Privacy Policy

Last updated: 27 July 2026

This Privacy Policy explains how the Strathlon mobile application (the "App") handles your information. We have designed Strathlon to keep your data on your device wherever possible. The App has no account and no login, and we do not run any advertising or third-party analytics SDKs.

In short: Most of your data — your profile, food logs, training history and in-app analytics — never leaves your iPhone. Apple Health data is read on-device only. When you use the AI Coach, the relevant text and any food photo are sent to our AI provider to generate a response. Subscriptions are handled entirely by Apple. We don't sell your data, and we never use your health data for advertising.

1. Who we are (Data Controller)

The data controller is Chanaka Ekanayake trading as Strathlon, developer of Strathlon. You can contact us about privacy at [email protected].

2. No account, no login

Strathlon does not require you to create an account, and we do not ask for your name purely to identify you (the name you optionally enter during setup is used only to personalise the App on your device). There is no email/password sign-up and no social login. The only identity associated with you on our servers is the anonymous transaction identifier Apple assigns to your subscription (see section 6).

3. What we collect, and why

The following is created and stored on your device and is not transmitted to us, except where this policy explicitly says otherwise:

Data	Why	Where it lives
Profile & setup (name, accent colour, age, gender, height, weight, goals, experience, training setup, food preferences, sports and schedules)	To build and personalise your training plan and nutrition targets	On device
Health & safety details you choose to enter (food allergies and supplements to avoid, injuries, pregnancy/breastfeeding, chronic conditions, medications, and the optional relationship-with-food and readiness questions)	To keep your plan and your coach's advice safe for you — for example never proposing a food you're allergic to, and never putting you in a calorie deficit during pregnancy	On device. Shared with the AI Coach so its advice is safe (see section 5). Not included in the default iCloud backup (see section 7)
Food logs, training history, weight and progress entries	To power your tracker, charts and plan progression	On device
In-app workout & body analytics (e.g. session and rest data, body-metric and sleep samples)	To improve plan personalisation; you can opt out in the App	On device (Apple SwiftData store, no iCloud sync)
Chat messages, food descriptions and food photos you send to the AI Coach	To generate coaching answers, meal plans and calorie/macro analysis	Sent to our AI processors (section 5); see retention in section 9
Apple subscription transaction identifier & anonymised usage/cost figures	To verify your subscription and meter AI usage fairly	On our Cloudflare Worker (section 6)

4. Apple Health (HealthKit) — read-only

With your permission, Strathlon reads data from Apple Health to personalise your plan and nutrition targets and to auto-fill your stats. Access is read-only. By default, Health data stays on your device and is not transmitted off it — the only exception is the opt-in AI coaching described below. Specifically, the App requests read access to:

Active and resting (basal) energy burned
Heart rate, resting heart rate and heart-rate variability (HRV)
Respiratory rate
Blood oxygen (SpO2)
Wrist temperature (overnight, while sleeping)
VO₂ max
Body weight (mass), height, BMI and body-fat percentage
Biological sex and date of birth (for accurate metabolic calculations)
Workouts
Sleep analysis, including sleep stages (deep/REM/core/awake), sleep efficiency and bed/wake times (used for analytics where you grant it)

Health data is never sold and never used for advertising. In line with Apple's requirements, data obtained through HealthKit is used only to provide and personalise the App's features on your device. It is not shared with third parties for advertising or marketing, and is not disclosed to data brokers.

Optional: sharing Health data with the AI Coach. By default, your Apple Health data is not sent to our AI provider. If you turn on "Share Health data with AI coaching" (off by default; offered once during onboarding and available any time in Settings → Privacy & your data), certain Health-derived figures — body weight, BMI/body-fat, calories burned, resting and active heart rate, heart-rate variability (HRV) and heart-rate recovery, respiratory rate, blood oxygen (SpO2), overnight wrist temperature, cardio-fitness (VO₂ max), recent workouts, your sleep in detail (including the deep/REM/core/awake breakdown, sleep efficiency and bed/wake times) and sleep-debt, and a derived "readiness" summary — may be sent to our AI provider (section 5) solely to generate your coaching and the AI Health Analyst's answers, and only when a feature you use needs them. If you have told the App you are on hormone therapy (an optional question — see below), that status is also covered by this same switch and is shared only when it is on, so the coach reasons from your actual logged data rather than a sex-typical baseline. This is never sold and never used for advertising, and you can turn it off at any time. Your reproductive/cycle information is never shared with the AI unless you separately enable cycle-aware coaching.

This same opt-in powers the AI Health Analyst, which lets you ask the coach plain-English questions about your Health data — for example your sleep, resting heart rate or recovery — and shows a "readiness" summary. No new data is shared beyond the figures listed above, and your reproductive/cycle data remains excluded.

