Legal
Last updated February 2026
CourseRecon — Privacy Policy Effective Date: [Launch Date] Last Updated: [Launch Date]
CourseRecon is operated by [Your Legal Entity Name] ("we," "us," or "our"), based in Auckland, New Zealand. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use CourseRecon.
We are committed to compliance with the New Zealand Privacy Act 2020 and the EU General Data Protection Regulation (GDPR) where applicable.
When you create an account, we collect:
To provide personalised analysis, you may provide:
When you connect a third-party fitness platform or upload files directly:
From Strava (via OAuth):
From Garmin Connect (via OAuth):
From direct FIT/GPX/TCX file uploads:
When you upload a course file for analysis:
When you make a purchase:
We automatically collect:
We use privacy-respecting analytics. We do not use Google Analytics or any tracking tool that shares data with advertising networks.
We use your information to:
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Provide course analysis and readiness scoring | Activity data, course files, athlete profile | Contract performance |
| Generate pacing and training recommendations | Activity data, athlete profile, course analysis | Contract performance |
| Process payments | Payment and account information | Contract performance |
| Send service emails (receipts, account updates) | Email address | Contract performance |
| Improve our algorithms and analysis accuracy | Aggregated, anonymised activity and course data | Legitimate interest |
| Respond to support requests | Account and communication data | Contract performance |
| Detect fraud and abuse | Technical data, usage patterns | Legitimate interest |
| Send product updates and feature announcements | Email address | Consent (opt-in) |
We do not use your data for:
We share your data only in the following limited circumstances:
We use trusted third-party services to operate CourseRecon:
| Provider | Purpose | Data Shared | Location |
|---|---|---|---|
| Supabase | Authentication, database hosting | Account data, athlete data, course data | USA |
| Stripe | Payment processing | Payment details, email, billing country | USA (PCI-DSS compliant) |
| Vercel | Application hosting | Technical data (IP, request logs) | USA (Global CDN) |
| Strava | Fitness data sync (when connected) | OAuth tokens; activity data flows from Strava to us | USA |
| Garmin Connect | Fitness data sync (when connected) | OAuth tokens; activity data flows from Garmin to us | USA |
To perform course analysis, we query open data services using the GPS coordinates from your uploaded course files. These services include OpenStreetMap (Overpass API), NASA SRTM, and ESA Copernicus. Only geographic coordinates are sent — no personal information is transmitted to these services.
We may disclose your information if required by law, court order, or government request, or to protect the rights, safety, or property of CourseRecon, our users, or the public.
If CourseRecon is acquired or merged, your data may be transferred to the new entity. We will notify you before any such transfer and give you the option to delete your account.
We will never sell your personal data.
Your data is primarily stored in Supabase's US region. Application hosting and static assets are served via Vercel's global CDN. Payment data is processed and stored by Stripe in PCI-DSS compliant infrastructure.
We implement the following security measures:
| Data Type | Retention Period |
|---|---|
| Account information | Until you delete your account |
| Activity and training data | Until you delete your account or disconnect the integration |
| Course analysis results | Until you delete the analysis or your account |
| Payment records | 7 years (NZ tax and legal requirements) |
| Technical/usage logs | 90 days (IP anonymised after 30 days) |
| Support communications | 2 years after resolution |
Regardless of your location, you can:
If you are located in the EU, EEA, or UK, you additionally have the right to:
Under the NZ Privacy Act, you have the right to:
CourseRecon uses a minimal set of cookies:
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| Session token | Authentication | Essential | Session / 30 days |
| Preferences | UI settings (units, dark mode) | Functional | 1 year |
| Analytics | Privacy-respecting usage analytics | Analytics | 90 days |
We do not use:
You can manage cookies through your browser settings. Disabling essential cookies may prevent you from using the Service.
When you connect Strava, we use OAuth 2.0 to access your activity data. We request only the permissions necessary to provide the Service:
We do not post to your Strava account, modify your data, or access your social feed, followers, or clubs. You can disconnect Strava at any time from your CourseRecon account settings or from Strava's "My Apps" settings page.
Strava API compliance: CourseRecon displays Strava data in accordance with the Strava API Agreement. Activity data sourced from Strava is attributed with the "Powered by Strava" badge where required.
When you connect Garmin Connect, we use OAuth 2.0 to access your activity data. We request only the permissions necessary to provide the Service:
We do not post to your Garmin account or modify your data. You can disconnect Garmin Connect at any time from your CourseRecon account settings or from the Garmin Connect app.
When you upload FIT files directly, we process the embedded data (GPS, heart rate, cadence, power, temperature, etc.) to build your training profile. FIT files are stored securely and deleted if you remove the activity or delete your account.
CourseRecon is not directed at children under 16. We do not knowingly collect personal information from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly.
Your data is primarily processed in the United States (Supabase, Vercel, Stripe, Strava, Garmin) and may transit through other locations via Vercel's global CDN. As your data is transferred outside New Zealand, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) where required by GDPR for EU/EEA/UK users.
We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before changes take effect. The "Last Updated" date at the top of this page indicates the most recent revision.
For privacy questions, data requests, or complaints:
Privacy Contact: [privacy@courserecon.app] Address: [Your registered address, Auckland, New Zealand]
For NZ Privacy Act complaints, you may also contact: Office of the Privacy Commissioner PO Box 10094, Wellington 6143 https://privacy.org.nz
