Your data, plainly.
Tuin is a tool shared between friends, not a company harvesting data. Here is exactly what it keeps and what it never does.
What Tuin stores
Your name and photo from Strava, your OAuth tokens (server-only, never sent to the browser), your training plan and chat history, and derived training numbers per run — distance, time, elevation, average heart rate, and computed training stress (TSS/NGP).
What Tuin never stores
Raw GPS tracks, per-second streams, or your location history. Streams are read once, in memory, to compute a run's training stress — then discarded. This is also what Strava's API agreement requires.
Health data, in the app
The iPhone app uses Apple's HealthKit; the Android app uses Health Connect. If you connect either, Tuin imports your workouts — distance, time, elevation, heart rate — to compute the same training numbers it computes for Strava runs. It never reads your location or routes: Tuin doesn't even request that permission, and health data is never used for advertising or shared with anyone. Tuin writes back to Apple Health only when you send a planned workout to your watch. Sync can be switched off in Settings any time, access can be revoked in Health → Sharing → Apps → Tuin, and deleting your account erases these workouts like everything else.
Signing in, and your email
You can sign in with Strava, Google, or Apple. Tuin keeps only what it needs to recognise you — the provider's anonymous ID and, from Google or Apple, the email they share (Apple's Hide My Email works fine). Your passwords never touch Tuin; they stay with the provider. Your email is for reaching you about your own training, never for selling.
Who sees it
Only you see your data — every table is keyed to your athlete ID and locked behind server-only access. No other athlete, no advertiser, no data broker. Two exceptions: the AI that writes your coaching, which has its own section below; and if you signed up through a partner's link — a creator, a run club, a coach — that partner sees your first name and whether you're on a trial or paying, and nothing else, so they can be paid for bringing you.
The AI coach
Tuin's plans and chat replies are written by Claude, an AI service run by Anthropic PBC in the United States. With your permission — asked for in the app before anything is sent, and withdrawable at any time in Settings → App — Tuin sends Claude your run summaries (date, distance, time, elevation, average heart rate and the training-stress numbers computed from them), your plan and goal race, your chat messages and Tuin's earlier replies, your first name, your stated training preferences, and the notes you write about how a session felt. That data reaches Tuin from Strava's API, from Apple Health or Health Connect if you connect them, from files you upload, and from what you type. It is used for exactly one thing: generating the coaching text you asked for. Anthropic processes it to produce the reply and does not use it to train its models; their API terms commit them to protections equivalent to those described on this page. Never sent: your GPS tracks or location, your email address, your OAuth tokens, and your payment details. If you decline, Tuin keeps importing and scoring your runs and keeps your calendar — it simply won't write or adjust a plan or reply in chat.
Ads, and counting visits
None of this happens unless you say yes to it. Until you accept on the cookie banner, Tuin sets no advertising cookie and loads no advertising script — and if you decline, it never does, the app is identical, and you're simply counted as nobody in particular. If you do accept: Tuin notes which campaign brought you here, in a cookie on your own browser for 30 days, and keeps it on your account if you sign up, purely so it can tell whether an ad was worth paying for. Meta's pixel also loads on the public pages, which is a third-party script and does let Meta know you visited; and when a trial or a payment happens, Tuin's server tells Meta that one did — identified by a scrambled (hashed) version of your email address, never a readable one, and never anything about your training, your runs or your plan. You can change your mind at any time, right at the bottom of this page. Separately, and whatever you choose, page visits are counted in aggregate by Vercel Web Analytics: how many people opened a page, roughly where from, on what kind of device. It sets no cookie and never tells Tuin who you are. Everything tied to you goes when your account goes.
Delete everything, any time
In the app, go to Settings → App → Delete account (there's also a "Delete account" link at the foot of every dashboard page). It erases your account, tokens, plan, chat, and every derived number — immediately and irreversibly, honoring the GDPR right to erasure. The one thing kept is the anonymous service-cost ledger (call counts and their cost — no name, no runs, no words), retained as billing records under GDPR Art. 17(3). You can also just ask Jordi, the data custodian for this group.
If you only left your email
An address on the waiting list is just that — an address, plus whatever you typed in the note. It's used once, to tell you Tuin is open, and you can ask for it to be deleted at any time.