Privacy policy

Sorva · last updated 30 October 2026

Dansk udgave

Sorva turns your runs into one number, your handicap, so runners of different levels can compete fairly. This policy explains what we read, what we store, what other runners can see, and how you get rid of it all.

What we read

• Runs from Garmin: if you connect your Garmin Connect account, Garmin sends us your new runs through its API, as described under "Garmin Connect".
• Runs from Apple Health: distance, duration, date and time.
• The weather on your runs: if Apple Health saved the weather with a run, the app reads it. For other runs we look up the weather afterwards from the Danish Meteorological Institute (DMI): we ask for the weather across Denmark around the time of the run, and pick the reading nearest your region. We store only the result, like "rain, evening".
• Runs from Health Connect: on Android, distance, duration, date and time.
• Your email address and a password, or your Apple or Google account. If you sign in with Apple or Google, they tell us your email address (with Apple you can hide it) and, the first time, your name. We never see your Apple or Google password. When you delete your account, we also ask Apple to forget that you signed in with Apple.
• The name you choose: your first name or a nickname. You pick it, and you can change it under Settings.
• What you write in team and tournament chat.
• A team photo: if you are your team’s admin and choose one. It is stored with the team, and it is removed when you go back to the default photo or the team is closed.
• Anything you report: if you report a message or a runner, we keep what you sent us so we can act on it.
• Your age and sex: the handicap is calculated from them, the same way a golf handicap is. And your region, one of the five Danish regions, so you can be ranked against runners near you.

Apple Health stays on your phone

This is the part worth being precise about. Reading Apple Health requires your explicit permission, and iOS asks you before anything is read. When you import, the app reads your workouts on the device and works out what it needs there. What leaves your phone is the summary of each run: how far, how long, when, and the weather Health saved with it.

Your raw Apple Health record is never uploaded. Neither is anything else Health knows about you: heart rate, weight, sleep, cycle tracking, medical data. The app never asks for them and cannot read them.

Your route is worth spelling out, because it can come from two places. A route from Apple Health is read here, on your phone. The app works out how long each 100 metres took you, and that is the only thing that leaves the device: a list of times. Those coordinates are never uploaded. A route from a watch you have connected is different: it is part of the file your watch records, and we store the route so that you can see it on your run's map. Friends you have accepted can see it too, without its first and last 200 metres. You can choose 400 or 800 under Settings, or choose Only me so that nobody else sees your runs. Those hidden parts are cut off on our server and are never sent to anyone else's phone. Runners who are not your friends, and your team, cannot see it. It is deleted with your account, and it is included when you download your data. When you open a run's map, the map background comes from Apple Maps on iPhone and Google Maps on Android, so Apple or Google sees which area is on screen, as in any map app. Your route is drawn on top by your phone and is never sent to Apple or Google.

Health Connect on Android

On Android, Sorva reads your runs from Health Connect if you allow it. Android asks you first, and you choose what Sorva may read: your exercise sessions and their distance, your earlier sessions so your handicap can be built from your history, and reading in the background so new runs come in without opening the app. We use them to score your runs, the same way as runs from Apple Health. What leaves your phone is the summary of each run: how far, how long and when. We also read which app recorded a run, so a run from Garmin Connect does not count twice once you have connected Garmin.

Sorva never writes anything to Health Connect. Nothing else Health Connect knows about you is read: not heart rate, weight, sleep or any other health data. Runs typed in by hand are not imported.

Garmin Connect

You can connect your Garmin Connect account to Sorva, so that new runs from your Garmin watch come in by themselves. Connecting is your choice. You can disconnect at any time, and Sorva works without it.

What we receive. When you connect, Garmin shows you what Sorva asks for, and nothing is shared until you approve. After that, Garmin sends us:

• Your Garmin user ID and access keys. The keys let us receive your activities. We store them encrypted on our server, apart from the key that unlocks them. They are never sent to your phone or to anyone else.
• A summary of each new run you sync: activity type, start time, duration, distance and the name of the device that recorded it.
• For runs, the activity file your watch recorded. From it we use the timestamps, distance, altitude, GPS position and cadence. We keep what we work out from it: the run, your pace every 100 metres, your cadence and your route. We do not keep the file itself.

