Privacy Policy

1. Introduction

HWGA Training Lab ("we," "our," or "the App") is a personal training coach that helps individual athletes understand their own fitness, build a personalised training plan, and request coaching insights — all based exclusively on their own data. The App does not aggregate data across users, generate insights about users for our own benefit, or use any athlete's data for purposes other than providing that athlete with their own personalised coaching experience. This policy explains what data the App processes, where it is stored, and which third-party services are involved.

2. Information We Collect

Strava Data

If you choose to connect your Strava account, you authorise the App to retrieve your own activity data (e.g., date, distance, duration, heart rate, power, elevation) through the Strava API. This data is private by default — visible only to you within the App — and is used exclusively to display your own training history back to you, generate a personalised training plan for you, and provide you with coaching insights about your own performance. It is never aggregated across users, sold, used for business analytics, or used for any purpose other than serving you as an individual athlete, and it is shared only as described in sections 3 and 4 below.

Intervals.icu Data

If you connect to Intervals.icu, you authorise the App to process your own activity and wellness data — such as HRV, weight, sleep, resting heart rate, and training load — exclusively to provide you with personalised training insights. This data is private by default and is never shared with or visible to other users. If you send your training plan to Intervals.icu, the App also writes those planned workouts to your Intervals.icu calendar and keeps them up to date when your plan changes.

Google Health Data

If you connect your Google Health account (Fitbit or Pixel Watch), you authorise the App to retrieve your own wellness data — sleep, heart rate variability, resting heart rate, oxygen saturation, weight, body fat, and respiratory rate — through the Google Health API. This data is used exclusively to provide you with your own personalised training and recovery insights, alongside data from your other connected sources. It is never aggregated across users, never used for advertising or any purpose unrelated to your personal coaching experience, and never transferred to third parties except as necessary to provide the App's features, such as the AI coaching described in section 3. The App's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Email Address

If you add an email address to your account, the App keeps it as a second way to sign in and uses it only to send you one-time sign-in codes, through an email delivery service. It stays with your account until you delete the account; Clear Data keeps it so you can still sign in.

Local Device Storage

By default, the App stores your activities, wellness data, training plan, and coach state locally in your browser so they persist between visits. This data remains on your device and is not accessible to anyone else.

Cloud Sync

When you are signed in, the App keeps your training state in a private, per-athlete cloud record so it follows you between devices. It is stored under a unique identifier tied to your account and is never shared with or visible to other users. How long each part is kept:

• Activities and wellness data: 7 days after you last used the App. After that they are fetched again from your connected sources.
• Your training plan, past plans, FTP, weight and settings: until you clear your data or delete your account, so a new device gets them back.
• Training history derived from your activities (per-ride and per-run power bests, ride durability and heart-rate anchors): until you delete your account, so it does not have to be rebuilt every week.
• Coaching notes and workout analyses: up to 7 days. Plan backups: 3 days.
• A list of activities you deleted (activity numbers only): 100 days, so a deleted activity doesn't come back from another device.

Authentication tokens and provider secrets are never included in sync payloads.

Credentials

Your Strava, Intervals.icu and Google Health access tokens are kept on the App's server, separately from your training data, so the App can fetch your new activities and wellness data. Your Strava sign-in session is kept in an encrypted cookie, and a backup of your Intervals.icu connection is kept in a cookie on the device where you connected it, which the App's pages can't read and which is sent only to the App's server, for up to a year or until you disconnect Intervals.icu, clear your data or delete your account on that device. Tokens are never included in cloud sync payloads, never sent to the AI provider, never visible to other users, and are deleted when you delete your account.

3. AI Coaching

• The App uses a third-party AI provider to write your daily brief, to check whether today's workout should be adjusted, to summarise a finished plan, and to answer your requests for coaching reports, plan changes and workout reviews.
• The daily brief and the workout check run automatically when you open the App, and the summary runs when you open a finished plan's report. Coaching reports, plan changes and workout reviews run only when you ask for them.
• Each request sends a summary of your training: fitness and fatigue numbers, training-load totals, wellness readings and trends (such as HRV, sleep and resting heart rate), your training plan, and training metrics of recent rides or of the ride being reviewed — for example a ride's normalized power, intensity, interval powers and heart-rate zones. Activity names, descriptions, GPS routes, per-ride distances and account identifiers are never sent.
• Your data is never used to train AI models. Under its terms the provider may keep a request for a limited time, solely to detect abuse and meet legal obligations, and then delete it.

4. Sharing Your Data

We do not sell, trade, or rent your personal data. We share data only with the third-party services strictly necessary to deliver the features you use. No data is shared for advertising, profiling, or any purpose unrelated to your personal coaching experience. If you create a share link for a workout or a plan report, anyone with the link can see that page until the link expires after 7 days; clearing your data or deleting your account removes your links. The services that run the App — hosting, the database, the email service for sign-in codes, the AI provider, and the services you connect — process your data only to provide the App to you.

5. Data Deletion

• You can disconnect Strava, Intervals.icu or Google Health at any time on the Connections page. Disconnecting Intervals.icu or Google Health revokes the App's access (for Google Health the App also asks Google to revoke the grant and deletes its connection records); data already imported stays. Disconnecting Strava removes the App's access in Strava, which also deletes your cloud data and signs out your other devices; the device you disconnect on keeps its own copy until you clear it.
• To remove your data but keep your account, use Clear Data on the Sync page. It deletes your cloud data first (activities, wellness, plans, training history, coaching notes and share links), then the copy on this device; your other devices clear theirs the next time they sync. Your sign-in (your Strava link and your email address) stays.
• To delete everything, use Delete account & all data on the Account page, revoke the App's access in your Strava settings, or delete your Strava account. Each one deletes all data stored for you, including your email address and training history. A minimal marker (your Strava athlete number and the time of deletion) is kept for 100 days so that a device still signed in can't upload your data again. Deleting your Intervals.icu or Google account stops new data from them; what was already imported stays until you clear it or it expires.
• To request immediate deletion of any cloud-stored data, contact us at hello@hwga.app.

6. Contact

For questions about this policy, contact us at hello@hwga.app.