Your physiological data is highly sensitive. We design around encryption-at-rest, least-privilege access, and strict scope limits for support/admin workflows.
When you export data from Apple Health, Google Fit, Garmin Connect, or any other wearable or health platform and sync it to Stryde, here is exactly what happens to it:
Your health data is yours. Stryde will never use your personal health records, workout history, sleep data, HRV readings, or any other physiological data to train, fine-tune, benchmark, or evaluate any AI or machine learning model — whether operated by Stryde or a third party. This commitment is unconditional and does not depend on any opt-out setting.
Traditional fitness apps store your heart rate, sleep, and GPS data in a readable format. This means their employees, advertisers, or hackers could potentially see your entire life.
Stryde is different. We use AES-256-GCM encryption at the individual record level.
Stryde's role is limited to storing your health data and computing derived metrics — fitness scores, load trends, readiness, running dynamics, and similar calculations.
Any coaching advice, training prescription, workout recommendation, or suggestion you receive is generated by the AI model you have chosen to connect (for example, Claude by Anthropic via MCP). Stryde does not prescribe, recommend, direct, or exhort any course of action.
Stryde has no control over what a connected AI model says. The outputs of that model are governed by the AI operator's own terms and policies — not Stryde's. You are responsible for evaluating whether any AI-generated suggestion is right for your situation.
Stryde is for informational and educational purposes only. It is not a medical device.
By using this application, you acknowledge that:
When you connect Claude or another MCP client using your API token, that client can read your health metrics, workout history, training plans, and coaching memory. It cannot access other users' data. Your token is scoped to your account only and can be rotated from Settings at any time. Revoking the token invalidates future MCP access.
We do not sell your personal health data. Operational telemetry may still be processed for reliability, abuse prevention, and product quality.
When you delete your account, we trigger a cascade that wipes your records from our GCP environment. Your encrypted identifiers are also purged, ensuring no "ghost" records remain. Deletion from active systems completes within 30 days. While your account is active, workout and health records are retained for the life of the account. Security and audit logs are retained for 12 months. Billing records are retained for 7 years as required by law.
Stryde sets one session cookie on sign-in. It is HttpOnly, Secure, and SameSite=Lax. It expires when your session ends or after 8 hours, whichever comes first. We do not set advertising, tracking, or third-party analytics cookies.
Stryde uses the following third-party processors to operate the service:
Regardless of where you are located, you may:
For requests not covered by self-service, email privacy@stryde.coach. We respond within 30 days.
| Data Type | Security | Access |
|---|---|---|
| Health Records | AES-256 Fully Encrypted | User Only |
| Calculated Scores | AES-256 Fully Encrypted | User Only |
| Coach Context | Record-Level Encryption | User Only |
| Account Email | Obfuscated Store | User + Support |