Last updated
This page explains what Uplabs collects, why it needs it, who else sees it, and how to get rid of it. It’s written to be read, not to be defended in court.
Who is responsible for it
Defineweb Inc. runs uplabs.fit and is the data controller for everything below — the company that decides what gets collected and why, and the one to hold to account. It is registered at 327 2nd Street E #8, Cornwall, ON K6H 1Y8, Canada.
Reach it at hello@uplabs.fit.
What we collect
- Account details — your email address and name, held by our sign-in provider so you can log in.
- What you tell the coach — your race and its date, the hours you have, your rest days, your thresholds, any sport you’ve put on hold, and the free-text notes you write about injuries or your week.
- Training history — if you connect Garmin or Strava, your activities, and from Strava a few profile figures. The full lists are under Garmin, if you connect it and Strava, if you connect it.
- Recovery data — if you connect Garmin, your sleep (duration, stages and score), overnight HRV, resting heart rate, Body Battery and stress figures.
- Your cycle — only if you turn it on: your typical cycle length, how long your period lasts, and the start dates you log. Off by default. Deleted outright when you turn it off.
- What you log — sessions marked done, missed or dropped, plus any duration, RPE and notes you add.
We don’t collect payment card details. If you subscribe, the payment processor handles the card and we never see the number.
Why we hold it
All of it exists to build and adjust your plan. Your history sets your starting point. Your thresholds set your paces. Your recovery data tells the plan how hard the week should be, and what you log tells it what actually happened.
We do not profile you for advertising. We do not sell your data to anyone.
Who else sees it
- Clerk holds your sign-in credentials and email address.
- Convex hosts the database your training data lives in.
- Anthropic provides the AI model behind your coach. It receives the daily brief — a summary of your recent training, your recovery figures, your plan and your notes — to write your check-in. If you subscribe, it also receives each new workout as it arrives — its name, sport, duration, distance, heart rate, power and climbing, with your last four of the same sport — to write the note under it. If you’ve turned on cycle tracking, the brief also says which phase you’re in. Activities you’ve set to “Only Me” on Strava are never named or described to it — they count only toward your weekly totals. That data is not used to train their models. What it sees, and how to stop it, is set out under How our AI coach uses your data.
- Garmin and Strava send us data only if you connect them, and only what their APIs return. If you turn on sending workouts to Garmin, Garmin receives those planned workouts.
- PostHog receives which pages you visit and a short list of things you do — finishing a step of setup, building a plan, joining the waiting list — along with a recording of how you moved around the page. Unlike the others here, it is linked to your account. Every word on screen is blanked out in your browser before anything is sent, so the recording shows where you clicked and nothing you read or typed. It never receives your training data, your plan, your cycle data, or anything you write to the coach.
- Anypost delivers our emails — your morning note and weekly summary if you’ve asked for them, and account email. It receives your email address and the email itself, which can include your planned sessions and your training minutes for the week.
- Sentry receives a report when something breaks: the error, the page it happened on, and the browser. It isn’t linked to your account, receives no IP address, and records nothing on screen.
- Stripe takes payment if you subscribe. It holds your name, email address and card; we never see the card number.
- Vercel hosts the site, so every request passes through them. Their analytics receives which pages get visited and how quickly those pages loaded. It sets no cookies and isn’t connected to your account.
That’s the full list. Nobody else receives your data unless the law requires it. Of these, the ones that receive data that came from your Garmin device are Convex (where it is stored), Anthropic (to write your coach’s notes), Vercel (which it passes through on its way to your screen) and Anypost (when a morning note or weekly summary mentions it). PostHog, Sentry, Stripe and Clerk never receive it.
We do not sell your data, and we do not share it with anyone for their own use. Not to advertisers, not to data brokers, not to other users. Every company above processes it only to provide their part of Uplabs to you.
Garmin, if you connect it
Connecting Garmin is optional, and nothing is read from it until you do. You connect on Garmin’s own sign-in page, and Garmin lets you choose what to share with Uplabs — you can change that later in Garmin Connect. Once connected, we collect:
- Each activity — its name, sport, when it started, moving and elapsed time, distance, elevation gain, heart rate, power, speed, cadence, calories and the device it was recorded on.
