Training history, schedule patterns, route coordinates, heart-rate samples, pace, feedback, pain/load notes, GPX files, backups, and exports are private. Treat them as sensitive in code, logs, screenshots, issues, and release evidence.

runway intentionally has no account or network service. It relies on Android's application sandbox, the device lock state, and the runner's control of their device and exported files. It cannot protect local data from a fully compromised or unlocked device, from another app granted broad device access, or from a user sharing a plaintext backup.

Backup and export use Android's document picker. The runner chooses the destination, and a cloud-backed document provider can move that plaintext file off the device without runway operating a network service.

The app requests no broad storage permission. A folder import uses a read-only Storage Access Framework tree grant selected by the runner. The grant can be revoked in Android settings. Share intake consumes a supplied file; it does not retain original raw GPX bytes.

Android notification permission is optional and requested only when the runner enables an alert. runway does not request Calendar permission and does not read or write the device calendar. Notification text uses private lock-screen visibility and omits route, heart-rate, distance, filename, schedule detail beyond the current run day, and private notes.

Health Connect access is optional and read-only. Permissions are scoped to the records runway needs. Route permission is separate and route samples are retained only when the profile permits it. Permission denial or revocation must fail safely without deleting unrelated local history.

• Imported activities begin in Review; no import automatically changes a plan.
• Content markers and tombstones prevent a deleted activity from being recreated by a later folder or Health Connect pass.
• Route discard clears retained and pending route samples together.
• Imported-heart-rate discard clears retained summaries, counts, detailed samples, and pending correction evidence together. Heart-rate profile zones are separate and remain.
• Backup and export are user-initiated plaintext files. The product must warn before writing them and never present them as encrypted.
• Disabling an alert clears its pending local deliveries. Removing imported runs cancels import-review notifications and clears their delivery history; a full reset also cancels run reminders and clears notification choices and delivery state.
• Removing imported runs and resetting runway first stop import work, release the selected-folder grant, and revoke Health Connect access. If Android cannot confirm those changes, data deletion does not proceed. A later database failure is reported as a partial result because platform permissions and Room cannot be rolled back atomically.

• Bound parser size, track points, values, and work per import. Reject document type declarations and entities; do not log raw activity content.
• Validate exact released restore lineages before replacement; run supported migrations from the same immutable source as installed-ledger upgrades, and prove reruns are no-ops.
• Keep Room queries bounded. Do not introduce unbounded history, route, or Health Connect reads into a primary surface.
• Do not hand-roll cryptography. Signing material stays outside the repository. CI receives it only through the protected release environment; local operator signing uses external, ignored configuration.
• Do not commit real activity files, backups, coordinates, signing keys, passwords, or local.properties.

Use the repository's private vulnerability-reporting form. If it is unavailable, open a public issue asking for a private reporting channel without including sensitive evidence.

Before a public APK, verify the current build on an emulator and at least one practical device: first launch/onboarding, all five destinations, notification permission and per-channel blocking, notification navigation, background GPX review alerts, data erase/backup warning, GPX share and folder grant/revocation, Health Connect permission/revocation, route discard, upgrade preservation, large text, and TalkBack. Keep private activity samples out of the repository and release record.