Privacy Policy

This Privacy Policy explains what data Train Ultra collects, how we use it, who we share it with, how long we keep it, and your rights over it. It applies to use of the Train Ultra mobile apps and web dashboard. If you do not agree with this policy, do not use the service.

1. Who we are

Train Ultra is operated by Spare Mile, LLC, a limited liability company organized in the State of Washington, USA, doing business as Spare Mile Studio (“we,” “us,” or “our”). For the purposes of GDPR and similar laws, Spare Mile, LLC is the data controller of the personal data described in this policy. You can reach us at [email protected]. Given our size and the nature of our processing, we have not appointed a Data Protection Officer.

2. What we collect

Train Ultra collects only the data needed to deliver AI-generated activity titles, workout evaluations, coaching conversations, training summaries, and the other features you use.

• Account data — your email address (used for sign-in via a 6-digit code), your first and last name (where you provide them), and the account-creation timestamp.
• Strava activity data — when you connect Strava, we read your activity history, including activity metadata (name, type, start time, duration), splits, heart-rate streams, GPS streams, and laps. Train Ultra can write generated activity titles to Strava. Train Ultra automatically writes each newly generated workout evaluation to the activity description or private note when that is your selected posting mode. If you select Train Ultra only, the evaluation stays in Train Ultra.
• Garmin Connect wellness data — if you connect Garmin, we ingest the daily summaries and events made available by the Garmin Health API: daily summaries, sleep, heart-rate variability (HRV), stress, respiration, pulse-oximetry, skin temperature, and the user-metrics events that update them.
• Oura data — if you connect Oura, we ingest similar daily wellness summaries via the Oura API.
• Apple Health data — if you connect Apple Health on iOS, the app reads workouts and daily wellness data from HealthKit on your device (sleep, heart-rate variability (HRV), resting heart rate, heart rate, respiration, blood oxygen, wrist temperature, VO2max, steps, and active energy) and sends daily summaries to our servers so your coach can factor them into evaluations and conversations. We read only the categories you approve in the HealthKit permission sheet, we do not write to Apple Health, and we never use HealthKit data for advertising or share it with third parties.
• User-generated content — goals you create, coach conversation history, and athlete-profile fields you fill in (such as sex, age, training history, optional injury notes, and optional max-heart-rate or threshold-pace values).
• Coach attachments — images, PDF and DOCX documents, TXT and Markdown files, FIT files, and GPX, TCX, and ZWO activity and course files that you choose to add to a Coach conversation, together with a safe display name, file type, byte size, and validation metadata. These private files can contain health, medical, identity, or precise-location data. Train Ultra does not require this content, and you control which files you upload.
• Activity Routes — when a connected Strava or Garmin activity carries GPS coordinates, Train Ultra reads its geographic trace to show that activity’s map, elevation, sections, and comparisons.
• Routes and route files — when Train Ultra indexes a usable Activity Route, or when you import a GPX, TCX, or FIT file into your Route Library or a goal, Train Ultra stores the resulting Route: its file, its decoded path and elevation, any name you give it, and any route or section preferences you set. A Route you import or link to a goal is kept independently, and survives deletion of the Coach conversation it came from.
• Places — a private map of the sport- and date-filtered places your completed activities cover. Places uses only completed Activity Routes; a route you only imported or linked to a goal is not shown as a visited place.
• Goal and Training Proposal data — you can link a goal to a Route as that goal’s course. When you ask the coach to help you prepare for a linked goal, the coach can create a Training Proposal: a reviewable set of suggested Calendar changes tied to the goal and its course facts. A Training Proposal changes nothing on your Calendar until you review and apply it.
• Map display requests — showing a map on the web dashboard, iOS app, or Android app sends the visible map area (tile coordinates and zoom level), your IP address, and your device or browser’s user-agent string to our map-tile provider, Stadia Maps. Train Ultra does not send your name, account identifier, activity title, route name, sensor data, or your full route trace with a map request, and does not use a place-search (geocoding) service.
• Device tokens — when you grant push-notification permission in a mobile app, we store its Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) device token so we can deliver notifications about your activities and coach prompts.
• Billing identifiers — if you subscribe to a paid tier, we store the customer, purchase, or subscription identifiers and status metadata returned by Stripe, Apple, or Google. We do not store full card numbers; the payment provider handles payment credentials and processing.
• Operational logs — limited request and response metadata for debugging, capacity planning, and abuse prevention. These logs may include IP address, user-agent, timestamps, the route accessed, and error details.
• Legal acceptance records — when you accept the Terms of Service or this Privacy Policy, we record the version accepted, the timestamp, your IP address, your user-agent string, and the platform (web, iOS, or Android) so we can demonstrate consent if asked.
• Product usage data — Train Ultra records limited account-linked events about how the web dashboard and mobile apps are used, such as app opens, screens viewed, features used, and completion of setup or coaching steps. We use this data only to operate, understand, and improve Train Ultra. We limit event metadata through per-event allowlists and structural-value checks. We do not intentionally collect email, names, tokens, coach-message or evaluation text, workout notes, or other free-text athlete content in product usage events.
• Marketing-site analytics — Google Analytics 4 (GA4) uses cookies to measure traffic and page use on our public marketing pages. Train Ultra also sends conversion events (account creation, trial start, purchase, cancellation) to GA4 under a pseudonymous browser or account-derived identifier, so we can see which marketing channels lead to signups and subscriptions. These conversion events are shared with Google Ads to measure our advertising. We do not load GA4 inside the authenticated dashboard or mobile apps, and these events never include your name, email, or training content.

