Privacy Policy

This Privacy Policy explains what data Train Ultra collects, how we use it, who we share it with, how long we keep it, and your rights over it. It applies to use of the Train Ultra mobile apps and web dashboard. If you do not agree with this policy, do not use the service.

1. Who we are

Train Ultra is operated by Spare Mile, LLC, a limited liability company organized in the State of Washington, USA, doing business as Spare Mile Studio (“we,” “us,” or “our”). For the purposes of GDPR and similar laws, Spare Mile, LLC is the data controller of the personal data described in this policy. You can reach us at support@sparemilestudio.com. Given our size and the nature of our processing, we have not appointed a Data Protection Officer.

2. What we collect

Train Ultra collects only the data needed to deliver AI-generated activity titles, workout evaluations, coaching conversations, training summaries, and the other features you use.

• Account data — your email address (used for sign-in via a 6-digit code), your first and last name (where you provide them), the account-creation timestamp, and, if you answer it at signup, how you heard about Train Ultra.
• Strava — when you connect Strava, Train Ultra uses Strava only to find your workouts on Strava and to update them. It writes generated activity titles, and it automatically writes each newly generated workout evaluation to the activity description or private note when that is your selected posting mode. If you select Train Ultra only, the evaluation stays in Train Ultra. Train Ultra no longer reads workouts from Strava: it does not send the Strava data it receives to AI features, and it stores only the Strava activity number that links a Train Ultra workout to the same workout on Strava. Workouts that Train Ultra read from Strava before it stopped reading from Strava stay in your account, and your coach can still see them, until you delete them. When you delete a workout on Strava, Train Ultra deletes its copy of that workout right away. When you disconnect Strava in Train Ultra, or remove Train Ultra’s access in your Strava settings, Train Ultra right away deletes the workouts it got from Strava, with their evaluations and maps.
• Garmin Connect data — if you connect Garmin Connect™, Train Ultra receives the activity, health, and training data described in Section 3 (Garmin Connect data).
• COROS data — if you connect COROS, Train Ultra reads your workouts and their workout files, sleep, heart-rate variability (HRV), heart rate, stress, and steps through the COROS MCP service, and writes the planned workouts that you choose to sync to your COROS calendar. You authorize this on COROS’s own consent screen, and you can disconnect COROS in Settings at any time.
• Oura data — if you connect Oura, we ingest similar daily wellness summaries via the Oura API.
• Apple Health data — if you connect Apple Health on iOS, the app reads workouts and daily wellness data from HealthKit on your device (sleep, heart-rate variability (HRV), resting heart rate, heart rate, respiration, blood oxygen, wrist temperature, VO2max, steps, and active energy) and sends daily summaries to our servers so your coach can factor them into evaluations and conversations. We read only the categories you approve in the HealthKit permission sheet, we do not write to Apple Health, and we never use HealthKit data for advertising or share it with third parties.
• Health Connect data — if you connect Health Connect on Android, the app reads exercise sessions, distance, active calories, heart rate, and elevation gain from Health Connect on your device. For each workout it sends a summary to our servers: the workout type, start and end time, duration, distance, active calories, average and maximum heart rate, elevation gain, and the name of the app that recorded it. Heart rate samples stay on your device; the app reads them only to work out the average and maximum. If you allow background access, the app also reads new workouts while it is closed, so your coach sees them without you opening Train Ultra. We use this data only to show your workouts, write titles and evaluations, and coach you. We read only the data types you allow on the Health Connect permission screen, and we do not write to Health Connect. We never sell Health Connect data, use it for advertising, or use it to decide credit, insurance, or employment, and we share it only with the service providers in Section 5 (Who we share it with) that process it to deliver your coaching. If you connect Strava and turn on title or evaluation posting, the titles and evaluations we write from these workouts are posted to the matching Strava workout. You can remove access at any time in Health Connect or Android Settings; this stops new reads but does not by itself delete workouts already stored in Train Ultra (see Section 6 (How long we keep it)).
