What PhormLab stores, and why
This is a closed beta run by one person. The text below describes what the software actually does — if something here turns out not to match the code, then the code is the bug.
What is stored
- Your Strava profile: name, city, country and your Strava athlete id.
- Your activities as Strava holds them: date, duration, distance, elevation, heart rate, power, pace, position data, and the photos you uploaded here.
- What you enter yourself: resting heart rate, injuries, thresholds, equipment, goals and milestones.
- Your training plans, including the conversation they came from if you used the assistant.
- Access tokens for Strava, encrypted. They are never shown and never appear in a log.
Heart rate, injuries and resting values are health data under Article 9 GDPR. They are stored because the training plan is computed from them, and for nothing else.
Where it goes
- Strava — the source. PhormLab reads your activities; it writes nothing back.
- Anthropic — only if you switch the assistant on, and only what you typed plus a summary of your training figures. Never your name, your address, your position data or a heart rate series: a guard checks every payload before it is sent and refuses the call rather than sending too much.
- Open-Meteo — the weather for the place and date of an activity. The coordinates are rounded before they are sent.
- Error reporting — when something breaks, the place in the code and your account number are reported. No request contents, no training data.
Nothing is sold. There is no advertising, no tracking and no analytics service. The application sets one cookie: the session you are signed in with.
How long
As long as your account exists. Delete it and the data is gone from the database immediately — every activity, plan, photo and conversation.
Backups are the honest exception: encrypted copies are kept for up to five weeks, so that a mistake on the server does not cost everybody their data. A deleted account is still in those copies until they expire. They are never opened to restore a single account — only to bring the whole application back.
What you can do
- Download everything, in one file, including your photos: Profile, then "Your data".
- Delete your account, with everything in it.
- Withdraw consent for the assistant at any time. The features switch off immediately, and the stored conversations can be deleted separately.
Who to ask
Write to the person who invited you. In a closed beta that is the same person who operates the server and wrote the code.