Privacy Notice

This notice describes information used for thethirdlap.com, endurosync.com, the EnduroSync app and account, billing and selected services. Contact craig@thethirdlap.com with a privacy question or request. The separate Consumer Health Data Privacy Notice below explains health-related information in more detail.

Information and purposes

Account and contact information: your email address, verification state, account identifiers and messages you send. We use these to establish your account, respond and provide service notices. Purchases: your selected offer, payment-provider references, payment and subscription status, trial and paid-access dates, and the terms version recorded with your purchase. We use these to process and reconcile purchases and determine access. Stripe collects the payment details you provide in its checkout. Training and optional personal information: your name, profile information, goals, availability, preferences, plans, workouts, recovery information, photos or videos, files and conversations you provide or connect. Precise location can be included in home-location information and GPS tracks in activity files. Weather and start-window features use location coordinates. Updated app and backend versions round those coordinates to about 11 km; other features, including uploaded activity tracks and home-location information, can still contain precise location. We use them for your selected features and support. Optional beliefs or preferences may be included if you enter them. Technical information: account/session identifiers, device push-notification identifiers, security/rate-limit records, product-interaction events, crash reports and other diagnostic reports help operate, protect, analyze and troubleshoot the service. App information sent with your authenticated account is linked to that account. Website services receive technical information when your browser contacts them.

Services that process information

Relevant information can be processed by these services: WordPress.com and Jetpack for website delivery, visit/click statistics, blog subscriptions and Likes. Jetpack Stats uses browser and request information, including IP addresses and visited/referring URLs. WordPress.com receives your email if you submit a blog subscription. Stripe for checkout, payment processing and subscription management. The billing integration sends purchase and integration references; it does not add workout or medical details to Stripe payment metadata. Fly.io for backend hosting/storage and a separate analytics service for athlete-scoped analysis. Training files and recovery measurements can be forwarded to that service. Resend for account verification, access-code and service emails. Email is not a private place to send unnecessary medical details. Anthropic for AI features. Relevant athlete, plan, activity and recovery context, conversations and tool results can be sent to its AI service, along with meal photographs submitted for nutrition estimation. Data received from your Garmin connection is sent to Anthropic only if you turn on “Let the AI coach use my Garmin data” (see Garmin data below). Google when you book through the linked scheduling page. If you separately connect Google Calendar in EnduroSync, workout details can be sent to a dedicated calendar and calendar changes read back for plan-adaptation suggestions. Your connected wearable/training providers, and Open-Meteo for weather coordinates. Availability and data exchanged depend on the provider and feature. A purchase does not itself create a coach relationship or grant a coach access to every training or health record. Coaching access and the information shared are governed by the applicable athlete permissions. Information you intentionally email to Craig is also received by Craig through email.

Choices and retained information

In app versions with Settings > Privacy > “Send crash and error reports,” this setting is on by default. Turning it off stops new analytics events, error reports and crash reports and deletes a queued crash report that has not been sent. It cannot recall a request already sent to the network. This app setting does not control website statistics or essential account/security processing.

Use available connection and sharing controls to change future access. Disconnecting a provider is different from deleting data already imported. Use coach-sharing controls to withdraw permission for future access and new processing of the information covered by that permission. Revocation is different from recalling information already received; it does not erase downloaded copies. Do not assume that a request already in progress is stopped immediately. Trial expiry, cancellation and a full refund do not automatically erase your account history. The manual-originals retention feature is designed to make retained files downloadable for up to 365 days. Updated versions apply a 2 GB (2,000,000,000-byte) total originals limit per athlete. When retaining another original would exceed the limit, the import can still succeed without retaining that original; the upload response identifies this. Existing retained originals are not removed merely to make room for a newer file. That period does not define retention for derived analysis, account, billing, messages or backup records. You can contact us to request access, correction, an export or deletion and to ask which records remain.

