Legal

Privacy Policy

Effective date: 9 October 2026

How TrainState uses AI

With your explicit consent, TrainState sends your health, biometric and training data to Anthropic to generate AI coaching. You can use TrainState without it and withdraw consent at any time. Read the AI Transparency Statement ↓

1. About this policy

TrainState (“TrainState”, “we”, “us”, “our”) is operated by Nicholas Andrew Van De Pas, a sole trader based in Wellington, New Zealand. This Privacy Policy explains how we collect, use, store, disclose, and protect personal information in connection with the TrainState application and website at trainstate.fit. TrainState is free to use.

This policy applies to all users of the Service and complies with the New Zealand Privacy Act 2020 (which is our primary governing jurisdiction), the General Data Protection Regulation (GDPR) for users in the European Economic Area (EEA), the California Consumer Privacy Act and California Privacy Rights Act (CCPA/CPRA) for California residents, and other applicable privacy laws in your jurisdiction.

Special category health data. The health and biometric data we process (including HRV, heart rate, sleep, and training data) constitutes special category personal data under GDPR Article 9. We ask for your explicit consent to process this data when you create your account, and separately for your explicit consent before any of it is processed by AI (see section 4). You may withdraw consent at any time without affecting the lawfulness of prior processing.

By using TrainState, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the Service.

2. What information we collect

2.1 Health and biometric data

Most health data in TrainState is entered by you. This may include:

  • Daily biometrics you log manually: heart rate variability (HRV), resting heart rate, sleep duration, sleep score, an optional energy score (such as a device's “body battery” reading), recovery time, and perceived fatigue
  • Sessions you complete or log: type, duration, perceived exertion (RPE), sets, reps, weights, and notes
  • Injury notes, training background, fitness goals, training focus, and performance benchmarks you provide

If you choose to connect a supported service (see section 6), we also receive activity data from it: activity type, date, duration, distance, average heart rate, and perceived exertion. If you don't connect a service, all of your data is entered manually.

2.2 Account and profile data

  • Name and email address
  • Hashed password (we never store your password in plain text)
  • Profile information: age, height, weight, and training preferences
  • Equipment, upcoming events, and days you are unable to train
  • Records of the consents you have given or withdrawn, including date, IP address, and browser

2.3 Connected-service data

Only if you connect a supported service. See section 6 for exactly what we access, how it is used, and how it is deleted.

2.4 Technical and analytics data

  • IP address
  • Browser type and device information
  • Service performance and error logs
  • Anonymous page-performance measurements (page load and responsiveness timings, the page address, browser, device type and approximate country), collected by our hosting provider without cookies
  • Pages visited and feature usage, collected through product analytics only after you accept analytics cookies

3. How we use your information

We use your personal information exclusively for the following purposes:

  • To provide and operate the TrainState coaching service
  • To show your biometric trends, training load, and session history
  • To maintain your training calendar and session history
  • To generate AI coaching, training plans, and daily readiness briefs — only with your AI-processing consent (see section 4)
  • To send transactional communications about your account and the service
  • To maintain, improve, and secure the Service

We do not use your health data for advertising, marketing profiling, or any purpose beyond delivering the coaching service described above. We do not sell, rent, or trade your personal information.

AI Transparency Statement

4. How TrainState uses AI

What we use AI for. TrainState uses AI to generate coach chat responses, to build training plans and save them to your calendar, to produce your daily readiness brief, and to save profile details you mention in chat (for example, a new injury) to your profile.

Who provides it. Anthropic, PBC (Claude models), processed in the United States.

What we send — including health data. Each coach request sends:

  • your name, age, height, and weight
  • your goals, benchmarks, injury notes, training background, equipment, events, and days you can't train
  • your training calendar and session results
  • your training log, including activities from any connected service
  • your last 14 days of biometrics (HRV, resting heart rate, sleep, sleep score, energy score, recovery, and fatigue)
  • the conversation itself

The daily readiness brief sends your recent biometrics, the last 7 days of training, today's and tomorrow's sessions, upcoming events, and active goals. This is health data, and it includes both biometrics you enter manually and data from connected services.

Why. Solely to generate personalised coaching for you. Never for advertising, profiling, or any other purpose.

