EndureMore

Coming soon. EndureMore is in final testing ahead of public launch — everything here already works, including connecting Strava and subscribing, but expect ongoing changes while we finish polishing things.

Draft — not yet legally reviewed. The registration consent text this policy supports was drafted directly by the site owner, not generated by AI; this policy page expands on it in good faith to be honest and specific rather than to sound complete. Given this service holds health information (special category data), a final legal review is still worth doing before this is relied on at scale, but it's a considered starting point.

Privacy Policy

Version: 2026-08-15

What we collect

• From Strava: your activity data (GPS routes, pace, heart rate, distance, time) for activities you choose to generate a mission card for, and basic profile information (name, and city/state/country if you've set and shared them on your Strava profile — used only in aggregate, e.g. "how many athletes per country," never shown individually) via Strava's OAuth connection. We do not receive your email address from Strava — Strava's API doesn't provide it.
• Directly from you: your name and email address (given at registration); your training goal, if you set one; your answers in the daily health check-in and the one-time onboarding health baseline (age, sex, long-term health conditions, exercise background, and anything you tell us in those conversations).
• From Spotify (optional): if you choose to connect a Spotify account (on the goal page, for the cadence-matched playlist feature we're building), we store an encrypted connection to your account and your Spotify account ID/display name. As of now, connecting doesn't do anything beyond storing that connection — no playlists are read or created yet. This connection is entirely optional, requires its own separate consent, and you can disconnect it at any time.

Why we collect it

To generate the AI-coached mission cards and training guidance this service provides — your GPX/activity data and health context are what the coaching narrative is grounded in. Without this data, the core features of the service don't work.

Special category data

Your health and performance data (age, sex, long-term health conditions, exercise background, and daily check-in responses) is treated as special category personal data. It is only used to provide the personalised analysis, training insights, capability assessments and related services you've requested, to improve those services, and to meet our legal obligations — not for any other purpose.

How it's processed

Your activity and health data is sent to Anthropic's API (Claude) to generate the coaching narrative text — this is a real third party in the data flow, processing your data on our behalf to provide the service, not an incidental one.

We do not send your name, email address, or Strava account ID to Claude as part of any request — only the training and health content itself (pace, distance, heart rate, GPX-derived session structure, and your check-in/onboarding/goal conversation content). If you choose to type your own name into a free-text reply during a check-in or goal conversation, that text is sent as-is, since it's part of what you wrote — we don't scan for or strip it out.

Where and how it's stored

Data is stored securely on servers located in the United Kingdom. Health check-in and health baseline responses are encrypted at rest, the same protection used for your Strava access tokens. Specific data retention periods and a named contact for data queries are not yet fully defined — this is a real gap in this draft, not an oversight to gloss over.

Your consent and how to withdraw it

We record the date/time you gave consent (separately for health data processing, service communications, and marketing, since these are genuinely different consents) and which version of this policy you agreed to. You may withdraw health data consent at any time; withdrawal doesn't affect processing already carried out, but may prevent continued use of features that rely on that information. Marketing consent is independent of the other two and can be withdrawn at any time without affecting your access to the service. Service communications (account verification, security notices, requested reports, support responses) are necessary to operate your account and aren't a marketing opt-out.