Privacy Policy

Introduction

AdaptCycling is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your data when you use our service. We take your trust seriously, especially when it comes to sensitive training and performance data from your connected ride sources. Residents of Washington and Nevada should also read our Consumer Health Data Privacy Policy.

What Data We Collect

When you connect a ride source to AdaptCycling — Strava, Wahoo, Hammerhead, Polar, intervals.icu, Rouvy, or a ride file you upload — we access and store the following data:

• Activities: Your cycling workouts, including dates, distances, durations, and elevation data
• Performance metrics: Power output, heart rate data, cadence, and normalized power when available
• Route data: The GPS trace of a ride (the route line and per-second coordinates) when your ride source provides one. We use it to display your ride and analyze efforts and climbs — never to profile where you live or travel
• Athlete profile: Your functional threshold power (FTP), weight, sex, birth date, heart rate zones, and other personal training parameters
• Training details you choose to share: Injury notes, schedule notes, morning readiness check-ins (including illness), and other context you give the coach
• Coach chat: Your messages with the coach, and the coaching memory (summaries and typed facts about your training) we build from them

We do not collect your followers, social connections, kudos, comments, or any other social-graph data from connected platforms.

How We Use Your Data

We use your ride data to provide you with personalized coaching and training insights. Specifically, we use it to:

• Generate personalized training plans tailored to your fitness level and goals
• Analyze your performance trends and identify areas for improvement
• Provide coaching feedback and analysis after your rides
• Track your progress over time and adjust recommendations accordingly

We may also use anonymized, aggregated data (stripped of any identifying information) to improve our service, understand feature usage patterns, and ensure system reliability. This aggregated data cannot be traced back to you.

AI Coaching and Your Data

AdaptCycling uses AI to analyze your individual training data and provide personalized coaching feedback directly to you. Our AI model processes your activity history and performance metrics to generate insights and recommendations specific to your training needs.

Critical privacy guarantees:

• Your ride data is never used to train, fine-tune, or improve AI/ML models.
• Your data is never sold, and never shared with other users or coaches. The service providers listed under Third-Party Services below process it only on our behalf.

AI calls go to OpenAI's API and are subject to OpenAI's API terms. Under OpenAI's API data policy, data submitted through the API is not used to train their models, and API inputs and outputs are retained for up to 30 days for abuse monitoring before deletion, unless longer retention is required by law.

Data Retention and Account Deletion

We retain your ride data as long as your account is active. Your data is permanently deleted in any of the following cases:

• You delete your AdaptCycling account (Account → Delete)
• You disconnect a ride source (Account → Data sources). This deletes that source’s rides and the training history computed from them; your chat history and coaching memory remain until you delete your account
• You revoke AdaptCycling’s access from your Strava connected apps page. We delete your Strava rides and the training history computed from them as soon as Strava notifies us; if Strava was your only sign-in method, your entire account is deleted
• You request deletion at email…

When your account is deleted, we permanently delete:

• All activity data, performance metrics, athlete profile data, training plans, and chat history
• Any cached or processed data used for generating coaching insights
• OAuth tokens and our access to your connected accounts

Account deletion is permanent and cannot be undone. Billing records held by Stripe are retained as required for tax and accounting. Aggregated, non-identifiable analytics data (e.g., feature-usage counts) may be retained for service improvement, but is not traceable to you.

Cookies and Analytics

We use the following cookies and tracking technologies:

• __Host-ac_session: A secure, httpOnly cookie that maintains your authenticated session for up to 400 days. This is essential for the app to function and cannot be disabled. A short-lived cookie is also set during sign-in (OAuth state), and a hint cookie remembering which provider you last signed in with is kept for up to a year.
• PostHog analytics: We use PostHog to understand how users interact with AdaptCycling—which features are used, where users encounter friction—and to capture error reports when something breaks. PostHog receives your user ID, email address, name, subscription tier, and product events. Some events carry summary training numbers, such as an updated FTP estimate. Health data (heart rate, weight, age, how you feel, illness, and injuries) is never sent in PostHog events. Your rides' recorded data, GPS traces, the messages you write to the coach, and your free-text notes are never sent to PostHog; short excerpts of the coach's replies may appear in quality-check error reports.
• Google Analytics: We use Google Analytics on our public marketing pages only (pages you can view without signing in) to measure traffic sources and which pages help visitors learn about AdaptCycling. Google Analytics is not loaded inside the signed-in app, and never receives your training data.

You can opt out of PostHog analytics by emailing email…. Opting out does not affect the functionality of AdaptCycling.

Third-Party Services

AdaptCycling relies on carefully selected third-party services to operate. Here's what data each service receives:

Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit: All communication between your device and our servers uses HTTPS/TLS encryption
• Token storage: Provider refresh tokens and API credentials are encrypted at rest using industry-standard encryption algorithms
• Database-backed sessions: Session tokens are stored in our database with cryptographic hashing, not in plain text
• Access controls: Every data query is scoped to your authenticated account; your data is only ever returned to your own session
• Security practices: We follow OWASP guidelines for secure coding and keep dependencies up to date

No system is 100% secure. If you believe your data has been compromised, please contact us immediately at email….

Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal data:

• Right to access: You can request a copy of all personal data we hold about you
• Right to correction: You can request that we correct inaccurate data
• Right to deletion: You can request that we delete your account and all associated data
• Right to data export: You can request your data in a portable, machine-readable format
• Right to opt-out: You can opt out of analytics and non-essential processing

You can delete your account yourself at any time (Account → Delete), which takes effect immediately. To exercise any other right, contact email… with a clear description of your request; we will respond within 30 days. If you are located in the European Union, these rights are guaranteed under the GDPR. If you are a California resident, you have similar rights under the CCPA; we do not sell or share your personal information.

Children's Privacy

AdaptCycling is not intended for users under 18 years old. We do not knowingly collect data from anyone under 18. If we become aware that we have collected data from someone under 18, we will promptly delete it. Parents or guardians who believe a child's data has been collected may contact email….

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes via email or by updating the "Last updated" date at the top of this page. Your continued use of AdaptCycling following any changes constitutes your acceptance of the updated policy.

Contact Us

If you have questions about this privacy policy or how we handle your data, please contact us at: