Privacy policy
Last updated 17 October 2026
AJFitness is a small, private training app run by Alex Ryan for himself and a handful of invited mates. It isn't a business, there are no ads and nothing is for sale. This page explains what the app stores, why, and how to get rid of it.
Who runs it
Alex Ryan, Melbourne, Australia. Questions or requests: the Coach tab in the app.
What we store
- Your login. A username and a scrypt-hashed password (we never store the password itself), plus a signed session cookie that keeps you logged in for 30 days.
- What you enter. Your training program, ticks, sets and weights, runs, rides and swims you log by hand (distance, time, effort, notes), notes, pain scores, weekly weigh-ins, coach chat messages and your approve/deny decisions.
- Strava, only if you connect it. We store your Strava access tokens, athlete ID and first name. Activity data is not stored: it's fetched live from Strava when you open Data or Predictions, and kept only in a temporary cache (each item timestamped and deleted within 7 days). That cache can hold, per activity: its ID, name, sport, start time, distance, moving and elapsed time, elevation gain, average and max heart rate, cadence, speed, power, relative effort, per-km splits and best efforts. When a Strava activity matches a planned session we tick that session off and remember which activity did it for up to 7 days; after that only the tick remains.
What we don't store
No GPS tracks, maps or routes, no photos, no raw sensor streams, no kudos, comments, followers or segments, and no other athletes' data. We never collect your Strava password; you sign in on Strava's own page.
How Strava data gets in
When you tap Connect with Strava, Strava asks you to approve read-only access (read and activity:read_all). After that the app reads your last 12 months of activities from the Strava API each time you open Data or Predictions (refreshing at most every 20 minutes, plus details for recent runs or ones you tap), and Strava notifies us when you add, edit or delete an activity so we can tick off the matching session. AJFitness never posts, uploads, edits or deletes anything on your Strava account.
How we use it
Only to show you your own sessions, charts, race predictions and logged workouts inside your own login. Your data is shown to you and nobody else; other users of the app can't see it.
Strava data and AI. Your training plan is written with help from an AI coaching assistant. Strava data is kept away from it: the coach's access to the app is blocked from Strava activity data, and it's never used to train, fine-tune or prompt any AI model. The coach only sees what you type or log by hand in the app (for example runs you enter yourself). Strava data and your hand-logged data are never combined: the Data and Predictions tabs show one or the other.
Sharing
We don't sell, rent, share or give your data to anyone, including advertisers, data brokers or AI companies, and we don't combine it with any other data. The app runs on Netlify (hosting and storage), which processes data on our behalf only to run the site.
How long we keep it
Your own entries stay until you clear them or ask us to delete your account. Strava data is never kept longer than 7 days, and goes immediately if you disconnect. If you delete an activity on Strava, it disappears from AJFitness automatically, usually within minutes and always within 48 hours.
Your choices: access, withdrawal and deletion
- See or download your Strava data: Settings → Download my Strava data gives you everything we hold, as a file.
- Withdraw consent and delete: Settings → Disconnect Strava revokes our access on Strava and immediately and permanently deletes all your Strava data from AJFitness. The app confirms on screen once deletion is complete. Revoking access from Strava's side (Strava → Settings → My Apps) does the same.
- Delete everything: ask via the Coach tab in the app and we'll delete your account and all your data within 30 days and confirm in writing.
- Manage Strava: your Strava account and its privacy settings live at strava.com. Strava's own privacy policy also applies and wins if anything here conflicts with it.
Strava's usage data
Strava may monitor and collect usage data and information about how AJFitness uses the Strava API, and may use it for any business purpose, including improving its API and platform, providing support and checking compliance with its API Agreement.
Security
Everything travels over HTTPS. Logins are rate-limited and locked after repeated failures, sessions are signed HttpOnly cookies, and app keys are kept in server-side environment variables, never in the browser.
Your rights
We handle personal information in line with the Australian Privacy Principles and, where they apply, the GDPR and UK GDPR. You can ask to access, correct, export or delete your data, or complain, via the Coach tab in the app. You can also contact the Office of the Australian Information Commissioner (oaic.gov.au).
Changes
If we ever change what Strava data we collect, we'll tell you in the app and ask for your consent again before collecting it.
