Privacy Policy

This policy explains what Sporava collects, why, who can see it, and how you control it. It is maintained by the Sporava team and applies to the web app and any companion mobile apps.

1. Data we collect

• Account & profile: email, display name, handle, referral code, chosen role (coach / athlete / self-coached), primary sport and specialization, locale.
• Health & fitness inputs: date of birth, self-reported medical conditions, injuries, medications, and any notes you enter. You choose whether to share these with your coach.
• Wearable & device data: workouts, heart rate, pace, power, cadence, distance, GPS traces, sleep, recovery, and other metrics from devices you connect (e.g. Apple Health export, Garmin, Strava, Oura, BLE sensors, phone GPS).
• Location: route GPS from workouts you sync, and phone GPS while a live session is active. We do not track background location outside a session.
• Live coaching: the session goals, targets, and live metrics you send to the AI coach, plus the cues it returns. Voice cues are synthesized locally in your browser and not stored.
• Payments: subscription status, tier, trial state, and billing metadata. Card details are handled by our payment processor — we never see or store your card number.
• Operational logs: IP address, browser, timestamps of Terms acceptance, sign-ins, errors, and sync jobs, used for security and debugging.
• Youth athletes (13–17): we require age 13+, and recommend parental or guardian oversight for anyone under 18. Coaches only see a minor's data with the same consent grants that apply to adults.

2. How your data is shared

Your data is private by default. Coaches only see what you explicitly grant through a consent grant (per-athlete, per-category, revocable at any time). We do not sell your data or share it with advertisers. We do not use your health, wearable, or coaching data to train third-party AI models.

3. Subprocessors

We rely on standard infrastructure providers to run the service, including database and auth hosting, our payment processor, an AI gateway that routes requests to model providers, and email delivery. Each processes data only to run the corresponding feature.

4. Retention & deletion

You can remove individual sessions, disconnect any device (which stops future ingestion), disassociate from any coach, cancel your subscription, and delete your account from Settings → Danger Zone. Account deletion removes your profile, sessions, health notes, device connections, and consent grants. Billing and audit records may be retained where required by law.

5. Security

Access to your rows is enforced by row-level security in the database. Coaches must have an active link and a matching consent grant to read any of your health or workout data.

6. Contact

Privacy questions or data requests: privacy@sporava.com.