Privacy, Terms, Security & Cookies.

GBI Inc. (“GBI”, “we”, “us”, or “our”) collects, uses, discloses, and safeguards personal information when you use Build Your Legend (the “Service”), including the website at www.buildyourlegend.app and the StrideIQ™ training application.

We are headquartered in the Province of Quebec, Canada. The Service is currently in beta. We are committed to handling your information in compliance with applicable data protection laws, including Quebec’s Act respecting the protection of personal information in the private sector (“Law 25”), Canada’s PIPEDA, the EU/UK GDPR, and the CCPA/CPRA.

1.1 Information we collect

We collect only what we need to operate StrideIQ™ and improve your training. Specifically:

• Account information. Your email address, optional display name, and authentication state. We do not store passwords; you authenticate through Strava’s OAuth flow.
• Strava-connected data. When you connect Strava, we receive your athlete profile and activity data (runs, distance, pace, heart rate, GPS streams, cadence, elevation, perceived effort). Scopes requested: read, read_all, profile:read_all, activity:read, activity:read_all, and activity:write. The activity:write scope is used only if you opt in to plan upload; we do not modify or delete your existing activities without your direction.
• Training inputs you provide. Race goals (“Chapters”), target distances and dates, training preferences, equipment notes, perceived effort, injuries you choose to disclose, and any free-text feedback.
• Generated training data. Plans, weekly workouts, adaptations, analytics, and AI-generated coaching messages produced by StrideIQ™ on your behalf.
• Device & usage data. IP address, browser type and version, operating system, device identifiers, referring URLs, pages viewed, timestamps, and basic interaction events.
• Communications. Emails you send us, beta feedback, and support tickets.

We do not knowingly collect Social Insurance Numbers, Social Security Numbers, government identification, payment-card numbers, or sensitive health-record data from clinical sources.

1.2 How we use your information

• Provide, operate, and maintain the Service, including generating and adapting your StrideIQ™ training plan;
• Authenticate you, secure your account, and prevent fraud or abuse;
• Communicate with you about plan updates, beta features, training milestones, maintenance, and product changes;
• Improve our models and product through aggregated, de-identified analytics;
• Comply with legal obligations and respond to lawful requests.

1.3 Legal bases (EU/UK users)

• Performance of a contract — to deliver the Service you signed up for (Art. 6(1)(b)).
• Legitimate interests — to secure our systems, prevent abuse, and improve the product (Art. 6(1)(f)).
• Consent — for non-essential cookies, optional marketing emails, and processing of special-category data you voluntarily provide (Art. 6(1)(a) and 9(2)(a)).
• Legal obligation — where we must process data to comply with applicable law (Art. 6(1)(c)).

1.4 Automated processing & StrideIQ™

StrideIQ™ is an automated training engine. It generates and modifies your weekly plan based on your inputs and your Strava activity history. These outputs are coaching suggestions, not medical advice. The plans do not produce legal or similarly significant effects within the meaning of GDPR Art. 22, but you may always edit, override, or ignore any suggestion, and you may contact us to request human review of any adaptation you believe is inappropriate.

1.5 How we share information

We do not sell your personal information. We share it only in these limited circumstances:

• Service providers (processors). Hosting and database providers (MongoDB Atlas), authentication infrastructure (NextAuth), email delivery, analytics, error monitoring, and AI model providers powering StrideIQ™. Each provider is bound by contractual confidentiality and data-processing terms.
• Strava. When you connect your Strava account, data flows under Strava’s own terms and privacy policy. If you opt in to plan upload, we may write planned workouts to your Strava account.
• Legal & safety. Where required by law, court order, or to protect the rights, property, or safety of GBI Inc., our users, or the public.
• Corporate transactions. If GBI Inc. is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to equivalent protections.

1.6 International transfers

Personal information is processed in Canada and may be processed in the United States and other countries where our service providers operate. Where data is transferred out of the EEA, the UK, Switzerland, or Quebec, we rely on appropriate safeguards including the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, and transfer impact assessments under Quebec Law 25.

1.7 Data retention

We retain your personal information for as long as your account is active and for a limited period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. When you delete your account, we delete or anonymize your personal information within ninety (90) days, except where retention is required by law. Aggregated, de-identified data may be retained indefinitely for product improvement.

1.8 Your rights

Depending on where you live, you may have the right to access, correct, port, restrict, or delete your personal information; to object to certain processing; to withdraw consent; and to lodge a complaint with a supervisory authority. Quebec residents have rights under Law 25, including the right to de-indexation. California residents have rights under CCPA/CPRA. EU/UK residents have rights under GDPR/UK GDPR.

To exercise any right, email privacy@buildyourlegend.app. We will respond within the timeframes required by applicable law (typically 30 days) and may need to verify your identity before fulfilling certain requests.

1.9 Disconnecting Strava and deleting your account

You can revoke our access to your Strava data at any time from Strava settings under “My Apps.” You can also request account deletion by emailing privacy@buildyourlegend.app. Disconnecting Strava halts new data sync; deleting your account removes your stored data subject to the retention terms above.

