Legal
Privacy Policy
Last updated July 2026
CourseRecon — Privacy Policy Effective Date: March 2026 Last Updated: 4 July 2026
1. Overview
CourseRecon is operated by CourseRecon LTD ("we," "us," or "our"), based in Auckland, New Zealand. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use CourseRecon.
We are committed to compliance with the New Zealand Privacy Act 2020 and the EU General Data Protection Regulation (GDPR) where applicable. Residents of Washington State and Nevada: our Consumer Health Data Privacy Policy explains how we handle consumer health data under your state laws.
2. Information We Collect
2.1 Account Information
When you create an account, we collect:
- Email address
- Name (optional)
- Password (managed by our authentication provider, Supabase Auth, as a salted bcrypt hash — we never see or store your plaintext password)
- Sport preferences (running, cycling, triathlon)
2.2 Athlete Profile Data
To provide personalised analysis, you may provide:
- Age, weight, and gender
- Experience level
- Race goals and target events
- Training preferences
2.3 Activity and Training Data
When you connect a third-party fitness platform or upload files directly:
From Strava (via OAuth):
- Activity history (routes, distances, durations, elevation, heart rate)
- Athlete profile data (weight, FTP, heart rate zones)
- Segment efforts and personal records
From direct FIT/GPX/TCX file uploads:
- GPS coordinates and elevation data
- Heart rate, cadence, power, and other sensor data embedded in activity files
- Timestamps and activity metadata
Activity and training data may include health-related information such as heart rate. Where the GDPR applies, we process this data on the basis of your explicit consent, which you give when you connect Strava or upload an activity file. You can withdraw that consent at any time by disconnecting Strava (which deletes our copy of your Strava activity data) or deleting your account.
2.4 Course Data
When you upload a course file for analysis:
- GPX/FIT/TCX file contents (coordinates, elevation, waypoints)
- Race name, date, and event details you provide
2.5 Payment Information
CourseRecon is currently free to use and we do not process payments. If we introduce paid plans, payments will be handled by a dedicated payment processor (we will never store full card numbers), and this policy will be updated before payments launch.
2.6 Technical and Usage Data
We automatically collect:
- IP address (processed transiently for security and rate limiting, and present in our hosting provider's short-lived request logs — we do not store IP addresses in our database)
- Browser type, operating system, and device type
- Pages visited and features used within CourseRecon
- Referral source
- Session duration and interaction patterns
- Error and crash reports (stack traces, browser context, and request metadata)
- Push notification data — if you enable browser notifications, we store your push subscription (endpoint, delivery keys, and browser user-agent) and your notification preferences (including timezone and quiet hours)
We use privacy-respecting analytics and error tracking tools to understand how the Service is used and to identify and fix issues. We do not use Google Analytics or any tracking tool that shares data with advertising networks.
3. How We Use Your Information
We use your information to:
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Provide course analysis and readiness scoring | Activity data, course files, athlete profile | Contract performance |
| Generate pacing and training recommendations | Activity data, athlete profile, course analysis | Contract performance |
| Send service emails (account updates, coach invitations you trigger) | Email address | Contract performance |
| Improve our algorithms and analysis accuracy | Aggregated, anonymised activity and course data | Legitimate interest |
| Respond to support requests | Account and communication data | Contract performance |
| Generate AI race analysis and coaching digests ("Coach's Analysis") | Athlete name, readiness scores, training-load summaries, race details, coach notes | Contract performance |
| Deliver notifications you enable (email and browser push) | Email address, push subscription, notification preferences | Contract performance / Consent for push |
| Monitor errors and improve reliability | Error reports, technical data | Legitimate interest |
| Detect fraud and abuse | Technical data, usage patterns | Legitimate interest |
| Send product updates and feature announcements | Email address | Consent (opt-in) |
We do not use your data for:
- Advertising or ad targeting
- Sale to third parties
- Profiling for purposes unrelated to the Service
- Training AI/ML models on individually identifiable data
Note: AI-generated analysis (see §8.2) sends data to an AI model to produce your report; no AI model is trained on your identifiable data.
4. How We Share Your Information
We share your data only in the following limited circumstances:
4.1 Service Providers
We use trusted third-party services to operate CourseRecon:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Authentication, database hosting | Account data, athlete data, activity data, course data | USA (us-west-1) |
| Vercel | Application hosting, web analytics, AI request routing (AI Gateway) | Technical data (IP, request logs), anonymised usage metrics, AI analysis inputs (see §8.2) | USA (Global CDN) |
| Anthropic (via Vercel AI Gateway) | AI-generated race analysis and coaching digests | Athlete name, readiness scores, training-load summaries, race details, coach notes — see §8.2 | USA |
| Resend | Transactional and notification email delivery | Email address, message subject and content | USA |
| Sentry | Error monitoring, crash reporting, sampled session replays | Stack traces, browser/OS context, request metadata, interaction recordings with all text masked and media blocked | USA |
| Vercel Analytics | Privacy-respecting, cookieless usage analytics | Page views, referral source, device type (no personally identifiable information) | USA |
| Strava | Fitness data sync (when connected) | OAuth tokens; activity data flows from Strava to us | USA |
4.2 Open Data Sources
To perform course analysis, we query open data services using the GPS coordinates from your uploaded course files. These services include OpenStreetMap (Overpass API), NASA SRTM, and ESA Copernicus. Only geographic coordinates are sent — no personal information is transmitted to these services.
4.3 Legal Requirements
We may disclose your information if required by law, court order, or government request, or to protect the rights, safety, or property of CourseRecon, our users, or the public.
4.4 Business Transfers
If CourseRecon is acquired or merged, your data may be transferred to the new entity. We will notify you before any such transfer and give you the option to delete your account.