• User-generated content — goals you create, coach conversation history, and athlete-profile fields you fill in (such as sex, age, training history, optional injury notes, and optional max-heart-rate or threshold-pace values).
• Coach attachments — images, PDF and DOCX documents, TXT and Markdown files, FIT files, and GPX, TCX, and ZWO activity and course files that you choose to add to a Coach conversation, together with a safe display name, file type, byte size, and validation metadata. These private files can contain health, medical, identity, or precise-location data. Train Ultra does not require this content, and you control which files you upload.
• Activity Routes — when a connected Garmin, COROS, or Apple Health activity carries GPS coordinates, Train Ultra reads its geographic trace to show that activity’s map, elevation, sections, and comparisons.
• Routes and route files — when Train Ultra indexes a usable Activity Route, or when you import a GPX, TCX, or FIT file into your Route Library or a goal, Train Ultra stores the resulting Route: its file, its decoded path and elevation, any name you give it, and any route or section preferences you set. A Route you import or link to a goal is kept independently, and survives deletion of the Coach conversation it came from.
• Places — a private map of the sport- and date-filtered places your completed activities cover. Places uses only completed Activity Routes; a route you only imported or linked to a goal is not shown as a visited place.
• Goal and Training Proposal data — you can link a goal to a Route as that goal’s course. When you ask the coach to help you prepare for a linked goal, the coach can create a Training Proposal: a reviewable set of suggested Calendar changes tied to the goal and its course facts. A Training Proposal changes nothing on your Calendar until you review and apply it.
• Map display requests — showing a map on the web dashboard, iOS app, or Android app sends the visible map area (tile coordinates and zoom level), your IP address, and your device or browser’s user-agent string to our map-tile provider, Stadia Maps. Train Ultra does not send your name, account identifier, activity title, route name, sensor data, or your full route trace with a map request, and does not use a place-search (geocoding) service.
• Feedback you send: when you use Send feedback in Settings, we store your message and any screenshot you choose to attach. To help us fix problems, the app also attaches your app version, device model, operating-system version, language, time zone, and a list of recent failed requests to our servers (time, address, and error code only), and we add your plan, your connected apps, and their last sync times. We remove photo metadata, such as location, from screenshots before we store them. Your message goes to our support inbox so we can reply to you by email.
• Device tokens — when you grant push-notification permission in a mobile app, we store its Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) device token so we can deliver notifications about your activities and coach prompts.
• Billing identifiers — if you subscribe to a paid tier, we store the customer, purchase, or subscription identifiers and status metadata returned by Stripe, Apple, or Google. We do not store full card numbers; the payment provider handles payment credentials and processing.
• Operational logs — limited request and response metadata for debugging, capacity planning, and abuse prevention. These logs may include IP address, user-agent, timestamps, the route accessed, and error details.
• Legal acceptance records — when you accept the Terms of Service or this Privacy Policy, we record the version accepted, the timestamp, your IP address, your user-agent string, and the platform (web, iOS, or Android) so we can demonstrate consent if asked.
• Product usage data — Train Ultra records limited account-linked events about how the web dashboard and mobile apps are used, such as app opens, screens viewed, features used, and completion of setup or coaching steps. We use this data only to operate, understand, and improve Train Ultra. We limit event metadata through per-event allowlists and structural-value checks. We do not intentionally collect email, names, tokens, coach-message or evaluation text, workout notes, or other free-text athlete content in product usage events.
• Marketing-site analytics — Google Analytics 4 (GA4) uses cookies to measure traffic and page use on our public marketing pages. Train Ultra also sends conversion events (account creation, trial start, purchase, cancellation) to GA4 under a pseudonymous browser or account-derived identifier, so we can see which marketing channels lead to signups and subscriptions. These conversion events are shared with Google Ads to measure our advertising. We do not load GA4 inside the authenticated dashboard or mobile apps, and these events never include your name, email, or training content.

