Privacy Policy

Effective date: October 15, 2026

This policy describes how FSTR (the "App", Android package app.fstr.coach, iOS later) handles your data. FSTR is operated by Diego Castañeda Kirste, an individual developer based in Guatemala ("we", "us"). Contact: master@fstrcoach.com.

1. What FSTR does

FSTR is a run + strength coaching app that builds a weekly training plan and updates training load, readiness and race forecasts using explainable load/recovery math (rTSS/PMC, biometrics). FSTR is not a medical device and does not provide medical diagnosis.

2. Data we collect

We do not access your contacts, SMS, or any data unrelated to training.

3. Connected services

You choose which accounts to connect (e.g. Garmin Connect, Apple Health, Android Health Connect). Connections use OAuth or the platform's consent screen and request only the minimum scopes/permissions needed. If you enable it, FSTR can write planned workouts to your watch calendar. You can disconnect any integration at any time in the App or in the provider's settings.

4. Health Connect (Android) and Apple HealthKit

Data read from Health Connect or Apple HealthKit is used solely to provide FSTR's training features (training plan, load, readiness and forecasts). Specifically:

FSTR's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. FSTR's use of HealthKit data follows Apple's App Store Review Guidelines for HealthKit.

Health Connect (Android): data we access and how we handle it

Data we read: with your permission, FSTR reads the following data from Health Connect: exercise sessions, distance, speed, heart rate, resting heart rate, sleep and elevation gained, and heart rate variability (HRV) if you grant it. If you grant access to historical data, FSTR also reads history older than 30 days (up to the previous 12 weeks) to establish your baseline training volume and recovery.

Data we write: with your permission, FSTR writes to Health Connect only the workout sessions you complete or log in FSTR (exercise sessions, e.g. runs and strength sessions, with their duration, distance and heart rate where available), so that other apps you choose can see them. FSTR never overwrites or deletes data written by other apps. You can revoke write permission at any time in Android Settings > Health Connect.

How we use it: only to personalize your training plan and recovery — matching completed workouts with your plan, estimating training intensity and load, and adapting upcoming workouts based on your recovery (resting heart rate, sleep).

What we never do: we do not sell Health Connect data; we do not use or transfer it for advertising, including personalized or interest-based ads; we do not use it to determine credit-worthiness, insurance or employment eligibility; and we do not share it with third parties without your explicit consent, except the service providers that host and process it on our behalf (Supabase for database hosting and our API hosting provider) under confidentiality and security obligations.

Storage and security: data is encrypted in transit (TLS) and at rest, and access is restricted to your account through access controls on a least-privilege basis.

Retention and deletion: we keep Health Connect-derived data while your account is active. You can disconnect Health Connect at any time in Android Settings > Health Connect or in the FSTR app; we then stop reading new data and writing workouts. You can delete your data or your account from the App or by emailing master@fstrcoach.com; we delete it within 30 days, except where retention is required by law.

5. Garmin data

When you connect Garmin, FSTR imports the activity and wellness data you authorize through Garmin's APIs and, if you enable it, sends planned workouts to your Garmin calendar. Garmin data is used only to provide FSTR's training features, is not sold, and you can revoke access at any time from FSTR or your Garmin Connect account settings.

6. How we use data

To generate and adapt your training plan (adaptations are confirmed by you), compute training load, readiness and race forecasts, sync workouts, and provide support. We do not sell your data and use no third-party advertising or tracking SDKs.

7. Storage, security and subprocessors

Data is transmitted over HTTPS. OAuth tokens are stored server-side and encrypted. Our subprocessors are limited to hosting infrastructure: Supabase (Postgres database) and our API hosting provider. Access is restricted on a least-privilege basis.

8. Retention and deletion

We keep your data while your account is active. When you disconnect an integration, we stop importing data from it. You may request deletion of your account and all associated data at any time in the App or by emailing master@fstrcoach.com; we will delete it within 30 days, except where retention is required by law.

9. Your rights

You can access, correct, export or delete your data, and withdraw consent by disconnecting integrations. Contact us to exercise these rights.

10. Children

FSTR is not intended for children under 13, or under 16 where local law requires a higher age. We do not knowingly collect data from them; if we learn we have, we will delete it.

11. Changes

We may update this policy and will post the new version here with a new effective date.

12. Governing law

This policy is governed by the laws of the Republic of Guatemala.

13. Contact

Diego Castañeda Kirste, Guatemala — master@fstrcoach.com