Garmin does not send us activities from before you connected. Every kind of run counts, including treadmill, trail, track and virtual runs. We only keep running activities. Other activities are discarded when they arrive: we keep only their id and type for 7 days, so the same activity is not processed twice. Garmin's summary can include values like average heart rate. We remove them before anything is stored. We do not use heart rate, sleep, stress or any other health data from Garmin. We only read from Garmin, and Sorva never writes anything to your Garmin account.

How we use it. To score each run and add it to your weekly score, to work out your handicap, to place you in a division and settle your matches, challenges, tournaments and standings, and to show you the run and its map with the label "Garmin" and your device model. Scores and standings that use Garmin data are labelled "Insights derived in part from Garmin device-sourced data". If your teammates have notifications on, they can get one like "Anna just ran · 5.2 km · 31 pts". We also look up the weather for the run, as described under "Where it is stored". That is the whole list. We do not use Garmin data for advertising or marketing.

Who sees it. Other runners see a run from Garmin the same way as any other run, as described under "What other runners can see". The services that handle it for us, each for one job, are listed under "Where it is stored". Garmin itself knows that your Garmin account is connected to Sorva, and we tell Garmin when you disconnect or delete your account.

Not sold, and no AI. We never sell Garmin data, rent it out or give it to advertisers, data brokers or other apps. Points, handicap and standings come from fixed formulas that are the same for everyone. Sorva does not use artificial intelligence or machine learning on your Garmin data, and it is never used to train an AI model.

Your control. Every run is in the app, and Settings → Data → Download my data gives you a file with everything we store about you, including your Garmin runs and your Garmin connection. A run from Garmin is your watch's record and cannot be edited in the app. If one is wrong, write to us and we will correct or remove it. You can disconnect Garmin under Settings → Connected watch, or remove Sorva in Garmin Connect. Either way, we delete your access keys at once and receive nothing new. Runs already scored stay in your history and results until you delete your account. If you want them removed as well, write to us.

How long we keep it. Your access keys are kept until you disconnect or delete your account. Your runs and our record of the runs Garmin sent us are kept for as long as you have an account. The id and type of other activities are deleted after 7 days.

What we do with it

• Work out your handicap from your best recent runs.
• Score each run and add it up into your weekly score.
• Place you in a division and settle your matches, challenges and tournaments.

That is the whole list. We do not use your data for advertising, we do not sell it, and we do not share it with advertising networks or data brokers. Health data is never used for advertising. Apple forbids it, and so do we.

What other runners can see

Sorva is a competition, so some things are public to the people you compete against:

• Your chosen name, your handle and your initials. Anyone who knows your exact handle can look you up; you can turn that off under Settings → Findable by handle.
• Your handicap and your weekly score.
• Your runs, to friends you have accepted. Unless you choose Only me under Settings → Who can see your runs, they see the date, start time, weather, time of day (day, evening or night), distance, time, pace and points of each run, your pace every 100 metres, and your route without its first and last 200 metres (you can choose 400 or 800). Never your heart rate, and never whether your runs count yet. A runner you block, or who blocks you, sees nothing. You can make your start time visible only to you in Settings.
• Your runs, to your team. The runners on your team see the date, start time, weather, time of day (day, evening or night), distance, time, pace and points of each run you log, in the team feed. Never your heart rate, and never your route. You can make your start time visible only to you in Settings.
• Your results: match scores, standings, challenges and tournaments you take part in.
• Anything you write in a team or tournament chat, to the others in that team or tournament.
• Your team’s photo, if your team’s admin has chosen one, to anyone who can see the team.

What other runners never see

• Your GPS routes. Where you run is yours. A route from Apple Health never leaves the device. A route from your connected watch is stored so that you, and the friends you accept, unless you choose Only me, can see it on a map, without the start and finish. Only the map background is fetched from Apple Maps or Google Maps.
• Your raw Apple Health data. It never leaves your phone.
• Your email address. It is never shown to other runners.
• Your individual runs: unless they are on your team or friends you have accepted. Everyone else sees your score, not the runs behind it.
• Your surname. Initials are taken from your first name only, so a public standing cannot reveal it.