Garmin data

In this section, “Garmin data” means data we receive through your Garmin connection in EnduroSync. If you connect it, Garmin sends us the data you choose to share on Garmin's own consent page. This can include activities (time, distance, pace, speed, power, heart rate, cadence, elevation and laps, with the route kept in the original activity file), daily summaries, sleep and sleep score, heart-rate variability, stress, Body Battery, respiration and breathing variations, pulse oximetry, VO2 max and fitness age, body composition, blood pressure, skin temperature, hydration and nutrition logs. Menstrual cycle data, including whether you are pregnant, is kept only if you turn that on separately. Without your permission, menstrual and pregnancy records are discarded during processing rather than saved to your menstrual-data store. Incoming data remains in the processing queue until processed; processing holds can delay its removal.

Garmin recordings that reach us another way. A workout or daily measurement recorded on a Garmin device can also reach us another way: through intervals.icu or Strava, as a file you upload, or through the Garmin bridge. Those copies are not Garmin data as defined here, and the Garmin AI setting below does not cover them. They are handled under the rest of this notice:

Activity files from intervals.icu and files you upload are analysed by our analytics service. Daily measurements from the Garmin bridge (such as HRV, resting heart rate, sleep, blood oxygen, stress, readiness, recovery and Body Battery) can also be sent to it.

AI coaching, if you use it, can use activities from intervals.icu, uploaded files, the Garmin bridge and other connected services. The AI source filter is enabled by default and excludes activities that came from Strava, came through Strava, or were merged with a Strava copy.

How we use it. Only to provide EnduroSync to you: showing your activities and health measurements; working out training load, fitness, fatigue, recovery trends and best efforts; looking up the weather for each activity; comparing completed sessions with your plan and adjusting upcoming sessions; race preparation; your report emails; and sending the planned workouts and race courses you choose back to your Garmin device. We may view your account to help you when you ask for support. Your Garmin data is linked to your account and is not combined with other people's data for any other purpose.

Who receives it.

Fly.io hosts our servers and stores your data.

Resend delivers your report emails, which contain figures worked out from your data. They are sent only to you. You can turn the weekly and monthly reports off. The quarterly report goes to the email address you set for notifications; remove that address to stop it.

Apple's push notification service delivers notifications you turn on, such as the morning brief, which can include your readiness figure.

Anthropic receives Garmin data only if you turn on AI coaching for it (see below).

A coach you connect can see your data according to the sharing permissions you give, which you can change at any time. Menstrual cycle data is shown to a coach only if you also turn on that separate setting.

Telegram carries the AI coach's replies if you link Telegram and have turned on AI coaching for your Garmin data.

Open-Meteo receives a location rounded to about 11 km, with a date, for weather. An activity's start point may come from Garmin.

Google Calendar and intervals.icu, if you connect them, receive your planned sessions (title, duration, planned load). Upcoming sessions may have been adjusted using your recovery data.

Garmin receives the planned workouts and race courses you send to your device.

Our analytics service does not receive the activity files or daily readiness records from your Garmin connection. No one else receives your Garmin data. We do not use advertising, tracking or data-broker services.

We do not sell it. We do not sell, rent or trade Garmin data, and we do not share it with third parties for their own purposes. We would tell you before any change to this.

AI Transparency Statement. EnduroSync's AI coaching uses Anthropic's Claude to answer your questions and write coaching notes. Garmin data is used by AI coaching only if you turn on “Let the AI coach use my Garmin data”. This setting is off unless you turn it on, both when you connect Garmin and in your Garmin connection settings. When it is on, the Garmin data and figures the coach uses to answer you are sent to Anthropic to produce that answer. That includes a summary of your recent recovery and training (activities, sleep, heart rate, HRV, stress and daily summaries, and figures worked out from them). Menstrual cycle data from your Garmin connection is never sent to the AI coach. EnduroSync never uses Garmin data, or anything worked out from it, to train, evaluate or improve AI models. Anthropic's commercial terms say it does not train its models on data sent through its API. When the setting is off, AI coaching is paused for your account. Your charts, numbers and reports still work. You can turn it off at any time, and that takes effect from your next request, including any request already waiting to be retried. Answers written while it was on stay in your history. You can clear your coach conversation in the iPhone app; you can ask us by email to remove other AI-written notes.

