Privacy Policy

This explains what UP collects, why it needs it, who else sees it, and how to get rid of it. It is written to be read rather than to be defensible.

Who is responsible for it

Defineweb Inc. operates uplabs.fit and is the data controller for everything described below — the company that decides what is collected and why, and the one to hold to account. Reach it at hello@uplabs.fit.

What we collect

• Account details — your email address and name, held by our authentication provider so you can sign in.
• What you tell the coach — your race and its date, the hours you have, your rest days, your thresholds, any sport you have put on hold, and the free-text notes you write about injuries or your week.
• Training history — if you connect Strava, the activities it returns: sport, duration, distance, pace, heart rate and timestamps.
• Recovery data — if you connect Garmin, your sleep, HRV, resting heart rate, Body Battery and training-readiness figures.
• What you log — sessions marked done, missed or dropped, plus any duration, RPE and notes you add.

We do not collect payment card details. If you subscribe, the payment processor handles the card and we never see the number.

Why we hold it

All of it exists to build and adjust your plan. Your history sets your starting point, your thresholds set your paces, your recovery data informs how hard the week should be, and what you log tells the coach what actually happened. We do not profile you for advertising, and we do not sell data to anyone.

Who else sees it

• Clerk holds your sign-in credentials and email address.
• Convex hosts the database your training data lives in.
• Anthropic receives the daily brief — a summary of your recent training, your plan and your notes — to write your check-in. That data is not used to train their models.
• Strava and Garmin send us data only if you connect them, and only what their APIs return.

That is the full list. Nobody else receives your data unless the law requires it.

Your Garmin password

Garmin issues API credentials to companies rather than individuals, so connecting Garmin means signing in through UP. Your password is sent to the app running on your own machine, used once to obtain an access token, and never stored — not by us, not in the database, not in a log. Only the resulting token is kept, and disconnecting deletes it.

How long we keep it

For as long as your account exists. Deleting your account removes your athlete profile, plan, sessions, imported activities and wellness history. Backups roll off within 30 days.

Your rights

You can see and edit most of your data directly in the app, disconnect Strava or Garmin at any time from the Account page, and delete your account outright. If you are in the UK or EU you also have the right to a copy of your data, to correct it, to restrict how it is processed, and to complain to your data protection authority. Ask via the contact page and we will respond within 30 days.

Cookies

UP sets a session cookie so you stay signed in, and stores small preferences in your browser. There are no advertising or tracking cookies, and no third-party analytics following you around.

Children

UP is not intended for anyone under 16. If we learn we hold data for a child, we delete it.

Changes

If this policy changes in a way that affects what we collect or who sees it, we will say so in the app before the change takes effect.

Last updated 30 August 2026