Privacy Policy

This is the privacy policy for Endura, a small project that uses AI to generate endurance-training plans. The short version: we collect what we need to build your plan and nothing else, we don't sell your data, and you can delete your account at any time from inside the app.

What we collect

• Account: email address (required for sign-in) and a display name.
• Profile (optional): birth year, sex, weight, current training context, doctor-clearance status, current injuries, and personalisation inputs (recent race time, threshold heart rate, FTP, swim CSS).
• Plans: the inputs you provide when creating a plan (race date, distance, weekly hours, etc.) and the AI output we generate. Adjustments and completion records you add over time.
• Strava data (only if you connect Strava): see the dedicated section below.
• Technical: IP address (for abuse prevention and rate-limiting), browser user-agent, request timestamps, and basic device/locale data sent by your browser.
• Operational: server logs needed to keep the service running (errors, AI request/response payloads for debugging, anonymised token-cost metrics).

We do not currently use third-party analytics or advertising cookies. We do not sell your data.

Strava integration

Connecting Strava is optional. If you do connect, we receive the following from Strava on each completed activity you upload:

• Activity metadata: type (run / ride / swim / etc.), start time, duration, distance.
• Performance data when present: average heart rate, average power, calories.
• Approximate location: the start coordinates of the activity (Strava's default precision; we don't pull route polylines).
• OAuth access + refresh tokens. Stored encrypted at rest; never returned to the browser.

We use this data only to auto-mark planned sessions as completed when an upload matches, and to surface unplanned activities on your dashboard. We don't sell, share, or use it for any other purpose, and we never send Strava data to any AI / LLM — your training plan generation, weekly summaries, and any other AI feature run only on our own data (your plan, completion status, your feedback).

7-day cache:per Strava API Policy 6.2 we don't retain Strava data longer than seven days. Every Strava-derived metric (duration, distance, HR, the Strava activity ID) is wiped automatically by a daily purge job once the data ages past our internal six-day cutoff. The session still shows as completed — that's our own data — but the Strava-sourced metrics and the “via Strava” attribution disappear. Cached unplanned activities and the webhook event log are deleted on the same 7-day cycle.

Visibility: Strava data we receive for you is shown only to you. Coaches who manage your plan see the completion status of your sessions but never the Strava-derived metrics (HR, power, duration) — the coach dashboard strips those before render.

Upstream deletions: if you delete an activity on Strava, Strava notifies us via webhook and we wipe any corresponding Strava-sourced columns within 48 hours (in practice within seconds). Per Strava API Policy 6.3.

Disconnecting: you can disconnect Strava from your profile at any time, or revoke our access directly in your Strava settings. Either way, we revoke the OAuth token at Strava and delete allStrava-sourced data we hold: tokens, cached activities, the webhook event log, and every session completion that was auto-matched from a Strava upload. The disconnect response contains a written confirmation enumerating what was deleted — surfaced as a toast on the profile page and available on request. Manual completions you logged yourself stay; those aren't Strava data.

Strava usage data:independent of the data above, Strava may collect and use information about how Endura calls the Strava API (endpoints, frequency, errors) for Strava's own business purposes. We have no control over that — Strava is an independent data controller for the usage-data relationship.

Where your data lives

• Supabase — authentication and database. EU region (Frankfurt).
• Anthropic (USA):AI provider. Plan-generation and adjustment prompts (which include your profile fields) are sent to Anthropic's API to generate or modify your plan. Your data is transferred to Anthropic's US infrastructure for processing under their standard contractual clauses (SCCs) for international data transfers. Anthropic's data-handling terms apply to that call.
• Vercel — hosting and serverless runtime. Edge servers may be EU or US depending on your geography.
• Inngest — background-job runner used for plan generation and adjustments.
• Strava (USA)— only if you connect it. Activity data is transferred from Strava's US infrastructure to ours.

Legal basis

Under UK GDPR / EU GDPR we process your data on the following legal bases:

• Contractual necessity — to deliver the training-plan service you signed up for (account, plan generation, adjustments, dashboard).
• Your consent — for the Strava integration. You opt in by connecting; you can withdraw consent at any time by disconnecting.
• Legitimate interests — service security, abuse prevention, and product improvement (debugging logs, anonymised cost metrics). We balance these against your privacy rights and minimise what we collect.

Retention

• We keep your data while your account is active.
• When you delete your account (in-app or by request), account data is removed from our active systems within 30 days.
• Backups containing your data are purged within 90 days of deletion. Operational logs that may incidentally reference your account ID are pruned on the same schedule.
• Anonymised token-cost metrics and aggregate usage statistics may be retained indefinitely for capacity planning; these cannot be tied back to you.

Your rights

• Access: view all your data inside the app (profile in Settings, plans on the dashboard).
• Correction: edit your profile in Settings any time.
• Deletion:“Delete account” is available from the Profile page. Deletion is immediate in our active systems and propagates to backups within 90 days (see Retention above).
• Portability: export your active plan as PDF or .ics calendar from the plan view; export individual sessions from the session-detail menu.
• Objection / restriction: contact us if you want to object to or restrict any specific processing activity. UK / EU users may also lodge a complaint with their local data-protection authority (e.g. the ICO in the UK).

Children

Endura is not intended for users under 16. Don't create an account if you're under 16.

Contact

Use the contact form for any privacy questions, data-subject requests, or to follow up on a deletion. We aim to respond within 7 days.

This policy may be updated as the product evolves. Material changes will be flagged in-app.