3. Garmin Connect data

If you connect Garmin Connect™, Train Ultra receives the Garmin data that you authorize through the Garmin Activity, Health, and Training APIs. Activity data can include the activity name and type, timestamps, duration, distance, device model, laps, route and location data, heart rate, cadence, power, speed, elevation, and the raw FIT, TCX, or GPX activity file. Health data can include daily summaries, sleep, heart-rate variability, resting heart rate, stress, respiration, pulse oximetry, skin temperature, Body Battery, and user metrics when your device and permissions make them available. Training API data includes planned workouts that Train Ultra sends to Garmin Connect at your request.

Train Ultra uses Garmin data to show your activities and recovery signals, calculate training summaries and trends, generate activity titles and workout evaluations, ground Coach conversations in your training history, and deliver planned workouts to Garmin Connect. These insights can combine Garmin data with information from other connected services and information that you provide directly.

Train Ultra stores and processes authorized Garmin data using DigitalOcean-hosted databases, application infrastructure, and AI services. Train Ultra uses these services to generate titles, evaluations, training summaries, and Coach responses. The AI services are OpenAI models, which Train Ultra calls through DigitalOcean’s inference service. If you connect Strava and enable title or evaluation posting, Train Ultra can write content derived in part from Garmin data to a matched Strava activity. Train Ultra does not sell Garmin data or use it for cross-context behavioral advertising.

Train Ultra keeps stored Garmin activity and wellness data for the lifetime of your account and deletes it from active systems when you delete your Train Ultra account. Backup copies are purged within 30 days. Disconnecting Garmin stops new Garmin data delivery and planned-workout delivery but does not by itself delete historical data already stored in Train Ultra. You can delete your Train Ultra account to remove that stored copy under the retention schedule above.

Garmin is the source of Garmin device data. Spare Mile, LLC, doing business as Spare Mile Studio, is the controller of the copy stored and processed by Train Ultra. See Section 5 (Who we share it with) for DigitalOcean and Strava processing and Section 8 (Your rights and how to exercise them) for access and deletion rights.

4. How we use it

• To generate AI-written titles for your activities, and to post them to Strava if you connect Strava.
• To generate AI workout evaluations and coaching responses grounded in your training and wellness data.
• To store and process the Coach attachments you select so the Coach can discuss them. Train Ultra sends validated images, documents, and text to the AI-inference endpoint as part of the Coach request. Train Ultra decodes TXT and Markdown files as text and FIT files as a bounded data projection instead of sending their raw file bytes. Adding or discussing a Coach attachment does not create an Activity or change your training history.
• To compute training summaries, weekly stats, year-over-year comparisons, and other derived views.
• To show Activity maps, build and search your Route Library, run repeat-activity comparisons, show Places, and prepare you for a goal using its linked Route and course facts.
• To send transactional emails (sign-in codes, account-deletion confirmations, billing receipts).
• To send push notifications about your activities, evaluations, and coach prompts.
• To operate, debug, secure, and improve the service.
• To understand how Train Ultra’s features are used, diagnose friction, and improve the service.
• To prevent fraud and abuse and to enforce our Terms of Service.
• To comply with legal obligations (for example, tax record-keeping for billing data).

We do not sell your personal information, and we do not share your personal information with third parties for cross-context behavioral advertising. We do not use your training data to train third-party foundation models beyond the per-request inference described below.

5. Who we share it with

We share personal data with the third parties below only as needed to deliver the features you use. Depending on the service, they process data on our behalf or provide a service directly to you under their own terms.

