Privacy Policy

1. Information we collect

• Account information — your email address and name, and either a securely hashed password or, if you sign in with Google, the basic profile your Google account shares with us.
• Training data you provide — workouts, planned sessions, wellness entries (e.g. sleep, fatigue, resting heart rate), notes, and goals you enter.
• Connected‑service data — when you link a third‑party account such as Garmin, Zwift, or Wahoo, we import the activity and workout data you authorize (for example: activity type, time, distance, heart‑rate, power, cadence, lap splits, and derived metrics such as training load). Some connections are brokered for us by Stridee (see Sections 4 and 8). You control each connection and can disconnect it at any time.
• Activity files you upload — if you upload your own workout files (FIT, GPX, or TCX), we parse and store the training data they contain, such as time, distance, heart‑rate, power, cadence, and laps.
• Apple Health data (iOS app) — with your permission, the iOS app reads data from Apple Health on your device for two optional features. (1) Today’s readiness: recovery metrics (heart‑rate variability, resting heart rate, sleep, and recent workout load) are sent only with a single coaching question to generate your answer and are not stored on our servers. (2) Workout import: if you choose to import your Apple Health workouts, we read each workout’s summary (type, time, duration, distance, and calories) and save it to your activity history so it appears alongside your other activities. In both cases the data is used only to provide the service to you — never for advertising or marketing, and never shared or sold. You can revoke access at any time in iOS Settings → Privacy & Security → Health.
• Billing data — if you subscribe, payments are processed by Stripe. We receive limited subscription and customer identifiers; we never see or store your full card number.
• Technical data — IP address, device and browser information, and basic usage and security logs needed to operate and protect the service.

We do not collect or store your location. The activity files we import may contain GPS coordinates, but we read only the training metrics out of them — we do not save the route, and the original file is discarded once it has been parsed.

2. How we use your data

• Provide your training dashboard, analytics, and history.
• Generate personalized coaching, feedback, and recommendations based on your training data, including through AI providers (see Section 3).
• At your direction, deliver the workouts we generate to a connected device or platform (for example, your Wahoo head unit or your Zwift training calendar), or let you export them as files.
• Operate, secure, troubleshoot, and improve the service.
• Process subscriptions and billing.
• Send essential service communications (and, only with your consent, optional updates you can opt out of).

We rely on your consent (for connected accounts), the performance of our contract with you (to provide the service), and our legitimate interests (to keep the service secure and working) as our legal bases for processing.

3. AI processing

To produce coaching feedback, plans, and insights, we send your training data and the messages you write to the coach to Anthropic (the maker of the Claude AI models), our third‑party AI provider acting as our processor. This processing is performed solely to generate results for you. Anthropic does not use the data we send on your behalf to train its AI models, and is contractually restricted from doing so. Data from Strava is never sent to the AI (see Section 2).

In our iOS app we ask for your explicit consent before any data is sent to the AI, and you can withdraw that consent at any time under Settings → AI & Data Sharing, after which the coach asks again before sending anything.

4. How we share data

We share data only with service providers who help us run Vexar, under contracts that limit their use of it:

• Cloud hosting & database — Microsoft Azure (United States).
• AI processing — Anthropic (Claude), as described in Section 3.
• Payments — Stripe.
• Transactional email — Resend, to deliver essential service emails such as password resets. They receive your email address and the contents of that email only.
• Push notifications (mobile apps) — Apple Push Notification service, if you allow notifications. It receives your device token and the text of the notification (for example, the name of today’s session) in order to deliver it.
• Authentication — Google, if you choose Google sign‑in; Apple, if you choose Sign in with Apple. These providers confirm your identity to us; we receive your email address and, for Apple, the name you choose to share on first sign‑in.
• Product analytics and session replay — PostHog, to understand how the app is used so we can improve it. It receives your account identifier, the pages you open, and a small set of named product events (for example, that a training plan was generated or a device was connected), together with your plan tier.
  
  We also record session replays: a reconstruction of how a page looked and where you tapped, so we can see where the app is confusing. These replays are masked before they leave your device — the contents of every form field are blanked (including your weight, date of birth, thresholds and password), and your conversation with the coach is blanked in full, both what you write and what the coach replies. We never record the content of network requests, so your training data is not captured. What remains is the layout of the page and your navigation through it.
  
