What Information We Collect

TrainSync collects the following information to provide our service:

• Phone Number: Used to identify you and enable WhatsApp messaging
• intervals.icu Access Token: Obtained via OAuth to upload workouts to your calendar
• Workout Data: Workouts you create through conversations with the AI coach
• Training Preferences: Your fitness level, training goals, race information, and pace zones
• Conversation History: Recent messages to provide context for personalized coaching
• Fitness Metrics: Data from intervals.icu (with your permission) to inform coaching recommendations

How We Use Your Information

We use your information exclusively to:

• Create personalized, structured workout plans
• Upload workouts to your intervals.icu calendar
• Provide training advice and coaching recommendations
• Remember your preferences and training context
• Calculate appropriate pacing zones based on your fitness level
• Improve the service and fix bugs

We never: Sell your data, share it with advertisers, or use it for purposes other than providing TrainSync services.

Data Storage & Security

Your data is stored securely on Vercel's infrastructure with the following protections:

• Encryption at rest: All data encrypted in storage
• HTTPS/TLS: All data transmission is encrypted in transit
• Secure databases: Vercel KV (Redis) with enterprise security
• Access controls: Limited access to production data
• No plaintext passwords: OAuth tokens are used instead of passwords

Third-Party Services

TrainSync integrates with the following third-party services:

• intervals.icu - To upload and manage planned workouts in your calendar. Your access is controlled via OAuth and can be revoked anytime in your intervals.icu settings.
• OpenAI (ChatGPT) - To provide AI-powered coaching responses. Conversations are sent to OpenAI's API for processing. OpenAI's privacy policy applies: openai.com/privacy
• Twilio (WhatsApp Business API) - For WhatsApp messaging infrastructure. Twilio's privacy policy applies: twilio.com/legal/privacy
• Vercel - Cloud hosting and database services. Vercel's privacy policy applies: vercel.com/legal/privacy-policy

Data Retention

• Active Users: Data retained while you use TrainSync
• Conversation History: Last 50 conversations kept for context
• Workout History: Last 100 workouts retained
• Inactive Users: Data may be deleted after 12 months of inactivity
• Deleted Users: All data permanently deleted within 30 days of deletion request

Your Rights & Controls

You have complete control over your data:

• Access: Request a copy of all your data stored in TrainSync
• Correction: Update your preferences, fitness level, or training goals anytime
• Deletion: Request permanent deletion of all your data
• Revoke intervals.icu Access: Disconnect your intervals.icu account in your intervals.icu settings under "Authorized Apps"
• Stop Using TrainSync: Simply stop texting the bot - your data remains secure
• Export: Request export of your workout history and training data

Children's Privacy

TrainSync is not intended for users under 13 years old. We do not knowingly collect information from children. If you believe a child has provided information to TrainSync, please contact us immediately.

International Users

TrainSync is hosted in the United States. If you use TrainSync from outside the US, your information will be transferred to and processed in the US where data protection laws may differ from your country.

Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make changes:

• The "Last Updated" date will change
• We'll notify active users via WhatsApp for material changes
• Continued use constitutes acceptance of the updated policy

Analytics & Cookies

TrainSync does not currently use cookies or third-party analytics tracking on web pages. Basic server logs (IP addresses, access times) are collected automatically for security and debugging purposes.

Data Breaches

In the unlikely event of a data breach affecting your information, we will:

• Notify affected users within 72 hours
• Explain what data was affected
• Detail steps we're taking to address it
• Provide guidance on protecting your account

Legal Compliance

TrainSync complies with:

• GDPR (European General Data Protection Regulation) - For EU users
• CCPA (California Consumer Privacy Act) - For California residents
• CAN-SPAM Act - We don't send unsolicited marketing messages
• COPPA (Children's Online Privacy Protection Act) - No data from users under 13

Your Consent

By using TrainSync, you consent to this privacy policy. When you first authorize TrainSync to access your intervals.icu account, you're agreeing to these terms.