- Daily health figures — sleep duration, sleep stages and sleep score, overnight HRV, resting heart rate, Body Battery and average stress.
We don’t collect maps, GPS tracks, photos, contacts, or anything about other Garmin users.
When it arrives: Garmin sends it to us each time your watch syncs with Garmin Connect. We receive data only from the moment you connect — Garmin does not send us your history from before then.
How it is used: to match your workouts to your plan, to measure your training load, to ease or hold the week depending on how you’ve recovered, to draw your progress charts, and to write your coach’s notes. It is shown only to you. It is never shown to another user, combined across users, used for advertising, or sold.
What we send to Garmin: only if you turn it on, the planned workouts from your plan, so they appear on your Garmin calendar and watch.
Stopping it: Disconnect on the Account page tells Garmin to stop sending us anything, deletes the keys that let us receive it, and deletes the Garmin data we hold — your Garmin activities and the health figures from your watch. Sessions you completed stay marked as done, and recovery answers you typed in yourself are kept. Removing Uplabs from Connected Apps in Garmin Connect does the same: Garmin tells us, and we delete it all in the same way. Your data in Garmin Connect is not affected either way.
How our AI coach uses your data
Your daily check-in, the note under each workout, and the changes your coach proposes to your week are written by an AI model, Claude, made by Anthropic. Building your plan is not: that is ordinary code working from your answers.
What the model sees: the daily brief described above — your plan, your recent sessions and activities, your recovery figures (including those from Garmin, if you agreed to that), the notes you write, and, if you turned cycle tracking on, which phase you’re likely in. For each new workout it also sees that workout’s figures alongside your last four of the same sport. It does not see your name, your email address or your payment details.
What it does with it: writes text for you, and only you. Its suggestions to change your plan are proposals — nothing moves until you approve it.
What it never does: your data, including anything from Garmin, is never used to train, evaluate or improve any AI model — not Anthropic’s and not ours. Anthropic processes it only to return the response and does not train on it.
Your Garmin data needs your consent: when you connect Garmin we ask, with a box that starts unticked, whether your coach may use your Garmin data. Without it you can’t connect. You can withdraw it at any time with the switch beside Garmin on the Account page, and from that moment no Garmin data reaches the model: Garmin workouts still count toward your weekly totals, but they are not named or described to it, they get no workout note, and your sleep, HRV and other figures from Garmin are left out of the brief.
Stopping it: the coach only runs on a paid subscription; free accounts send nothing to the model at all. To stop your Garmin data reaching it while keeping both your subscription and the connection, switch off the coach’s use of Garmin data on the Account page.
Strava, if you connect it
Connecting Strava is optional, and nothing is read from it until you do. When you connect, Strava asks you to allow Uplabs to read your activities — including ones you’ve kept private — and your profile. That is what we then collect:
- Each activity — its name, sport and type, when it started and in which time zone, moving and elapsed time, distance, elevation gain and range, heart rate, power, speed, cadence, kilojoules, calories, temperature, perceived exertion, Strava’s relative effort, the device it was recorded on, the gear id, whether it was on a trainer, a commute or entered by hand, and who you let see it on Strava.
- Your profile — your heart-rate and power zones, your weight and your FTP.
We don’t collect maps, GPS tracks, photos, comments, kudos or anything about other Strava athletes. Activities arrive when Strava tells us you’ve uploaded one; on first connecting we also read back up to two years.
It’s used to match your workouts to your plan, to measure your training load, and — as set out above — to write your coach’s notes. It is shown only to you. It is never shown to another user, combined across users, used for analytics or advertising, or sold.
Withdrawing consent is either of two things: Disconnect on the Account page, or removing Uplabs in your Strava settings. Either one deletes every activity we imported from Strava straight away. Sessions you completed stay on your plan with their date and duration, because those are your training record rather than Strava’s data.
Asking us to delete it without disconnecting: email hello@uplabs.fit and it’s done within 30 days — in practice, the same day.
The keys Strava gives us to read your account are encrypted before they’re stored, under a key held outside the database. If the data we collect from Strava ever changes, we’ll tell you and ask again before reading anything new.
Your menstrual cycle, if you turn it on
This is off unless you switch it on. Nothing about it is collected or inferred until you do.