• DigitalOcean — hosts our backend, database, private object storage, and AI-inference endpoint. Activity, wellness, Coach conversation, Coach attachment, goal, and product usage data passes through DigitalOcean’s infrastructure. Validated images and documents, decoded text and FIT projections, and other data used by AI features pass through the inference API as part of the Coach request.
• Stadia Maps — supplies the map tiles and styling for Activity maps, the Route Library, and Places on the web dashboard, iOS app, and Android app. Each map tile or style request discloses the requested tile coordinates (which reveal your current map viewport and zoom level), your IP address, and your user-agent to Stadia Maps. Stadia Maps states that it keeps server logs for approximately 7 to 14 days, and separately keeps aggregated analytics data without your raw IP address for longer. Train Ultra does not use a geocoding (place-search) processor.
• Strava, Garmin, COROS, Oura — connected providers that process data for the features you choose. Train Ultra writes generated activity titles to Strava and, when your selected evaluation posting mode is the Strava description or private note, automatically writes each newly generated evaluation there. Train Ultra can send planned workouts to Garmin or COROS when you use watch workout scheduling. We read authorized activity or wellness data from Garmin, COROS, and Oura as described in Section 2.
• Resend — transactional email delivery (sign-in codes, account-deletion confirmations, billing-related notices).
• Stripe, Apple, and Google — payment processing for subscriptions. The payment provider receives the billing details you submit and returns customer, purchase, or subscription metadata to Train Ultra; we do not receive full card numbers.
• Apple Push Notification service and Firebase Cloud Messaging — delivery of push notifications to your mobile device.
• Google Analytics and Google Ads — GA4 measures traffic and page use on our public marketing pages with cookies, and receives our conversion events (account creation, trial start, purchase, cancellation) under a pseudonymous identifier. Conversions are shared with Google Ads to measure our advertising. GA4 does not load inside the authenticated dashboard or mobile apps.

We may also disclose personal data when we believe in good faith that disclosure is required to comply with a law, court order, or other valid legal process; to protect the rights, property, or safety of Spare Mile, LLC, of our users, or of the public; or in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets (in which case we will give you advance notice and the chance to delete your account before the transfer where the law requires it).

6. How long we keep it

We retain personal data only as long as we need to provide the service or to meet a specific legal or operational requirement.

• Account data (email and name): for the lifetime of your account, plus up to 30 days after deletion to allow backup purges to complete. When you delete your account, we keep a de-identified record of it: when it was created and deleted, which app you deleted it from, the marketing source that brought you to Train Ultra (including your answer to how you heard about Train Ultra), when a trial or paid plan started, and its plan at deletion. That record has no email, name, or other contact details.
• Workouts that Train Ultra read from Strava before it stopped reading from Strava: until you delete the workout on Strava, disconnect Strava, or delete your account, plus up to 30 days for backup purges. Train Ultra deletes them from active systems right away in each case.
• Garmin, COROS, Oura, Apple Health, and Health Connect data: lifetime of account + 30 days.
• User-generated content (goals and athlete profile): lifetime of account + 30 days.
• Coach conversations and their attachments: until you delete the conversation or your account. We delete the conversation and its private attachment objects from active systems. Copies in backups are purged within 30 days. A ready attachment that you do not send expires after 24 hours.
• Activity Routes (the geographic trace read from a connected activity): follows the source Activity. Deleting the Activity removes its recorded trace from Places, route-visit counts, and comparisons; it does not delete an independently saved Route.
• Routes, Route Versions, and route files (your Route Library): kept until you delete the Route or your account. Deleting a Route removes its versions, files, sections, and preferences; the Activities that used it remain.
• Goals, goal courses, and Training Proposals: kept until you delete the goal or your account. Deleting a goal removes its course link, preparation records, and Training Proposals, but keeps the Route itself and any already-applied Planned Workouts (with their goal reference marked unavailable).
• Feedback you send (message, screenshot, and the attached device and account details): kept until you delete your account. Copies of your message in our support email inbox are kept as ordinary correspondence.
• Device tokens: removed when you uninstall the app, when APNs or FCM reports the token as invalid, or 30 days after account deletion — whichever happens first.
• Billing identifiers and invoices: 7 years after the last transaction, to comply with US tax record-keeping requirements. Card numbers are never stored by us.
• Operational logs: 90 days. When you delete your account, the AI usage records in these logs (the feature, model, and amount of AI processing for each request) stay for the rest of that period with no link to you, so we can measure our costs.
• Legal acceptance records: kept indefinitely so we can demonstrate consent if disputed; references to the user are removed on account deletion (the audit row survives but is no longer linked to you).
• Product usage data: retained for the lifetime of your account. When you delete your account, we remove the link between these events and you and keep them de-identified, grouped under the de-identified account record above, to understand how Train Ultra is used in aggregate. Backup copies that still link them to you are purged within 30 days.
• Marketing-site analytics (GA4): Google retains measurement and conversion data for the GA4 property’s configured retention window (currently 14 months).

