← Back to sign in

Privacy Notice

How Masters Running Analytics handles your training and health data

We only collect and use the data needed to provide your training guidance. We do not sell your data. You can delete your account from Settings, disconnect integrations at any time, and email privacy requests to [email protected].

What Masters Running Analytics is

Masters Running Analytics is a wellness-focused training guidance platform for runners. It is not a medical device and does not replace qualified clinical care. The data you connect is used to support coaching-style recommendations only.

Controller and privacy contact

Masters Running Analytics is the operator of this service and the controller for the account, activity, health, and training data described in this notice.

Privacy, correction, portability, and deletion requests can be sent to [email protected]. Account deletion remains available in Settings.

What data we collect

We collect and store the following categories of data:

  • Account data — email address, display name, date of birth (for age-adjusted thresholds), and OAuth provider identity.
  • Activity data — running activities, pace, distance, heart rate, training load, and derived analytics imported from connected integrations.
  • Health metrics — HRV, sleep duration, sleep quality, resting heart rate, and stress scores, where provided by Garmin or similar sources.
  • Biomechanics data — ground contact, stance time, step length asymmetry, efficiency and fatigue scores from Striv uploads.
  • Training plans — planned workouts imported via iCal or CSV.
  • Recommendation audit records — snapshots of the inputs and outputs used to generate daily guidance, retained for explainability and support review.

Why we process your data

Activity, health, and biomechanics data are processed to calculate training guidance, readiness context, risk signals, and plan adherence. We process this data with your explicit consent, given at account creation. Health-related data (HRV, sleep, resting heart rate) is classified as sensitive personal data under applicable privacy law and is processed only for the purpose of providing you with the service.

How we use your data

Imported data is used exclusively to calculate training guidance and analytics for your own account. We do not use your training or health data to train, fine-tune, or improve AI models. AI features use inference only — generating narrative text from pre-computed analytics scores, similar to a template engine with natural language output. Raw activity data from connected platforms is never provided to AI models.

Garmin-specific handling

Garmin Connect can provide activity data and optional health metrics such as heart rate, sleep, HRV, stress, and resting heart rate. Garmin activity data is used only for your own private dashboard, readiness context, and training guidance inside your account.

Garmin health metrics are synced only after you complete the in-product health-data consent acknowledgement. Garmin data is synced on a scheduled daily basis rather than a real-time webhook model.

Disconnecting Garmin removes Garmin-derived data from the platform. Garmin-derived analytics records follow the same rolling 12-month retention baseline described below.

Data retention

Activity, health, biomechanics, and recommendation records follow a rolling 12-month retention window. Data older than 12 months is automatically removed. Recommendation audit records are retained within the same window to support explainability and user support. Account data is retained for the life of your account and removed upon deletion.

Your data, your controls

You have the following rights over your data:

  • Access — request a copy of the data we hold about you.
  • Deletion — delete your account from Settings, which removes all associated records and linked integrations immediately.
  • Correction — request that inaccurate account data be corrected.
  • Portability — request your data in a structured, machine-readable format.
  • Consent withdrawal — disconnect any integration at any time, which immediately removes all data from that source.

Settings currently supports account deletion and integration disconnect. Export, access, correction, and portability requests are handled directly via [email protected].

Connected sources

Strava is the primary activity source when connected. Activities are received via real-time webhooks. We request read-only access (scopes: read, activity:read_all, profile:read_all) and never modify your Strava data. Strava API data is not used to train AI models. Disconnecting Strava removes all Strava-derived data immediately.

Garmin is the fallback activity source when Strava is not connected and can also provide optional health metrics (HRV, sleep, stress, resting heart rate) when you enable Garmin health sync. Data is synced daily. Disconnecting Garmin removes all Garmin-derived data.

Striv provides optional supplementary biomechanics data from uploaded session files. Uploaded files are not stored — only the extracted biomechanics records are retained. Disconnecting Striv removes all Striv-derived records.

How we handled Strava data

When you connect your Strava account, we read your running activities, heart rate streams, and training zones via the Strava API. This data is processed on arrival into derived analytics metrics — training load scores, heart rate zone distributions, pace statistics, and risk signals. We do not retain raw Strava API responses beyond a short processing window. The derived analytics metrics are retained within our 12-month rolling retention window. Strava data is never used to train AI models, in accordance with Strava API terms.

Third-party sharing

We do not sell, share, or expose your data to other users or third parties for advertising or commercial purposes. Data may be shared with infrastructure providers (hosting, database) strictly for the purpose of operating the service. These providers are bound by data processing agreements.

Data security

All data is transmitted over encrypted connections (TLS). Restricted data (OAuth tokens, credentials, secrets) is never logged and is encrypted at rest where applicable. Access to production data is restricted to authorised personnel only. In the event of a data breach presenting high risk to your rights, we will notify you within 72 hours.

Eligibility and children

Masters Running Analytics is intended for users aged 18 or older (or the age of digital majority in your jurisdiction). We do not knowingly collect personal data from persons under this age.

Changes to this notice

We may update this privacy notice from time to time. The date at the bottom reflects the most recent revision. Material changes will be communicated via the platform or by email.

Last updated: March 2026