Last updated: October 13, 2026 · Effective date: at app launch
The short version: Why Not builds and runs your training plan on your phone. It needs an account, and your account keeps a copy of your plan and your running stats so a new phone gets them back. Your routes, your Apple Health readings and anything from WHOOP stay on your phone. If you connect Strava, the runs you record go to your Strava account too. We don't sell your data, we don't show ads, we don't track you, and we never use your data to train AI.
1. Who we are
Why Not is a running coach app for iPhone and Apple Watch. It is run by Why Not Run LLC, a Massachusetts company owned by Robert Kiley ("we", "us"), which also runs this website. Until our App Store developer account moves to the company, the App Store lists Robert Kiley as the app's seller. Why Not is the app's name.
Why Not Run LLC decides how the data described here is used, so for readers covered by the GDPR it is the controller. You can reach us at support@whynot.run.
We ask only for what these uses need. Why Not has no connection to Garmin's, Suunto's, COROS's or Polar's own services, and never signs in to your accounts with them: their apps write your runs into Apple Health, and Why Not reads them there (section 5).
3. Your account and its copies on our servers
Our servers are run by Supabase, in the United States. Everything below is tied to your account, readable only by you (and by us when you ask for help), and used only to make the app work. None of it is used for advertising.
Your account
Sign in with Apple: your account ID and the email address Apple shares with us. If you choose Hide My Email, we only ever see Apple's relay address.
Your Apple sign-in token: kept on the server only so we can revoke Why Not's access at Apple when you delete your account.
Your profile: your first name, age and gender, which the plan and the fitness estimates use. A new phone reads them back instead of asking again.
A copy of your plan
So a new phone, or a reinstall, gets your plan back, your account keeps a copy of it: your plan and its workouts, including the ones you finished with their distance, pace and how hard you rated them; your answers from setup (your goal, your race, its date and city, goal and recent race times); the coach's adjustments; and your units. When a run from Apple Health or Strava checks off a planned day, that day's distance and pace are part of the copy. The copy holds no GPS route.
A copy of your running stats
So your personal bests and trophies survive a new phone, your account also keeps:
for each run, its best efforts at nine distances (from 400 metres to the marathon), and its start time, distance and time;
your trophies and milestones, and your weekly miles;
which trophy celebrations and race-date notes you have already seen, with the dates you saw them, so a new phone never shows them twice;
whether the app has finished reading your past runs from Apple Health, and whether you turned off the plan check-in reminders.
Runs that came from Strava are never in this copy. It holds numbers only: no routes, no heart rate, no notes.
Strava and WHOOP connections
When you connect Strava or WHOOP, the sign-in code they send back passes through our server once so it can be swapped for access tokens, and when those tokens expire they are renewed the same way. Our server stores none of it, and logs none of it. The tokens themselves are kept in your iPhone's Keychain. WHOOP is open to anyone with a WHOOP membership, within the number of members WHOOP lets an app connect (section 6); Strava is closed to new connections at the moment, and existing Strava connections keep working.
Two things with no data of yours
The race list is a public list of races the app downloads. It sends nothing about you.
The app checks whynot.run for a newer version. That request carries nothing about you.
4. What stays on your phone
Everything else lives on your phone (and your paired Apple Watch) and nowhere else: your recorded runs, their route maps, heart rate, splits and cadence; your morning readiness readings; everything from WHOOP; your settings, voice and notification preferences; your notifications; and the run cards you can share. iPhone backups are switched off for Why Not's data on purpose, so the copies in section 3 are how your plan and stats come back.
Notifications are made on your phone. Why Not never asks for a push notification token.
5. Apple Health and your watch
Connecting Apple Health is optional. This is exactly what Why Not asks for.
On iPhone
Reads: your workouts and their routes, heart rate, walking and running distance, active energy, step count and flights climbed. That includes runs recorded by an Apple Watch, Garmin, Suunto, COROS, Polar or any app that writes to Apple Health. Workouts the WHOOP app saves to Apple Health come in as runs only if you turn on Runs from WHOOP in Settings, Connected Apps.
Reads, only if you allow it separately: your resting heart rate, breathing rate, and sleep, for the morning readiness card. They are asked for on their own, so you can share your runs without them. They are kept on your phone, never sent to our servers, and removed when you tap Stop reading (Settings, Apple Health) or delete your account.
