Privacy

From Strava, when you connect it. Your Strava athlete ID, first and last name, profile picture URL, and the city and state on your Strava profile. We also store the access and refresh tokens Strava issues, with their expiry and granted scope, so we can read your activities without asking you to reconnect. Access is read-only. We never post to your Strava account.

Your training data, read on demand. We read activities and gear from Strava to size recommendations to your real mileage and pace, and to tell you when a shoe is worn out. We keep the derived result, such as a mileage total per shoe, not a copy of your activity history.

Sign-in. A session token in a cookie, with its expiry. If you register a passkey, we store its credential ID, its public key, a signature counter, and the device name you give it. Passkeys are public-key credentials: the private half never leaves your device and we could not extract it.

If you subscribe to Pro.Your Stripe customer and subscription identifiers, the subscription status, and when the current period ends. Card details are entered on Stripe's own checkout and never reach our servers.

If you ask for emails.Your email address, where it came from, the time you opted in, and the time you unsubscribed if you do. We also keep a log of each message sent: recipient, subject, delivery status, and the provider's message ID.

When you click a buy link.A click identifier, which product it was, which retailer, which affiliate network, and the destination host. This is how a purchase can be matched to cashback. If cashback is credited, the ledger records the amount, the reason, and the retailer's order reference.

Card numbers. Stripe handles payment. We hold identifiers that point at Stripe records, nothing else.

Your search history. Searches and questions are answered and discarded. There is no table in our database recording what you searched for.

Passwords. There are none. Sign-in is Strava OAuth or a passkey.

Advertising or cross-site trackers. No Google Analytics, no Meta pixel, no ad network, and nothing that follows you to other sites.

We use these because the service cannot work without them. Each sees only what its job needs.

• Strava — the source of your training data, under the read-only permission you grant and can revoke.
• Stripe — payments and subscription management, including the email address you enter at checkout.
• Anthropic— when you ask a question in natural language, the question is sent to Anthropic's API to compose an answer. Do not put anything in a question that you would not want to leave our systems.
• Voyage AI — search text is sent to Voyage to be turned into a numeric vector so we can match it against our catalogue.
• Resend — sends email, and therefore sees your address and the message.
• Railway — hosts the API and the database, so the data described above is stored on their infrastructure.
• Vercel — hosts the website. We use Vercel Analytics and Speed Insights, which record page views, referrers, approximate country, and device and browser type. They do not use cookies and do not identify you personally.

We do not sell your data, and we do not share it with anyone for advertising.

Two, both necessary. A session cookie that keeps you signed in, and a cookie recording that you entered a valid invite code so you are not asked again. Neither is used for advertising or tracking across sites.

Strava tokens are kept until you disconnect Strava or delete your account, at which point they are removed and become useless to us.

The cashback ledger is append-only, including after an account is deleted, because it is a financial record: a corrected entry is added rather than an old one edited. It can be reduced to your user identifier with no other personal data.

Everything else is deleted when you ask, or when your account is deleted.

Disconnect Strava at any time, from your Strava settings or ours. Recommendations then stop being personalised.

Unsubscribe from email using the link in any message we send. It works without signing in and takes effect immediately.

Get a copy of your data, or have it deleted. Email sanchezjacob4203@outlook.com and we will do it. StrideRec is small enough that a person handles this directly.

If you are in the EU or UK, or in California, you have rights of access, correction, deletion, and objection under GDPR or the CCPA. The email above is how to exercise them; we do not require a specific form.

StrideRec is not intended for anyone under 16, and we do not knowingly collect data from children. Strava's own terms require users to be at least 16 in the EU, or 13 elsewhere.

If we start collecting something new, this page changes and the date at the top changes with it. For a change that materially affects what we do with your data, we will email you if we have an address you have opted in to.

StrideRec, Chicago, Illinois. sanchezjacob4203@outlook.com