Where it is stored

Your data is stored with Supabase, which hosts our database and handles sign-in. They process it on our behalf and for no purpose of their own. Access is restricted per user at the database level, so one runner cannot read another runner's private data.

A few others see a small part of it, and only to do one job:

• Resend delivers the emails that confirm your account and reset your password. They see your email address.
• Expo delivers notifications to your phone and checks for app updates. For a notification they see the message and the token that identifies your device, not your name and not your account.
• Apple carries the notification the last step to your phone.
• Netlify serves this page, the invitation pages and the page Garmin sends you back to after you connect. That address carries a one-time code, not your activities.
• Apple Maps and Google Maps draw the map background when you open a run's map, Apple Maps on iPhone and Google Maps on Android. They see which area is on screen, not your route.
• GitHub runs our scheduled jobs. The jobs that settle each week and update standings, team ratings and tournaments read your run records, such as distance, time, date and points, and write the results back to our database.
• Stridee was the earlier way to connect a watch. New watches no longer connect through it. If you connected a watch through Stridee before, your watch company sends your activities to Stridee, and Stridee passes your runs on to us, with the file your watch recorded, until you disconnect it under Settings → Connected watch. The runs that came in through Stridee stay in your history.
• DMI gives us the weather for a run. We ask for the weather across Denmark in a window around the time of the run. DMI never receives your name, your account, your region or your route.
• Garmin sends us your activities if you connect your Garmin account, as described under "Garmin Connect". Garmin knows that your Garmin account is connected to Sorva.

None of them use your data for anything of their own, and none of them are advertising networks or data brokers.

How long we keep it

We keep your runs and scores for as long as you have an account, because your handicap is built from your history. We do not keep an archive of accounts that no longer exist.

Withdrawing permission

You can revoke the app's access to Apple Health at any time in iOS Settings → Privacy & Security → Health → Sorva. Nothing new is read after that. Runs already imported stay until you delete your account.

On Android, you can withdraw the app's access to Health Connect at any time in Health Connect's settings on your phone, under App permissions → Sorva. Nothing new is read after that. Runs already imported stay until you delete your account.

Notifications

If you turn notifications on, your phone gives us a token that lets us reach it. It is stored with your account and used for nothing else. We tell you when your week is settled, when a match is decided, and when someone challenges you. Nothing more, and never anything you have switched off under Settings.

You can turn notifications off in iOS Settings at any time. The token is deleted with your account.

Deleting your account

You can delete your account from inside the app, under Settings. You do not need to email anyone or ask permission.

Deleting removes:

• your account, your email address and your name, everywhere it appears
• every run you have imported, including routes and elevation data
• your handicap, your scores and your weekly history
• your level, your records and every badge you have earned
• the notification settings you chose, and this device's push token
• everything you did that showed up in your team's feed: runs, badges and streaks
• anything you have written in team chat is hidden from everyone

What stays is the competition itself: matches that were played, and the standings other runners earned. Those results belong to everyone who took part. Your place in the league is handed back and filled again, so nobody is left with a fixture against an empty seat.

We also keep the text of anything you wrote in team chat, with nothing on it that points to you, because we have to be able to look into reports of abusive messages after the person who wrote them is gone.

Deletion is permanent. There is no undo, and your runs cannot be recovered afterwards. If you re-join later you start fresh, though you can import your history from Apple Health again, since that has been on your phone all along.

Children

Sorva is not intended for children under 13, and we do not knowingly collect their data.

Changes to this policy

If we change how data is used, we will update this page and the date at the top. Material changes will be shown in the app rather than made quietly.

Data controller

Sorva · CVR 46558022
Emmavej 2, 3660 Stenløse, Denmark

Contact

Questions about your data, or a request to see or delete it: support@sorva.run. We aim to reply within 24 hours.