Privacy policy

What we collect

We collect only what the engine needs to plan your training:

• Waitlist: your email, and optionally your target race, goal time and weekly mileage.
• Account: your email, language and timezone.
• Training details you enter: race and race date, weekly distance, a recent race time, run days, experience, goal time and any current injury.
• Strava, only if you connect it: read-only access to your activities (activity:read). For runs, that means the date, distance, time, pace, heart rate, elevation, laps and best efforts. Activities you set to "Only me" stay invisible to us. We never ask for write access and never post to Strava.

How we use it

Your data is used for one thing: building and adapting your own training plan. We do not sell it, we do not use it for advertising, and we do not show it to other users.

Your Strava data is not used to train AI models. Some features send the free text you write (a debrief note, say) and numbers derived from your training to an AI provider to interpret them, together with a few facts from your profile (age, max heart rate, race distance and date, weekly kilometres, experience level) so the answer fits you. Raw Strava data, run history, your name and your email are never sent.

Who processes it

We use a small set of providers, each only for its part of the service:

• Supabase (EU region, Frankfurt): the database and sign-in. It holds everything described above.
• Vercel: hosting of this website. It sees your requests and the pages we send back.
• Modal: the servers that run the training engine. They process your training data and your Strava tokens in memory.
• Vercel Web Analytics: counts page views (which page, the country, the browser) without cookies and without identifying you across sites or visits. It is part of our hosting at Vercel.
• Sentry (EU region): error reports when the site or the engine fails. They hold the error type, the page address without its query, and the code location. Before they leave our servers we remove cookies, request bodies and your account details, and we mask email addresses and long codes in error messages.
• Resend: sign-in, account and support emails, including the ones you send to support@. It receives your email address and the message.
• Open-Meteo: the weather forecast on your session card. It receives only the coordinates of your saved location, rounded, and the date. No account details.
• Cloudflare Turnstile: the bot check on sign-in. It sees your IP address and browser signals, never your account.
• OpenRouter: the AI text features described above. It receives only free text you wrote, cut to 4,000 characters, numbers derived from your training, and those profile facts. Never your email, name or raw Strava data. A debrief voice note, recorded only when you press the microphone, goes through our servers and OpenRouter to AssemblyAI, which turns it into text; neither we nor they keep the audio. When you write to support, your messages in that conversation (without your email address) may be sent to draft our reply, which a person reads and edits before it goes out.

Your Strava connection

Strava tokens are stored encrypted and are only used by our servers. Your browser never sees them.

You can disconnect at any time, in the app or from your Strava settings. We then revoke our access and delete the activity data we imported from Strava (activities, laps, best efforts and weekly volume) within 48 hours. Plans already built from it are kept, marked as no longer backed by Strava data.

How long we keep it

Your data is kept while your account exists. The raw Strava payload of each run is kept only while Strava is connected. Our log of Strava notifications is deleted after 30 days.

If you have written to support, we keep your message and email address for 30 days after you delete your account, in case we need to reply, and then delete them.

Deleting your account removes your sign-in and everything linked to it, and we send you an email to confirm.

Your choices

You can download a copy of your data (a JSON file) and delete your account yourself, both from Settings. For anything else, such as correcting your data or objecting to how it is used, write to support@roenlabs.com. We reply within 30 days.

Cookies and local storage

We use only what the site needs to work: a session cookie that keeps you signed in, a short-lived cookie that secures the Strava connection, and your browser's local storage for your language, theme and last engine preview. Page-view analytics are cookieless (see Vercel Web Analytics above). No advertising and no third-party trackers.

Changes and contact

If this policy changes in a way that matters, we will email you before it applies. Questions: support@roenlabs.com.