Privacy policy

Stridewise is operated by [Operator name], [Registered address]. [Operator name] is the data controller for the personal data described here. You can contact us about privacy at [Contact email].

From Strava, when you connect your account and agree to the permissions shown:

• Basic profile details: your Strava athlete ID, name, profile picture and preferred units.
• Your activities: type, date, distance, duration, elevation, heart rate summaries, laps and whether it was a race, plus detailed streams for runs (time, distance, heart rate, speed, altitude, gradient and cadence). This includes activities you have marked as private on Strava, so that your training load is complete.
• Access and refresh tokens that let Stridewise read your activities. These are encrypted when stored.

From you, when you set up and use Stridewise:

• Your training profile: goal, race date and target time, available days and times, fixed sessions, runs and strength sessions per week, current weekly distance, longest recent run, recent race results, and maximum and resting heart rate.
• After each run: your effort rating (RPE), how it felt, and any pain or niggle flag with its location and severity.
• Any illness or time off you log.
• Your settings, such as units, theme, notification times and your time zone.

Created by Stridewise from the above: your training plan, run analyses, load and fitness figures, race predictions, readiness scores and the changelog of plan changes.

For notifications, if you turn them on: a push subscription for your device, issued by your browser.

To keep you signed in: a session record linked to a cookie (see cookies).

Heart rate data, pain and niggle flags, and illness records are data concerning health. This is “special category” data under UK GDPR and needs extra protection.

We process it only with your explicit consent, which you give during onboarding before any of it is collected. You can withdraw consent at any time by deleting your account. Withdrawing consent does not affect processing that took place before.

• To provide the service (analysing your runs, building and adapting your plan, showing your history): necessary for our contract with you, under Article 6(1)(b) UK GDPR.
• Health data as part of that service: your explicit consent, under Article 9(2)(a) UK GDPR, alongside the contract basis above.
• Notifications: your consent, which you give by turning them on and can withdraw by turning them off.
• Security and keeping the service running (for example, sign-in sessions, preventing abuse and fixing faults): our legitimate interests in operating a secure, reliable service, under Article 6(1)(f) UK GDPR.
• Meeting legal obligations, if any apply: Article 6(1)(c) UK GDPR.

Stridewise makes automated suggestions about your training plan, but these do not have legal or similarly significant effects on you. You can always change or ignore them.

Every calculation in Stridewise is a fixed, published formula or rule that runs on our own server. Your Strava data and your health data are never sent to any AI model, large language model, analytics service or other external processor. They are never sold, rented or shared, and are never used for advertising.

Your data is visible only to you when signed in. There are no public profiles, feeds or leaderboards. See how Stridewise works for the calculations.

Stridewise and its database run on a server operated by [Operator name], hosted in [Hosting location, UK or EU]. Strava tokens are encrypted at rest. Data is transferred over encrypted connections.

Push notifications. If you turn on notifications, messages are delivered through your browser’s push service: Apple, Google or Mozilla, depending on your device and browser. These companies receive the notification and your device’s push address in order to deliver it. Notification content is encrypted end to end between our server and your device, so the push service cannot read it. To keep things minimal, notifications contain only a short summary, such as today’s session type and distance or a note that your plan has changed. These services may be located outside the UK, and their handling of delivery data is covered by their own privacy policies.

Apart from these push services, we use no third-party processors.

• We keep your data while you have an account.
• If you disconnect Strava, or revoke Stridewise’s access from your Strava settings, we revoke our tokens and delete all Strava-derived data: your activities, streams and anything calculated from them.
• If you choose “Delete my account and data”, we delete everything linked to your account, including your profile, feedback, health data, plan and push subscriptions.
• Deleted data may remain in encrypted backups for up to [Backup retention period] before it is overwritten.
• Server logs used for security and fault-finding are kept for up to [Log retention period] and do not contain your activity data.

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Rectification: correct inaccurate data. Most of your profile can be edited directly in settings.
• Erasure: use “Delete my account and data” in settings, or contact us.
• Data portability: receive the data you provided in a machine-readable format. Contact us to request it.
• Restrict or object to certain processing.
• Withdraw consent at any time, for health data and notifications.

To use any of these rights, contact [Contact email]. We will respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to help first.

Stridewise uses two cookies, both set by Stridewise itself:

• A session cookie (sw_session), which keeps you signed in. It is strictly necessary, cannot be read by scripts, is only sent over secure connections, and expires after 30 days or when you sign out.
• A theme cookie (sw_theme), which remembers whether you chose the light or dark theme. It contains nothing else.

There are no analytics, advertising or tracking cookies, and no third-party cookies.

Stridewise is for people aged 16 and over. We do not knowingly collect data from anyone younger. If you believe we have, contact us and we will delete it.

Your use of Strava is covered by Strava’s own terms and privacy policy. Stridewise is not operated by or endorsed by Strava. We follow Strava’s API agreement, which limits how Strava data can be used and displayed.

If we make significant changes, we will tell you in the app before they take effect. The date at the top shows when this policy was last updated. See also our terms of use.