Privacy Policy

What the app stores on your device

Whether or not you sign in, the app saves the following locally using Apple's standard on-device storage (UserDefaults):

• Your race plans (distances, target times, checkpoints, fuel and reminders)
• Products you save or scan
• Your saved Favorites (pace, time, and distance combinations)
• Your profile (age, weight, and optional resting/maximum heart rate) and your unit, appearance, and accent colour preferences
• Activities you record with the app: the route (location, only while an activity is running), pace, and — if you connect them — heart rate from a strap, glucose from a sensor, and temperature/humidity from an environment tag
• Training sessions you import from Strava, Apple Health, Health Connect or intervals.icu (summaries: date, distance, time, heart rate, elevation), any lab report you import, and the coach profile and training plan built from them

Signed out, none of this leaves your device, and deleting the app deletes it.

If you create an account

Signing in is optional. It backs up your data and syncs it between your devices, and it is how Community works. If you do sign in:

• Your email address is stored to identify your account and to send you sign-in codes. There is no password.
• Your race plans, recorded activities, imported training-session summaries, coach profile and plan, saved products, favorites, and settings — including the profile fields above (age, weight, heart rate) — are stored on our server so they can be restored on your other devices.

This data is hosted on Supabase on servers in the European Union, and is protected by row-level security so that your account is the only one able to read or write your data. It is used only to provide sync. It is never sold, never shared with advertisers, and never used to profile you.

You can sign out at any time, which stops syncing and leaves your data on the device. To delete your account and everything stored with it, use Delete Account in Settings — it removes your account and all synced data permanently, and leaves your plans on this device. You can also email the address below.

Community

Community is optional. Nothing is shared until you share an activity yourself. People who follow you can read what you share. Any signed-in athlete can follow any other; there is no approval step. Signed-out visitors cannot read Community.

• Profile. When you create a Community profile we store a display name (up to 60 characters) and an @handle. Follow counts (how many people follow you, and how many you follow) can be read by any signed-in athlete. The lists of who follows whom can be read only by the two people in that follow. Every signed-in account can read every Community profile. Signed-out visitors cannot.
• Profile picture. Optional. A picture you set is stored in a public bucket, so the file can be read without a sign-in. You can leave it unset.
• Posts and comments. A post is a copy of an activity you chose to share: the caption, the summary, an optional map, and the comments other athletes write on it. Followers, and you, can read them. They are user-generated content shared with your followers. A caption is limited to 500 characters. A comment is limited to 1000 characters.
• Photos. A post holds up to four photos. They are stored in a private bucket. You and your followers read them through signed links; they are not a public page. A video, where the build allows one, counts as one of those four and is kept in the same private bucket, on the same signed links. Choosing a photo is the only time the app reads your photos.
• Health figures on a post. A post summary can include the average heart rate, the highest heart rate, and an average glucose, when the activity has those readings. A chart you leave on can also show heart rate, altitude and glucose to your followers. These are the same kinds of health figures the app already stores with the activity. Community is a second place your followers can see them. A figure the activity does not have is left off the post.
• Report and block. You can report a post, a comment, or a profile, and you can block another athlete. A report is kept so we can review it and moderate. Reports are read by us and by the person who sent the report. They are not published. A block records the two accounts so each of you is hidden from the other.

Deletion. Unsharing a post removes that post and its photos at that moment. Deleting your account removes the Community profile with the account: the profile row is deleted with the account. Delete Account also removes the photo files and the profile picture stored for that account.

Community data is hosted on the same Supabase project in the European Union. It is used to run Community. It is never sold and never shared with advertisers.

Ask Coach

Ask Coach is optional. On iPhone, iPad and the web, a Pro account can ask a question about training. The answer states what stands out in the facts. It does not advise, and it does not build or change a plan.

When you ask, the app sends the question to our Supabase edge function, coach-ask. That function sends it on to Anthropic's API. The model is claude-opus-5-5. The function writes nothing down: it has no store for the question or the answer.

With the question, the request includes:

• Training activities — activities the app already holds, with their dates and measurements
• Notes — notes kept with those activities, and calendar notes
• Glucose — glucose readings already stored with an activity, where the activity has them
• Profile facts — resting heart rate, maximum heart rate, and sex if you have set it
• Plans — the name, sport and day of your plans
• The question, and a recent part of this conversation

Notes and glucose can be sensitive. They are included so the answer can use what you already keep in the app. An activity that exists only as Strava data is left out of the request.

