Privacy Policy

1. Overview

TrailMetrics is designed to enrich your trail running activities by calculating specialized trail metrics (elevation gain/loss, vert per kilometer, GAP, terrain category, VAM, pacing fatigue index, and km-effort) and appending them onto your Strava activity description. We value your privacy and retain only the minimal data required to deliver this service.

2. Data We Collect & Process

When you authenticate with Strava and upload activities, we process:

• Athlete Profile: Your Strava Athlete ID and name to associate your account with webhook events.
• OAuth Credentials: Secure access and refresh tokens to interact with the Strava API on your behalf.
• Activity Metadata: Distance, moving time, elapsed time, elevation gain/loss, kilometer splits, max speed, and sport type.
• Biometrics (Optional): Heart rate (average and max) solely when provided, to calculate Training Load (TRIMP).

We do not store raw GPS track streams, detailed geographical coordinates, or map geometries in our database. Activity enrichment calculations are processed transiently in-memory when a webhook notification is received.

3. Waitlist Data

If TrailMetrics has reached its current capacity and you choose to join the waitlist, we collect the following additional data:

• Email address — the only piece of information we store for waitlist purposes.

Purpose: Solely to notify you when a spot becomes available. We will send you one email at that point and will not contact you for any other reason.

Storage: Your email is stored in a secure PostgreSQL database with Row Level Security enabled, separate from and not linked to any Strava athlete records or activity data.

Retention: Waitlist emails are retained until you are notified that a spot is available and choose to connect, or until you request deletion, whichever comes first.

Legal basis (EU / GDPR): Processing is based on your freely given, specific, and informed consent at the time you submit your email. You may withdraw this consent and request deletion at any time (see Section 6).

Data separation: Waitlist email addresses are stored independently and are not associated with your Strava account, athlete profile, activity data, or OAuth tokens in any way.

4. No Sale of Data & No AI Model Training

We do not sell, rent, monetize, or share your activity or athlete data with third-party advertisers or data brokers.

In accordance with the Strava API Developer Agreement, none of your Strava activity data, athlete information, or biometrics is used to train, fine-tune, or develop Artificial Intelligence (AI) or Machine Learning (ML) models.

5. Data Storage & Security

Athlete tokens and idempotency records (activity ID and status) are stored in a secure PostgreSQL database with Row Level Security (RLS) enabled. Only isolated server-side processes with authorized service credentials can access these records. Athlete tokens are never exposed to the client-side or public web.

6. Deauthorization and Data Deletion

You maintain full control over your data and can disconnect TrailMetrics at any time directly from your Strava account under Settings → My Apps → Revoke Access.

When an athlete revokes authorization, Strava immediately notifies our webhook endpoint. We automatically delete your athlete record, stored tokens, and all associated activity processing logs from our database.

To request deletion of your waitlist email address, contact us via Instagram DM (see Section 8) and we will remove it promptly.

7. Third-Party Services

TrailMetrics integrates directly with the Strava API. Your use of Strava remains governed by the Strava Privacy Policy.

8. Contact & Inquiries

If you have any questions regarding this Privacy Policy or your data, you can reach out directly via direct message on our Instagram page: @trailmetrics.app.