Privacy Policy

1. Who we are

EnduranceBlurb is operated by Hexoglyph Holdings, LLC, a Utah limited liability company ("we," "us," or "our"). Our mailing address is PO Box 1004, Clearfield, UT 84089. Questions about this policy can be directed to cameron@enduranceblurb.com.

This policy describes how we collect, use, and share information when you use EnduranceBlurb.com (the "Site") and our calculator tools (the "Service"). It does not apply to third-party sites or services, even if linked from ours.

2. Age requirement

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, please contact us so we can delete it.

3. Information we collect

Calculator inputs

Calculator inputs (weight, pace, sweat rate, and similar values) are processed entirely in your browser. When you share or bookmark a plan, those values are encoded into the URL you choose to copy. We do not log or store calculator inputs on our servers, and no account is required to use any free calculator.

Information you give us directly

When you create an account or otherwise interact with us, we may collect:

• Email address (for account creation and sign-in via magic link)
• Name and profile photo (when you sign in with Google)
• Saved calculator plans and named recipes you choose to store
• Favorite tools and account preferences
• Any messages you send to us via email or contact forms

Information from Strava

If you connect your Strava account, we receive the data you authorize Strava to share, which may include:

• Basic profile information (name, weight, age, gender)
• Performance metrics (FTP, maximum heart rate)
• OAuth access and refresh tokens (stored encrypted in our database)

This data is used only to pre-fill your calculator inputs. It is not used for advertising or marketing. You can disconnect Strava at any time from your account settings, which stops future synchronization. Previously imported data can be deleted by contacting us or deleting your account.

Information from Google sign-in

If you sign in with Google, we receive your email address, display name, and Google account identifier. We do not receive your Google password, Drive files, or any other Google account data. Google's privacy policy governs Google's own data practices.

Payment information

Payments for Pro features are processed by Stripe. We never see or store your full card number, expiry, or CVV. Stripe returns only a transaction confirmation and, if applicable, a billing postal code. Stripe's privacy policy governs their data practices.

Information collected automatically

When you visit the Site we may automatically receive:

• IP address and approximate location derived from it
• Browser type, operating system, and device identifiers
• Pages visited, time spent, and referring URL
• Session identifiers stored in our KV store for authentication
• A daily usage count per calculator (IP-keyed, anonymized) to apply free-tier limits

4. Cookies and analytics

Cloudflare Web Analytics

We use Cloudflare Web Analytics to measure traffic. This service is cookieless and does not track you across sites or store personal identifiers. No consent is required under GDPR for this analytics service.

Google Analytics (optional, consent required)

With your consent, we load Google Analytics via Google Tag Manager to understand how features are used. Google Analytics sets cookies on your device and is governed by Google's privacy policy. We do not load Google Analytics until you accept cookies in the consent banner. You can change your choice at any time:

Cookie preferences

Session cookies

We set a session cookie after you sign in so you stay authenticated between page loads. This cookie is essential to the Service and does not require separate consent. It is deleted when you sign out.

5. How we use your information

We use the information we collect to:

• Provide, operate, and improve the Service and its calculators
• Authenticate you and maintain your session
• Save your plans, recipes, and preferences
• Process payments and manage Pro subscriptions
• Apply free-tier rate limits to prevent abuse
• Send transactional emails (magic-link sign-in, payment confirmations). These are not marketing and cannot be unsubscribed from.
• Send marketing and onboarding emails, only if you have opted in. You can opt out at any time via the unsubscribe link in any email or from your account email preferences.
• Detect and prevent fraud, abuse, and security incidents
• Comply with legal obligations including tax and accounting requirements
• Respond to your support requests and inquiries
• Analyze aggregated, anonymized usage patterns to improve features

6. How we share your information

We do not sell your personal information. We share information only as described below.

Service providers

We share data with vendors who help us operate the Service. These processors act on our instructions and are contractually required to protect your information:

• Stripe (payment processing, US) -- processes payment card data for Pro subscriptions
• Amazon Web Services / AWS SES (email delivery, US) -- delivers transactional and marketing emails
• Cloudflare (CDN, DNS, Workers runtime, analytics, US/EU) -- hosts and serves the Site; performs cookieless analytics
• Google (OAuth, Analytics) -- provides sign-in and optional usage analytics

Third-party integrations

When you authorize a third-party integration (such as Strava), that service's own privacy policy governs how they handle your data. We are not responsible for third-party data practices.

Amazon Associates

Some product links on the Site are Amazon affiliate links. Clicking an affiliate link may set cookies controlled by Amazon, governed by Amazon's privacy policy. We receive a commission if you make a qualifying purchase at no extra cost to you.

