Privacy Policy
Last updated October 1, 2026
The short version
- Your reflections belong to you. We use them to run Athlete Arc for you, and we never sell them.
- A coach sees only what you've shared with them, and only after you've both agreed to connect. Private entries stay private.
- We use a small number of service providers (listed below) to host the app, store and play videos, transcribe and summarize reflections, send notifications and email, report errors, and connect to Strava.
- You can ask us to delete your account and everything in it at any time.
This policy explains what information Athlete Arc ("Athlete Arc", "we", "us") collects when you use our website at athletearc.app and our mobile app (together, the "Service"), how we use it, and the choices you have.
Information we collect
Information you give us
- Account details: email address, password (stored only in hashed form by our authentication provider), first and last name, date of birth, whether you're an athlete or a coach, and an optional profile photo.
- Reflections: the voice and video recordings you make, reflections you type, their written transcripts, your answers to follow-up questions, and whether each one is shared or private.
- Notifications: if you allow notifications, a push token that lets us send notifications to your device.
- Coaching connections: which coaches and athletes you connect with, team names a coach creates, and comments left on shared reflections.
- Early-access list: if you join our waitlist, your email address and whether you're an athlete, coach or parent.
Information from Strava, if you connect it
When you connect your Strava account, Strava shares your Strava athlete ID and name, and access tokens that let us read your activities. We read activity details (activity name, type, start time, moving time, distance and climbing, and, when your device records them, power and heart rate) so we can prompt you to reflect after a session and show the workout alongside your reflection. Power and heart-rate figures are shown only to you, not to coaches. We don't post to Strava or change anything there.
Information we generate
- Summaries and themes: we analyze the text of your reflections to write a short summary, pick out themes, suggest one follow-up question, and note mentions of pain, illness or sleep ("body flags").
- Mood and trend scores: we estimate signals such as energy, confidence, motivation and stress from your reflections, and combine them into trends such as your Arc Score and monthly recaps. These are rough indicators, not medical or psychological assessments.
- Activity markers: for example, when a coach first viewed or acknowledged a shared reflection.
Technical information
Like most online services, our servers receive your IP address and basic request details when you use the Service. We use IP addresses briefly to prevent abuse (for example, limiting repeated login attempts) and delete those records within a few days. If the Service hits an error, it sends a technical error report (what failed, where in our code, and the device or browser type) to our error-reporting provider so we can fix it. Error reports identify an account only by an anonymous ID and never include reflections, recordings, transcripts, anything you type, or your email.
Usage events
To learn which parts of Athlete Arc are used, we record a few moments with the time, your account ID, the app version and whether you were in your own journal or in Coaching: opening the app, which main screen you view, starting a recording (voice, video or typed), opening an after-workout prompt, and completing or skipping each setup step. These events never include anything you say, type or record, and we keep them for 13 months. They stay with us: we don't use advertising trackers or third-party analytics.
How we use information
- To provide the Service: store your reflections, transcribe them, show your trends, and prompt you after Strava activities.
- To share what you've chosen to share with the coaches you've connected with, including an alert to them if a shared reflection mentions pain or illness.
- To keep the Service secure, prevent abuse, and fix problems.
- To understand which features are used, so we can improve them.
- To contact you about your account, security, or (if you joined the waitlist) early access.
We do not sell your personal information, use it for advertising, or use your reflections to train AI models.
Who can see your information
- You can see everything in your account.
- Coaches you've connected with can see your name, email, profile photo, reflections you've marked as shared, the related activity details, and scores calculated from shared reflections. They can't see private reflections or tell that they exist. Either of you can end the connection at any time.
- Service providers who process data for us to run the Service (below). They may use it only to provide their service to us.
- Legal reasons: we may disclose information if required by law, or to protect someone's safety.
Service providers
| Provider | What they do for us | Data involved |
|---|---|---|
| Supabase | Database, authentication and file storage (hosted in the United States) | All account data, reflections, recordings and photos |
| Vercel | Hosts our website and servers | Data passing through our servers |
| Mux | Stores and plays video reflections | Video recordings (deleted no later than 90 days after upload) |
| OpenAI | Transcribes recordings, and writes summaries, themes, follow-up questions, trend signals and monthly recaps from reflections | Recordings, transcripts and typed reflections, sent when you save a reflection or a recap is prepared |
| Expo | Delivers push notifications to your device (through Apple's notification service) | Your push token and the text of each notification |
| Resend | Sends account emails, such as password resets | Your email address and the email's contents |
| Sentry | Error reporting | Technical error details and an anonymous account ID (never reflections, recordings, transcripts or email) |
| Strava | Source of your activity data, if you connect it | Your Strava ID and access tokens |
| Google Fonts | Serves the typeface used on our website | Your IP address when a page loads fonts |
Under OpenAI's API terms, data we send them is not used to train their models.
How long we keep information
We keep your information for as long as your account is open, except video recordings, which are deleted automatically no later than 90 days after upload (the written reflection stays). If you delete your account or ask us to, we delete your account data, reflections, recordings and Strava tokens within 30 days, except where we must keep something to comply with the law. Usage events are kept for 13 months. Waitlist emails are kept until early access opens or you ask us to remove yours.
Your choices and rights
- Access and correction: you can view and edit your profile in the app at any time.
- Private reflections: mark any reflection private so no coach can see it.
- Coaching connections: accept, decline or remove coaches and leave teams from your profile.
- Strava in your Strava settings: you can also revoke Athlete Arc's access from Strava itself; we're notified and remove your connection the same way.
- Deletion and export: delete your account at any time from your profile in the app or on the website; this permanently removes your profile, reflections, recordings, comments, coaching connections and Strava connection. You can also download a copy of your data from your profile on the website, or email us at brian.riordan@gmail.com for either.
- Strava: disconnect Strava from your profile at any time. We revoke our access, delete your Strava tokens, and remove synced activities you haven't reflected on.
Depending on where you live, you may have additional rights under local law (for example in California or the EU). Contact us and we'll help.
Security
We protect your information with encryption in transit, access controls that limit data to the people it belongs to, and rate limits that make password guessing impractical. Voice recordings are stored privately and are only accessible through short-lived links. No system is perfectly secure, but we work to protect your data and will notify you if a breach affects it.
Young athletes
Athlete Arc isn't intended for children under 13, and we don't knowingly collect personal information from them. Athletes aged 13 to 17 should use Athlete Arc with a parent's or guardian's permission. If you believe a child under 13 has given us information, contact us and we'll delete it.
Changes to this policy
If we make meaningful changes, we'll update the date above and let you know in the app or by email before the changes take effect.
Contact
Questions or requests: brian.riordan@gmail.com