How Anthropic handles it. Under Anthropic's commercial terms, inputs and outputs from its API are not used to train its models by default, and TrainState has not opted in to share data for training. Anthropic deletes API inputs and outputs within 30 days, except where content is flagged for violating its Usage Policy (kept for up to 2 years) or where retention is required by law.

No human review. AI responses are generated automatically and are not checked by a coach, trainer, or clinician before you see them. They can be wrong. They are not medical advice — see section 9 of our Terms of Service.

Your consent. We only send your data to Anthropic after you give explicit AI-processing consent, which is separate from accepting our Terms. You can use TrainState's calendar, session logging, and biometric tracking without it. You can withdraw consent at any time from Profile → AI processing, and the withdrawal takes effect immediately: nothing further is sent. Data already sent is handled as described above. Withdrawing doesn't affect processing that happened before.

5. Sub-processors and data sharing

We share your personal information only with the following sub-processors, each engaged for a specific purpose:

  • Vercel — Hosting, serverless functions (run in Sydney, Australia) and cookieless page-performance measurement. United States company. SOC 2 Type 2 certified.
  • Supabase — Database and authentication. Your data is stored in Sydney, Australia. SOC 2 Type 2 certified.
  • Anthropic — AI processing (Claude models). United States. Only with your AI-processing consent; see section 4.
  • PostHog — Product analytics. United States. Only after you accept analytics cookies.
  • Resend — Transactional email (sign-in and password-reset emails). United States. Processes your email address.
  • Cloudflare — DNS, and email routing for hello@trainstate.fit. Processes emails you send us.
  • Google (Gmail) — We read and reply to support emails sent to hello@trainstate.fit using Gmail.
  • CookieYes — Cookie consent banner. Stores your cookie preferences.

Connected services such as Strava are not sub-processors: you choose to connect them, and they are described in section 6.

We may also disclose personal information if required to do so by law, court order, or to protect the rights, property, or safety of TrainState, its users, or the public.

We do not sell, license, or share your personal information with any other third parties.

6. Connected services

You can choose to connect a third-party fitness or wearable service to TrainState. This is optional — TrainState works fully without one. For every connected service:

  • OAuth only. You authorise TrainState on the service's own website. We never see or store your username or password for that service — only the access tokens needed to fetch your data. Tokens are stored in our database, encrypted at rest, and deleted when the connection ends.
  • Limited scopes. We request only the permissions listed below and use only the data listed.
  • Shown only to you. Data from a connected service appears only in your own account. It is never shown to other users, published, or sold.
  • Immediate deletion. If you disconnect the service in TrainState, or revoke TrainState's access in the service's own settings, we immediately delete all data synced from that service, along with the access tokens.
  • AI processing only with your consent. Connected-service data is included in AI coaching only if you have given AI-processing consent (section 4).

Current connected services

Strava (available to invited accounts only)

  • Scope: activity:read_all — lets us read your activities, including those set to “Only You”.
  • What we store per activity: name, type, date, elapsed time, distance, average heart rate, perceived exertion, and description.
  • What we don't store: GPS routes or maps, location streams, photos, followers, segments, or clubs.
  • Deletion: disconnecting in Profile → Strava, or revoking access in Strava → Settings → My Apps, immediately deletes all Strava-synced data from TrainState. Activities you delete on Strava are removed from TrainState too.
  • Your use of Strava is also governed by Strava's own terms and privacy policy.

We may add further integrations (for example, other wearable platforms) in future. Before any such data is collected, this policy will be updated to list the service and the data accessed.

We aren't responsible for changes to, or the availability of, third-party services and their APIs.

7. Data retention

We retain your data for the following periods:

  • Account, profile, health, and biometric data: kept while your account is active. Deleted immediately when you delete your account, apart from encrypted database backups, which are kept for up to 7 days.
  • Connected-service data: deleted immediately when you disconnect the service, revoke access, or delete your account. Access tokens are deleted at the same time.
  • Coach conversations: unsaved chats are not stored by TrainState. Conversations you choose to save are kept until you delete them or delete your account.
  • Data sent to Anthropic: see section 4.
  • Consent records: kept for the life of your account, so we can show what you agreed to and when.
  • Technical logs: up to 90 days.
  • Analytics data: retained in line with our analytics provider's retention settings, and deleted on request.

