Privacy Policy

2. What we collect

When you sign up and use IcuSync, we collect:

• Account information - your email address and password (hashed, never stored in plain text)
• Subscription data - payment status and billing history, processed by Stripe. We do not store your card details - Stripe handles all payment data.
• Connection credentials - your Intervals.icu OAuth token, stored encrypted, used solely to authenticate requests to Intervals.icu on your behalf
• Usage data - basic logs of when the MCP tools are called, for debugging and service improvement. These logs do not contain your training data.

We do not collect, store, or process your Intervals.icu training data. When Claude requests your training history or pushes a workout, that request passes through IcuSync to Intervals.icu in real time and is not retained.

Lawful basis: We process your account and subscription data on the basis of contract performance - it is necessary to provide the service you have subscribed to. We process usage logs on the basis of legitimate interest - to keep the service running reliably and improve it over time.

3. How we use your data

We use your data only to:

• Operate your IcuSync account and authenticate your connection to Intervals.icu
• Process your subscription payment via Stripe
• Send you account-related emails (subscription confirmation, renewal reminders, important service updates) on the basis of contract performance, and occasional onboarding, feedback, or support-related messages on the basis of legitimate interest to help you get the most out of the service
• Debug and improve the service

We do not sell your data. We do not use your data for advertising.

4. Third parties

IcuSync integrates with the following third-party services:

• Stripe - payment processing. Stripe's privacy policy applies to payment data: stripe.com/privacy
• Anthropic / Claude - Claude processes your prompts and tool calls. Anthropic's privacy policy applies: anthropic.com/privacy
• Intervals.icu - your training data lives on Intervals.icu's servers. Their privacy policy applies: Intervals.icu. Activity data sourced from Garmin devices is attributed to Garmin in accordance with the Intervals.icu API Terms and Conditions.
• Railway - application hosting and infrastructure. Your account and credential data is stored on Railway's servers: railway.com/legal/privacy
• Cloudflare - DNS and CDN services. Network traffic passes through Cloudflare's infrastructure: cloudflare.com/privacypolicy

We are not responsible for the data practices of these third parties.

5. Coach access and athlete data

IcuSync offers two coach access modes:

• IcuSync invite - an athlete sends a coach invite from their dashboard. The coach then has access to that athlete's training data through Claude. The athlete controls which tools the coach can use and can revoke access at any time.
• Direct Intervals.icu coach mode - a coach who already has an established coaching relationship on Intervals.icu enters their Intervals.icu API key in IcuSync. IcuSync uses that key to access the coached athletes' data on Intervals.icu on the coach's behalf.

In both modes, when a coach uses Claude through IcuSync, their athletes' training data passes through Anthropic's systems in the same way as any other Claude conversation. Anthropic's privacy policy applies: anthropic.com/privacy. IcuSync does not store athlete training data.

Coaches using direct Intervals.icu coach mode must confirm, at the point of setup, that they have informed their athletes that AI tools are used to assist with training analysis. The responsibility to obtain any consent required under applicable law rests with the coach.

Athletes who have accepted a coaching relationship on Intervals.icu should be aware that their coach may use third-party tools, including AI tools, to assist with training analysis. If you are an athlete and have concerns about how your coach uses your data, contact your coach directly.

6. Data retention

We retain your account data for as long as your subscription is active. If you would like your account and data deleted, email dev@icusync.icu and we will action it manually.

Usage and debug logs are retained for up to 90 days, after which they are automatically deleted.

7. Your rights

You have the right to:

• Access the data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and data
• Withdraw consent at any time by cancelling your subscription

If you are based in the EU or EEA, these rights are guaranteed under the General Data Protection Regulation (GDPR).

To exercise any of these rights, email dev@icusync.icu.

8. Security

We take reasonable steps to protect your data, including encrypted storage of credentials and HTTPS for all data in transit. No system is completely secure. If you have security concerns, contact us at dev@icusync.icu.

9. Cookies

We use a small number of cookies to keep you logged in and to understand basic site usage. See our Cookie Policy for details.

10. Changes to this policy

We may update this policy from time to time. We will notify you by email if the changes are significant. The current version is always available at icusync.icu/privacy.