Privacy Policy

• Account: your username and a securely hashed password (we never store the plain password).
• Training data: the profile you enter (goals, experience, PRs, injuries, availability) and your generated plan, workouts, and completions — this is what the app adapts your plan from.
• Strava (optional): only if you connect it. We store access tokens and pull your recent activities to auto-complete matching planned sessions.
• Apple Health (optional): only if you grant access, and read-only. We request exactly one HealthKit type — workouts — and from each workout we use its sport, start time, duration and distance to match it to a planned session. We do not request or read heart rate, sleep, body measurements, clinical records, or anything else. Workouts are read and matched on your iPhone; the health data itself is never uploaded to our servers, and only the resulting “session completed” is synced. Trifecta never writes to Apple Health.
• AI features (optional, off by default): nothing about your body is sent anywhere unless you switch on Analyse my injury notes with AI — a separate choice from accepting these terms, which you can withdraw at any time in Profile → AI features. With it on, the text you type about aches and injuries is sent to Google (Gemini) to turn into training limits, and the AI coach may be told which areas you are training around. With it off, neither happens and the on-device safety check still runs. We only send health text to a no-training tier, so it is not used to improve their models.

Health and fitness data is treated as sensitive, and Apple’s rules for it are strict. We hold ourselves to them explicitly: data read from Apple Health, and the training and injury information you enter, is never used for advertising, marketing, or use-based data mining, and it is never sold or shared with data brokers — by us or by anyone we work with. We do not store personal health information in iCloud. It is used for one thing: building and adapting your training plan for you.

To build and adapt your training plan, show your progress, and — if you use the social features — show your username and workout summaries to people you connect with. That’s it.

Data is encrypted in transit (HTTPS/TLS) and stored in our database (hosted on Railway). Passwords are hashed with scrypt. Apple Health data stays on your device.

Only the services needed to run the app: our hosting provider (Railway), Strava (only if you connect it), and Google (Gemini) as our AI provider (only for the optional AI features, and only when you tap). No advertisers. No data brokers.

You can view and edit your data in the app at any time, and you can permanently delete your account and all associated data from Profile → Delete account. Deletion is immediate and irreversible. For anything else, email us.

We keep your data until you delete your account, after which it is erased.

Questions or requests: ryan.helou@gmail.com.