privacy

what we store

We collect your name, and everything Strava gives us about you and your activities once you connect it — your profile details, your activities, and the per-second data streams behind them. We also store whatever you choose to tell the app directly: your goals, your settings, and your conversations with the coach.

who can see it

Only you. There are no public profiles, no leaderboards, no shareable links, no coach view and no social feed. Every database query is filtered by your signed-in user ID at the data layer, not merely hidden in the interface. This is both our own policy and a requirement of Strava’s API agreement.

your strava tokens

Your Strava access and refresh tokens are encrypted at rest with AES-256-GCM using a key held outside the database. They are never sent to your browser and never written to logs.

we share training data with outside ai providers

To generate a brief, review a run, or answer a question, this app sends the relevant computed figures from your training to an external AI provider as context for that one response — today that’s Anthropic, and in future it may also be Google (Gemini), OpenAI, or others.

runrunrunrun doesn’t control these companies, their models, their employees, or what they do with data once it reaches them. We cannot promise the data isn’t retained, reviewed, or used to train their models — that’s each provider’s own decision under their own terms, not ours. runrunrunrun takes no responsibility for how any external AI provider handles, stores, retains, or uses data sent to it.

we can’t guarantee against a data leak

No system is unbreakable, including this one. runrunrunrun takes reasonable, ordinary precautions, but cannot promise its own database is never breached — and equally cannot promise that of any third-party service it relies on, including Strava and any AI provider above. runrunrunrun is not responsible for a data leak or breach at runrunrunrun, at Strava, or at any AI provider or other third party it uses, however it happens.

deletion

“Disconnect & delete” in Settings revokes our access token at Strava and deletes your rows from our database. It is immediate and cannot be undone. You can also revoke our access at any time from Strava’s own connected-apps page; we handle the resulting deauthorization event by deleting your data.

contact

Questions about any of the above: get in touch through the repository this app is built from.