mylz← Back to home

Privacy Policy

Last updated: November 5, 2026

1. Introduction

Mylz Technology Inc. (“mylz,” “we,” “us” or “our”) makes mylz tags, small sensors that thread into your shoelaces, and the mylz app for iOS and Android. This policy covers our website, the app and the tags. It explains how we handle your personal information and how you can access, correct or ask us to delete it.

We’re a small company incorporated in Ontario, Canada, and mylz is currently offered in Canada as a closed alpha. Our Privacy Officer is responsible for how we handle personal information and can be reached at hello@mylz.run.

2. Information We Collect

2.1 Website. If you sign up for the alpha on mylz.run, we collect your name, email address and any optional survey answers (what you’d use mylz for and how many pairs of shoes you have) to manage your application and contact you about the alpha. If you subscribe to the mylz letter, we collect your name, email address and, if you give them, your affiliation and how you know us, to send you the letter. Our website host records technical details of each visit, such as your IP address and browser, to run and protect the site.

2.2 Your account and profile. You sign in with Apple, Google or a link we email you. We store your email address and, if your sign-in provider shares it, your name. During setup you give us your height, weight, birthday, gender, foot arch type, foot width, time zone and preferred units. When your weight changes, we keep the new value with its date.

2.3 Shoes. For every shoe you add, we store the brand, model, size, width, purchase date and the distance it already had, and, if you retire it, when and why. If you use the camera to identify a shoe, we receive the photo (section 3 explains what happens to it).

2.4 Tag data. Each time your tags sync, the app uploads what they recorded, minute by minute and foot by foot: steps, cadence, ground contact and swing time, stride timing and estimated stride length, landing impact and other motion statistics, whether you were walking or running, and the tag’s temperature and battery level. We also store each tag’s hardware identifier, firmware version and foot, and the last Bluetooth identifier your phone saw for it. From all of this we work out your runs, daily totals and shoe wear.

2.5 Check-ins. The app occasionally asks how your shoes feel while you wear them. If you answer, we keep your answer, including any discomfort you mention and which side it was on. If you have agreed to body check-ins, the app also asks occasionally how your body feels, and we keep your score (40 to 100), the side and any note you add. Notes are stored but never shown back to you in the app.

2.6 Device and notifications. We store your notification token, an ID for this installation of the app, your phone’s platform, the app version and whether you allow notifications.

2.7 App statistics and crash reports. Which screens and features you use, and reports when the app crashes. These are tied to your account ID. The ID is a random code, not your name or email, but we can link it back to you. Some records also contain a shoe’s step totals or wear reading, a reason you gave for retiring a shoe, a tag hardware identifier, or a one-word answer you gave to a shoe check-in from a notification. They never contain your profile details, your body check-in scores, sides or notes, or the words of your run notes. We also keep a copy of these app statistics in our own database (Supabase, Canada) for up to 14 months, and our team uses Claude to read them, with your name, to see how the app is used. There is currently no setting in the app to turn this off.

2.8 Location in the app. The app and tags don’t collect your location. Some versions of Android require location permission before an app can scan for Bluetooth devices, so the Android app asks for that permission, but it never reads your location.

2.9 Strava. If you connect Strava, we receive the information described in section 5.

2.10 Run notes. You can talk or type a note about a run your tags recorded. We keep the note’s words, whether you typed or spoke them, and the run and shoe it belongs to. When you talk, your phone’s own speech service turns your voice into text: on your phone where it can, otherwise through Apple’s or Google’s speech service, under their privacy policies. We never receive, record or keep the audio. Only the words you save reach us.

3. How We Use Your Information

We use your information to:

  • run the app and the tags, sync your data and update tag firmware;
  • turn tag data into measurements such as cadence, contact time, left/right balance, impact and shoe wear;
  • estimate your stride length and distance, which depend on your height, weight, age and gender;
  • show how each of your shoes is wearing and when it may be time to replace it;
  • send you check-in questions and other notifications, if you allow them;
  • identify a shoe from a photo;
  • understand how shoe wear relates to how you feel, using your check-ins;
  • show your run notes beside what your tags measured, and read them to understand how runs feel compared with what the tags measure;
  • find and fix problems, and see which features get used;
  • answer your questions and meet our legal obligations.

Improving mylz for other runners. If you agree, we also use your tag data, profile details, check-ins and run notes, together with other runners’, to improve how mylz measures stride, distance, balance and shoe wear. This is optional. You can say no, or change your mind later, by emailing hello@mylz.run, and you can keep using the app either way. We never use Strava data, or records made from it, for this, and we use Garmin runs only as section 6 describes. If we publish research or share findings, they will be aggregated or de-identified.

Shoe photos. A photo you take to identify a shoe is sent to Anthropic, whose software recognizes the brand and model. We also keep the photo indefinitely, in public storage that feeds our shoe catalog. It is saved under a random file name with no link to your account, but anyone who has its web address can open it, and copies may stay in web caches for up to a year. Because the photo isn’t linked to you, deleting your account doesn’t remove it. Please photograph only the shoe.

