privacy

what we store

When you connect Strava we store: your Strava athlete ID, name, profile photo URL, city and country, your unit preference, and OAuth tokens for your Strava account. As later features land we will also store your activities, their data streams, computed metrics, your goals, and your conversations with the coach.

who can see it

Only you. There are no public profiles, no leaderboards, no shareable links, no coach view and no social feed. Every database query is filtered by your signed-in user ID at the data layer, not merely hidden in the interface. This is both our own policy and a requirement of Strava’s API agreement.

your strava tokens

Your Strava access and refresh tokens are encrypted at rest with AES-256-GCM using a key held outside the database. They are never sent to your browser and never written to logs.

model training

Your data is never used to train or fine-tune any AI model. To generate run summaries and answer your questions, we send the relevant computed metrics from your own training to the Anthropic API as context for a single response. Anthropic does not train models on API inputs or outputs. Your data is not used to improve this app for anyone else, and it is never pooled with other users’ data.

deletion

“Disconnect & delete” in Settings revokes our access token at Strava and deletes your rows from our database. It is immediate and cannot be undone. You can also revoke our access at any time from Strava’s own connected-apps page; we handle the resulting deauthorization event by deleting your data.

contact

Questions about any of the above: get in touch through the repository this app is built from.