Privacy Policy

1. Who We Are

ThreshIQ LLC is a Texas limited liability company operating the ThreshIQ AI coaching platform at threshiq.ai and app.threshiq.ai. References to “ThreshIQ”, “we”, “us”, or “our” in this policy refer to ThreshIQ LLC.

If you have questions about this policy or your data, contact us at lachlan@threshiq.ai.

2. What We Collect

Account information

When you create a ThreshIQ account we collect:

• Your email address — used to log in and for product communications
• Your name — used to personalise your coaching experience
• Your password — stored as a secure hash, never readable by ThreshIQ

Athletic profile information

To provide accurate AI coaching, we collect information you provide about your athletic background:

• Your A-race and target race date
• Your athletic goals and experience level
• Your current FTP, threshold pace, and CSS (if provided)
• Your injury history (if you choose to share it)
• Your preferred training hours and weekly availability

Daily check-in data — the 4 Burners

Each day you complete a check-in covering four areas of life stress:

• Work stress level
• Family and relationship stress level
• Sleep quality and quantity
• Nutrition and fuelling quality

This data is used exclusively to adapt your training recommendations. It is never shared with third parties.

Training data from Strava

If you connect your Strava account, ThreshIQ accesses:

• Activity data — distance, duration, pace, power, heart rate, and TSS for each workout
• Your Strava athlete profile — name and profile photo
• Historical activities — up to 12 months of prior training to establish baseline fitness

We do not post to Strava on your behalf. We do not access Strava data beyond what is listed above. You can disconnect Strava at any time from the Devices page in your account.

HRV and recovery data

If you provide HRV readings — either manually or via connected devices — we store this data to inform daily training recommendations and readiness scores.

AI coaching interactions

Your conversations with the ThreshIQ AI coach — including questions asked and responses received — are stored to improve the quality and continuity of your coaching experience. We may use anonymised and aggregated coaching interaction data to improve the AI models that power ThreshIQ. Your individual conversations are never shared with third parties.

Technical and usage data

We automatically collect limited technical data when you use the app:

• Browser type and operating system
• IP address — used for security and fraud prevention only
• Pages and features accessed within the app
• Session timestamps

We do not use advertising trackers or sell usage data to advertisers.

Payment information

ThreshIQ uses Stripe to process payments. We do not store your credit card number, CVV, or full card details. Stripe handles all payment data under their own privacy policy. We store only your Stripe customer ID and subscription status.

3. How We Use Your Data

We use the data we collect for these purposes:

• Providing AI coaching — your training data, check-ins, and athlete profile are used to generate personalised morning briefings, session recommendations, and coaching notes
• Adapting your training plan — your 4 Burners check-in data is used to modify your training plan when life stress is high
• Injury management — information you share about injuries is used to suggest modified training protocols
• Product communications — we send onboarding emails, trial reminders, and product updates to your email address. You can unsubscribe from marketing emails at any time.
• Product improvement — anonymised and aggregated data helps us understand how the product is used and where to improve it
• Security and fraud prevention — technical data helps us protect the platform
• Legal compliance — we retain certain data as required by law

4. Strava Integration

ThreshIQ connects to Strava to display your activity history — your rides, runs, and swims — within the ThreshIQ app. This section explains exactly how your Strava data is used and how it is protected in compliance with the Strava API Agreement and API Policy (June 2026).

What ThreshIQ does with your Strava data

• Displays your Strava activities (rides, runs, swims) within the ThreshIQ app for your own reference
• Shows each activity with a direct link back to the full activity on Strava

What ThreshIQ does not do with your Strava data

• Strava data is never passed to any AI system, language model, or analytical engine (Strava API Policy Section 5.3)
• Strava data is never used to generate coaching recommendations, morning briefings, or any AI-powered output (Section 5.3)
• Strava data is never processed in an aggregated or analytical manner (Section 5.4)
• Strava data is never combined with other data for analytics or product improvement purposes (Section 5.4)
• Strava data is never shared with any third party for any purpose (Section 5.10)
• ThreshIQ never posts to Strava on your behalf
• Strava data is never used for advertising or marketing

How ThreshIQ's AI coaching works without Strava data

ThreshIQ's AI coaching layer — Lachy — operates exclusively on data you enter directly into ThreshIQ. This includes your performance metrics (FTP, CSS, run threshold pace), your daily 4 Burners check-in responses (Work, Family, Sleep, Nutrition), and health data from Apple Health where you have granted permission. No Strava data is involved in any AI process at any point.

How long ThreshIQ retains your Strava data

ThreshIQ retains your Strava activity data for a maximum of seven days in compliance with the Strava API Policy (Section 6.2). A nightly automated process permanently deletes all Strava activity data older than seven days from ThreshIQ's systems. No Strava Data or data derived from Strava Data is stored beyond the seven-day permitted window. If you delete an activity on Strava, it is removed from ThreshIQ immediately via our real-time webhook connection.

