.

Signing out or uninstalling does not delete the cloud account. Account deletion cannot erase files you exported, disconnected device copies, Apple Health originals or third-party provider records. Manage those separately. No paid membership or trial is enabled in this preview.

Technical logs and support

There is no advertising or third-party analytics SDK. Spring does not log application request/response bodies. Infrastructure logs may contain IP addresses, request paths, timestamps and response codes; the current Cloud Run default log retention is 30 days, with provider or legal exceptions possible. An independent security assessment is pending.

For access, correction, deletion or a privacy question contact jon@buildworld.ai. You can also request deletion without reinstalling the app. Never send your password or a health-data export by email.