Privacy Policy

Effective date: March 2026

Tawa ("Tawa", "we", "us") is a personal endurance analysis application. This policy describes what data we collect, how we use it, and your rights.

Data we collect

Account data - your email address and display name, used to identify your account.
Authentication credentials - hashed passwords (bcrypt). We never store passwords in plain text.
Strava and Intervals.icu activity data - when you connect a Strava or Intervals.icu account, we retrieve activity history and associated metadata. Available data may include GPS/location streams, heart rate, pace or speed, elevation, cadence, and other activity measurements. This data is sourced from the provider APIs.
Derived training metrics - values computed from your activity data, including training load, aerobic efficiency, and fitness/fatigue estimates.
Preferences - your timezone and unit preferences.

How we use your data

To import, display, and compute training metrics and charts from the activity data you choose to connect.
To authenticate you and maintain your session.
To send a password reset email if you request one.

We do not sell your data. We do not use your data for advertising.

Connected activity providers

Tawa lets you optionally connect Strava and Intervals.icu accounts. We use the access you authorize solely to import your activity history, associated activity metadata, and available streams; and to calculate and show the training metrics described in this policy. We do not sell this data or use it for advertising.

Strava data and the Strava API

Tawa uses the Strava API to access your activity data. By connecting your Strava account you agree to Strava's API Agreement and Privacy Policy.

Strava may collect usage data related to API use as described in their privacy policy. You can revoke Tawa's access to your Strava account at any time from Strava's app settings. When access is revoked, your Strava activity data is deleted from Tawa automatically.

Intervals.icu data and API

When you connect Intervals.icu, Tawa uses the Intervals.icu API to read your activity summaries, activity details, and available activity streams. We request only the access needed to import and analyze those activities; we do not create, edit, upload, or delete your Intervals.icu activities, workouts, wellness data, or settings.

You can disconnect Intervals.icu from the Account page at any time. Disconnecting removes the Intervals.icu connection credentials and Intervals.icu-sourced activity data from Tawa while leaving data from other providers and your notes intact. Intervals.icu's applicable terms and privacy practices govern its own service.

Data retention and deletion

Activity data sourced from Strava or Intervals.icu is deleted when you disconnect that provider or delete your account.
You can delete all imported activity data at any time from the Account page without deleting your account.
You can delete your entire account and all associated data from the Account page.

Data security

Passwords are hashed with bcrypt. OAuth access and refresh tokens for connected providers are stored server-side and used only to operate the connection you authorize. Tokens are encrypted at rest when encryption is configured. All connections use HTTPS.

Third-party services

Strava - activity data source. See Strava Privacy Policy.
Intervals.icu - optional activity data source. See Intervals.icu for its applicable privacy practices and terms.
Google Fonts - typography (Inter, DM Serif Display, IBM Plex Mono) loaded from Google's CDN.

Contact

Questions about this policy? Reach out via the project repository.

Tawa - Personal use