Privacy policy

EndurTrack processes the data required to track your cycling: profile, imported activities, power, heart rate, goals, check-ins and plans.

Registration and preferences

During registration, EndurTrack uses your email address, country and language to verify your address, enable resumption and send at most one operational reminder after twenty-four hours. No marketing consent is requested and this information is not used to create internal funnel statistics.

An unfinished draft is deleted automatically after seven days, or immediately through the link received. When the account is created, the draft is deleted and country and language are retained in the profile until they are changed or the account is deleted.

Activity sources

EndurTrack works independently of any single platform. You can directly provide ZIP, FIT, FIT.GZ, TCX or GPX files from your bike computer, watch or training service. These files are processed in your private account and are never shared between users.

Strava data

The Strava connection is used only to display and process the authenticated athlete’s data in their private account. Data obtained through the Strava API, including derived metrics, is never sent to an artificial-intelligence provider, used to train or evaluate a model, or pooled across users.

Without broader written permission from Strava, data retrieved through the API is retained for no more than seven days. Disconnecting removes the token, API-sourced activities, related technical events and any plans derived from them. Activities supplied directly by the user through an archive remain under their control and are deleted with their account.

Isolation and access

Each account is isolated. A coach can access only the categories explicitly authorised by the athlete, until that access is revoked.

Public local calendar

The home page requests your location only after you take action, unless you have already allowed it in your browser. Coordinates are rounded to two decimal places before being sent, used to identify the approximate municipality through the French government geographic API and to query an open-events catalogue. They are neither linked to an account nor stored in the database; a technical response may remain cached for thirty minutes. Without permission, EndurTrack displays an open-data example around Paris.

Service providers

The application is hosted by Scaleway, protected by Cloudflare, uses Resend for email, R2 temporarily for archives, the public geo.api.gouv.fr and France Évasion Regions APIs for the calendar preview, and Strava when you connect it. After consent, the LLM provider can receive only information supplied by the user or from sources other than the Strava API.

Audience measurement

Google Analytics is loaded on every page as soon as it opens and uses cookies to measure page views and general technical information in order to improve EndurTrack. The Cookies notice informs you of this and can be dismissed; it does not control whether measurement is enabled. Your activity files, sports data and account content are not sent to Google Analytics.

Retention and security

Import archives placed on R2 are deleted after processing, and a fallback rule removes them within one day. Strava tokens are encrypted. Technical logs do not contain raw activity files.

Sharing with a coach

Training, recovery data and plan editing are three separate permissions. Only the athlete can grant them. Revocation takes effect immediately and is recorded in the security log.

Your choices

You can export your data, disconnect Strava, withdraw AI consent or delete your account immediately from your account area.

For any question or request about your data, email [email protected].