Analysis software. Our team uses Anthropic’s Claude and OpenAI’s Codex to help analyze tag data and look into problems. The tag data we give these tools sometimes includes the runner’s name. We have turned off the settings that would let either company train its models on it. Claude also reads the app statistics in section 2.7, with names, to show our team how the app is used. We don’t give these tools run notes, or Strava or Garmin data.

We don’t sell personal information, and we don’t use it for advertising.

4. Consent

Some of what we collect is sensitive: tag data, check-in answers, and body details such as height and weight. We ask for your express consent to collect and use it before you start using the app, and we ask again, separately, before body check-ins start.

You can withdraw consent at any time. Turn off body check-ins in Settings, withdraw research use by email (section 3), or delete your account. Turning off body check-ins or withdrawing research consent doesn’t change your other choices. Deleting your account ends your use of the app and removes information as described in sections 9 and 10. Some features can’t work without the information they rely on; for example, the app can’t show measurements without tag data.

5. Strava

Connecting Strava is optional. With your permission (Strava’s “read”, “activity:read” and “profile:read_all” access), we receive:

  • for each run: its title, type, start and end times, distance, moving and elapsed time, speed and pace, cadence, elevation gain, and Relative Effort, a score Strava calculates from heart rate;
  • your Strava shoe list, with each shoe’s name, brand, model and distance, and whether it’s retired;
  • your Strava athlete ID and the access keys we need to fetch new runs.

We copy runs only, not other activities. We don’t store routes, maps, location or heart-rate data. When you upload a run, Strava tells us and we fetch it, usually within minutes. If you haven’t opened the app in 7 days, we stop fetching until you do.

We use Strava data only to show your runs in the app, match each run to the shoe you wore, and compare its distance with what your tags measured. We keep each copied run for up to 7 days after we last fetch it from Strava. While you use the app we fetch your last 30 days of runs again every few hours, so your recent runs stay up to date. Strava data is never sold, used for advertising or analytics, used to improve mylz for other runners, or given to analysis software.

When you confirm a run and the shoe you wore, we save a separate record with the date, part of the day, distance rounded to 0.1 km, duration rounded to the nearest minute, cadence and shoe, and we calculate pace from it. When a Strava run clearly matches one your tags recorded, the app may save that confirmation for you, and you can undo it. Confirmations are kept after the copied run expires, for as long as Strava stays connected.

To disconnect, use the app or remove mylz in your Strava settings. We then delete the runs and shoes we copied from Strava, and every confirmation made from them, and stop all access. If you disconnect from Strava’s side, we delete the copied runs and shoes straight away and the rest once Strava confirms the change, within two days, unless you reconnect Strava before then. Shoes you imported from Strava stay in your shoe list.

Strava may monitor and collect information about how we use its API, and may use that information for any of its business purposes. Strava’s Privacy Policy governs how Strava handles your data, and controls if this policy conflicts with it.

6. Garmin

The Garmin connection isn’t available yet. This section describes the connection we plan to offer through Garmin’s Activity API, subject to Garmin’s approval. Connecting will be optional, and before you connect we’ll explain these uses and ask for your permission. Once you authorize the connection through Garmin, Garmin will send us summaries and files for the activities you sync from then on; we won’t receive your earlier history. These can include routes, location and heart rate, which we’ll discard without storing. We’ll ignore activities that aren’t runs, and for each run keep only its type, start time, duration, distance, pace and cadence.

We’ll use your Garmin runs to show them in the app, to match each run to the shoe you wore, and to compare their distance with what your tags measured so your own distance estimates get more accurate. When you confirm a run and the shoe you wore, we save the same kind of confirmation described in section 5.

Only if Garmin gives us written permission and you agree, we’ll also use your runs’ distance, pace and cadence, without your name, to improve the formula mylz uses to estimate stride length and distance for everyone. We fit this statistical formula in our own software. Before using your Garmin runs this way, we’ll ask you to confirm that your research choice in section 3 includes them. You can say no and still connect Garmin, and you can withdraw at any time by emailing hello@mylz.run.

Garmin data will never be sold, used for advertising, included in our app statistics, or given to Claude, Codex or any other AI service. We’ll use it only for the purposes in this section. Garmin data is stored and processed only by Supabase, our database and server provider, on Amazon Web Services servers in Canada.

We’ll keep runs from Garmin while Garmin stays connected. To disconnect, use the app or remove mylz in Garmin Connect. Within 48 hours we’ll then delete the runs we received from Garmin and any confirmation made from them, and stop all access; copies in our database backups expire within 30 days. Deleting your account does the same. A formula already improved with your runs keeps that improvement but holds none of your runs. Garmin’s Privacy Policy governs how Garmin handles your data.

7. Who We Share Information With

The service providers below handle personal information for us so they can provide their service to us. We remain responsible for information we pass to them. Shoe photos are also publicly reachable, as section 3 explains. Apart from that, we disclose personal information without your consent only when the law requires or permits it.

