This Privacy Policy explains how Fitness and Sports Network, LLC, an Oklahoma limited liability company doing business as Sweat Is Free ("we," "us"), collects, uses, and protects your information when you use Thríamvos (the "Service"). Contact: sweatisfree@gmail.com.
1. Special Category Data Notice
Some data you provide — resting heart rate, maximum heart rate, heart rate variability (HRV), sleep duration, and respiratory rate — is health data, a special category of personal data under GDPR Article 9 and similar laws. We only process this data with your explicit consent, given when you connect a HealthKit export or submit a manual entry, and only for the purpose of computing your own Autonomic Recovery Index. You can withdraw this consent at any time by ceasing to submit this data and requesting deletion (see Section 7).
2. What We Collect
- Account data: your email address and authentication credentials, managed via our authentication provider, Supabase.
- Strava data: if you connect Strava, we store an access token and refresh token (server-side only, never exposed to your browser) and your athlete name/ID, so we can fetch your recent activities (name, type, date, duration, distance, and heart rate/power if recorded) on your behalf. Activities themselves are fetched live and are not stored in our database.
- Athlete profile: your sex, resting heart rate, and maximum heart rate, plus whether that maximum was measured or estimated. These are the inputs the TRIMP training-load formula requires; without them, load is calculated from session duration alone. You enter them yourself and can change or clear them at any time in Settings.
- Health data: resting heart rate, HRV, sleep hours, and respiratory rate, submitted either by you directly or automatically via a webhook from a third-party HealthKit export app you configure (e.g. Health Auto Export). This requires a unique sync token, which we store only as a one-way cryptographic hash — never in a form that could be reversed to the original token.
- Usage data: basic technical logs (e.g. error logs) generated by our hosting infrastructure in the ordinary course of operating the Service.
We do not use third-party analytics, advertising, or tracking SDKs of any kind, and we do not sell or share your data with third parties for marketing purposes.
3. Why We Process Your Data
- Account data — to provide the Service, under contract with you.
- Strava data — to provide the training-load features you requested, under contract with you.
- Athlete profile — under your explicit consent, to weight your training load by heart rate rather than by duration alone.
- Health data — under your explicit consent, to compute your Autonomic Recovery Index.
- Usage/technical data — under our legitimate interest in operating, securing, and improving the Service.
4. How Your Data Is Stored and Protected
- All data is stored with Supabase (PostgreSQL) and encrypted at rest. Every table holding your activity or health data uses Row Level Security, restricting access to your own account.
- Strava tokens and your health-sync token are additionally locked down beyond standard access controls: Strava tokens are only ever readable by a narrow, purpose-built server process, never by any client-facing code path; your sync token is stored only as a hash, so even we cannot see its original value.
- The Service itself is hosted on Vercel.
5. Third-Party Services
We use the following sub-processors to operate the Service: Supabase (database and authentication) and Vercel (hosting). If you connect Strava, your relationship with Strava is governed by Strava's own privacy policy. If you use a third-party HealthKit export app, that app is chosen and configured by you, is not controlled by us, and its own privacy practices apply to how it reads your data from Apple Health before sending it to us.
6. International Data Transfers
Our sub-processors may store or process data in the United States or other countries outside your own. Where required by applicable law, we rely on appropriate safeguards (such as Standard Contractual Clauses) for these transfers.
7. Your Rights
Depending on your location, you may have the right to access, correct, delete, or export your data, restrict or object to certain processing, and withdraw consent at any time.
Export and deletion are both available directly in the Service, under Settings → Your data. The export is a JSON file containing everything we hold about you. Deletion is immediate and irreversible: it erases your profile, your health readings and your Strava connection, cancels any subscription, and revokes our access to your Strava account. Access tokens are excluded from the export because they are credentials rather than your personal data.
You do not have to delete your whole account to remove data. Individual health readings can be deleted one at a time under Settings → Stored readings, and you can disconnect Strava — which revokes our access on Strava's side — without affecting your account or your health readings. For anything else, including correction of account details, restriction, or objection, email sweatisfree@gmail.com.
If you are in the EU/EEA or UK, you also have the right to lodge a complaint with your local data protection supervisory authority.
8. Data Retention
We retain your account and associated data for as long as your account remains active. If you request deletion, we will delete your personal data within a reasonable period, except where we are required to retain limited records (e.g. billing records) for legal or accounting purposes.
9. Children's Privacy
The Service is not directed at, and we do not knowingly collect data from, anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
10. Cookies
See our Cookies Notice for details on the limited, strictly-necessary storage the Service uses.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be announced via the Service or by email.
12. Contact
Questions or requests regarding this Privacy Policy can be sent to sweatisfree@gmail.com.