Privacy Policy

1. What We Collect

Endure is a training platform, so most of the data we collect is athletic and physiological in nature. Specifically:

• Workout data — duration, power output, heart rate, Training Stress Score (TSS), and structured workout steps
• Nutrition logs — meals, macronutrients, micronutrients, daily water intake, and meal photos you take or pick from your camera or library to log food
• Body measurements — weight entries logged manually or synced from connected devices
• Readiness data — sleep duration and quality, subjective energy, and stress survey responses
• GPS and location data — workout routes recorded or synced from your devices or connected platforms (website and connected services; the iPhone app does not request location permission). Routes are saved by default and used for your own training analysis. Only you and your coach can see them
• Device data — workout files you upload and data from any connection you choose to enable in Endure
• Account information — name, email address, account identifiers (user ID), and profile settings

The Endure Labs iPhone app does not use the Advertising Identifier (IDFA), does not run ads, and does not track you across other companies' apps or websites. Heart rate in the iPhone app is collected via a Bluetooth strap only during a user-started orthostatic test. There is no HealthKit integration.

We do not collect data we do not need. If a feature does not require a data type, we do not ask for it.

2. How We Protect Your Data

Athletic and biometric data is sensitive. We treat it that way:

• Encryption in transit and at rest — all data is encrypted over TLS in transit and encrypted at the database level at rest
• Row-level security — our database enforces that each user can only read and write their own data, enforced at the database layer, not just the application layer
• Audit logging — all data access events are logged so we can detect and investigate anomalies
• Regular security reviews — we conduct periodic security audits and apply patches promptly

3. Who Can Access Your Data

• You — always, with full access to everything you have logged
• Your coach — only after you connect with them on Endure, by accepting their invitation or when a coach you already train with adds you to their roster. A connection gives your coach full access to your training data: your calendar and planned workouts, completed workouts with their routes and analysis, fitness and training metrics, zones and thresholds, readiness and check-in answers (including sleep, heart rate variability, and how you feel), body measurements such as weight, nutrition logs, and the notes and comments you add. Your coach can also plan and change workouts for you. If your coach works within an organization on Endure, that organization's owners and admins have the same access. There are no separate sharing categories: the connection is the permission, and disconnecting the coach removes it
• Third-party integrations — a connected service receives or sends data only after you explicitly authorize it. Settings shows which connections are currently available and lets you revoke them
• Endure Labs staff — only for support purposes when you request help. We never browse user data without cause. Your data is never sold

4. Your Rights

You have meaningful control over your data:

• Export your data — you can download a full export of your account data (workout history, nutrition logs, readiness entries, settings) in JSON or CSV format from Settings at any time
• Delete your account — account deletion requests enter a 24-hour grace period in case of accidental submission. After that period, your data is permanently deleted in a cascading operation across all tables. Nothing is retained. On iPhone, start deletion from Settings → Delete Account; no extra email step is required
• Revoke consent — you can revoke any specific data-collection consent at any time via Settings, then Privacy. To stop sharing with a coach, disconnect them via Settings, then Coaches. Disconnecting immediately removes their access to your data
• Turn off GPS routes — routes are saved by default, and you can turn them off any time in Settings, then Privacy. Turning them off stops saving routes from connected apps and deletes the routes already saved from them. Routes from files you upload are kept either way.

5. Third-Party Services

Endure relies on these infrastructure and integration partners:

• Clerk — authentication and session management
• Supabase — database storage and real-time features
• Stripe — payment processing on the website (Endure Labs never stores your payment card details). The iPhone app is free and does not sell in-app purchases
• Resend — transactional email delivery
• Vercel — application hosting and deployment
• Google Analytics — anonymized usage analytics on the website only. Not used in the iPhone app. No personally identifiable information is sent to Google
• Sentry — application error tracking (error reports may contain anonymized context, never raw user data)
• Upstash — API rate limiting infrastructure
• Open-Meteo — receives the start location and date of an activity to look up the weather for it.
• Mapbox — serves the map tiles for the area you view and the elevation tiles along a route. It does not receive the route itself.
• Integration partners — any service you choose to connect through Settings. Each available connection is authorized by you and governed by that service's privacy policy in addition to this one

Each of these services is contractually required to process your data only as needed to deliver their function.

6. Do Not Sell or Share

We do not sell, rent, or share your personal data with third parties for marketing purposes. Period.

We do not run advertising on Endure. We do not provide data to ad networks. We do not participate in data broker markets. Our business model is subscription revenue — your data is not the product. The iPhone app does not use IDFA and does not track you for advertising.

7. Contact

Questions, requests, or concerns about this policy can be sent to support@endurelabs.app. We will respond within 5 business days.

Policy Changelog

• v1.5 — 2 October 2026 — Third-Party Services now lists Open-Meteo and Mapbox.
• v1.4 — 30 September 2026 — GPS routes are saved by default, and only you and your coach can see them. Turning them off in Settings deletes the routes saved from connected apps. Routes from files you upload are kept
• v1.3 — 29 September 2026 — Your Rights now states how routes from files you upload are kept
• v1.2 — 24 September 2026 — A coaching connection now gives your coach full access to your training data, replacing per-category coach sharing. Disconnecting a coach removes their access immediately
• v1.1 — 18 September 2026 — Declared meal photos, account identifiers, iPhone deletion, and no Advertising Identifier so this page matches App Store nutrition labels
• v1.0 — March 2026 — Initial policy published