Disconnecting Strava

You can disconnect your Strava account and delete all associated data at any time from Settings → Devices → Strava → Disconnect. Disconnecting immediately revokes ThreshIQ's access to your Strava account, removes all cached Strava activity data from our systems, and provides you with written confirmation of deletion.

ThreshIQ's use of Strava data complies with the Strava API Agreement and API Policy (June 2026), including Sections 5.3 (no AI use), 5.4 (no analytics or aggregation), 5.5 (no persistent storage beyond operational scope), 6.2 (seven-day cache limit), and 6.3 (reflecting user deletions within 48 hours). Strava's privacy policy is available at strava.com/legal/privacy.

5. Who We Share Data With

We share your data only with service providers necessary to operate ThreshIQ:

• Supabase — database and authentication infrastructure. Your data is stored on Supabase servers in the United States.
• Anthropic / Claude API — powers the AI coaching features. Your training data and check-in information is sent to the Claude API to generate coaching responses. Anthropic does not use this data to train their models unless you separately opt in to Anthropic's own data practices.
• Stripe — payment processing. Stripe receives your billing information to process subscription payments.
• Resend — email delivery. Your email address is shared with Resend to deliver product emails.
• Vercel — hosting and infrastructure. Vercel hosts the ThreshIQ application.

All service providers are contractually required to protect your data and may not use it for their own purposes beyond what is necessary to provide their services to ThreshIQ.

We do not share your data with advertisers, data brokers, sponsors, or any other third parties.

6. AI Coaching and Your Data

ThreshIQ uses large language model AI to generate personalised coaching content. When you interact with the AI coach or receive a morning briefing, relevant portions of your training data, check-in history, and athlete profile are included in the prompt sent to the AI model.

We take the following steps to protect your data in AI interactions:

• Only the data necessary for the coaching response is included in each prompt
• Your data is never used to train AI models without your explicit consent
• AI responses are stored in your account to provide coaching continuity
• You can view and delete your AI coaching history from your account settings

7. How Long We Keep Your Data

• Active account data — retained for as long as your account is active
• Training and coaching data — retained for up to 3 years to support long-term coaching context, unless you delete your account sooner
• Payment records — retained for 7 years as required by tax law
• After account deletion — all personal data is deleted within 30 days, except payment records retained for legal compliance

8. Your Rights and Choices

You have the following rights regarding your data:

Access your data

You can view your training data, check-in history, and account information within the ThreshIQ app at any time. To request a full export of your data, email lachlan@threshiq.ai.

Correct your data

You can update your name, email, athletic profile, and other account details directly in the app under Settings.

Delete your data

You can delete your ThreshIQ account at any time from Settings → Account → Delete account. This permanently deletes all your personal data, training history, and coaching data within 30 days. Payment records are retained as required by law.

Disconnect Strava

You can disconnect your Strava account at any time from Settings → Devices. This stops future syncing but does not delete historical data already imported unless you also delete your account.

Unsubscribe from emails

Every marketing email from ThreshIQ includes an unsubscribe link. You can also manage email preferences from Settings → Notifications. Transactional emails — such as receipts and security alerts — cannot be disabled.

Data portability

You can request an export of your personal data in a machine-readable format by emailing lachlan@threshiq.ai. We will respond within 30 days.

9. How We Protect Your Data

• All data is encrypted in transit using TLS
• Passwords are hashed using industry-standard algorithms and never stored in plain text
• Database access is restricted to authorised ThreshIQ systems only
• Strava access tokens are encrypted at rest
• We regularly review our security practices and infrastructure

No system is completely immune to security risks. If you discover a security issue, please report it responsibly to lachlan@threshiq.ai.

10. Children's Privacy

ThreshIQ is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16, we will delete it promptly. If you believe we have inadvertently collected such data, please contact lachlan@threshiq.ai.

11. International Users

ThreshIQ is operated from the United States. If you are accessing ThreshIQ from outside the United States — including from Australia, the European Union, or the United Kingdom — your data will be transferred to and processed in the United States. By using ThreshIQ, you consent to this transfer.

For users in the European Union and United Kingdom, we process your data on the basis of contractual necessity — your data is required to provide the coaching service you have subscribed to.

12. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• The right to know what personal information is collected about you
• The right to know whether your personal information is sold or disclosed and to whom
• The right to opt out of the sale of personal information — ThreshIQ does not sell personal information
• The right to request deletion of your personal information
• The right to non-discrimination for exercising your privacy rights

To exercise any of these rights, email lachlan@threshiq.ai.

13. Australian Privacy

For users in Australia, ThreshIQ complies with the Australian Privacy Act 1988 and the Australian Privacy Principles. You have the right to access and correct your personal information and to make a complaint if you believe your privacy rights have been breached. Contact lachlan@threshiq.ai for any privacy concerns.

14. Changes to This Policy

We may update this privacy policy from time to time. When we make material changes, we will notify you by email and update the “last updated” date at the top of this page. Your continued use of ThreshIQ after changes take effect constitutes acceptance of the updated policy.