1.10 Children

The Service is not intended for individuals under the age of sixteen (16). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can delete it.

1.11 Changes to this Policy

We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date above. For material changes, we will notify you by email or in-app before they take effect.

1.12 Contact us

GBI Inc.
Province of Quebec, Canada
Privacy inquiries: privacy@buildyourlegend.app

EU/UK residents may lodge a complaint with their local data protection authority. Quebec residents may contact the Commission d’accès à l’information du Québec. Other Canadian residents may contact the Office of the Privacy Commissioner of Canada.

These Terms of Service (the “Terms”) are a binding agreement between you and GBI Inc., a corporation incorporated in the Province of Quebec, Canada, governing your use of Build Your Legend, including the StrideIQ™ training engine, the website at www.buildyourlegend.app, and any related applications (collectively, the “Service”).

By creating an account, connecting Strava, or otherwise using the Service, you agree to these Terms and to our Privacy Policy. If you do not agree, do not use the Service.

2.1 Eligibility

You must be at least sixteen (16) years old to use the Service. By using the Service, you represent that you meet this requirement and have the legal capacity to enter into these Terms in your jurisdiction.

2.2 Beta Service

The Service is currently offered as a beta. Beta features are provided “as is,” may contain bugs, may change or be withdrawn at any time, and may not perform as intended. We may limit, throttle, or revoke access to beta features for any user at any time without liability. We will provide reasonable notice before transitioning to a paid plan and will honour any commitments specifically extended to early-access users.

2.3 Your account

You are responsible for maintaining the confidentiality of your authentication credentials, including your connected Strava account. Notify us promptly at privacy@buildyourlegend.app of any unauthorized use. You are responsible for all activity that occurs under your account.

2.4 Third-party services (Strava)

The Service relies on Strava’s API to provide its core functionality. Your use of Strava is governed by Strava’s own terms of service and privacy policy. We are not affiliated with, endorsed by, or sponsored by Strava. If Strava changes its API, restricts our access, or becomes unavailable, our ability to provide the Service may be impaired or suspended. We accept no liability for Strava’s acts or omissions.

2.5 Acceptable use

You agree not to:

• Use the Service in violation of any law, regulation, or third party’s rights;
• Attempt to reverse-engineer, decompile, scrape, or otherwise gain unauthorized access to the Service or its underlying systems;
• Use the Service to transmit malware, conduct denial-of-service attacks, or interfere with other users;
• Submit false or misleading data, impersonate another person, or use another user’s Strava account without authorization;
• Resell, sublicense, or commercially exploit the Service or its outputs without our prior written consent;
• Use the Service or its outputs to train competing machine learning models.

2.6 Not medical advice — assumption of risk

The Service provides general training guidance, not medical advice. StrideIQ™’s suggestions are informational only and are not a substitute for the advice of a qualified physician, physiotherapist, or other healthcare professional. Running and other physical activity carry inherent risks of injury, illness, and, in rare cases, death. You assume all risks associated with following any plan generated by the Service. Consult a qualified healthcare provider before beginning any new exercise program, particularly if you have any medical condition, are pregnant, or are recovering from injury.

2.7 Your content

You retain ownership of the data and content you submit to the Service (“User Content”). You grant GBI Inc. a worldwide, non-exclusive, royalty-free licence to host, store, reproduce, process, transmit, and create derivative works of your User Content solely as necessary to operate, secure, and improve the Service. You may revoke this licence by deleting your account, subject to the retention terms in our Privacy Policy.

2.8 Our intellectual property

The Service, including the StrideIQ™ engine, software, models, designs, logos, and the “Build Your Legend” and “StrideIQ” names and marks, is owned by GBI Inc. or its licensors. We grant you a limited, non-exclusive, non-transferable, revocable licence to use the Service for your personal, non-commercial training, subject to these Terms.

2.9 Fees, billing, and trials

During the beta, the Service is provided free of charge unless otherwise stated. When paid plans are introduced, fees, subscription terms, free-trial length, and refund policy will be presented at the point of purchase. Subscriptions auto-renew until cancelled. You may cancel at any time; cancellation takes effect at the end of the then-current billing period. Beta users will receive notice and an opportunity to opt in before any paid charges begin.

2.10 Suspension and termination

We may suspend or terminate your access at any time, with or without notice, if we reasonably believe you have violated these Terms, if required by law, or if continued provision poses a risk to other users or our systems. You may stop using the Service and delete your account at any time by emailing privacy@buildyourlegend.app.

2.11 Disclaimers

The Service is provided “as is” and “as available,” without warranties of any kind, whether express, implied, or statutory. To the maximum extent permitted by applicable law, GBI Inc. disclaims all warranties, including warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, and uninterrupted or error-free operation. We do not warrant that StrideIQ™’s suggestions will produce any particular outcome.