It’s health data, which the law treats differently from the rest of this page. The legal basis for holding it is your explicit consent and nothing else — so we record when you gave it.
What’s held is what you enter: your typical cycle length, how long your period usually lasts, and the start dates you log — the twelve most recent, no further back. From those we work out which phase you’re likely in, and that phase goes into the daily brief sent to Anthropic so your coach can take it into account.
Your coach never changes your plan because of it. It’s context, not an instruction. The evidence for training by cycle phase is mixed enough that treating it as a rule would be wrong.
Turning it off in your account deletes all of it immediately. There’s no archived copy and no hidden flag. Turn it back on later and you start from nothing — which is what withdrawing consent has to mean.
How connecting Garmin works
You connect on Garmin’s own sign-in page, not ours. We never see or store your Garmin password. Garmin shows you what Uplabs is asking for and lets you choose what to share, then hands us a key that lets us receive that data and nothing else.
That key is encrypted before it’s stored, under a key held outside the database. Disconnecting deletes it and tells Garmin to revoke it.
How long we keep it
For as long as your account exists.
Deleting your account deletes your data immediately. There’s no waiting period and no way to undo it. Your profile, plan, sessions, imported activities, wellness history, your sign-in itself, and everything the coach ever wrote or spent on your behalf are removed in the same operation. Any subscription is cancelled as part of it. We also tell Strava and Garmin to disconnect us at their end, so we don’t stay listed as an authorised app. We email you a record of what was removed, and that’s the last email you get from us.
Activities already in Strava or Garmin belong to you and stay there. Backups roll off within 30 days.
One thing survives, and it’s worth naming rather than leaving in the gap between “everything” and what actually happens. If you ever paid us, the record of the payment stays. Stripe keeps the customer and the invoices, because tax law requires a business to hold its billing records for six years and the right to erasure doesn’t reach them. They’re a name, an email address, and a list of amounts and dates. They’re not used for anything else, they’re not part of any account, and nothing in them can bring your training data back.
Your rights
You can see and edit most of your data directly in the app, disconnect Garmin or Strava at any time from the Account page — disconnecting either deletes the data we received from it — and delete your account outright.
Wherever you live, you can ask us for a copy of your data (including everything that came from Garmin) in a format you can take elsewhere, to correct anything that’s wrong, or to delete any of it without closing your account. Email hello@uplabs.fit and we’ll do it within 30 days.
If you’re in the UK or EU you also have the right to restrict how it’s processed, to object to it, and to complain to your data protection authority. Ask via the contact page and we’ll respond within 30 days.
Cookies and analytics
Uplabs sets a session cookie so you stay signed in, and stores small preferences in your browser. There are no advertising cookies, and nothing here follows you to other sites.
We use PostHog to count visits, to see which pages people actually read, and to find the places where the app is confusing enough that people give up. It sets its own cookies and records the page you’re on, a rough location from your IP address, and the kind of device you’re using. Your training data, your plan, your cycle data, and anything you write to the coach are never sent to it, and we don’t use it for advertising.
It is connected to your account, and the others here aren’t. Once you sign in we tell PostHog your account id, along with a short list of settings — your sport, your experience level, your units, your timezone, your weekly hours, whether you’ve finished setup, whether Strava is connected, and which plan you’re on. That is the entire list. Not your name, not your email, not your age, not your weight, not your resting heart rate, and not your cycle.
PostHog also records your session — a replay of how you moved around the page, so we can see where people get stuck. Every piece of text is blanked out before it leaves your browser. That happens on your device, not on their servers, so the words you read and the things you type are never transmitted and never stored. What the replay shows is a grey skeleton of the page and where you clicked in it. If you would rather not be recorded at all, ask on the contact page and we’ll switch it off for your account.
We also use Vercel Analytics and Vercel Speed Insights, which count the same visits and measure how quickly pages load. Neither sets a cookie. Instead of storing anything on your device, a visitor is identified by a one-way hash of the request that’s re-salted every day — so nothing stays on your machine and nothing about you carries over to tomorrow. Neither is connected to your account, and neither is used for advertising.
Children
Uplabs isn’t intended for anyone under 16. If we learn we hold data for a child, we delete it.
Changes
If this policy changes in a way that affects what we collect or who sees it, we’ll say so in the app before the change takes effect.