4.5 Your Coach (if you join a squad)
If you accept a coach's invitation, that coach can see your readiness scores, training summaries, race entries, and Strava connection status, and may record private coaching notes about you. Leaving a squad (Settings → Coaching) immediately removes the coach's access to your live data and race entries, and deletes the notes and AI summaries the coach held about you.
We will never sell your personal data.
5. Data Storage and Security
5.1 Where Your Data Is Stored
Your data is primarily stored in Supabase's US region. Application hosting and static assets are served via Vercel's global CDN.
5.2 Security Measures
We implement the following security measures:
- Encryption in transit (TLS 1.2+) for all connections
- Encryption at rest for database storage
- Password hashing (salted bcrypt, managed by Supabase Auth)
- Row-level security policies in our database
- OAuth 2.0 for third-party integrations (no passwords stored for Strava)
- Regular security reviews and dependency updates
- Principle of least privilege for internal access
5.3 Data Retention
| Data Type | Retention Period |
|---|---|
| Account information | Until you delete your account |
| Activity and training data | Until you delete your account or disconnect the integration |
| Course analysis results | Until you delete the analysis or your account |
| AI-generated analysis | Until the underlying analysis or your account is deleted |
| Hosting/request logs | Retained briefly by our hosting provider (Vercel), typically no more than 30 days |
| Support communications | 2 years after resolution |
6. Your Rights
6.1 All Users
Regardless of your location, you can:
- Access & export your data — view your data in the app at any time; request a machine-readable export of everything we hold about you by emailing [privacy@courserecon.app] (a self-serve export is on our roadmap)
- Correct your data — update your profile and preferences at any time
- Delete your data — delete your account and all associated data instantly from your account settings
- Disconnect integrations — revoke Strava access at any time
- Opt out of marketing emails — unsubscribe link in every email
6.2 Additional Rights (GDPR — EU/EEA/UK Users)
If you are located in the EU, EEA, or UK, you additionally have the right to:
- Data portability — receive your data in a machine-readable format
- Restrict processing — ask us to limit how we use your data
- Object to processing — object to processing based on legitimate interest
- Withdraw consent — where processing is based on consent
- Lodge a complaint — with your local data protection authority
6.3 New Zealand Privacy Act 2020
Under the NZ Privacy Act, you have the right to:
- Access your personal information held by us
- Request correction of inaccurate information
- Lodge a complaint with the Office of the Privacy Commissioner
7. Cookies and Tracking
CourseRecon uses a minimal set of cookies:
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| Session token | Authentication | Essential | Session / 30 days |
| Preferences | UI settings (units, dark mode) | Functional | 1 year |
| Analytics | Privacy-respecting usage analytics (Vercel Analytics — cookieless) | Analytics | Session only |
Analytics and Error Tracking: We use privacy-respecting, cookieless web analytics to understand how the Service is used, and error tracking tools to detect and fix issues. These tools do not use cookies, do not track users across sites, and do not collect personally identifiable information. No consent is required as no cookies are set for analytics or error tracking purposes.
We do not use:
- Third-party advertising cookies
- Cross-site tracking pixels
- Social media tracking widgets
- Fingerprinting techniques
You can manage cookies through your browser settings. Disabling essential cookies may prevent you from using the Service.
8. Third-Party Integrations
8.1 Strava
When you connect Strava, we use OAuth 2.0 to access your activity data. We request only the permissions necessary to provide the Service:
- Activity summaries and details (routes, pace, heart rate, elevation)
- Athlete profile (weight, FTP, heart rate zones)
- Segment efforts
We request Strava's activity:read_all permission, which includes activities you have marked private — training analysis is only accurate against your complete log. Private activities are never shown publicly by CourseRecon.
We do not post to your Strava account, modify your data, or access your social feed, followers, or clubs. You can disconnect Strava at any time from your CourseRecon account settings or from Strava's "My Apps" settings page; disconnecting deletes our stored copy of your Strava activity data.
Strava API compliance: CourseRecon displays Strava data in accordance with the Strava API Agreement. Activity data sourced from Strava is attributed with the "Powered by Strava" badge where required.
8.2 AI-Generated Analysis
Parts of CourseRecon (the "Coach's Analysis" on readiness reports, and coaching digests) are generated by a large language model (Anthropic's Claude), accessed through Vercel's AI Gateway. To generate them we send the model: your name, your readiness scores and pillar breakdown, summaries of your recent training load (hours, distance, elevation, intensity — not raw GPS tracks or heart-rate streams), your target race and goal, and — for coach digests — notes your coach has written. AI requests are not used to train models, and we cache the generated text so repeated views don't re-send your data. AI output can be inaccurate; see our Terms of Service for the full disclaimer.
8.3 FIT File Uploads
When you upload FIT files directly, we process the embedded data (GPS, heart rate, cadence, power, temperature, etc.) to build your training profile. FIT files are stored securely and deleted if you remove the activity or delete your account.
8.4 Validation Study
Some users joined our readiness validation study, contributing pre-race training data and post-race survey responses used to validate our scoring. Study data is retained for research integrity; to have your study contribution removed, email [privacy@courserecon.app].
9. Children's Privacy
CourseRecon is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.
10. International Data Transfers
Your data is primarily processed in the United States (Supabase, Vercel, Anthropic, Resend, Sentry, Strava) and may transit through other locations via Vercel's global CDN. As your data is transferred outside New Zealand, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required by GDPR for EU/EEA/UK users.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before changes take effect. The "Last Updated" date at the top of this page indicates the most recent revision.
12. Contact Us
For privacy questions, data requests, or complaints:
Privacy Contact: [privacy@courserecon.app]
For NZ Privacy Act complaints, you may also contact: Office of the Privacy Commissioner PO Box 10094, Wellington 6143 https://privacy.org.nz