2.12 Limitation of liability

To the maximum extent permitted by applicable law, GBI Inc. and its directors, officers, employees, and agents will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages, or any loss of profits, revenues, data, goodwill, or other intangible losses. In no event will our aggregate liability exceed the greater of (i) the total fees you paid us in the twelve (12) months preceding the event, or (ii) CAD $100.

2.13 Indemnification

You agree to indemnify and hold harmless GBI Inc. and its personnel from and against any claims, damages, losses, liabilities, and expenses (including reasonable legal fees) arising out of your use of the Service in violation of these Terms, your User Content, or your violation of any law or third-party right.

2.14 Changes to these Terms

We may update these Terms from time to time. For material changes, we will provide reasonable advance notice by email or in-app. Your continued use of the Service after changes take effect constitutes acceptance of the updated Terms.

2.15 Governing law and venue

These Terms are governed by the laws of the Province of Quebec and the federal laws of Canada applicable therein. The parties agree that the courts of the judicial district of Montreal, Province of Quebec, will have exclusive jurisdiction over any dispute arising out of or relating to these Terms or the Service, subject to any non-waivable rights you may have in your country of residence.

2.16 Miscellaneous

These Terms, together with our Privacy Policy and any order-specific terms, constitute the entire agreement between you and GBI Inc. regarding the Service. If any provision is held unenforceable, the remaining provisions remain in effect.

Quebec law note: As required by Article 55 of the Charter of the French Language, this English-language version is made available at the express request of the parties. Les parties confirment leur volonté expresse que le présent contrat soit rédigé en anglais.

Security is foundational to a service that handles your training data and Strava connection. This section describes the organizational and technical measures we use to protect the Service. Our practices evolve as the product matures.

3.1 Data in transit

All connections to the Service use TLS 1.2 or higher. Traffic between your browser, our application servers, our database, and the Strava API is encrypted in transit. We enforce HTTPS site-wide and use HSTS to prevent protocol downgrade attacks.

3.2 Data at rest

Your data is stored in MongoDB Atlas with encryption at rest using AES-256. Backups are encrypted and access is restricted to authorized personnel using role-based access control. Secrets (API keys, OAuth client secrets, signing keys) are stored in a managed secrets system, never in source code.

3.3 Authentication and session security

User authentication is handled through Strava’s OAuth 2.0 flow via NextAuth. We do not store your Strava password. Sessions are issued as signed JWTs with a short access-token lifetime; refresh tokens are rotated and revoked on sign-out. Sensitive cookies are flagged HttpOnly and Secure and use the strictest practical SameSite setting.

3.4 Application security

We follow common web-application security practices, including input validation, parameterized queries, output encoding, dependency scanning, and regular updates of third-party libraries. Our infrastructure is segmented; production data is not accessible from staging or local development environments. Privileged access is limited to a small number of authorized personnel and is logged.

3.5 Monitoring and incident response

We monitor application errors, abnormal authentication patterns, and usage anomalies. We maintain an incident-response process and will notify affected users and applicable regulators in accordance with our legal obligations under Quebec Law 25, PIPEDA, GDPR/UK GDPR, and CCPA/CPRA in the event of a confirmed personal-information breach that creates a real risk of significant harm.

3.6 Responsible disclosure

If you believe you have discovered a security vulnerability, please report it privately to privacy@buildyourlegend.app. Please do not publicly disclose the issue until we have had a reasonable opportunity to investigate and remediate. We will acknowledge your report, work in good faith to address valid issues promptly, and credit your finding if you wish.

3.7 Your role in keeping the Service secure

Security is a shared responsibility. Please use a strong, unique password on Strava; enable Strava’s two-factor authentication; sign out of shared devices; and review the applications connected to your Strava account periodically. If you suspect your account has been compromised, contact us immediately.

This Cookie Policy explains how Build Your Legend uses cookies and similar technologies on the website at www.buildyourlegend.app and within the StrideIQ™ application.

4.1 What is a cookie?

A cookie is a small text file that a website places on your device when you visit. We also use related technologies such as local storage, session storage, and pixel tags. For brevity, we refer to all of these as “cookies” in this section.

4.2 The cookies we use

We do not use cookies for cross-context behavioural advertising and we do not sell or share personal information for advertising purposes within the meaning of CCPA/CPRA.

4.3 Third-party cookies

When you authenticate via Strava, Strava may set its own cookies on its own domain. Those cookies are governed by Strava’s policies, not ours. We do not embed third-party advertising or social-media tracking pixels on the Service.

4.4 Managing your preferences

Where required by law, we will ask for your consent to non-essential cookies via an in-product banner before we set them. You can withdraw consent at any time from your account settings or by clearing cookies in your browser. Most browsers honour the Global Privacy Control (GPC) signal, and we treat a GPC signal as a valid opt-out request under CCPA/CPRA.

4.5 Updates to this Cookie Policy

We may update this Cookie Policy as our use of cookies evolves. We will revise the “Last updated” date above. For material changes, we will notify you in-app or by email.