Privacy Policy

This Privacy Policy explains how Duravel LLC (“Duravel,” “we,” “us”) collects, uses, and shares information when you use the Duravel web app and any related applications (the “Service”). By using the Service you agree to this policy.

Information we collect

Account information. Your name, email address and authentication details, used to create and secure your account. If you sign in with Google or Apple, we receive the name and email address associated with that account and nothing else; we never receive your password for those services.

Date of birth. Collected when you create an account. It confirms you meet the minimum age in our Terms of Use, and your age sets your heart-rate zones and the age-graded benchmark bands your projections are measured against.

Your acceptance of our policies. When you create an account we record that you accepted the Terms of Use, Privacy Policy and Refund Policy, the time you did so, and which published version of those documents was in force. Separately, we record whether you allowed AI-written sessions, when, and which version of that disclosure you saw.

Training profile and inputs. Details you provide to build your programs — such as your name, age, primary sport, body weight, experience levels, training days, race dates and goals, and optional performance benchmarks (e.g. run, erg, and strength numbers).

Health-related metrics you provide or connect. Inputs such as biological sex (asked when you create an account, and answerable as “prefer not to say”), resting heart rate, heart-rate variability, maximum and threshold heart rate, session RPE, and logged workout details. Some of these may be entered by you directly, and some may be imported from a fitness service you choose to connect (see Connected services & wearables below). You are never required to provide these; they are used only to personalize your training (heart-rate zones, readiness, and load management) and are stored with your account.

Usage data. Basic technical and usage information (such as generation events and app interactions) needed to operate, secure, and improve the Service.

How you found us. If you first arrive through a tagged link — a creator or referral code, or a campaign link — or from another website, we keep a first-party cookie for up to 90 days with that code or campaign tag, the name of the referring website and the page you landed on. When you create an account, we save it with your account so we can see which partners and campaigns bring people to Duravel. It is never shared with advertising networks.

How we use your information

We use your information to generate and adapt your individualized training programs, to operate and secure your account, to process payments, to provide support, and to improve the Service. We do not sell your personal information, and we do not use it for advertising.

AI-written sessions (optional)

Duravel’s training engine decides the structure of every program — phases, weekly volume, paces, loads, deloads and race week — in our own code. With your permission, we also use a third-party AI service, Anthropic (the Claude models), to write the session descriptions and exercise selection inside that structure, and to rewrite an upcoming week when your program adapts.

We only send data to Anthropic if you say yes. We ask you separately from our Terms of Use — when you create your account, during account setup, when you sign in, or the first time you build a program — and the box is never ticked for you.

If you say yes, we send Anthropic only what is needed to write your sessions: your first name, age, sex, body weight, heart-rate numbers, experience levels, training days, benchmarks and race splits, and the plan our engine has built. When your program adapts we also send what you entered in Duravel about last week: the sessions you logged, your effort ratings and session notes, and extra workouts you added by hand. We do not send anything we import from a connected service — no Strava, Oura or Apple Health workouts, effort ratings, notes or health metrics, and nothing calculated from them, such as your readiness score. We also do not send your email address, last name, date of birth or payment details.

Anthropic processes this data on our behalf to return the session text, under its commercial terms, which do not permit it to train its models on data sent through our account. Anthropic deletes this data within 30 days, except where it must keep it longer to enforce its usage policies or to comply with the law.

If you say no, or later turn it off, Duravel still builds and adapts your full program using our training engine alone; your sessions simply aren’t AI-written. You can change your choice at any time in Settings → Privacy. Turning it off stops all further data going to Anthropic from your next program build or weekly adjustment; sessions already written stay in your program.

We record your choice, when you made it, and which version of this disclosure you saw.

Connected services & wearables

Duravel lets you optionally connect third-party fitness services to import your training data. We currently support Strava and Oura, and, in our mobile app, Apple Health (HealthKit). Connecting any of these is entirely your choice and is never required to use the Service.

What we import. When you connect a service, we import activity data for your completed workouts (such as type, date, duration, distance, pace, and heart rate), which we match to your planned sessions to track adherence and adapt your future training. From Oura (and Apple Health, in our mobile app) we may additionally import daily health metrics — heart-rate variability (HRV), sleep, and resting heart rate — which are used to compute a readiness score that personalizes your training load.

Your explicit authorization. We access this data only after you explicitly authorize the connection through the provider’s own secure authorization (OAuth), and only for the data types you grant. We request the minimum scopes needed, and you can choose to sync activities while keeping daily health-metric ingestion turned off.

How we use it. Connected-service data is used solely to deliver and personalize your own training experience within Duravel. We do not sell it, we do not use it for advertising, and we do not share it with third parties other than the service providers listed below that operate the Service on our behalf. Data imported from a connected service — workouts, effort ratings, notes and health metrics, and anything calculated from them, such as your readiness score — is never sent to Anthropic or any other AI provider, even if you have allowed AI-written sessions.

Disconnecting and deletion. You can disconnect any service at any time from your settings, which stops all future syncing and deletes the access tokens we hold (you can also remove Duravel from the provider’s own app settings). You can delete previously imported data — workouts and daily health metrics — at any time under Settings → Connections → Imported data, which removes it immediately; deleting your account removes all connected-service data along with the rest of your records.

How long we keep it. Workouts imported from Strava are kept for 7 days, as Strava’s API terms require, and then deleted automatically. Daily health metrics, and workouts imported from Oura, are kept for 180 days and then deleted automatically. Workouts you log in Duravel yourself are part of your training record and are kept until you delete them or your account.

Oura. Data you authorize from your Oura account is handled in accordance with Oura’s API terms: it is never sold, never used for advertising, and never stored in third-party cloud services outside the processors named below. Disconnecting Oura in your settings stops ingestion and deletes the access tokens we hold for your account.

Apple Health (HealthKit). In our iOS app, health data you allow us to read via HealthKit is used only to personalize your training; it is never used for advertising or marketing, is never sold, and is not shared with third parties for their own purposes, consistent with Apple’s HealthKit requirements.

Service providers

We share information with a small number of processors solely to run the Service: Supabase (authentication and database hosting), Anthropic (AI model that writes your session text — only if you allow it; see AI-written sessions above), Stripe (payment processing; we never store full card details), Resend (transactional and account emails), and our hosting provider ( Vercel). Each processes data on our behalf under its own terms and security commitments.

Data retention and deletion

We keep your information for as long as your account is active. You can permanently delete your account and all associated data at any time from your profile page; deletion removes your profile, programs, logs, check-ins, connected-service data, and related records.

Security

Access to your data is restricted to your own account through row-level security, and traffic is encrypted in transit. Access and refresh tokens for connected services are encrypted before storage. No method of storage or transmission is perfectly secure, but we take reasonable measures to protect your information.

Children

The Service is not directed to children under 13, and you must be at least 13 (or the age of majority where required) to use it. We do not knowingly collect information from children under 13.

Your choices

You can review and update your profile at any time, disconnect any connected service, and delete your account to remove your data. Depending on where you live, you may have additional rights over your personal information; contact us to exercise them.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the date above.

Contact

Questions about this policy or your data? Contact us at support@duravel.app.

Terms of Service · Back to dashboard