3. How we use it

• To generate creative AI-written titles for your Strava activities.
• To generate AI workout evaluations and coaching responses grounded in your training and wellness data.
• To store and process the Coach attachments you select so the Coach can discuss them. Train Ultra sends validated images, documents, and text to the AI-inference endpoint as part of the Coach request. Train Ultra decodes TXT and Markdown files as text and FIT files as a bounded data projection instead of sending their raw file bytes. Adding or discussing a Coach attachment does not create an Activity or change your training history.
• To compute training summaries, weekly stats, year-over-year comparisons, and other derived views.
• To show Activity maps, build and search your Route Library, run repeat-activity comparisons, show Places, and prepare you for a goal using its linked Route and course facts.
• To send transactional emails (sign-in codes, account-deletion confirmations, billing receipts).
• To send push notifications about your activities, evaluations, and coach prompts.
• To operate, debug, secure, and improve the service.
• To understand how Train Ultra’s features are used, diagnose friction, and improve the service.
• To prevent fraud and abuse and to enforce our Terms of Service.
• To comply with legal obligations (for example, tax record-keeping for billing data).

We do not sell your personal information, and we do not share your personal information with third parties for cross-context behavioral advertising. We do not use your training data to train third-party foundation models beyond the per-request inference described below.

4. Who we share it with

We share personal data with the third parties below only as needed to deliver the features you use. Depending on the service, they process data on our behalf or provide a service directly to you under their own terms.

• DigitalOcean — hosts our backend, database, private object storage, and AI-inference endpoint. Activity, wellness, Coach conversation, Coach attachment, goal, and product usage data passes through DigitalOcean’s infrastructure. Validated images and documents, decoded text and FIT projections, and other data used by AI features pass through the inference API as part of the Coach request.
• ElevenLabs (via DigitalOcean’s text-to-speech endpoint) — when you use the audio-playback feature on a workout evaluation, the evaluation text is sent for speech synthesis. We do not retain the synthesized audio beyond what is needed to deliver it to you.
• Stadia Maps — supplies the map tiles and styling for Activity maps, the Route Library, and Places on the web dashboard, iOS app, and Android app. Each map tile or style request discloses the requested tile coordinates (which reveal your current map viewport and zoom level), your IP address, and your user-agent to Stadia Maps. Stadia Maps states that it keeps server logs for approximately 7 to 14 days, and separately keeps aggregated analytics data without your raw IP address for longer. Train Ultra does not use a geocoding (place-search) processor.
• Strava, Garmin, Oura — connected providers that process data for the features you choose. Train Ultra writes generated activity titles to Strava and, when your selected evaluation posting mode is the Strava description or private note, automatically writes each newly generated evaluation there. Train Ultra can send planned workouts to Garmin when you use Garmin workout scheduling. We read authorized activity or wellness data from these providers as described in Section 2.
• Resend — transactional email delivery (sign-in codes, account-deletion confirmations, billing-related notices).
• Stripe, Apple, and Google — payment processing for subscriptions. The payment provider receives the billing details you submit and returns customer, purchase, or subscription metadata to Train Ultra; we do not receive full card numbers.
• Apple Push Notification service and Firebase Cloud Messaging — delivery of push notifications to your mobile device.
• Google Analytics and Google Ads — GA4 measures traffic and page use on our public marketing pages with cookies, and receives our conversion events (account creation, trial start, purchase, cancellation) under a pseudonymous identifier. Conversions are shared with Google Ads to measure our advertising. GA4 does not load inside the authenticated dashboard or mobile apps.