Writes: a running workout (its start, end, distance and an estimate of the energy used) for a run you record with Why Not on your iPhone, or a watch run the watch could not save itself. No heart rate and no route are written from the iPhone.
On Apple Watch
Reads during a run: your workouts, heart rate, distance, active energy, step count and running speed.
Writes: the run you record on the watch, as a workout with its GPS route.
Garmin, Suunto, COROS and Polar watches
Garmin Connect, the Suunto app, the COROS app and Polar Flow can each write your watch's runs into Apple Health once you turn that on in their app. Why Not reads those runs from Apple Health exactly as above, and shows the name of the app each run came from. Why Not does not connect to these companies' services, receives nothing from them directly and sends them nothing.
What leaves your phone
Apple Health readings stay on your phone. Two things built from them reach your account: the distance and pace of a planned day a run checks off (the copy of your plan), and each run's best efforts, start time, distance and time (the copy of your stats). Your heart rate, routes and readiness readings are never sent to us. If you connect Strava, the runs you record with Why Not go to Strava as section 7 explains.
We never use Apple Health data for advertising or marketing, and never sell it or give it to data brokers. You can stop sharing at any time in iPhone Settings, Privacy & Security, Health, Why Not.
6. WHOOP
Connecting WHOOP is optional and needs a WHOOP membership; everything else in Why Not works without it. Why Not reads this data through WHOOP's API. You connect in Settings, Connected Apps, and sign in on WHOOP's own page, so Why Not never sees your WHOOP password.
What Why Not reads: three things, and only these. Your recovery (WHOOP's Recovery score, heart rate variability and resting heart rate), your cycles (your daily Strain) and your sleep (how long you slept, Sleep Performance, Sleep Need and respiratory rate). Why Not also asks WHOOP for offline access, which only keeps the connection working without signing in again. It never reads your WHOOP workouts, profile or body measurements, and never writes anything to WHOOP.
Why: for the Recovery card and its detail, which show WHOOP's own numbers in WHOOP's colours, marked "Data by WHOOP", and for your run coaching: the coach's note and the post-run read follow your WHOOP Recovery against the session your plan asks of you. Your plan never changes on its own.
Where it is kept: on your phone only. No WHOOP number is sent to our servers, put in the copy of your plan or your stats, sent to your Apple Watch, or put on a run sticker you share. The sign-in code and the tokens pass through our server as described in section 3, and it stores none of them. Your WHOOP tokens are kept in your iPhone's Keychain.
How long: 35 days at most. Anything Why Not read from WHOOP that is older than 35 days is deleted from your phone, including the WHOOP line a post-run read quoted.
What we never do with it: sell it, share it with anyone, show it to other people, use it for advertising, or use it to train any AI model.
Disconnecting: Settings, Connected Apps, Disconnect WHOOP. That revokes Why Not's access at WHOOP and deletes every WHOOP record from your phone, including the WHOOP line in any post-run read. Deleting your account (section 17) does the same.
If WHOOP is full: WHOOP limits how many members can connect to an app until it approves more. If WHOOP turns a new connection away, nothing from WHOOP is kept, and the app counts the refusal on your phone (when it happened and where you tapped, no WHOOP data) so we can tell WHOOP how many runners are waiting.
Runs from WHOOP: separate from the connection, the WHOOP app saves its own workouts to Apple Health. They become runs in Why Not only if you turn on Runs from WHOOP (section 5); it is off unless you turn it on.
You can see what Why Not holds from WHOOP on the Plan tab's Recovery card and its detail. WHOOP handles your data on its side under WHOOP's privacy policy.
7. Strava
Connecting Strava is opt-in, and closed to new connections at the moment; existing connections keep working. Once connected, runs you recorded elsewhere come into Why Not, and runs you record with Why Not go to your own Strava account as normal activities, with their full GPS route and, for watch runs, your heart rate. They go to Strava, not to us. Imported runs, their routes and splits stay on your phone; a Strava run that checks off a planned day adds only that day's distance and pace to the copy of your plan. Disconnecting in the app revokes the tokens, deletes the runs that came only from Strava, and leaves your own recordings in place. To have every Strava-sourced record removed at once, email us. What you sent to Strava is in your Strava account; delete it there. Strava may collect usage data about its integrations on its side, under Strava's privacy policy.