8. Cookies

We use the following categories of cookies:

  • Strictly necessary — Supabase authentication tokens. These cookies are required for you to stay signed in and use the Service. They cannot be disabled without breaking functionality.
  • Optional analytics cookies (PostHog). Used to understand how the Service is used. These are only set after you provide consent via the cookie banner on first visit. You can update your preferences at any time via the preference centre in the footer.

We do not use advertising cookies. We do not share data with advertising networks.

9. Security

We implement the following technical and organisational security measures:

  • TLS encryption for all data in transit
  • Encryption at rest via Supabase infrastructure
  • Passwords hashed with bcrypt — never stored in plain text
  • Row-level security (RLS) in Supabase — each user can only access their own data
  • OAuth for connected services — we never handle your credentials for those services
  • Access controls limiting internal access to user data

In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours of becoming aware, and will notify affected users without undue delay where the breach is likely to result in high risk to their rights and freedoms.

Despite these measures, no internet transmission or electronic storage is completely secure. We cannot guarantee the absolute security of your data.

10. Where your data is stored and international transfers

Your TrainState data is stored by Supabase in Sydney, Australia. Our server functions run on Vercel in Sydney, Australia. Vercel is a United States company: it delivers pages, routes requests and checks your sign-in session through its global network, and may process technical data in the United States and other countries. Your data is also processed in the United States by Anthropic (AI processing, only with your consent), and by PostHog, Resend, Cloudflare, Google, and CookieYes as described in section 5.

  • EEA users: Transfers outside the EEA are made under Standard Contractual Clauses (SCCs) as approved by the European Commission, where required by GDPR.
  • New Zealand users: Transfers are made under reasonable steps obligations as required by the NZ Privacy Act 2020.

11. Your rights

You can withdraw AI-processing consent yourself at any time in Profile → AI processing, export your data from Profile, and delete your account from Profile.

11.1 EEA users — GDPR rights

If you are located in the European Economic Area, you have the right to:

  • Access the personal data we hold about you
  • Rectification of inaccurate or incomplete data
  • Erasure (“right to be forgotten”) where grounds apply
  • Portability — receive your data in a structured, machine-readable format
  • Restrict processing in certain circumstances
  • Object to processing based on legitimate interests
  • Withdraw consent at any time for consent-based processing, including for special category health data and AI processing

You may lodge a complaint with your national supervisory authority. Norwegian users may contact Datatilsynet at datatilsynet.no.

11.2 New Zealand users — NZ Privacy Act 2020

Under the New Zealand Privacy Act 2020, you have the right to:

  • Request access to personal information we hold about you
  • Request correction of personal information that is inaccurate or out of date

We will respond to access and correction requests within 20 working days as required by the Privacy Act 2020. If you believe we have interfered with your privacy, you may complain to the New Zealand Privacy Commissioner at privacy.org.nz.

11.3 California residents — CCPA/CPRA rights

California residents have the right to:

  • Know what personal information we collect, use, and disclose
  • Delete personal information we have collected
  • Correct inaccurate personal information
  • Opt out of the sale or sharing of personal information — we do not sell your personal information
  • Limit the use and disclosure of sensitive personal information
  • Non-discrimination for exercising your CCPA/CPRA rights

11.4 All other users

Users in other jurisdictions may have additional rights under applicable local law. Contact us at hello@trainstate.fit to make a request.

12. Health disclaimer

TrainState is not a medical device and does not provide medical advice, diagnosis, or treatment. It is not a substitute for a qualified healthcare professional or certified trainer. See the full health disclaimer in section 9 of our Terms of Service.

13. Children's privacy

TrainState is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected personal information from a child under 16, we will take steps to delete that information promptly.

14. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify you by email at least 30 days before the changes take effect. The updated policy will include a revised effective date. Continued use of TrainState after changes take effect constitutes acceptance of the updated policy.

15. Contact and Privacy Officer

For privacy enquiries, data access requests, consent withdrawal, or any concerns about how we handle your personal information, contact our Privacy Officer:

Nicholas Andrew Van De Pas

Privacy Officer — TrainState

Email: hello@trainstate.fit

Wellington, New Zealand

← Back to TrainState