Your choices and rights.

Access and export: you can see your data in the app. The data export on the web or iPhone downloads your account data as a file: your activities from every source, your daily readiness records, your coach conversation, your preferences and other records you have made. From your Garmin connection, the readiness records include HRV, resting heart rate and sleep. The rest of your Garmin data (for example stress, Body Battery, pulse oximetry, body composition and menstrual cycle data) and the original activity files are not in the export yet; you can ask for them by email.

Correct: you can correct an activity's duration, distance and training load, and add notes. Changes you make in Garmin Connect update the copy here. Sleep and other daily measurements cannot be edited in the app; you can ask us by email to correct one.

Delete: you can delete activities in the app. To delete daily measurements or original activity files, or your whole account and everything in it, email craig@thethirdlap.com. Deleted data can remain in our backups until those are replaced: we keep the 14 most recent nightly backups, and older ones are removed as new ones are made, so a failed or held backup run can delay this. Turning off menstrual cycle data deletes what was kept (apart from copies in backups). Disconnecting Garmin does not delete it, so turn that setting off first if you want it gone.

Withdraw consent: turn off AI coaching for your Garmin data at any time. Disconnect Garmin in EnduroSync, or remove EnduroSync in Garmin Connect, and no new Garmin data is received. Data already received stays until you delete it.

Consumer Health Data Privacy Notice

This separate notice concerns health-related information handled by The Third Lap and EnduroSync. It applies alongside the general Privacy Notice. It is not consent to share information with a coach, connect a provider or use an optional feature.

What we collect and why

Depending on what you provide and the features or connections you choose, health-related information can include heart rate and heart-rate variability, sleep, readiness and recovery measures, body measurements, training activities and exertion, injury or illness information, nutrition and meal images, recovery check-ins, clinician records you supply, and health information in notes or conversations. Analysis can derive trends or inferences from those records. Sources include you, files you upload, your device or health platform when connected, and connected wearable or training services. We use the information to show your records, analyze training and recovery, support the plans and guidance you request, and provide the human review or coaching you purchase. Features vary; not every source or category is required for every service.

Who can receive health-related information

Hosting and storage services process the records stored for the app. The separate analytics service can receive training files and recovery measurements. Anthropic can receive the relevant health and training context, messages, tool results and meal images for AI features. A coach can receive information covered by the athlete’s applicable sharing permissions. A connected calendar can receive workout details when you use calendar export. A weather provider can receive coordinates for the weather feature. Information included in a message you choose to send is received by that message’s recipient and communication service. The general Privacy Notice identifies the currently reviewed providers by name. Connected-provider authorization and coach-sharing permissions are distinct from payment authorization. Review the data and recipient before connecting a service, granting access or including health information in a message.

Your choices and requests

Where applicable consumer-health privacy law gives you these rights, you may ask us to confirm whether we collect, share or sell your consumer health data; obtain access and information about recipients; withdraw consent; request deletion; or appeal a denied request. Send requests or appeals to craig@thethirdlap.com. Identify the account and request, but do not include passwords, payment-card numbers or unnecessary medical records in email. Stopping a connection or withdrawing a sharing permission is not the same as deleting retained records. Deletion requests can involve the app, analytics stores, service providers and backups, and applicable legal requirements may affect what must be retained. This notice does not promise immediate deletion from every system, a fixed deletion completion date, or recall of copies already received by another person.

Security and changes

No online service can promise perfect security. Keep account access codes private and contact craig@thethirdlap.com if you suspect unauthorized account access. A privacy notice is not a substitute for a feature’s required consent. Materially different collection or sharing must be explained before it is introduced, with any consent required by applicable law.