Privacy Policy

1. What we collect

When you sign in with Google or Strava, we receive your name, email address (if available), and profile picture from your OAuth provider.

When you connect Strava, we access your activity data (runs, rides, swims), including distance, duration, pace, heart rate, and elevation. We access this data through the official Strava API with your explicit authorization.

We also store your race goals, training preferences, and coach chat messages that you create within the app.

2. How we use your data

Your Strava activity data is used to provide personalized AI coaching through our coach chat feature. Your data is sent as context to our AI provider (Anthropic Claude) to generate training recommendations specific to your fitness level, goals, and recent training.

We do not use your data to train AI models. Your data is used solely as input context for generating your personal coaching responses.

Your data is not sold, shared with, or disclosed to any third parties for marketing, advertising, or analytics purposes.

3. Data storage and caching

We store your account information, race goals, and coach chat messages in a secure PostgreSQL database hosted on Vercel.

Strava activity data is fetched in real-time from the Strava API when needed and is not permanently stored in our database. OAuth tokens for Strava are stored securely to maintain your connection.

4. Data deletion

You can delete your account at any time from your profile page. This permanently deletes all your data including your account, goals, connected services, chat messages, and OAuth tokens.

If you disconnect Strava from your account, we immediately delete your Strava OAuth tokens and stop accessing your Strava data.

If you revoke access from within Strava settings, we will delete your stored tokens within 48 hours.

5. Third-party services

We use the following third-party services:

• Strava API - to access your activity data with your authorization
• Anthropic Claude - to power the AI coaching chat (your data is sent as context, not used for model training)
• Google OAuth - for sign-in authentication
• Vercel - for hosting and database
• Vercel Analytics - anonymous usage analytics (no personal data)

6. Your rights

You have the right to:

• Access the data we hold about you
• Delete your account and all associated data
• Disconnect third-party services at any time
• Withdraw consent for data processing

7. Security

All data is transmitted over HTTPS. OAuth tokens are stored server-side and never exposed to the client. We use industry-standard security practices to protect your data.

8. Contact

For any privacy-related questions, data access requests, or concerns, contact us at:

mzanattis201@gmail.com