We may also disclose personal data when we believe in good faith that disclosure is required to comply with a law, court order, or other valid legal process; to protect the rights, property, or safety of Spare Mile, LLC, of our users, or of the public; or in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets (in which case we will give you advance notice and the chance to delete your account before the transfer where the law requires it).

5. How long we keep it

We retain personal data only as long as we need to provide the service or to meet a specific legal or operational requirement.

• Account data (email, name, account-creation timestamp): for the lifetime of your account, plus up to 30 days after deletion to allow backup purges to complete.
• Strava activity data: lifetime of account + 30 days.
• Garmin and Oura wellness data: lifetime of account + 30 days.
• User-generated content (goals and athlete profile): lifetime of account + 30 days.
• Coach conversations and their attachments: until you delete the conversation or your account. We delete the conversation and its private attachment objects from active systems. Copies in backups are purged within 30 days. A ready attachment that you do not send expires after 24 hours.
• Activity Routes (the geographic trace read from a connected activity): follows the source Activity. Deleting the Activity removes its recorded trace from Places, route-visit counts, and comparisons; it does not delete an independently saved Route.
• Routes, Route Versions, and route files (your Route Library): kept until you delete the Route or your account. Deleting a Route removes its versions, files, sections, and preferences; the Activities that used it remain.
• Goals, goal courses, and Training Proposals: kept until you delete the goal or your account. Deleting a goal removes its course link, preparation records, and Training Proposals, but keeps the Route itself and any already-applied Planned Workouts (with their goal reference marked unavailable).
• Device tokens: removed when you uninstall the app, when APNs or FCM reports the token as invalid, or 30 days after account deletion — whichever happens first.
• Billing identifiers and invoices: 7 years after the last transaction, to comply with US tax record-keeping requirements. Card numbers are never stored by us.
• Operational logs: 90 days.
• Legal acceptance records: kept indefinitely so we can demonstrate consent if disputed; references to the user are removed on account deletion (the audit row survives but is no longer linked to you).
• Product usage data: retained for the lifetime of your account and deleted from our active systems when you delete your account. Copies in backups are purged within 30 days.
• Marketing-site analytics (GA4): Google retains measurement and conversion data for the GA4 property’s configured retention window (currently 14 months).

Content Train Ultra previously wrote to Strava, including generated activity titles and workout evaluations already written to activity descriptions or private notes, may remain on Strava after you delete your account. Train Ultra does not remove or rewrite that past Strava content during account deletion.

6. International data transfers

Train Ultra’s backend infrastructure and most of our processors are located in the United States. If you access Train Ultra from outside the United States — including from the European Economic Area, the United Kingdom, or Switzerland — your personal data will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses (or equivalent transfer safeguards) with our processors to protect personal data on transfer.

7. Your rights and how to exercise them

You have the following rights with respect to your personal data:

• Access a copy of the personal data we hold about you.
• Correct personal data that is inaccurate or incomplete.
• Delete a Coach conversation, including its attachments, from Coach History. You can also delete your account and the personal data we hold about you from the mobile apps (Settings → Delete Account), the web dashboard (Settings → Delete Account), or by emailing us. Deletion permanently removes the data described in Section 5 within the listed retention windows and disconnects Train Ultra from your Strava, Garmin, and Oura authorizations.
• Delete a Route from your Route Library, or a goal, from the mobile apps or web dashboard. Deleting a Route removes its versions, files, and preferences; deleting a goal removes its course link, preparation records, and Training Proposals. Both keep the unrelated data described in Section 5.
• Object to or restrict certain processing, where the law gives you that right.
• Withdraw consent for processing that depended on your consent (for example, push notifications or optional provider connections), without affecting the lawfulness of earlier processing.
• Receive a portable copy of personal data you provided to us, where the law gives you that right.

To exercise any of these rights, email [email protected]. We will respond within the time required by applicable law (no later than 30 days under GDPR, 45 days under CCPA) and may verify your identity before acting on a request. There is no fee for exercising these rights, and we will not discriminate against you for exercising them.

8. EEA, UK, and Switzerland (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR (or UK GDPR / Swiss FADP). We are the controller of your personal data. We process personal data under the following lawful bases:

• Contract — processing necessary to deliver the service you signed up for (running AI features, storing goals and activities, processing payments).
• Legitimate interests — processing necessary to secure the service, prevent fraud, debug operational issues, understand how features are used, improve the service, and maintain audit records of legal-document acceptance. Where we rely on legitimate interests, you may object as described in Section 7.
• Consent — processing that depends on a permission you grant, including push notifications, optional connected providers (Garmin, Oura), and the use of optional athlete-profile fields. You may withdraw consent at any time.
• Legal obligation — processing necessary to comply with law (for example, retaining billing records for tax purposes).

