Privacy Policy

1. Introduction

TrainCraft ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

2.1 Personal Information

We collect information that you provide directly to us:

• Account Information: Name, email address, password
• Profile Information: FTP, weight, cycling goals, training history
• Payment Information: Processed securely through Stripe (we do not store credit card details)

2.2 Training Data

We collect data you create or import:

• Workouts and training plans you create
• Training calendar and scheduling information
• Activity data imported from Strava (if you connect your account)
• Progress metrics and analytics

2.3 Automatically Collected Information

When you access our Service, we automatically collect:

• Usage Data: Features used, pages visited, time spent
• Device Information: Browser type, operating system, device type
• Log Data: IP address, access times, error logs
• Cookies: We use cookies to maintain your session and preferences

3. How We Use Your Information

We use your information to:

• Provide the Service: Enable core functionality and features
• Personalization: Customize your experience and recommendations
• AI Features: Generate personalized workouts based on your data (PRO+AI users)
• Communication: Send service updates, support responses, and newsletters (opt-in)
• Analytics: Understand usage patterns and improve the Service
• Security: Protect against fraud and unauthorized access
• Legal Compliance: Comply with legal obligations

4. How We Share Your Information

4.1 Service Providers

We share data with trusted third-party service providers:

• Clerk: Authentication and user management
• Stripe: Payment processing
• Supabase: Database hosting
• Vercel: Application hosting
• Anthropic: AI processing (PRO+AI features)
• PostHog: Analytics (anonymized)

4.2 Third-Party Integrations

If you choose to connect third-party services (e.g., Strava), we share only the data necessary for that integration to function. This is done with your explicit consent.

4.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or to protect our rights and the safety of others.

4.4 Business Transfers

If TrainCraft is involved in a merger, acquisition, or sale of assets, your information may be transferred. We will notify you of any such change.

5. Data Retention

We retain your information for as long as your account is active or as needed to provide services. If you delete your account, we will delete your personal data within 30 days, except:

• Information required for legal or regulatory compliance
• Anonymized data used for analytics
• Backup copies (automatically deleted within 90 days)

6. Data Security

We implement industry-standard security measures to protect your data:

• Encryption in transit (HTTPS/TLS)
• Encryption at rest for sensitive data
• Regular security audits and updates
• Access controls and authentication
• Secure payment processing via Stripe

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

7. Your Rights and Choices

7.1 Access and Update

You can access and update your account information at any time through your account settings.

7.2 Data Export

You can request a copy of your data in a machine-readable format by contacting us at [email protected].

7.3 Account Deletion

You can delete your account through account settings or by contacting us. This will permanently delete your personal data.

7.4 Marketing Communications

You can opt out of marketing emails by clicking "unsubscribe" in any marketing email or updating your preferences in account settings.

7.5 Cookies

You can control cookie preferences through your browser settings. Note that disabling cookies may limit Service functionality.

8. Children's Privacy

TrainCraft is not intended for users under 13 years of age. We do not knowingly collect personal information from children under 13. If we learn we have collected such information, we will delete it immediately.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place to protect your data in accordance with this Privacy Policy.

10. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information (we do not sell your data)
• Right to request deletion of personal information
• Right to non-discrimination for exercising CCPA rights

11. GDPR Compliance (European Users)

If you are in the European Economic Area, you have rights under the General Data Protection Regulation (GDPR):

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Service. The "Last updated" date at the top indicates when changes were last made.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: [email protected]

For general support: [email protected]