Legal
Privacy policy
Trainpane is a Mac app that shows live data from your fitness equipment and can upload your workouts to Strava. It's run by Peter Gifford ("Trainpane", "we", "us"). This policy explains what we collect, why, who we share it with, how long we keep it and how to delete it.
In short: workouts stay on your Mac unless you choose to push them. A pushed workout goes to our server only so it can be uploaded to your Strava account. We don't sell data, show ads or use analytics, and deleting your account deletes everything we hold about you.
What we collect
| Data | Where it comes from | Why |
|---|---|---|
| Account: your email address, your name if you give one, and your password (stored hashed by our sign-in provider), or your Google sign-in | You, when you create a Trainpane account | To sign you in and to tie your workouts and Strava connection to you |
| Strava connection: your Strava athlete ID and name, the permissions you granted, and the access tokens Strava issues to Trainpane | Strava, when you choose Connect Strava | To upload the workouts you push to your Strava account |
| Pushed workouts: the activity name and type, start time, duration, distance, and a second-by-second record of speed, power, heart rate, cadence and incline, plus the ID of the Strava activity created from it | The app, only when you choose Push to Strava | To build the file Strava receives, and to show you the upload's progress and link |
| Beta signup: your email address, your name if you give one, which computer you use and the equipment you list | You, through the form on this site | To invite you to the beta and to ask how it's going |
| Emails you send us, including any log file you attach | You | To answer you and fix problems |
| Server logs: request details such as IP address, time and the page or API address requested | Your browser or the app, when it contacts our servers | To keep the service running and secure. Our hosting provider keeps these for a short time |
Heart rate is health information, so we treat workouts with particular care: they're used only to upload to Strava for you and to show you your own uploads.
What stays on your Mac
While you train, the app reads your Bluetooth sensors and keeps the workout in memory on your Mac. Nothing is sent anywhere unless you push the workout. If you trash it, it's gone. The app also keeps on your Mac:
- Your sign-in, as a token in the macOS Keychain.
- A session log in
~/Library/Logs/Trainpane, listing device names, connection events and workout events. It's only sent to us if you choose to send it. - Your workout plans and settings, in
~/.config/trainpane.
The app has no analytics, advertising or tracking code.
Strava
Trainpane is compatible with Strava, but isn't made or endorsed by Strava. When you connect Strava, you choose on Strava's own page what Trainpane may do. Trainpane uses that permission only to upload the workouts you push. We don't read your other activities, and nobody but you sees anything about your Strava account through Trainpane.
- Strava data is never used to train or prompt AI models, and never passed to an AI assistant or agent.
- If you disconnect Strava in the app, or revoke Trainpane in your Strava settings, we delete your Strava tokens straight away.
- If you delete an activity on Strava that Trainpane uploaded, Strava tells us and we forget that activity's ID straight away.
- Once a workout is on Strava, Strava's own privacy policy covers it there.
Who we share data with
We don't sell or rent personal data, and we don't share it for advertising. We share it only with the services that run Trainpane, and only as much as each one needs:
| Service | What it does for us |
|---|---|
| Authgear | Sign-in: holds your login (email, password hash, Google link) and your sessions |
| Only if you choose to sign in with Google | |
| Render | Hosts our server and this website, in the United States |
| MongoDB Atlas (on Amazon Web Services) | Our database, in the United States (Oregon) |
| Strava | Receives the workouts you push, on your instruction |
| Our email provider | Delivers the email you send to and receive from trainpane.com addresses |
We may also disclose data if the law requires it, or to protect someone's safety. If Trainpane is ever sold or merged, your data would move only under this policy, and we'd tell you first.
How long we keep it
- Account and pushed workouts: while your account exists. Deleting your account (Account → Delete account in the app) deletes your Strava connection and every workout we hold straight away, and revokes Trainpane's access at Strava. Your login itself is removed from the sign-in provider when you delete it under Account → Login settings.
- Strava tokens: until you disconnect Strava, revoke Trainpane on Strava, or delete your account.
- Beta signups: until the beta ends, or sooner if you ask us to remove you.
- Emails and attached logs: as long as we need them to help you, and no longer than a year.
Backups of our database may hold deleted data for a short time until they're replaced.
Security
Everything sent between the app, this site and our servers is encrypted in transit. Strava tokens are encrypted again (AES-256) before they're stored. The app never sees your Strava tokens or password. No system is perfectly secure, but we'll tell you promptly if a breach affects your data.
Your choices and rights
You can ask us to show you, correct, export or delete the data we hold about you, or to stop using it. Email support@trainpane.com and we'll reply within 30 days. You can delete your account and data at any time from the app without asking us.
If you're in the UK or the European Economic Area, we use your data to provide the service you asked for (contract), to email you about the beta (your consent, which you can withdraw at any time), and to keep the service secure (legitimate interests). You can complain to your local data protection authority. Your data is stored in the United States.
If you're in California, you have the right to know, delete and correct your personal information, and we don't sell or share it as those terms are defined in California law.
Children
Trainpane isn't for anyone under 16, and we don't knowingly collect their data. If you think a child has given us data, email us and we'll delete it.
Changes
If we change this policy, we'll update the date above. For significant changes, we'll also tell you in the app or by email before they take effect.
Contact
Questions about privacy: support@trainpane.com.