Privacy

What is collected

Only what a training analysis needs, and only from sources you connect yourself.

• Who you are. A name, an avatar and an email address, held by Clerk, which handles sign-in. This site stores your Clerk user id, a public handle, your display name and your avatar URL. It never sees or stores a password.
• Your activities, from Strava. Under the grant you approve: date and time, sport, title, distance, duration, elevation, heart rate, calories, time in heart-rate zones, and weather where Strava has it. The refresh token that keeps the sync working is stored so it can keep working, and is deleted when you disconnect.
• What is computed from those. Daily totals, fitness, fatigue and form, intensity distribution, efficiency and decoupling, power and pace curves, the anomaly models, and the written readings beside them. All derived — none of it is collected from you.
• A little about your use of the site. When the coach was asked, so the shared question budget can be rationed fairly; when your data last synced.
• Garmin, for the site owner only. Recovery data — HRV, sleep, respiration, readiness, body battery — reaches this site only for the account that runs it, through that account’s own credentials. Garmin’s API is open to approved business partners only, so there is no grant flow to offer you, and your Garmin password is something this site will never ask for.

Who else processes it

Running this site means other companies handle some of your data. These are all of them, and what each one gets.

• Clerk — your identity: email, name, avatar, and the sign-in itself.
• Neon — the database. Everything above lives here.
• Vercel — hosting. The site runs on their machines, so requests pass through them.
• Strava — the source of your activities, under a grant you approve and can revoke from either side.
• OpenAI — only for the coach and the written readings. See below, because this is the one that sends your figures somewhere else.
• GitHub — runs the scheduled import. The site owner’s own data is also stored in a private repository there; nobody else’s is.
• Telegram — an operations log for the site owner, so a sync that quietly stopped is noticed. It carries events and counts: that an account signed up, that Strava was connected, that a sync ran and what it imported, that the coach was asked and how many times this hour. It does not carry what you asked, what the answer was, or any of your recovery or training figures.

What other people can see

• Nothing, until you accept a connection. There is no half-open tier and no public profile. Someone not connected to you sees nothing, signed in or not.
• Connections see everything by default, which you can narrow. What they may see is stored per category — volume, fitness, intensity, routes, recovery, performance — so recovery can be withheld while training stays visible.
• The signals page is yours alone. Every figure on it comes from recovery data, and a list of days your body may have been struggling is not something this site offers to anyone else, whatever your visibility settings say.
• Nothing is sold, and there is no advertising or analytics. Your data is not a product here.

What the coach sends onward

Two features use a language model, and both send data to OpenAI to do it. This is worth reading rather than skimming, because it is the only place your information leaves the systems listed above.

• The coach. Your question, and a brief of your own figures for it to answer from — totals, recent sessions, training load, and your recovery figures where you have them. Your display name and the titles you gave your activities are part of that brief, because the answer refers to them by name.
• The written readings beside the charts, and the recommendation on the signals page. These send the computed figures, not your identity.
• What is not sent: your email address, your avatar, your Strava token, or where you trained. No GPS trace, route geometry or coordinate ever leaves this site.
• Numbers are computed here, not there. Every figure is calculated by this site; the model is asked only to put it into words, and what it writes is checked against those figures before it is stored. If you would rather not use it, do not use the coach — nothing else on the site requires it.

Keeping and deleting

• Data stays until you ask for it to go. There is no automatic expiry, because a training history is only useful as a long record.
• Disconnecting Strava stops new data and deletes the stored token. What was already imported stays, and nothing is added past the last day it already covers.
• Deleting everything is done by asking. There is no self-serve delete button yet — saying so is more honest than implying one exists. Ask, and your athlete record and everything keyed to it is removed: activities, daily rollups, health rows, dashboards, connections and coach usage.
• Deleting your Clerk account does not delete your training data on its own, because the two systems are separate. Ask for both if you want both.

About health data

Heart rate, sleep, HRV and recovery figures are health information, and are treated as the most sensitive thing here: withheld from the sharing model by default on the one page built entirely from them, never placed in the operations log, and never used for anything but showing you your own patterns.

None of it is medical advice and this is not a medical device. The signals page measures distance from your own baseline, which is a reason to look, not a diagnosis. Anything that worries you is a question for a doctor.