You also have the right to lodge a complaint with a supervisory authority — for example, your national data-protection authority in the EU, the UK Information Commissioner’s Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC). We encourage you to contact us first so we can try to resolve the issue.

Your data is transferred to the United States and processed there. See Section 6 (International data transfers) for the safeguards we rely on.

9. California residents (CCPA / CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories of personal information we collect. In the 12 months preceding this policy’s effective date, we collected the following categories: identifiers (email, name, IP address, device token), commercial information (billing identifiers and subscription history), internet or other electronic-network activity (product usage events and operational request logs), health and fitness information, user-generated content and files, geolocation from connected activities, imported route files, or uploaded FIT files, and inferences drawn from the above to provide the service. We collect these directly from you and the files you choose to upload, from Strava / Garmin / Oura when you authorize them, and from your device.

How we use it. See Section 3 (How we use it).

How we share it. See Section 4 (Who we share it with). Depending on the recipient, they process data on our behalf under contractual terms or provide a service directly to you under their own terms.

Do not sell or share my personal information. We do not sell your personal information and we do not share your personal information for cross-context behavioral advertising. We do not knowingly process the personal information of minors under 16 for sale or sharing.

Sensitive personal information. Health-related fields (heart rate, HRV, sleep, athlete-profile injury notes), precise location, and health, medical, or identity data in files you choose to upload may qualify as sensitive personal information under California law. We use them only as needed to deliver the AI features you use, and we do not use them to infer characteristics about you for any purpose unrelated to the service.

Your California rights. You may request to know what personal information we have collected about you, to delete it, to correct it, and to limit our use of sensitive personal information. To exercise these rights, email [email protected]. We will respond within 45 days (extendable by an additional 45 days where reasonably necessary, with notice). There is no fee, and we will not discriminate against you for exercising your rights.

10. Children

Train Ultra is not directed at children. We do not knowingly collect personal data from anyone under 13 in the United States, or under 16 in the European Economic Area, the United Kingdom, or Switzerland (unless local law sets a different age and a parent or guardian has consented).

If you believe a child under the applicable age has provided personal data to Train Ultra, please contact [email protected]. We will delete the account and the personal data we hold about that child promptly upon verification.

11. Apple App Privacy disclosures

To help users on the iOS App Store understand how Train Ultra uses data, here is how the data described in this policy maps to Apple’s “App Privacy” categories. This summary is provided for transparency; the canonical declaration is the one we file with Apple.

• Data linked to you: contact info (email, name); user content (goals, Coach conversations, uploaded photos and files, your Route Library, athlete-profile fields); health and fitness data (Strava activities; Garmin, Oura, and Apple Health workout and wellness data; uploaded FIT or medical information); precise location (connected activities, imported route files, or uploaded FIT files); identifiers (account id, device token); usage data (product interactions and operational request logs); financial info (customer, purchase, or subscription identifiers from Stripe, Apple, or Google, not card numbers); diagnostics (debugging logs).
• Data not linked to you: marketing-site measurement and conversion reporting via GA4, which uses pseudonymous identifiers rather than your name or email.
• Data used to track you: none. Train Ultra does not track you across apps or websites owned by other companies.

12. Cookies and similar technologies

We use a session cookie (HTTP-only, secure) on the web dashboard to keep you signed in. On public marketing pages, Google Analytics 4 sets cookies to measure traffic and to attribute signups and subscriptions to marketing channels, and Google Ads receives conversion measurements through our Google Analytics link. We do not use cookies for ad personalization or cross-site tracking, and Google Signals stays disabled. You can disable cookies in your browser, but doing so may break sign-in.

13. Security

We protect personal data using a combination of TLS-encrypted transport, encryption at rest in our managed database and object storage, least-privilege access controls, and routine review of operational logs for anomalous behavior. No service is perfectly secure, and we cannot guarantee absolute security; we will notify affected users of a personal-data breach as required by applicable law.

14. Changes to this Policy

We may update this Privacy Policy as the product evolves. Where we make material changes, we will announce them in the in-app changelog and bump the Effective date at the top of this page. For material changes, you will be asked to re-accept this Policy before continuing to use Train Ultra; we will tell you, in summary, what has changed. If you do not accept the updated Policy, you may stop using the service and delete your account at any time.

15. Contact

For any privacy-related question or request, email [email protected].