Privacy
What we keep,
and why.
CINDER asks you to write down how your running felt. That is personal, so this page says plainly what we store, who can see it, and how to take it back.
The short version
- We collect what you type into the app, and what you do in it. Nothing else.
- There is no advertising, no tracking pixel, and no third-party analytics script.
- We do not sell your data or share it for anyone else's marketing.
- You can download everything or delete it all from Settings, any time.
What we collect
Account. Your email address and a password, handled by our authentication provider. We never see your password in readable form.
Profile. Display name, birth year, goal race and date, weekly mileage band, and your cue word.
Training record. Baseline self-assessment scores, lessons completed, drill answers and scores, time-trial attempts, grit awards, the days you were active, your spaced-review schedule, and your if-then plans.
Your running log. Session labels, which skills you practised, whether your cue fired, whether the skill held up, and the free-text notes you write about a run. This is the most personal thing in the app and it is treated that way — it is never shown to other runners, and it is not used to profile you.
Club posts. Anything you post in the club, plus any reports you file, both visible to moderators.
Technical. A session cookie to keep you signed in, and ordinary server logs kept for security and debugging.
What we do not collect
No GPS, no distance, no pace, no splits, no heart rate — CINDER is deliberately not a training log, and it has no connection to your watch or to Strava. No advertising identifiers. No behavioural analytics SDK: the aggregate numbers we look at are computed from our own database, not from a tracking vendor.
Why we're allowed to hold it
We process your data to run the service you signed up for. Where the law requires a specific basis, ours is performance of our contract with you for the training record, your consent for anything optional, and our legitimate interest in keeping the club safe and the service secure. You can withdraw consent by deleting your account.
Who else sees it
We use a small number of processors to run the product, and they may only act on our instructions:
- Supabase — database, authentication, and storage.
- Vercel — application hosting and server logs.
- Mux — video delivery, once video lessons ship.
- Resend — account and confirmation email.
Other runners see only your display name and what you choose to post in the club. Your logbook, drill answers, baseline scores, and grit are yours alone.
We will disclose data if the law genuinely requires it, and we will tell you unless we are prohibited from doing so.
Where it lives
Our infrastructure is hosted in the United States, in the US West (Oregon) region. If you are outside that region, your data is transferred there and protected by the safeguards our providers have in place.
How long we keep it
Your training record is kept while your account is open, because the whole point is a log you would be sad to lose. When you delete your account it is removed immediately, not queued for later. Server logs roll off on a short cycle. Club threads you started remain readable with your name removed, so that other runners' replies still make sense.
Your controls
Download everything. Settings → Your data → Download my data returns your complete record as JSON.
Delete everything. Settings → Delete account removes your account and all of it. There is no undo and no recovery window.
Reset without deleting. Settings → Reset clears your training progress and keeps the account.
Depending on where you live you may also have rights to correct your data, object to processing, or complain to a data protection authority. Write to us at cindermentaltraining@gmail.com and we will answer within the time the law allows.
Age
CINDER is for runners aged 13 and over. Club posting is closed to accounts under 16. If we learn we are holding data for someone under 13, we delete it. Parents or guardians can reach us at cindermentaltraining@gmail.com.
Cookies
One essential cookie keeps you signed in. There are no advertising or analytics cookies, which is why the app does not put a consent banner in your way.
Security
Traffic is encrypted in transit. Access to the database is restricted per-account by row-level security, so one runner's session cannot read another's record. No system is perfect; if we ever have a breach affecting you, we will tell you and the relevant regulator as the law requires.
Changes
If we change this page in a way that matters, we will say so in the app before it takes effect.
Contact
cindermentaltraining@gmail.com · Cinder Mental Training, 721 E Nora Ave, Spokane, WA