your privacy.
short version: minimal collection, encrypted at rest, SMS optional.
what we collect
Email address, display name, primary sport, and optional race date. A password hash for app login. Your intervals.icu athlete id and API key — the API key is encrypted at rest with Fernet (AES-128 + HMAC-SHA256). Coach conversation turns. Training data synced from intervals.icu (activities, wellness rows, athlete profile). If you opt into SMS, we also store your US phone number, SMS consent timestamp, and SMS conversation turns. When you request phone verification in the iOS app, we process your phone number and one-time code. This phone-based access creates a private, unsubscribed identity without an email, password or Intervals account. After separate morning-text consent, we store only the latest app readiness score, sleep duration and seven-day training minutes. Raw HealthKit samples, workout routes and muscle notes are not uploaded.
how it flows
Your training context + coach conversation pass through the configured LLM API (currently NVIDIA NIM in production) to generate replies. Twilio sends and checks a verification code when you request one. Twilio also processes the morning summary text. App summaries are not sent to the LLM. Morning texts require separate SMS and summary consent; verification does not subscribe you or reverse a previous opt-out. All morning summaries come from the app. Historical intervals.icu records remain stored, but are no longer read or synced for morning delivery. Everything we store sits in Supabase (US-hosted Postgres on AWS).
how it's protected
HTTPS for every request. Your intervals.icu API key is encrypted at rest with a Fernet key stored as a Fly.io secret outside the database. Row-level security is enabled on every public-schema table; only the service role can read or write. No analytics, no third-party cookies, no tracking pixels.
calendar writes
The coach writes training plans into your intervals.icu calendar as planned events, with structured workouts attached for key sessions. You can edit or delete them in intervals.icu directly. Ask Mingjun to pause or delete your account if you want the coach to stop writing new items.
retention & deletion
We keep your data as long as you're an active user. Message Mingjun directly to remove everything — including future calendar events the coach has written into your intervals.icu account. If you opted into SMS, text STOP to unsubscribe from texts and stop future app-summary uploads. Disconnecting a device removes its saved session without changing SMS consent.
personal project
This is run by one person (Mingjun) as a personal project — not a commercial service. Mingjun has full database access for debugging and may read conversation history. There's no team, no support desk, no SLA.
contact
Anything off about your data? Reach out to Mingjun directly.
last updated: 2026-10-26