Biological sex and hormone therapy. Strathlon asks for your biological sex as a required setup field. It is a calculation input, not a label: the metabolic-rate equations the App uses were derived separately for male and female bodies, and the App's minimum daily calorie floor is keyed to it. Like your age and height, it forms part of your basic profile and is included in the standard iCloud backup and in the context sent to the AI Coach, because the calorie model cannot be applied or explained without it. Strathlon separately asks an optional question about hormone therapy (testosterone, estrogen, or none / prefer not to say), asked of every user. Its only purpose is accuracy: where no measured body-fat percentage or lean mass is available, it adjusts the App's estimate of your body composition, which changes your calorie targets. It is treated as special-category health data: it is stored on your device, excluded from the iCloud backup unless you switch on the separate, off-by-default "Back up health & safety details", and shared with the AI Coach only under the "Share Health data with AI coaching" switch above. Setting it back to None in Profile & Settings → Body & stats deletes it everywhere the App holds it. It is never used for advertising, profiling or sale.

You can grant or revoke Health access at any time in iPhone Settings → Privacy & Security → Health → Strathlon. Declining only means you'll enter some values manually.

5. AI processing (Anthropic & Cloudflare)

The AI Coach features — chat answers, AI meal plans, "describe-to-log", and photo calorie/macro analysis — are powered by a large language model. When you use these features, the App sends the relevant content to a Cloudflare Worker that we operate, which forwards it to Anthropic's Claude models to generate the response. What is sent depends on the feature and may include:

The chat message or food description you type;
A food photo you choose to analyse;
Relevant profile context (such as your goals, targets and preferences) so the answer is tailored to you;
Your health & safety details — see the box below.

Health & safety details are always shared with the AI Coach. So that its advice is safe for you, the health & safety details you enter in the App are included with every AI Coach message: food allergies and supplements to avoid, whether you are pregnant or breastfeeding, any chronic conditions and medications you have entered, and any injuries. If you completed the optional relationship-with-food or fitness-readiness questions and something was flagged, the coach is told that a flag was raised — never your individual answers — so that it keeps its guidance gentle and conservative. Your dietary and religious food preferences (for example halal, kosher, vegetarian or vegan) are included for the same reason.

This is not controlled by the "Share Health data with AI coaching" switch, which governs Apple Health measurements only — the figures listed in section 4. We have deliberately chosen to share these details rather than withhold them: a coach that does not know about a nut allergy, a pregnancy or a heart medication can give advice that is unsafe. You can review the full list in the App at Profile & Settings → App settings → Privacy & your data → "What your AI coach can see", and you can change or remove any of these details at any time in your profile.

These details are sent to generate that answer only. They are never sold, never used for advertising and are not used to train AI models. To keep follow-up questions fast, our AI provider briefly caches the background context we send (a few minutes); beyond that, our processors apply only their own limited operational retention as described in section 9. We keep no long-term store of your messages. Your reproductive/cycle information is never included unless you separately enable cycle-aware coaching, and then only as a single general phase word.

We use the following processors for this feature:

Cloudflare, Inc. — hosts the proxy ("Worker") that authenticates your subscription, applies fair-use limits, and routes the request. It does not store the content of your messages or photos.
Anthropic PBC — operates the Claude AI models that generate the response from the content sent.

These providers process your content to deliver the feature you requested. Your AI requests are not used to train models under our API arrangement, and we do not attach your name or contact details to them.

6. Subscriptions (Apple)

Strathlon's premium AI features require an auto-renewing subscription, purchased through Apple's App Store using Apple's StoreKit. Apple processes the payment — we never see or store your card or payment details.

To confirm you're entitled to the AI features, the App sends the Apple-signed subscription transaction (a cryptographic token) to our Cloudflare Worker, which verifies it directly with Apple's App Store Server API. The Worker keeps a record keyed to the anonymous Apple original transaction identifier in order to apply daily fair-use limits and to log anonymised AI usage and cost (token counts and estimated cost). This identifier is not your name, email or Apple ID, and is not combined with any directly identifying information by us.

7. Where your data is stored

The large majority of your data — profile, food and training logs, progress, and in-app analytics — is stored on your device and is included in your normal device and iCloud device backups (which are controlled by Apple, not us). The only data on our servers is the subscription/usage record described in section 6, plus the transient AI request content described in section 5.

Strathlon's own iCloud backup (your private iCloud, never our servers).

