Privacy Policy

1. Introduction

HyprPace ("we", "our", "us") is an AI-powered running coach that helps athletes train smarter using their Strava activity data. This Privacy Policy explains what data we collect, how we use it, and how we protect it.

By using HyprPace, you agree to the collection and use of information as described in this policy. If you do not agree, please discontinue use of the application.

2. Data We Collect

2.1 Account Information

When you create an account, we collect:

• Your name
• Email address
• Encrypted password

2.2 Strava Data

When you connect your Strava account via OAuth 2.0, we access and store the following data from the Strava API:

• Athlete profile (name, athlete ID)
• Activity data: distance, duration, pace, heart rate, cadence, elevation, device name, and activity type
• Activity metadata: timestamps, timezone, kudos count, achievement count
• OAuth tokens (access token, refresh token) — stored securely and used solely to sync your data

We do not access your Strava social feed, followers, photos, or private messages. We only request scopes necessary to read your activities and profile.

2.3 Profile & Training Data

During onboarding and usage, we collect:

• Running experience level
• Training goals (race distance, target pace, target date)
• Available training days and preferred session types
• Injury information you voluntarily share
• Conversation history with the AI coach

2.4 Automatically Collected Data

• IP address and user agent (for session security)
• Session tokens (for authentication)

3. How We Use Your Data

We use your data exclusively to:

• Generate personalized AI-powered training plans
• Provide coaching feedback based on your real activity data
• Track your progress and adapt plans over time
• Authenticate your account and maintain sessions
• Sync and display your Strava activities within the app

We do not sell, rent, or share your personal data with third parties for marketing or advertising purposes.

4. Third-Party Services

HyprPace integrates with the following third-party services:

• Strava API — to import your activity data. Your use of Strava is governed by Strava's Privacy Policy.
• OpenAI API — to power AI coaching conversations. Your conversation data is sent to OpenAI for processing. OpenAI does not use API data to train their models.

5. Data Storage & Security

• All data is stored in a secured PostgreSQL database with encrypted connections (SSL/TLS)
• Passwords are hashed and never stored in plain text
• Strava OAuth tokens are stored server-side and are never exposed to the client
• All communications between the app, backend, and third-party APIs use HTTPS

6. Data Retention & Deletion

We retain your data for as long as your account is active. You may request complete deletion of your account and all associated data at any time by contacting us.

Upon account deletion, we will permanently remove:

• Your account information and profile
• All synced Strava activities
• Strava OAuth tokens (revoking access)
• Training plans and coaching history
• All conversation data

7. Strava-Specific Provisions

In compliance with the Strava API Agreement:

• Users can disconnect their Strava account at any time
• Upon disconnection or account deletion, all Strava data is permanently deleted from our systems
• We do not cache Strava data beyond what is necessary for the app to function
• We do not re-share or redistribute Strava data to any third party
• We display Strava attribution as required ("Powered by Strava")

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Disconnect your Strava account at any time
• Export your data upon request

If you are located in the European Economic Area (EEA), you also have rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection authority.

9. Children's Privacy

HyprPace is not intended for children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by updating the "Last updated" date at the top of this page.