Conversation history. The conversation stays on the device. It is not part of account sync. On iPhone and iPad it is a file in the app's documents, ask-coach-history.json. On the web it is in this browser's local storage, under oxygon.ask-coach.v1. A recent part of that history is sent with the next question.

Deletion. In Ask Coach, open History and use Clear history. That removes the conversation from the device. Deleting the app removes the iPhone and iPad file. Clearing this site's stored data removes the web copy. Delete Account removes the synced account. It does not, by itself, remove a conversation that lives only on the device. Use Clear history for that.

Anthropic. The request is sent so Anthropic can write the answer. Anthropic does not use API inputs or outputs to train its models by default, as described in its Commercial Terms and commercial data-use policy. Its retention policy says API inputs and outputs are normally deleted within 30 days, with exceptions for longer-retention features, separate agreements, feedback, safety enforcement and legal requirements.

Third parties we rely on

• Supabase — hosts your account and synced data (EU region). Acts only as our processor.
• FairyMail — delivers your sign-in code emails, and receives your email address to do so.
• Strava (only if you connect it). With your permission we read your activities and profile to compute your training metrics and history. What we read from Strava is shown only to you and is not put into Ask Coach. If you choose Share to Strava on a finished activity, that activity is sent to your own Strava account. That send is separate from the read. Strava may collect usage data about this integration under its API Policy. Disconnect any time in Settings → Connected apps, or at strava.com/settings/apps.
• Apple Health (only if you allow it) — workouts, heart rate and related samples are read on your device to compute your training metrics. Nothing is written back.
• Health Connect (Android, only if you allow it) — workouts, distance, elevation and heart rate are read on your device to compute your training metrics. Nothing is written back. Oxygon asks for history beyond the last 30 days because a training plan is built against a whole year — thirty days cannot tell a base phase from a taper. Revoke any time in Settings, or in Health Connect itself.
• intervals.icu (only if you connect it) — with the API key you provide we read your activity summaries and wellness data to compute your training metrics and history. The key is stored on your device only. Disconnect any time in Settings.
• Anthropic — Ask Coach is described in its own section. When you ask the race assistant a question, the question, your plan and your interview answers are sent to Anthropic's API to produce the reply. If you import a lab report, the document itself is sent there too, once, so its stage table can be read; nothing it returns is used until you have checked it on screen. Strava data is never included. Anthropic does not use API inputs or outputs to train its models by default, as described in its Commercial Terms and commercial data-use policy. Its retention policy says API inputs and outputs are normally deleted within 30 days, with exceptions for longer-retention features, separate agreements, feedback, safety enforcement and legal requirements.
• Open-Meteo — the forecast for a race location is fetched from their public weather API; only coordinates and dates are sent.
• MapTiler — maps are drawn from MapTiler's tiles: a course, the small map on a route card, and a replay. The route card is drawn on our server, and MapTiler then receives only the map area being drawn, from us, not your account. When the app shows a map, your device requests the tiles for the area on screen. A replay may also send the coordinate at the start of the route so the place can be named. MapTiler does not receive your account.
• Crew link (only if you share one). While an activity is running, your position, pace, heart rate and glucose are published to a private link you choose to share, so your crew can follow you. On an outdoor activity, the route so far is published with it, about once a minute, so someone who opens the link after you have started can see the path, not only the latest point. Anyone with the link can see it for the duration of the activity. Sharing the link is your choice. We do not check who opens it. When the activity stops, the live page stops updating.
• Open Food Facts — when you scan a product barcode, the barcode is sent to their public database to look up its nutrition. No personal data or account information is included in that request.

What the app does not do

• No analytics, crash reporting, or usage tracking
• No advertising or ad tracking
• No access to contacts. Photos are used only when you choose them for a Community post or a profile picture. Location is used only while you record an activity and is stored with that activity
• No selling or sharing of your data with third parties for their own purposes
• No account required — every feature except sync and Community works signed out

Changes to this policy

If this policy ever changes — for example, if a future version of the app adds a feature that uses data differently — this page will be updated and the "Last updated" date above will reflect that.

Contact

Questions about this policy can be sent to support@oxygon.app.