Privacy by design.

TrainWithMCP is an independent project operated as a small, privacy-conscious service. It is not owned, operated, or sponsored by Strava, OpenAI, Google, xAI, Anthropic, or another AI provider.

When you create an account, Supabase Auth processes your email address, password credentials, email-verification state, password-recovery state, and authentication tokens. TrainWithMCP receives your verified Supabase user ID and uses it to scope your records. The application does not log passwords, JWTs, or OAuth authorization codes.

When you authorize Strava, TrainWithMCP stores an encrypted access token and refresh token, token expiry information, the connected Strava athlete reference, and synchronization timestamps so it can refresh and update your authorized data.

The service imports approximately the most recent 90 days of activities. It stores normalized training fields such as activity name, sport, date, distance, duration, heart rate, cadence, watts, calories or kilojoules, and elevation when provided. Provider payloads may be retained for richer training analysis, but they are redacted before storage and exposure.

Maps, polylines, precise start and end coordinates, embed tokens, upload identifiers, and other provider identifiers are stripped before activity details are stored or returned. Raw provider details are not returned by default from MCP tools; an explicitly requested activity detail is still redacted and size-limited.

• Authenticate you and maintain your account.
• Connect to Strava only after you authorize the connection.
• Store and retrieve your authorized activities for website views and MCP tools.
• Refresh stale activity data when an MCP read needs current information.
• Prevent cross-account access by scoping every read to the verified user ID.
• Measure basic product usage and reliability when optional analytics are configured.

The Worker may keep a small D1 usage record containing your internal user ID, whether the read came from the website or MCP, and a timestamp. It does not contain activity payloads, emails, tokens, or JWTs.

If PostHog is configured for this deployment, the Worker sends privacy-minimized product events and request diagnostics. Product events do not include emails, tokens, JWTs, Strava payloads, or raw activity JSON. Cloudflare Worker observability may retain invocation metadata and application logs for the configured retention period; the application is designed not to log secrets or query strings.

Supabase Auth receives account and authentication requests. Strava receives OAuth and API requests needed to authorize and import your activities. Cloudflare operates the Worker and D1 database hosting. PostHog receives analytics only when the deployment owner has configured a PostHog key. Your selected AI assistant receives data only after you connect this MCP server to that assistant and authorize its OAuth request; the assistant provider then handles the conversation under its own terms and privacy policy.

The current MVP does not include a self-service delete button or a user-facing data export. You can revoke TrainWithMCP access from Strava, which prevents future API access, and you can request deletion of your TrainWithMCP account data by contacting the project owner. A deletion request should identify the account email or verified account context needed to locate the records; do not send passwords or tokens.

Strava tokens are encrypted before they are stored in D1. Database queries are parameterized and scoped to the authenticated user. MCP requests must pass the Worker’s OAuth/JWT authorization boundary, and tool arguments cannot supply an arbitrary user ID. No security measure is perfect, so do not use the service to store secrets or highly sensitive health information beyond the authorized fitness data it supports.

The service is not directed to children and is not a medical device. Training summaries are informational and should not be used to diagnose, treat, or make urgent health decisions.

For privacy questions or deletion requests, email the project owner at privacy contact: acdplol@gmail.com. This policy may change as the product adds providers, controls, or operational services. The updated version will be posted on this page with a new date.