Privacy Policy

DRAFT — Kevin has not yet given final sign-off on every clause below (see §5). Not legal advice. Source: docs/legal/DRAFT-PRIVACY-POLICY.md.

1. Who this covers

Coaching Vault ("the platform") is the coaching data and training-plan system operated by Powerhouse Cycling / UAE Team Emirates coaching staff ("the coach", "we"). This covers any athlete ("you", "the rider") whose training data is held by the platform, whether you access it directly or it is used only by your coach.

2. What we collect, and where it comes from

Only what a connected source actually sends, plus what a coach enters by hand:

  • TrainingPeaks — workouts, laps, wellness (sleep, HRV, RHR where your device syncs them), personal records, CTL/ATL/TSB.
  • Strava — activities and, only where you have explicitly authorised it, 1 Hz stream data (GPS position is stripped before anything leaves the coach's Mac).
  • Analog Sports — physiology (critical power, W′, durability, LT1), blood biomarkers, zones.
  • A wearable (e.g. WHOOP) — only where readings already flow into TrainingPeaks' wellness import.
  • Your coach, by hand — date of birth, weight, height, race calendar, session notes, feedback.

We do not buy or receive data about you from any other source, and we do not sell your data.

3. What we do with it: AI services

Two kinds of AI work touch your data. The daily briefing your coach reads is written by the platform using Claude, an AI system made by Anthropic, from your training history, physiology, wellness, race calendar and season position.

When your coach asks a question, builds or edits a plan, or challenges a number, the work is done by the AI service your coach has connected to their own account(for example Claude or ChatGPT). That service reads the data your coach is allowed to see, through the Coaching Vault connector, and is covered by the coach's own agreement with its provider. The connector can only save drafts. Nothing is published to TrainingPeaks by an AI: every plan is a draft, and only your coach can approve and publish it, gated by a same-day human authorisation step.

4. Where your data is stored

  • Supabase (hosted Postgres + object storage) — structured records and, for riders with a connected stream source, 1 Hz ride data with GPS position removed before upload.
  • The coach's Mac — the working copy of your files, and the only place raw, un-trimmed GPS position is ever held.

5. How long we keep it — retention

Not yet confirmed. This is a genuine open decision, named here rather than invented.

Three concrete options, for Kevin to choose between:

  • A. Retained for the life of the coaching relationship, plus 12 months after it ends or you are archived — whichever is later (the proposed default, reasoned in docs/legal/DRAFT-PRIVACY-POLICY.md §5).
  • B. Retained indefinitely until you or your coach requests export/deletion.
  • C. Deleted automatically after 12 months of account inactivity, regardless of relationship status.

Whichever is chosen, your deletion right in §6 works immediately at any time — you are never made to wait for a scheduled purge.

6. Your rights: export and delete

Because you can see everything your coach sees about your training, you can also take it with you and ask for it to be removed.

  • Export. You (or your coach, on your behalf) can request a full export of everything the platform holds about you — your local files, your Supabase records, and an index of your stored ride streams. From the coach dashboard: Data rights. From your own rider app: Your data.
  • Delete. You can request permanent removal. Your coach previews exactly what would be removed, then a second, explicit confirmation carries it out — irreversible, and logged.
  • Verify. After a delete, the platform checks — not on faith — that nothing is still held.

7. Third parties who can see your data

  • Your coach and any coaching colleague given access to the platform.
  • Anthropic, only for the training-plan-building requests in §3, under Anthropic's API terms.
  • TrainingPeaks, Strava, Analog Sports already hold whatever you gave them directly — this platform reads from them, it does not give them anything they did not already have.

We do not share your data with sponsors, insurers, or any other third party without your separate, explicit consent.

8. Changes to this policy

Kevin will confirm a final version, at which point the DRAFT marker is removed and a version date is added.

Questions or a data-rights request: kevin@powerhousecycling.com.au, or ask your coach directly. See also Terms.