Privacy, Terms, Security & Cookies.
The rules of the road for using Build Your Legend. Plain language where we can manage it; precise language where we have to.
Privacy Policy
GBI Inc. (“GBI”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards personal information when you use Build Your Legend (the “Service”), including the website at www.buildyourlegend.app and the StrideIQ™ training application.
We are headquartered in the Province of Quebec, Canada. The Service is currently in beta. We are committed to handling your information in compliance with applicable data protection laws, including Quebec’s Act respecting the protection of personal information in the private sector (“Law 25”), Canada’s PIPEDA, the EU/UK GDPR, and the CCPA/CPRA.
1.1 Information we collect
We collect only what we need to operate StrideIQ™ and improve your training. Specifically:
- Account information. Your email address, optional display name, and authentication state. We do not store passwords; you authenticate through Strava’s OAuth flow.
- Strava-connected data. When you connect Strava, we receive your athlete profile and activity data (runs, distance, pace, heart rate, GPS streams, cadence, elevation, perceived effort). Scopes requested:
read,read_all,profile:read_all,activity:read,activity:read_all, andactivity:write. Theactivity:writescope is used only if you opt in to plan upload; we do not modify or delete your existing activities without your direction. - Training inputs you provide. Race goals (“Chapters”), target distances and dates, training preferences, equipment notes, perceived effort, injuries you choose to disclose, and any free-text feedback.
- Generated training data. Plans, weekly workouts, adaptations, analytics, and AI-generated coaching messages produced by StrideIQ™ on your behalf.
- Device & usage data. IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, timestamps, and basic interaction events.
- Communications. Emails you send us, beta feedback, and support tickets.
We do not knowingly collect Social Insurance Numbers, Social Security Numbers, government identification, payment-card numbers, or sensitive health-record data from clinical sources.
1.2 How we use your information
- Provide, operate, and maintain the Service, including generating and adapting your StrideIQ™ training plan;
- Authenticate you, secure your account, and prevent fraud or abuse;
- Communicate with you about plan updates, beta features, training milestones, maintenance, and product changes;
- Improve our models and product through aggregated, de-identified analytics;
- Comply with legal obligations and respond to lawful requests.
1.3 Legal bases (EU/UK users)
- Performance of a contract — to deliver the Service you signed up for (Art. 6(1)(b)).
- Legitimate interests — to secure our systems, prevent abuse, and improve the product (Art. 6(1)(f)).
- Consent — for non-essential cookies, optional marketing emails, and processing of special-category data you voluntarily provide (Art. 6(1)(a) and 9(2)(a)).
- Legal obligation — where we must process data to comply with applicable law (Art. 6(1)(c)).
1.4 Automated processing & StrideIQ™
StrideIQ™ is an automated training engine. It generates and modifies your weekly plan based on your inputs and your Strava activity history. These outputs are coaching suggestions, not medical advice. The plans do not produce legal or similarly significant effects within the meaning of GDPR Art. 22, but you may always edit, override, or ignore any suggestion, and you may contact us to request human review of any adaptation you believe is inappropriate.
1.5 How we share information
We do not sell your personal information. We share it only in these limited circumstances:
- Service providers (processors). Hosting and database providers (MongoDB Atlas), authentication infrastructure (NextAuth), email delivery, analytics, error monitoring, and AI model providers powering StrideIQ™. Each provider is bound by contractual confidentiality and data-processing terms.
- Strava. When you connect your Strava account, data flows under Strava’s own terms and privacy policy. If you opt in to plan upload, we may write planned workouts to your Strava account.
- Legal & safety. Where required by law, court order, or to protect the rights, property, or safety of GBI Inc., our users, or the public.
- Corporate transactions. If GBI Inc. is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to equivalent protections.
1.6 International transfers
Personal information is processed in Canada and may be processed in the United States and other countries where our service providers operate. Where data is transferred out of the EEA, the UK, Switzerland, or Quebec, we rely on appropriate safeguards including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and transfer impact assessments under Quebec Law 25.
1.7 Data retention
We retain your personal information for as long as your account is active and for a limited period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or anonymize your personal information within ninety (90) days, except where retention is required by law. Aggregated, de-identified data may be retained indefinitely for product improvement.
1.8 Your rights
Depending on where you live, you may have the right to access, correct, port, restrict, or delete your personal information; to object to certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority. Quebec residents have rights under Law 25, including the right to de-indexation. California residents have rights under CCPA/CPRA. EU/UK residents have rights under GDPR/UK GDPR.
