Privacy Policy

Velora Labs ("Velora", "we", "us") operates veloralabs.io and the Velora training platform. We are a US-based company. Contact: contact@veloralabs.io.

We collect:

• Account data: email address, display name, timezone preference
• Training data synced from connected services (Strava; Garmin planned): activity records, heart rate, pace, duration, health metrics
• Usage data: pages visited, features used — via server-side logging only, no third-party analytics
• Contact form submissions

We do not collect payment data, social connections, or any data from accounts you have not explicitly connected.

• To generate personalized training prescriptions and coaching feedback
• To maintain and improve the service
• To respond to support and data requests
• To send transactional emails (account-related only; no marketing without explicit consent)

We do not sell your data. We share data only with:

• OpenAI — for AI-generated coaching content; governed by OpenAI's data processing terms
• Supabase — database hosting; data processed in the US
• Resend — transactional email delivery

Each sub-processor is bound by appropriate data processing agreements. No sub-processor is authorized to use your data for their own purposes.

We retain your data for as long as your account is active. Upon account deletion, personal data is purged within 30 days, except where retention is required by applicable law.

You may request: access to your stored data, correction of inaccurate data, deletion of your account and all associated data, or a portable JSON export. Email contact@veloralabs.io. We respond within 2 business days.

We use AES-256 encryption at rest and TLS 1.2+ in transit. Access is controlled via least-privileged service roles with Row-Level Security. We maintain access audit logs.

We use a single session cookie for authentication. We do not use advertising, analytics, or cross-site tracking cookies.

When you connect Strava or Garmin, you authorize those services to share data with us within the scope shown during the OAuth flow. You may revoke access at any time from within Velora or directly from the third-party service's settings.

Velora is not intended for users under 18. We do not knowingly collect data from minors.

We will notify users of material changes by email before they take effect. Continued use after notice constitutes acceptance of the updated policy.

Privacy questions or data requests: contact@veloralabs.io