Separately from Apple's device backup, the App can copy some of your data to your own private iCloud account so it is restored if you reinstall or change phone. This never goes to a Strathlon server and is never sent to the AI. It is split across several switches in Profile & Settings → App settings → Privacy & your data:

Switch	Default	What it covers
iCloud backup	On	Basic details (name, age, sex, height), weight, daily totals, goals, training setup, plan progress, your saved foods, auto-add rules, saved meal plans, schedule changes and holiday breaks, and your food preferences — including any dietary or religious food preference you have set, such as halal, kosher, vegetarian or vegan
Back up health & safety details	Off	Allergies and supplements to avoid, injuries, body composition and fitness figures (resting heart rate, VO₂ max), pregnancy/breastfeeding, chronic conditions and medications, and your answers to the optional relationship-with-food and readiness questions. While this is off, none of these — including your allergies — are copied to iCloud, and you will be asked to re-enter them after a reinstall
Sync progress photos to iCloud	Off	Your progress photos
Back up training data to iCloud	On	Weigh-ins and lifting history

Your reproductive/cycle data is never included in any of these, in any configuration. You can turn any switch off at any time; turning one off also removes that data from your iCloud backup.

8. No advertising, no third-party trackers

Strathlon contains no advertising and no third-party advertising or analytics SDKs (for example, no Facebook SDK, Google Analytics, or similar). We do not track you across apps or websites, and we do not sell or share your personal data for advertising.

9. Retention

On-device data remains until you delete it, reset the App, or delete the App. The AI request content sent to our processors is used to generate your response and is subject to those providers' own limited operational retention (for example, short-term abuse-prevention retention); we do not maintain our own long-term store of your messages or photos. The anonymised subscription/usage records are retained for fair-use enforcement, accounting and fraud prevention.

10. Legal basis (UK GDPR)

For users in the UK and EEA, we rely on the following legal bases under the UK GDPR / GDPR:

Performance of a contract — to provide the App's features you request, including AI responses and subscription verification.
Consent — for access to Apple Health data and your camera/photos, which you grant through the iOS permission prompts and can withdraw at any time.
Legitimate interests — to keep the service secure, prevent abuse, and understand anonymised, aggregate AI usage and cost.
Explicit consent (Article 9) — some of what you may choose to enter is special-category data: health information (allergies, pregnancy or breastfeeding, chronic conditions, medications, injuries, cycle data, hormone-therapy status) and, where a dietary preference such as halal or kosher reflects a religious belief, that preference. Every one of these fields is optional and is entered by you; you provide explicit consent by entering it, and you can remove it at any time in the App. We use it only to make the App's plans and coaching safe and appropriate for you — never for advertising, profiling or sale.

11. Your rights

Because Strathlon has no account, most of your data is in your own hands: you can view, edit, or delete it directly in the App, and deleting the App removes the on-device data. Where we hold data (the anonymised subscription/usage record), you have the right to request access, correction, or deletion, and to object to or restrict processing. Note that we may be unable to link a request to a specific record without the relevant Apple transaction identifier. To exercise your rights, contact [email protected]. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority.

12. Children

Strathlon has a minimum age of 16, and we recommend it for ages 18 and over. Onboarding blocks anyone who indicates they are under 16, and for users aged 16 or 17 the App never sets a weight-loss target or calorie deficit — it keeps their calories at a healthy maintenance level. We do not knowingly collect data from anyone under 16. If you believe someone under 16 has used the App, please contact us so we can help.

13. Camera & photos

Strathlon requests access to your camera and photo library only so you can take or choose a food photo to analyse. A photo you select for analysis is sent to our AI processors (section 5) to estimate calories and macros. We do not access your photo library for any other purpose.

14. Launch notification list (website)

If you register your interest on our website ("register your interest" / "Notify me"), we store: your email address, the time you signed up, which page you signed up on, and the exact consent text you agreed to. We use this for a single purpose: to send you one email announcing Strathlon's launch on the App Store. It is never shared with anyone else and never used for any other marketing.

The lawful basis is your consent, which you can withdraw at any time. The list is deleted no later than 60 days after the App Store launch. To be removed sooner, use the unsubscribe link in any email we send, or contact [email protected].

15. Website visit measurement (no cookies)

On our website only — not in the App — we count arrivals so we can tell whether people are finding our guides. This uses no cookies, no third-party analytics service, and nothing that can identify you. When a page loads, we record the page you arrived on, the time, the hostname of the site that linked you (for example "google.com" or "chatgpt.com"), and the country your request reached us from.

We deliberately do not store your IP address, any identifier, your browser's user-agent string, or the address of the referring page — only its bare hostname, because a full referring address can contain search terms and other personal details. We only record the page you arrive on, not where you go next, so there is no browsing trail to reconstruct. The data is processed by Cloudflare on our behalf and never leaves it. Our lawful basis is our legitimate interest in understanding how our website is found; because nothing identifies you, there is nothing for us to link back to a person.

16. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above and, where appropriate, highlighted in the App.

17. Contact

Questions about this policy or your data? Email [email protected].