Privacy Policy

Who we are

SurgeIQ Lab (“we”) runs this website and app and is responsible for the personal data described here. For any privacy question, request or complaint, contact our contact page.

Browsing the public site

The public pages and tools (guides, the calculators and the workout builder) work without an account. Values you type into the calculators stay in your browser. When you download a FIT file from the workout builder, the workout is sent to our server only to build the file and is not stored. We don’t use analytics cookies or advertising.

Your account

• Sign-in details: your email address, the display name you choose, a hashed password (we never store the password itself), whether you signed up as an athlete or coach, and whether you’ve confirmed your email.
• Age: your year of birth, so we can keep under-13s out and ask for a parent or guardian’s agreement for riders under 16. We don’t store your full date of birth.
• Profile: details you choose to add: gender, FTP, weight, weekly training hours, goal, target race date and home location.
• Training data: your workouts and plans, completion status, and daily training state such as load and readiness.
• Consent records: when you gave or withdrew consent to the processing of training and health-related data.

Health-related data

Heart rate, power, FTP, weight and the load and readiness figures we calculate from them can reveal things about your health, so we treat them as health data. We process them only with your explicit consent, given at sign-up, and only to run your training: to show it back to you, calculate zones, load and readiness, plan sessions, and show it to coaches you accept. You can withdraw consent in My profile at any time; doing so disconnects Strava and deletes your imported activities and readiness history. Washington, Nevada and Connecticut residents: see our consumer health data policy.

Strava

Connecting Strava is optional. If you connect it, we ask Strava for read access to your activities, including ones you’ve marked private, and store the access and refresh tokens it issues (encrypted). For each imported activity we store the name, sport type, start time, duration, distance, elevation gain, average and normalised power, best power over set durations, average and maximum heart rate, average cadence, Strava’s relative effort, your description, and a training-load figure. We also store the heart-rate and power zones from your Strava account. We don’t store GPS routes, maps or second-by-second data streams.

When you disconnect Strava, or revoke access from Strava’s settings, we revoke our access and delete the tokens, zones and every activity imported from Strava. Activities you delete on Strava are deleted here too. Strava’s own privacy policy covers data on Strava.

Who can see your data

• Coaches: a coach can invite you by your email address. Until you accept, the coach sees only your display name and that the invitation is pending. Once you accept, the coach can see your profile, calendar, workouts and generated weekly plans (including the training analysis behind them), and can place draft workouts on your calendar. Removing a coach ends their access. Coaches never see your email, password or Strava tokens.
• Other riders: if you join an event or challenge, your display name appears on its participant list or leaderboard.
• Home location is used only to show you announcements for your area; it isn’t shown to other riders.
• We don’t sell personal data or share it for targeted advertising, and we don’t use your training data to target ads.

Service providers

• Supabase hosts our PostgreSQL database.
• Our application and website hosting providers run the server and deliver the pages.
• Our email provider sends account emails (confirmation, password reset, retention notices).
• Strava, only if you connect it.

These providers process data on our instructions. Some are in the United States. If you’re in the EU, UK, Switzerland or Canada, your data is transferred there. We rely on the EU–US Data Privacy Framework (and its UK extension) where the provider is certified, and on standard contractual clauses otherwise.

Legal bases (EU and UK)

• Contract: to provide your account, workouts, plans and files.
• Explicit consent: for health-related training data and Strava imports.
• Legitimate interests: to keep the service secure, for example rate-limiting sign-in attempts.

Cookies and browser storage

We use two cookies that are needed for signing in and security: a session cookie that keeps you signed in, and a CSRF cookie that protects forms from cross-site attacks. We don’t use local storage or tracking cookies.

How long we keep data

• Your account and training data: until you delete your account. Accounts not signed in to for 24 months are deleted, after an email warning 30 days beforehand.
• Strava data: until you disconnect Strava, revoke access, delete the activity on Strava, or withdraw consent.
• Sign-in sessions expire after two weeks.
• Database backups kept by our hosting provider expire on their own schedule; deleted data disappears from them as they expire.

Children and junior riders

You must be 13 or older to create an account. Riders under 16 must confirm that a parent or guardian agreed. Junior riders get the same protections as everyone else: no ads in the app, no data sales, and coaches see their training only after they accept an invitation. If you believe a child under 13 has an account, contact us and we will delete it.

Security

Connections use HTTPS, passwords are hashed, Strava tokens are encrypted, and sign-in attempts are rate-limited. If a breach affects your data, we’ll notify you and the relevant regulators as the law requires.

Your rights

• Access and portability: download everything we store about you under Privacy & data in My profile.
• Correction: edit your profile and training data in the app.
• Deletion: delete your account in My profile. It’s removed immediately, and our access to Strava is revoked.
• Withdraw consent: in My profile, at any time.
• Objection and restriction: contact us.

For anything you can’t do in the app, or to make a complaint, contact our contact page. We acknowledge complaints within 30 days and answer requests within a month. You can also complain to your data protection authority: the ICO in the UK, your national authority in the EU, the Office of the Privacy Commissioner of Canada, or the Commission d’accès à l’information in Quebec.

Changes

If we change how data is handled, we’ll update this page first and change the “updated” date above. For material changes we’ll also tell account holders by email.