  • Supabase (on Amazon Web Services): Database, servers, file storage and sign-in. Information involved: all app information described in this policy.
  • Google Firebase: App statistics and crash reports. Information involved: the records described in section 2.7.
  • Expo, Apple and Google: Delivering notifications. Information involved: your notification token and the text of each notification.
  • Anthropic: Recognizing shoes in photos; Claude analysis software. Information involved: shoe photos; tag data and app statistics, sometimes with the runner’s name.
  • OpenAI: Codex analysis software. Information involved: tag data, sometimes with the runner’s name.
  • Loops: Our alpha sign-up and the mylz letter mailing list. Information involved: name, email address and the optional answers in section 2.1.
  • Vercel: Website hosting, including passing sign-up forms to Loops. Information involved: technical details of your visit, and the sign-up information in section 2.1.

If mylz is merged, acquired, financed or sells its assets, personal information may go to the other party, but only as the law allows and only if they agree to use and protect it as this policy describes. We’ll tell you before your information becomes subject to a different privacy policy.

8. Where Information Is Processed

Our main database is in Supabase’s Canada (Central) region. Google Firebase, Expo, Anthropic, OpenAI and our website providers process information in the United States, where U.S. authorities may be able to access it under U.S. law.

9. How Long We Keep Information

  • Account, profile, shoes, tag data and check-ins: until you delete your account.
  • Run notes: until you delete the note, the shoe it belongs to, or your account. A record of each save and delete, without the words, until you delete your account.
  • Strava runs: up to 7 days after we last fetch them, and sooner if you disconnect Strava or delete your account.
  • Strava shoe list: up to 7 days after we last fetch it, and sooner if you disconnect Strava or delete your account.
  • Strava confirmations: while Strava stays connected, then deleted as section 5 describes, or when you delete your account.
  • Garmin runs and confirmations made from them, once the Garmin connection is available: while Garmin stays connected, then deleted within 48 hours of disconnecting Garmin or deleting your account (section 6).
  • Alpha sign-up details: for the alpha and a reasonable time after, unless you ask us to delete them sooner. mylz letter subscriptions: until you unsubscribe.
  • App statistics in Google Firebase: up to 14 months. Crash reports: about 90 days. Deleting your account doesn’t remove these early.
  • App statistics in our own database: up to 14 months. Deleting your account removes them.
  • Database backups: up to 30 days.
  • Shoe photos: indefinitely, as explained in section 3.
  • Shoe models you add to our shared shoe catalog (a brand and model name): kept, with no record of who added them.

10. Your Rights and Choices

In the app you can edit your profile and shoes, turn notifications off, disconnect Strava, and turn body check-ins off. Turning body check-ins off withdraws your consent and stops new questions. “Delete my notes” erases the notes you’ve written; we keep a record of when you gave and withdrew consent. You can edit or delete any run note on its run’s screen.

To delete your account, go to Settings in the app. If you no longer have the app, email hello@mylz.run from the address on your account. We’ll confirm it’s you, asking for no more than we need. Deleting your account removes the data we copied from Strava and ends our access to it, then removes your profile, shoes, tag data, check-ins, run notes, confirmations and sign-in details. Section 9 lists what stays.

You can ask to see the personal information we hold about you, and ask us to correct it, by emailing hello@mylz.run. You can also ask for a copy of the information you gave us, including any runs we received from Garmin, in a structured, commonly used format. If Quebec law applies to you, you can also ask for the computerized personal information you gave us in a structured, commonly used format, or ask us to send it to someone you authorize, subject to the exceptions in that law. We’ll respond within 30 days. If we need longer and the law allows it, we’ll tell you within those 30 days why, how much longer, and that you can complain. If you’re not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d’accès à l’information du Québec.

11. If You Are in the European Union or United Kingdom

mylz is currently offered only in Canada. Where the GDPR or UK GDPR applies to our processing, you have the additional rights described here. We process your information to provide the service you signed up for, with your consent (for sensitive information, body check-ins, research use and Strava), and for our legitimate interest in keeping the app working and secure (app statistics and crash reports). You can ask us to access, correct, delete, restrict or transfer your information, object to processing based on our legitimate interests, and withdraw consent at any time. Withdrawing consent doesn’t affect processing we did with your consent before you withdrew it. You can also complain to your local data protection authority.

The European Commission recognizes adequate protection for transfers to Canadian commercial organizations subject to PIPEDA. For transfers to our U.S. providers that need EU or UK transfer safeguards, we will put the European Commission’s standard contractual clauses, and for UK transfers the UK Addendum to them, in place before we offer mylz in the EU or UK.

12. Security

We protect personal information with encryption in transit and at rest and with access controls, and only the people who need it can see it. Shoe photos are the exception: anyone with a photo’s web address can view it, as section 3 explains. Strava access keys can be read only by our servers. These safeguards reduce the risk of unauthorized access but cannot remove it.

13. Cookies

Our website doesn’t use analytics or advertising cookies, and the app doesn’t use cookies.

14. Children

mylz is not for anyone under 16, and we don’t knowingly collect information from children under 16. If you think a child has given us information, contact us and we’ll delete it.

15. Changes to This Policy

We’ll post any update on this page with a new date. Before a significant change takes effect, we’ll tell you by email, and if the change is a new use of sensitive information, we’ll ask for your consent first.

16. Contact Us

Mylz Technology Inc.
Attention: Privacy Officer
Ontario, Canada
hello@mylz.run