Privacy Policy

Effective Date: June 4, 2026
Last Updated: October 27, 2026

Training Blocks ("we," "us," "our," or the "App") is an AI-powered running coaching app developed by Dean Dominguez ("Developer"). This Privacy Policy explains what data the App collects, how we use it, who we share it with, and the rights you have over your data.

By using Training Blocks, you agree to the practices described here. If you do not agree, please do not use the App.

---

1. Who We Are

• Developer: Dean Dominguez (sole proprietor)
• Contact: support@training-blocks.com
• App: Training Blocks (iOS)
• Website: https://training-blocks.com

We are a single-developer operation based in the United States.

---

2. Data We Collect

We collect only what we need to coach you. Categories:

2.1 Account Data

• Email address
• Hashed password (handled by our authentication provider, Supabase — we never see your plaintext password)
• Account creation timestamp, last sign-in time
• Display name, if you provide one

2.2 Profile & Training Data

• Self-reported runner profile (experience level, weekly mileage, recent races, injuries you choose to disclose)
• Race goals and target dates
• Generated training plans, training blocks, and scheduled workouts
• Workout completion data: distance, duration, pace, heart rate, elevation (from linked activities)
• Subjective inputs you log: rating of perceived exertion (RPE), how you felt, freeform notes to your coach

2.3 Linked Activity Data (Strava)

If you connect a Strava account:

• Recent activities (runs and other workouts you authorize)
• Activity streams: pace, heart rate, cadence, altitude, GPS where present
• Classified workout segments derived from these streams

OAuth is brokered through our backend so that the Strava client secret never lives on your device. We store an access token and a refresh token, scoped to the permissions you grant. You can revoke access at any time from your Strava account settings or by disconnecting in the App.

2.4 Apple HealthKit (Optional)

If you grant HealthKit permission, we read the following data types (you choose which to allow in the system permission sheet):

• Workouts: your running workouts, including their date, duration and type
• Walking + running distance
• Heart rate (the app reads each workout's average and maximum heart rate)
• Active energy burned
• Workout routes (GPS location points recorded during a workout)
• Resting heart rate (RHR)
• Heart rate variability (HRV)
• Sleep analysis
• VO2 Max estimates

What leaves your device. For each run we upload to our servers:

• its date, distance, duration, average and maximum heart rate, energy and elevation gain;
• streams derived from its route: time, distance, speed, grade and altitude along the run.

Your route's GPS coordinates (latitude/longitude) stay on your device. They are used only to draw the map in the App and are not uploaded. Resting heart rate, HRV, sleep and VO2 Max readings are uploaded as values for your account.

How it is used. This data is stored with your account and used to build and adjust your training plan, track your fitness and progress, and power coaching. To write your plan and coaching messages, summaries of this data are sent to our AI provider (Anthropic; see Section 4), which does not use it to train its models.

We do not write to HealthKit. HealthKit data is used solely to provide the App's training and coaching features. Per Apple's App Review Guidelines:

• We never use HealthKit data for advertising or marketing.
• We never sell HealthKit data.
• We never share HealthKit data with third parties for their own purposes.
• HealthKit data is used only to provide in-app coaching features.

You can revoke HealthKit permission at any time in iOS Settings → Privacy & Security → Health.

2.5 AI Generation Logs

When the App generates a training plan, classifies a workout, or responds to a coaching chat, we store:

• The prompt sent to the AI model (including the runner profile context required to produce useful output)
• The model's response
• Timestamps and the model version used

We keep these logs for quality auditing, debugging, and to improve coaching prompts. We do not use them to train any third-party AI model.

2.6 Device & Diagnostic Data

• App version, iOS version, device model
• Crash logs and error traces (via Sentry)
• Aggregated usage events (e.g., "plan generated," "chat message sent") — no message contents

We do not collect IDFA or use third-party advertising trackers.

---

3. How We Use Your Data

We use your data to:

• Generate personalized training plans and block arcs
• Power the AI coaching chat and workout classification
• Show you progress, fitness trends, and race predictions
• Send transactional emails (account verification, password reset)
• Debug crashes and improve the App
• Comply with legal obligations

We explicitly do not:

• Sell your data to anyone.
• Share your data with advertisers.
• Use your data to target ads to you inside or outside the App.
• Use your data to train third-party AI models.

---

4. Third-Party Services

Training Blocks relies on a small set of vendors. Each receives only the data needed to perform its function.

We have data processing relationships with each vendor and select them based on their security posture.

---

5. Data Retention & Deletion

• Active accounts: We retain your data for as long as your account is active.

• AI generation logs: Retained for up to 24 months for audit and quality purposes.