8. Location and sharing a run
Location
During a run: GPS gives your live pace, distance and route map. iOS may ask once whether a run can keep recording with the screen off; that is the only use of "always" location.
Near me in the race list: when you tap Near me, the app reads your position once and uses it on your phone to put nearby races first. It is never stored, sent anywhere or logged.
Routes stay on your phone, and a watch run's route is also saved in your Apple Health. We never hold a route on our servers.
Sharing a run
You can share a finished run as a sticker. The app makes the picture on your phone and hands it to the place you pick: Copy puts it on your clipboard; Instagram Story hands it to Instagram (it waits for Instagram for five minutes, then is cleared); Text Message opens Apple's Messages; Save adds it to your photo library, with permission to add photos only, never to see them; More opens the share sheet. Nothing is uploaded to us.
9. Purchases
Apple takes every payment; we never see your card. We use RevenueCat, a subscription service built into the app, to know whether your subscription is in its trial, active or lapsed. RevenueCat knows your purchases by your account ID.
10. Contacting support, and support tools
Every support link in the app opens an email to support@whynot.run in your own mail app. Under the space for your words it adds a short block: your iPhone model (never its name), the iOS version, the app version and build, your units, and a support ID (your subscription ID) so we can find your account. You see all of it before you send, and it reaches us only if you tap Send.
Settings, About also has tools for when you write to us (tap the version number seven times to show them): a pace log, a Health import report, the number of times WHOOP turned a connection away and, on a phone that holds one, a way to restore your plan from before an update. Their reports stay on your phone unless you choose to share one.
11. This website
whynot.run uses Google Analytics to count visits. It is never joined to the app or your account. An email left in a launch form is kept by Netlify, our web host, and used for one email when the app launches; email us to have it deleted.
12. Where it is kept, and for how long
Your account, the copy of your plan and the copy of your stats: on our servers (Supabase, United States) until you delete your account.
Your Apple sign-in token: on our servers until you delete your account, when it is revoked at Apple and deleted.
Your runs, routes, readings and settings: on your phone (and your Apple Watch) while the app is installed. Deleting your account clears your plan, settings and stats from the phone; your past runs' cards, route maps and metrics stay until you delete the app.
Morning readiness readings from Apple Health: on your phone until you tap Stop reading or delete your account.
Anything from WHOOP: on your phone only, 35 days at most, and deleted at once when you disconnect WHOOP or delete your account.
Runs imported from Strava: on your phone until you disconnect Strava.
Strava and WHOOP tokens: in your iPhone's Keychain until you disconnect or delete your account. Our server keeps none.
Support emails: in our support mailbox on Apple's iCloud Mail for as long as we need them to help you; ask and we will delete yours.
A launch list email: kept by Netlify until the launch email is sent, or deleted sooner if you ask.
We keep no marketing list.
If you use Why Not from outside the United States, your account data is transferred to and stored in the United States, where our servers are.
13. Legal basis for processing (GDPR)
If the GDPR or a similar law covers you, these are the grounds we rely on:
Contract: your account, the copies of your plan and stats, your subscription, and answering your support emails. We need these to provide the app you signed up for.
Consent: Apple Health (including the separate readiness readings), WHOOP, Strava, location, notifications and photos. Health data is read only with your explicit consent, given in Apple's Health sheet or on WHOOP's or Strava's own consent page. You can withdraw consent at any time by disconnecting the service or switching the permission off (sections 5 to 8 and 17); that does not affect what was done before.
Legitimate interests: keeping the service secure, and counting visits to this website.
14. Your rights, and how to use them
Wherever you live, you can ask us to:
see the data we hold about you, and get a copy of it in a machine-readable file (portability);
correct anything that is wrong;
delete it (section 17);
restrict or object to how we use it;
withdraw consent for a connected service or a permission, by disconnecting it or switching it off.