To exercise any right, email privacy@buildyourlegend.app. We will respond within the timeframes required by applicable law (typically 30 days) and may need to verify your identity before fulfilling certain requests.
1.9 Disconnecting Strava and deleting your account
You can revoke our access to your Strava data at any time from Strava settings under “My Apps.” You can also request account deletion by emailing privacy@buildyourlegend.app. Disconnecting Strava halts new data sync; deleting your account removes your stored data subject to the retention terms above.
1.10 Children
The Service is not intended for individuals under the age of sixteen (16). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.
1.11 Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. For material changes, we will notify you by email or in-app before they take effect.
1.12 Contact us
GBI Inc.
Province of Quebec, Canada
Privacy inquiries: privacy@buildyourlegend.app
EU/UK residents may lodge a complaint with their local data protection authority. Quebec residents may contact the Commission d’accès à l’information du Québec. Other Canadian residents may contact the Office of the Privacy Commissioner of Canada.
Terms of Service
These Terms of Service (the “Terms”) are a binding agreement between you and GBI Inc., a corporation incorporated in the Province of Quebec, Canada, governing your use of Build Your Legend, including the StrideIQ™ training engine, the website at www.buildyourlegend.app, and any related applications (collectively, the “Service”).
By creating an account, connecting Strava, or otherwise using the Service, you agree to these Terms and to our Privacy Policy. If you do not agree, do not use the Service.
2.1 Eligibility
You must be at least sixteen (16) years old to use the Service. By using the Service, you represent that you meet this requirement and have the legal capacity to enter into these Terms in your jurisdiction.
2.2 Beta Service
The Service is currently offered as a beta. Beta features are provided “as is,” may contain bugs, may change or be withdrawn at any time, and may not perform as intended. We may limit, throttle, or revoke access to beta features for any user at any time without liability. We will provide reasonable notice before transitioning to a paid plan and will honour any commitments specifically extended to early-access users.
2.3 Your account
You are responsible for maintaining the confidentiality of your authentication credentials, including your connected Strava account. Notify us promptly at privacy@buildyourlegend.app of any unauthorized use. You are responsible for all activity that occurs under your account.
2.4 Third-party services (Strava)
The Service relies on Strava’s API to provide its core functionality. Your use of Strava is governed by Strava’s own terms of service and privacy policy. We are not affiliated with, endorsed by, or sponsored by Strava. If Strava changes its API, restricts our access, or becomes unavailable, our ability to provide the Service may be impaired or suspended. We accept no liability for Strava’s acts or omissions.
2.5 Acceptable use
You agree not to:
- Use the Service in violation of any law, regulation, or third party’s rights;
- Attempt to reverse-engineer, decompile, scrape, or otherwise gain unauthorized access to the Service or its underlying systems;
- Use the Service to transmit malware, conduct denial-of-service attacks, or interfere with other users;
- Submit false or misleading data, impersonate another person, or use another user’s Strava account without authorization;
- Resell, sublicense, or commercially exploit the Service or its outputs without our prior written consent;
- Use the Service or its outputs to train competing machine learning models.
2.6 Not medical advice — assumption of risk
The Service provides general training guidance, not medical advice. StrideIQ™’s suggestions are informational only and are not a substitute for the advice of a qualified physician, physiotherapist, or other healthcare professional. Running and other physical activity carry inherent risks of injury, illness, and, in rare cases, death. You assume all risks associated with following any plan generated by the Service. Consult a qualified healthcare provider before beginning any new exercise program, particularly if you have any medical condition, are pregnant, or are recovering from injury.
2.7 Your content
You retain ownership of the data and content you submit to the Service (“User Content”). You grant GBI Inc. a worldwide, non-exclusive, royalty-free licence to host, store, reproduce, process, transmit, and create derivative works of your User Content solely as necessary to operate, secure, and improve the Service. You may revoke this licence by deleting your account, subject to the retention terms in our Privacy Policy.
2.8 Our intellectual property
The Service, including the StrideIQ™ engine, software, models, designs, logos, and the “Build Your Legend” and “StrideIQ” names and marks, is owned by GBI Inc. or its licensors. We grant you a limited, non-exclusive, non-transferable, revocable licence to use the Service for your personal, non-commercial training, subject to these Terms.
2.9 Fees, billing, and trials
During the beta, the Service is provided free of charge unless otherwise stated. When paid plans are introduced, fees, subscription terms, free-trial length, and refund policy will be presented at the point of purchase. Subscriptions auto-renew until cancelled. You may cancel at any time; cancellation takes effect at the end of the then-current billing period. Beta users will receive notice and an opportunity to opt in before any paid charges begin.
