Last updated: March 2026 · Effective: March 2026
Short version: We collect only what we need to run your dashboard. We never sell your data. Your health and training data stays yours. You can delete everything at any time.
Decode Strength ("we", "us", "our") is a personal athletic dashboard product operated by Decode Strength, Bengaluru, India. You can reach us at privacy@decodestrength.com.
This Privacy Policy covers the Decode Strength website (decodestrength.com), the web app (app.decodestrength.com), your public dashboard (username.decodestrength.com), and the Decode Strength Android app.
When you sign up, we collect:
When you connect Strava, we access (with your permission):
We access only what you authorise via Strava's OAuth flow. We do not access private activities unless you explicitly set them to public. We do not access your Strava followers, payment information, or email address.
If you install the Decode Strength Android app and grant permission, we read the following from Android Health Connect on your device:
This data is read from your device and sent to our servers only to power your dashboard. It is never sold, shared with advertisers, or used for any purpose other than displaying your personal health metrics.
You can revoke Health Connect permissions at any time through your Android device settings. Revoking permissions stops future data collection. Previously collected data can be deleted on request.
If you connect Intervals.icu by providing your athlete ID and API key, we use these credentials to fetch your training load data (CTL, ATL, TSB, VO₂max estimate) from Intervals.icu. Your API key is stored encrypted. You can disconnect Intervals.icu at any time from Settings.
Payments are processed by Razorpay. We do not store your card number, CVV, UPI PIN, or any full payment credentials. We store only your Razorpay customer ID and subscription ID for managing your subscription status.
We collect basic usage information to keep the service running:
We do not use third-party analytics tracking. We do not install advertising cookies.
| Data | Why we use it |
|---|---|
| Account data | To create and manage your account, send you emails about your subscription, and identify you when you log in. |
| Strava activity data | To populate your public dashboard: heatmap, recent activities, personal bests, statistics. To calculate your Decode Score, Consistency Score, and Runner Archetype. |
| Health data | To show your health metrics on your dashboard (Recovery, HRV, Resting HR, Sleep, SpO₂, Weight, Body Fat). To calculate Race Readiness. Never for any other purpose. |
| Intervals.icu data | To show training load charts (CTL/ATL/TSB) and enhance Race Readiness calculation. |
| Payment data | To manage your subscription status (trial, active, archived) and send receipts. |
| Usage data | To keep the service running, fix bugs, and understand which features are used. |
We do not use any of your data for advertising. We do not sell your data. We do not share your data with third parties except as described in Section 5.
Your public dashboard at username.decodestrength.com is visible to anyone with the link. It displays the data you have chosen to make public:
Health metrics (HRV, resting HR, sleep, weight, body fat, blood pressure) are shown only in your private app view. They are not displayed on your public dashboard.
If your subscription lapses, your dashboard is archived (hidden from visitors). Your data is preserved and the dashboard is restored immediately when you renew.
| Third Party | Purpose | Data Shared |
|---|---|---|
| Strava | Activity data source | OAuth tokens only — used to fetch your data on your behalf |
| Razorpay | Payment processing | Name, email, payment amount — governed by Razorpay's privacy policy |
| Resend | Transactional email | Your email address and name — for sending you subscription emails |
| Cloudflare | Infrastructure (hosting, database) | All data passes through Cloudflare's infrastructure — governed by Cloudflare's privacy policy |
| Cloudflare | Infrastructure — Workers, database, queues, email automation | Account data and activity data processed in Workers runtime; no third-party data sharing |
We do not share your data with any other third parties. We do not share your data with advertisers, data brokers, or analytics companies.
Your data is stored on Cloudflare's infrastructure, primarily in data centres in the Asia-Pacific region. Cloudflare is SOC 2 Type II certified.
We protect your data using:
No system is perfectly secure. If we become aware of a security breach affecting your data, we will notify you at your registered email address within 72 hours.
You have the right to:
To exercise any of these rights, email privacy@decodestrength.com. We will respond within 30 days.
Decode Strength is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at privacy@decodestrength.com and we will delete it promptly.
Health and fitness data is sensitive. We apply additional protections:
We use minimal cookies:
We do not use advertising cookies, tracking pixels, or analytics cookies from third parties. We do not use Google Analytics.
We may update this Privacy Policy as the product evolves. When we make material changes, we will:
Continued use of Decode Strength after changes are posted constitutes acceptance of the updated policy.
For any privacy questions, data requests, or concerns:
Privacy requests: privacy@decodestrength.com
General support: support@decodestrength.com
General enquiries: info@decodestrength.com
We aim to respond to all privacy requests within 30 days.