• Account deletion: Deleting your account (Settings → Delete account, or by emailing us) is immediate and permanent. There is no grace period, and a deleted account cannot be recovered. In a single operation we permanently delete everything stored for your account on our production systems: your profile, training plans and workouts, imported runs and HealthKit data, coaching conversations, AI generation logs, and connected-service tokens. We then:

  • delete your sign-in account with our authentication provider (Supabase);
  • revoke our access to Strava, if you connected it;
  • clear your cached data.

  If one of these external steps cannot finish right away, the App tells you which one is pending.
  We keep a minimal deletion record, with no name, email or training data, to show the deletion happened. Database backups containing your data are removed on their normal rotation (up to 35 days).

• Crash logs (Sentry): Retained per Sentry's default 30-day rolling window.

---

6. Your Rights

Regardless of where you live, you can:

• Access your data: in the App, Settings › Data management › Export data gives you a JSON archive of everything we have associated with your account.
• Delete your data: in the App, Settings › Data management › Delete Account permanently deletes your account and data immediately, as described in Section 5.
• Correct inaccurate data: Edit your profile in-app or email us.
• Withdraw consent: Disconnect Strava, revoke HealthKit permissions, or delete your account at any time.

GDPR (European Economic Area, UK)

If you are in the EEA or UK, you also have the right to:

• Object to processing or restrict it
• Data portability (covered by Export data in Settings)
• Lodge a complaint with your local supervisory authority

Our legal basis for processing is your consent (Art. 6(1)(a) GDPR) and, where applicable, performance of the contract you have with us (Art. 6(1)(b)).

Health and fitness data is "special category" data. Your heart rate, HRV, sleep, VO2Max, and related fitness signals (such as personal bests, pace, and recovery) are special-category personal data under Art. 9 GDPR. We process this data only on the basis of your explicit consent (Art. 9(2)(a)), which you give when you connect Apple Health or a third-party service and which you can withdraw at any time by disconnecting the integration or deleting your account.

Automated decision-making. We use algorithms and AI to generate training suggestions, but we do not make decisions that produce legal or similarly significant effects about you within the meaning of Art. 22 GDPR. Training plans and coaching messages are suggestions you remain free to accept, modify, or ignore.

CCPA / CPRA (California)

If you are a California resident, you have the right to know, delete, and not be discriminated against for exercising these rights. We do not "sell" or "share" personal information as those terms are defined under CCPA/CPRA.

To exercise any right, email support@training-blocks.com with the subject line "Privacy Request."

US State Consumer Health Data (Washington, Nevada, and similar laws)

Some US states have specific consumer-health-data laws, including Washington's My Health My Data Act and Nevada's health-data privacy law. Where these apply to you:

• The "consumer health data" we collect is the health and fitness information described in Section 2 (e.g., heart rate, HRV, sleep, VO2Max, and training metrics), sourced from your inputs, Apple Health (if you connect it), and connected services like Strava.
• We collect and use this data only to provide the App's coaching features, as described in this Policy.
• We do not sell your consumer health data, and we do not share it for cross-context behavioral advertising.
• You may access or delete this data, and withdraw consent, using the rights described above. We will not discriminate against you for exercising these rights.

To make a consumer-health-data request, email support@training-blocks.com with the subject line "Health Data Request."

---

7. International Data Transfers

Training Blocks is operated from the United States. If you use the App from outside the US, your data will be transferred to and processed in the US. By using the App, you consent to this transfer. For EEA/UK users, we rely on appropriate safeguards (vendor Standard Contractual Clauses where applicable).

---

8. Children's Privacy

Training Blocks is not intended for users under the age of 13. We do not knowingly collect data from children under 13 (COPPA). If you believe a child has provided us data, email support@training-blocks.com and we will delete it promptly.

For users between 13 and the age of majority in their jurisdiction, parental or guardian consent is required where local law mandates it.

---

9. Security

We use industry-standard practices:

• TLS for all data in transit
• Encryption at rest (PostgreSQL on Railway, Supabase Auth)
• Scoped OAuth tokens stored server-side
• JWT-based session auth, short-lived access tokens
• Principle of least privilege for vendor access

No system is perfectly secure. If we discover a breach affecting your data, we will notify you and any relevant authority as required by law.

---

10. Changes to This Policy

We may update this Privacy Policy. Material changes will be communicated by:

• In-app notice on next launch, and/or
• Email to your account address

The "Last Updated" date at the top reflects the most recent revision. Continued use of the App after a change means you accept the updated policy.

---

11. Contact

Questions, requests, or complaints:

Dean Dominguez
Email: support@training-blocks.com

We aim to respond to all privacy inquiries within 30 days.