← Endurance Science Labs

Privacy Policy

Endurance Science Labs ("ESL", "we", "us") provides evidence-based endurance coaching and running analysis tools at endurancesciencelabs.com. This policy explains what personal data we collect, how we use it, and the rights you have over it. It is written to meet the requirements of the EU General Data Protection Regulation (GDPR) and the UK GDPR.

What we collect

• Account information — your email address, display name, and profile photo, provided when you sign in (via Google or email) through Firebase Authentication.
• Coaching data — training plans, workout logs and notes, strength-training entries, race goals, and profile details (such as body weight and watch model) that you or your coach enter.
• Strava data — only if you choose to connect your Strava account (see the Strava section below).
• Uploaded device files — activity exports (for example Garmin CSV or Coros/Garmin FIT files) that you upload to the Run Dynamics tool, and the running metrics parsed from them.
• Form-analysis data (esFormLab) — running videos you submit are analyzed in your browser; the analysis results, and the captured frames used to generate your PDF report, are associated with your account when you save or download a report.
• Payment status — payments are processed by Stripe. We store your subscription and payment status; we never see or store card numbers.

How we use your data

We use your data solely to provide our services: displaying your training to you and your assigned coach, generating your analysis reports, processing purchases, and sending service and coaching-related email (via MailerLite). We do not sell personal data, we do not use it for advertising, and we do not use it to train AI or machine-learning models.

Strava data

If you connect your Strava account, we access your activities through the official Strava API, under the Strava API Agreement, using the permission you grant during Strava's authorization screen. Specifically:

• We sync your recent activities (rolling ~120-day window): activity name, type, date, distance, moving/elapsed time, elevation gain, average speed and pace, heart-rate averages, and recent activity descriptions.
• Your Strava data is displayed only to you and your assigned coach. It is never shown to other athletes, never published, never used in leaderboards, and never shared with third parties.
• Your Strava data is used only to deliver your coaching — never for analytics products, aggregated insights, or AI/ML purposes.
• Strava access tokens are stored server-side and are never accessible from the browser.
• You can disconnect at any time using the Disconnect option in your coaching dashboard, or by revoking access at strava.com → Settings → My Apps. Either way, we delete your stored Strava activities and tokens immediately upon disconnection or deauthorization.

Where your data lives

Data is stored in Google Firebase (Firestore and Firebase Authentication, hosted in the United States). Our payment processor is Stripe; our email provider is MailerLite. Each processes data under its own privacy terms and safeguards for international transfers (including standard contractual clauses where applicable).

Retention

Account and coaching data are kept while your account is active. Strava data is deleted immediately when you disconnect Strava or deauthorize the app. To delete your account and all associated data, email us and we will complete the deletion within 30 days.

Legal bases

We process your data to perform our contract with you (providing coaching and analysis services), with your consent (connecting Strava, receiving marketing email), and under our legitimate interest in operating and securing the service.

Your rights

Under the GDPR and UK GDPR you may request access to, correction of, deletion of, or a portable copy of your personal data, and you may object to or restrict certain processing. Contact us at austen.hughes@finalforms.com and we will respond within 30 days. You also have the right to lodge a complaint with your local supervisory authority.

Children

Our services are not directed at children under 16, and we do not knowingly collect their data.

Changes

If we materially change this policy we will update this page and the date above. Continued use of the service after a change means the updated policy applies.