Content Train Ultra previously wrote to Strava, including generated activity titles and workout evaluations already written to activity descriptions or private notes, may remain on Strava after you delete your account. Train Ultra does not remove or rewrite that past Strava content during account deletion.

7. International data transfers

Train Ultra’s backend infrastructure and most of our processors are located in the United States. If you access Train Ultra from outside the United States — including from the European Economic Area, the United Kingdom, or Switzerland — your personal data will be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses (or equivalent transfer safeguards) with our processors to protect personal data on transfer.

8. Your rights and how to exercise them

You have the following rights with respect to your personal data:

• Access a copy of the personal data we hold about you.
• Correct personal data that is inaccurate or incomplete.
• Delete a Coach conversation, including its attachments, from Coach History. You can also delete your account and the personal data we hold about you from the mobile apps (Settings → Delete Account), the web dashboard (Settings → Delete Account), or by emailing us. Deletion permanently removes the data described in Section 6 within the listed retention windows and disconnects Train Ultra from your Strava, Garmin, and Oura authorizations.
• Delete a Route from your Route Library, or a goal, from the mobile apps or web dashboard. Deleting a Route removes its versions, files, and preferences; deleting a goal removes its course link, preparation records, and Training Proposals. Both keep the unrelated data described in Section 6.
• Object to or restrict certain processing, where the law gives you that right.
• Withdraw consent for processing that depended on your consent (for example, push notifications or optional provider connections), without affecting the lawfulness of earlier processing.
• Receive a portable copy of personal data you provided to us, where the law gives you that right.

To exercise any of these rights, email support@sparemilestudio.com. We will respond within the time required by applicable law (no later than 30 days under GDPR, 45 days under CCPA) and may verify your identity before acting on a request. There is no fee for exercising these rights, and we will not discriminate against you for exercising them.

9. EEA, UK, and Switzerland (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the GDPR (or UK GDPR / Swiss FADP). We are the controller of your personal data. We process personal data under the following lawful bases:

• Contract — processing necessary to deliver the service you signed up for (running AI features, storing goals and activities, processing payments).
• Legitimate interests — processing necessary to secure the service, prevent fraud, debug operational issues, understand how features are used, improve the service, and maintain audit records of legal-document acceptance. Where we rely on legitimate interests, you may object as described in Section 8.
• Consent — processing that depends on a permission you grant, including push notifications, optional connected providers (Strava, Garmin, COROS, Oura), and the use of optional athlete-profile fields. You may withdraw consent at any time.
• Legal obligation — processing necessary to comply with law (for example, retaining billing records for tax purposes).

You also have the right to lodge a complaint with a supervisory authority — for example, your national data-protection authority in the EU, the UK Information Commissioner’s Office (ICO), or the Swiss Federal Data Protection and Information Commissioner (FDPIC). We encourage you to contact us first so we can try to resolve the issue.

Your data is transferred to the United States and processed there. See Section 7 (International data transfers) for the safeguards we rely on.

10. California residents (CCPA / CPRA)

If you are a California resident, you have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories of personal information we collect. In the 12 months preceding this policy’s effective date, we collected the following categories: identifiers (email, name, IP address, device token), commercial information (billing identifiers and subscription history), internet or other electronic-network activity (product usage events and operational request logs), health and fitness information, user-generated content and files, geolocation from connected activities, imported route files, or uploaded FIT files, and inferences drawn from the above to provide the service. We collect these directly from you and the files you choose to upload, from Garmin / COROS / Oura / Strava when you authorize them, and from your device.