2.10 Suspension and termination
We may suspend or terminate your access at any time, with or without notice, if we reasonably believe you have violated these Terms, if required by law, or if continued provision poses a risk to other users or our systems. You may stop using the Service and delete your account at any time by emailing privacy@buildyourlegend.app.
2.11 Disclaimers
The Service is provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory. To the maximum extent permitted by applicable law, GBI Inc. disclaims all warranties, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, and uninterrupted or error-free operation. We do not warrant that StrideIQ™’s suggestions will produce any particular outcome.
2.12 Limitation of liability
To the maximum extent permitted by applicable law, GBI Inc. and its directors, officers, employees, and agents will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or any loss of profits, revenues, data, goodwill, or other intangible losses. In no event will our aggregate liability exceed the greater of (i) the total fees you paid us in the twelve (12) months preceding the event, or (ii) CAD $100.
2.13 Indemnification
You agree to indemnify and hold harmless GBI Inc. and its personnel from and against any claims, damages, losses, liabilities, and expenses (including reasonable legal fees) arising out of your use of the Service in violation of these Terms, your User Content, or your violation of any law or third-party right.
2.14 Changes to these Terms
We may update these Terms from time to time. For material changes, we will provide reasonable advance notice by email or in-app. Your continued use of the Service after changes take effect constitutes acceptance of the updated Terms.
2.15 Governing law and venue
These Terms are governed by the laws of the Province of Quebec and the federal laws of Canada applicable therein. The parties agree that the courts of the judicial district of Montreal, Province of Quebec, will have exclusive jurisdiction over any dispute arising out of or relating to these Terms or the Service, subject to any non-waivable rights you may have in your country of residence.
2.16 Miscellaneous
These Terms, together with our Privacy Policy and any order-specific terms, constitute the entire agreement between you and GBI Inc. regarding the Service. If any provision is held unenforceable, the remaining provisions remain in effect.
Quebec law note: As required by Article 55 of the Charter of the French Language, this English-language version is made available at the express request of the parties. Les parties confirment leur volonté expresse que le présent contrat soit rédigé en anglais.
Security
Security is foundational to a service that handles your training data and Strava connection. This section describes the organizational and technical measures we use to protect the Service. Our practices evolve as the product matures.
3.1 Data in transit
All connections to the Service use TLS 1.2 or higher. Traffic between your browser, our application servers, our database, and the Strava API is encrypted in transit. We enforce HTTPS site-wide and use HSTS to prevent protocol downgrade attacks.
3.2 Data at rest
Your data is stored in MongoDB Atlas with encryption at rest using AES-256. Backups are encrypted and access is restricted to authorized personnel using role-based access control. Secrets (API keys, OAuth client secrets, signing keys) are stored in a managed secrets system, never in source code.
3.3 Authentication and session security
User authentication is handled through Strava’s OAuth 2.0 flow via NextAuth. We do not store your Strava password. Sessions are issued as signed JWTs with a short access-token lifetime; refresh tokens are rotated and revoked on sign-out. Sensitive cookies are flagged HttpOnly and Secure and use the strictest practical SameSite setting.
3.4 Application security
We follow common web-application security practices, including input validation, parameterized queries, output encoding, dependency scanning, and regular updates of third-party libraries. Our infrastructure is segmented; production data is not accessible from staging or local development environments. Privileged access is limited to a small number of authorized personnel and is logged.
3.5 Monitoring and incident response
We monitor application errors, abnormal authentication patterns, and usage anomalies. We maintain an incident-response process and will notify affected users and applicable regulators in accordance with our legal obligations under Quebec Law 25, PIPEDA, GDPR/UK GDPR, and CCPA/CPRA in the event of a confirmed personal-information breach that creates a real risk of significant harm.
3.6 Responsible disclosure
If you believe you have discovered a security vulnerability, please report it privately to privacy@buildyourlegend.app. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate. We will acknowledge your report, work in good faith to address valid issues promptly, and credit your finding if you wish.
3.7 Your role in keeping the Service secure
Security is a shared responsibility. Please use a strong, unique password on Strava; enable Strava’s two-factor authentication; sign out of shared devices; and review the applications connected to your Strava account periodically. If you suspect your account has been compromised, contact us immediately.
Questions about anything on this page? Email us at privacy@buildyourlegend.app. This is a first draft prepared for review — please have counsel licensed in Quebec review it before relying on it for any regulated activity.