Data on your phone you can see and delete in the app. What Why Not holds from WHOOP is on the Plan tab's Recovery card and its detail. For your account, delete it in the app, or email support@whynot.run and we will correct, delete or send you a copy of what we hold. We answer within one month. To be sure the account is yours, we may ask you to write from the email address your account uses, or to include the support ID the app adds to its support email. If you are in the European Economic Area or the United Kingdom, you can also complain to your data protection authority.
15. Who receives data, and what we never do
These services handle data for us, each only for its role:
Supabase: our servers: your account, sign-in, the copies of your plan and stats, and the server functions that swap sign-in codes for tokens and delete an account when you ask.
Apple: Sign in with Apple, App Store payments and TestFlight, and crash reports if you share them with developers in iPhone Settings.
RevenueCat: your subscription's status.
Netlify: hosts whynot.run, including the file the app checks for a newer version, and keeps launch list emails.
Google Analytics: counts visits to this website only. It is not in the app.
Apple iCloud Mail: our email host, which holds the support mailbox, support@whynot.run.
WHOOP and Strava are services you connect yourself: Why Not reads from them what sections 6 and 7 say, and sends your Why Not runs to Strava only if you turn that on. We would disclose data to authorities only where the law requires it, and only what it requires.
What we never do:
We don't sell your data, ever.
We don't share your data with advertisers or data brokers.
We don't show ads, and never use your data for advertising.
We don't use your data, or anything from Apple Health, WHOOP or Strava, to train any AI model.
We don't share your WHOOP or Strava member identifiers with anyone, and never show your data to other people.
We don't track you across other apps or websites. The app has no advertising, analytics or crash-reporting SDK.
Crash reports reach us only through Apple, if you have chosen to share them in iPhone Settings.
16. Security
In transit: everything the app sends or receives travels encrypted (TLS).
On your phone: your data is protected by iOS and your passcode; WHOOP and Strava tokens and your sign-in session are kept in the iOS Keychain.
On our side: each account can read only its own rows. The keys that let our server talk to Apple, WHOOP and Strava live only in our server's secret settings, never in the app.
Less to protect: we ask only for the data the app needs, and most of it never leaves your phone.
No system is perfect. If we learn of a breach that affects your data, we will tell you without undue delay, and tell the authorities and the service the data came from (such as WHOOP or Strava) wherever the law or that service's terms require it.
17. Deleting your data
Delete your account: in the app, open Profile, tap the gear to open Settings, then tap Delete account at the bottom. That deletes your account from our servers, with your profile, the copy of your plan, the copy of your stats and your Apple sign-in token, and revokes Why Not's access at Apple (and at WHOOP if you connected it). Then the app clears your plan, settings and stats from your phone. Your past runs' cards, route maps and metrics stay on that phone until you delete the app. Deleting your account doesn't cancel an App Store subscription; manage that in your Apple account.
Disconnect WHOOP: revokes Why Not's access at WHOOP and deletes every WHOOP record from your phone.
Disconnect Strava: revokes the tokens and deletes the runs that came only from Strava.
Disconnect Apple Health: stops new runs coming in; to revoke Why Not's access fully, use iPhone Settings, Privacy & Security, Health, Why Not. Stop reading removes the readiness readings.
By email: you can also ask us to delete your account by email, at support@whynot.run.
Location: while you use the app, for recording runs and for Near me; "always" only to keep a run recording with the screen off. Without it, everything but run recording and Near me works.
Apple Health: optional, as in section 5.
Photos: add only, the first time you save a sticker.
Notifications: optional, for run reminders and "your run is ready". Everything also appears in the app's notification bell.
19. Children
Why Not is not for children under 13, and we don't knowingly collect data from anyone under 13. If you think a child has an account, email support@whynot.run and we will delete it.
20. Not medical advice
Why Not is a training coach, not a medical service or a medical device. Its plans, its readiness card and anything it shows from WHOOP or Apple Health are for training, not for diagnosing or treating anything. The health and safety section of our Terms says more.
21. Changes to this policy
If anything material changes, such as a new connected service or a new kind of data leaving your phone, we will update this page and say so in the app first. The date at the top shows the latest revision.
22. Contact
Why Not Run LLC, the company that runs Why Not
Massachusetts, USA
Email: support@whynot.run
This policy is in plain English on purpose. If anything is unclear, email us and we will fix it.