How we use it. See Section 4 (How we use it).

How we share it. See Section 5 (Who we share it with). Depending on the recipient, they process data on our behalf under contractual terms or provide a service directly to you under their own terms.

Do not sell or share my personal information. We do not sell your personal information and we do not share your personal information for cross-context behavioral advertising. We do not knowingly process the personal information of minors under 16 for sale or sharing.

Sensitive personal information. Health-related fields (heart rate, HRV, sleep, athlete-profile injury notes), precise location, and health, medical, or identity data in files you choose to upload may qualify as sensitive personal information under California law. We use them only as needed to deliver the AI features you use, and we do not use them to infer characteristics about you for any purpose unrelated to the service.

Your California rights. You may request to know what personal information we have collected about you, to delete it, to correct it, and to limit our use of sensitive personal information. To exercise these rights, email support@sparemilestudio.com. We will respond within 45 days (extendable by an additional 45 days where reasonably necessary, with notice). There is no fee, and we will not discriminate against you for exercising your rights.

11. Children

Train Ultra is not directed at children. We do not knowingly collect personal data from anyone under 13 in the United States, or under 16 in the European Economic Area, the United Kingdom, or Switzerland (unless local law sets a different age and a parent or guardian has consented).

If you believe a child under the applicable age has provided personal data to Train Ultra, please contact support@sparemilestudio.com. We will delete the account and the personal data we hold about that child promptly upon verification.

12. Apple App Privacy disclosures

To help users on the iOS App Store understand how Train Ultra uses data, here is how the data described in this policy maps to Apple’s “App Privacy” categories. This summary is provided for transparency; the canonical declaration is the one we file with Apple.

• Data linked to you: contact info (email, name); user content (goals, Coach conversations, uploaded photos and files, your Route Library, athlete-profile fields, feedback messages and screenshots); health and fitness data (workouts that Train Ultra read from Strava before it stopped reading from Strava; Garmin, COROS, Oura, Apple Health, and Health Connect workout and wellness data; uploaded FIT or medical information); precise location (connected activities, imported route files, or uploaded FIT files); identifiers (account id, device token); usage data (product interactions and operational request logs); financial info (customer, purchase, or subscription identifiers from Stripe, Apple, or Google, not card numbers); diagnostics (debugging logs, and the device details and recent errors attached to feedback you send).
• Data not linked to you: marketing-site measurement and conversion reporting via GA4, which uses pseudonymous identifiers rather than your name or email.
• Data used to track you: none. Train Ultra does not track you across apps or websites owned by other companies.

13. Cookies and similar technologies

We use a session cookie (HTTP-only, secure) on the web dashboard to keep you signed in. On public marketing pages, Google Analytics 4 sets cookies to measure traffic and to attribute signups and subscriptions to marketing channels, and Google Ads receives conversion measurements through our Google Analytics link. We do not use cookies for ad personalization or cross-site tracking, and Google Signals stays disabled. You can disable cookies in your browser, but doing so may break sign-in.

14. Security

We protect personal data using a combination of TLS-encrypted transport, encryption at rest in our managed database and object storage, least-privilege access controls, and routine review of operational logs for anomalous behavior. No service is perfectly secure, and we cannot guarantee absolute security; we will notify affected users of a personal-data breach as required by applicable law.

15. Changes to this Policy

We may update this Privacy Policy as the product evolves. Where we make material changes, we will announce them in the in-app changelog and bump the Effective date at the top of this page. For material changes, you will be asked to re-accept this Policy before continuing to use Train Ultra; we will tell you, in summary, what has changed. If you do not accept the updated Policy, you may stop using the service and delete your account at any time.

16. Contact

For any privacy-related question or request, email support@sparemilestudio.com.