Privacy Policy

2. What we collect

When you sign up and use IcuSync, we collect:

• Account information - your email address and password (hashed, never stored in plain text)
• Subscription data - payment status and billing history, processed by Stripe. We do not store your card details - Stripe handles all payment data.
• Connection credentials - your Intervals.icu OAuth token, stored encrypted, used solely to authenticate requests to Intervals.icu on your behalf
• Usage data - basic logs of when the MCP tools are called, for debugging and service improvement. These logs do not contain your training data.

We do not collect, store, or process your Intervals.icu training data. When Claude requests your training history or pushes a workout, that request passes through IcuSync to Intervals.icu in real time and is not retained.

Lawful basis: We process your account and subscription data on the basis of contract performance - it is necessary to provide the service you have subscribed to. We process usage logs on the basis of legitimate interest - to keep the service running reliably and improve it over time.

3. How we use your data

We use your data only to:

• Operate your IcuSync account and authenticate your connection to Intervals.icu
• Process your subscription payment via Stripe
• Send you account-related emails (subscription confirmation, renewal reminders, important service updates) on the basis of contract performance, and occasional onboarding, feedback, or support-related messages on the basis of legitimate interest to help you get the most out of the service
• Debug and improve the service

We do not sell your data. We do not use your data for advertising.

4. Third parties

IcuSync integrates with the following third-party services:

• Stripe - payment processing. Stripe's privacy policy applies to payment data: stripe.com/privacy
• Anthropic / Claude - Claude processes your prompts and tool calls. Anthropic's privacy policy applies: anthropic.com/privacy
• Intervals.icu - your training data lives on Intervals.icu's servers. Their privacy policy applies: Intervals.icu. Activity data sourced from Garmin devices is attributed to Garmin in accordance with the Intervals.icu API Terms and Conditions.
• Railway - application hosting and infrastructure. Your account and credential data is stored on Railway's servers: railway.com/legal/privacy
• Cloudflare - DNS and CDN services. Network traffic passes through Cloudflare's infrastructure: cloudflare.com/privacypolicy

We are not responsible for the data practices of these third parties.

5. Data retention

We retain your account data for as long as your subscription is active. If you would like your account and data deleted, email dev@icusync.icu and we will action it manually.

Usage and debug logs are retained for up to 90 days, after which they are automatically deleted.

6. Your rights

You have the right to:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Withdraw consent at any time by cancelling your subscription

If you are based in the EU or EEA, these rights are guaranteed under the General Data Protection Regulation (GDPR).

To exercise any of these rights, email dev@icusync.icu.

7. Security

We take reasonable steps to protect your data, including encrypted storage of credentials and HTTPS for all data in transit. No system is completely secure. If you have security concerns, contact us at dev@icusync.icu.

8. Cookies

We use a small number of cookies to keep you logged in and to understand basic site usage. See our Cookie Policy for details.

9. Changes to this policy

We may update this policy from time to time. We will notify you by email if the changes are significant. The current version is always available at icusync.icu/privacy.