  PostHog does not receive your training files, and we do not use any of this for advertising. We honour your browser’s “Do Not Track” setting: if it is switched on, we record nothing at all.
• Device‑connection broker — Stridee, if you connect Garmin. Stridee holds the authorization you grant your device platform and delivers your activity files to us. We send Stridee only an internal account identifier we generate for you — not your email address, your name, or your training data.

We require each of these third parties, by contract, to provide the same or equal level of protection for your personal data as set out in this policy.

We do not sell your personal data or share it for advertising. We may disclose data if required by law or to protect the rights, safety, and security of our users and the service.

5. Strava data (existing connections only)

Strava is no longer available to connect — we retired the integration on July 2, 2026, and it is not offered to new accounts. This section applies only if you linked Strava before that date and have not disconnected it. Where it still applies, we access your data through Strava’s official API and handle it in line with Strava’s API Agreement:

• Your Strava data is shown only to you, within your own account — it is never displayed to other users or made public by us.
• We use your Strava activities for display and analysis only. We do not send Strava data to AI features or use it to generate coaching or plans. (Data from your own uploads and from other connected services such as Wahoo may power AI coaching — see Sections 2 and 3.)
• We store your Strava access tokens in encrypted form and use them only to sync your activities.
• You can disconnect Strava at any time from your settings, or revoke access from your Strava account. When you disconnect, revoke access, or delete your Vexar account, we delete the activity data we imported from Strava within 30 days.
• We do not sell or redistribute your Strava data.

Powered by Strava.

6. Wahoo

If you connect Wahoo, we use Wahoo’s official Cloud API to, at your direction:

• Import your completed workouts and their training data (such as power, heart‑rate, cadence, and training load) into your Vexar account.
• Send the structured workouts we generate to your Wahoo device.
• Store your Wahoo access tokens in encrypted form and use them only for the syncing described above.

Workout data you bring in from Wahoo is your own training data, and we use it to power your dashboard and your AI coaching (see Sections 2 and 3). You can disconnect Wahoo at any time from your settings.

7. Zwift

If you connect Zwift, we use Zwift’s official Training API to, at your direction:

• Import your completed Zwift activities and their training data (such as power, heart‑rate, cadence, duration, and distance) into your Vexar account.
• Send the structured workouts we generate to your Zwift training calendar, and update or remove one there when you change or delete it in Vexar.
• Receive notifications from Zwift when an activity is saved or a connection changes, so your history stays current without you having to sync by hand.
• Store your Zwift access tokens in encrypted form and use them only for the syncing described above.

Workout data you bring in from Zwift is your own training data, and we use it to power your dashboard and your AI coaching (see Sections 2 and 3). You can disconnect Zwift at any time from your settings, which also cancels those notifications at Zwift’s end.

8. Garmin (via Stridee)

If you connect Garmin, the connection is brokered by Stridee, a device‑integration platform acting as our processor. You grant access on Garmin’s own consent screen; Stridee holds that authorization and passes your activities to us.

• We send Stridee only an internal account identifier we generate for you, so your activities can be matched to your Vexar account. We do not send them your email address, your name, or your training data.
• We receive your completed activities as the original device files your watch or head unit recorded (FIT, TCX, or GPX), and store the training data they contain — such as time, distance, heart‑rate, power, cadence, and lap splits.
• We never receive or store your Garmin password, and we hold no Garmin credentials of our own.
• You can disconnect at any time from your settings, which revokes the authorization at Stridee and stops any further activities arriving. You can also revoke access from your Garmin account.

Workout data you bring in from Garmin is your own training data, and we use it to power your dashboard and your AI coaching (see Sections 2 and 3).

9. Data retention

We keep your data for as long as your account is active. When you delete your account, we delete or anonymize your personal data within a reasonable period, except where we must retain limited records to meet legal, tax, or security obligations. Connected‑service data is removed as described above.

10. Security

We protect your data with encryption in transit and at rest, encrypted storage of third‑party access tokens, network access controls, and least‑privilege access to production systems. No system is perfectly secure, but we work to safeguard your information and to respond promptly to any incident.

11. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can edit your profile and disconnect services in‑app, delete your account, or contact us to exercise any of these rights. We will not discriminate against you for doing so.

12. Cookies

We use only essential cookies needed to keep you signed in and to keep the service secure. We do not use third‑party advertising or tracking cookies.

13. Children

Vexar is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child has provided us data, please contact us and we will remove it.

14. Changes to this policy

We may update this policy as the service evolves. We will revise the “Last updated” date above and, for material changes, provide a more prominent notice.

15. Contact

Questions or requests about your privacy? Email us at privacy@vexartraining.com.