Legal requirements

We may disclose your information if required by law, court order, or government authority, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business transfers

If EnduranceBlurb or Hexoglyph Holdings, LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information becomes subject to a materially different privacy policy.

7. Health and fitness data

Fitness and biometric values such as body weight, heart rate, FTP, and sweat rate may constitute sensitive personal information. We treat this data with heightened care:

• Health and fitness data received from Strava or entered into our calculators is used solely to provide and improve the Service.
• We do not use health or fitness data for advertising, profiling, or marketing without your explicit consent.
• We do not share health or fitness data with third parties for their marketing purposes.
• Calculator inputs are never stored on our servers. They remain in your browser and, optionally, in a URL you choose to share.

Calculator outputs are estimates based on published scientific formulas and population averages. They are not medical advice, diagnosis, or treatment. See Section 1 of our Terms of Use for the full medical disclaimer.

8. Your privacy rights

For all users

Regardless of where you are located, you can:

• Access and download your data. Email us and we will provide a copy of the personal information we hold about you.
• Correct inaccurate data. Update your profile in account settings or contact us.
• Delete your account and data. You can request deletion at any time by emailing us. Deletion from all systems typically takes up to 30 days. Some data may be retained for a limited period for fraud prevention or legal compliance.
• Opt out of marketing email. Use the unsubscribe link in any marketing email or visit your account email preferences.
• Manage cookies. Use the cookie preferences button above or your browser's built-in controls.

EEA, UK, and Swiss residents (GDPR)

If you are located in the European Economic Area, the United Kingdom, or Switzerland, you have additional rights under the GDPR and equivalent laws:

• Legal basis for processing. We process your data under the following legal bases: (a) contract (to provide the Service you requested), (b) legitimate interests (fraud prevention, security, analytics, service improvement), (c) legal obligation (tax and compliance requirements), and (d) consent (optional Google Analytics, marketing emails). Health data from Strava is processed under your explicit consent.
• Right to erasure ("right to be forgotten"). You may request deletion of your personal data, subject to certain legal exceptions.
• Right to restriction of processing. You may ask us to limit how we process your data while a request is pending.
• Right to data portability. You may receive your data in a structured, machine-readable format.
• Right to object. You may object to processing based on legitimate interests.
• Right to withdraw consent. Where processing is based on consent, you may withdraw it at any time without affecting prior processing.
• Right to lodge a complaint. You may lodge a complaint with your local data protection authority (for example, the ICO in the UK or your EU member state's supervisory authority).

We aim to respond to all privacy requests within 30 days. For complex requests, we may extend this by an additional 60 days with notice.

California residents (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to know. You may request disclosure of the categories and specific pieces of personal information we have collected about you in the past 12 months, including the purposes for collection and the categories of third parties with whom we share it.
• Right to delete. You may request deletion of personal information we have collected about you, subject to certain exceptions.
• Right to correct. You may request correction of inaccurate personal information.
• Right to opt out of "sale" or "sharing." We do not sell your personal information. We do not share personal information with third parties for cross-context behavioral advertising.
• Right to limit use of sensitive personal information. We do not use sensitive personal information (including health and biometric data) for purposes beyond providing the Service.
• Right to non-discrimination. We will not discriminate against you for exercising any of these rights.

To exercise your California rights, email cameron@enduranceblurb.com with "California Privacy Request" in the subject line. We respond within 45 days.

Other U.S. state residents

Residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia have rights to access, delete, correct, and obtain a portable copy of their personal data, and to opt out of targeted advertising. Contact us to exercise these rights.

9. Data retention

We retain personal data for as long as necessary to fulfill the purposes described in this policy, unless a longer period is required by law. Specific periods:

• Account data (email, name, preferences): retained while your account is active. Deleted within 30 days of account deletion.
• Saved plans and recipes: deleted with your account or on individual deletion requests.
• Strava tokens: deleted when you disconnect Strava or delete your account.
• Payment records: retained for 7 years for tax and accounting compliance, even after account deletion. Card details are never stored.
• Email delivery logs: retained for 90 days for deliverability troubleshooting, then deleted.
• Marketing consent records: retained until withdrawn, then retained as a suppression record for up to 3 years.
• Rate-limiting counters: TTL of 25 hours; never stored permanently.
• Session data: deleted on sign-out or after 30 days of inactivity.

10. Security

We implement technical, organizational, and administrative safeguards designed to protect your personal information from unauthorized access, disclosure, alteration, and destruction. These include encryption in transit (TLS), Cloudflare's edge security, and access controls limiting who can access production data.

No security measures can guarantee absolute protection. We encourage you to use a strong, unique email password and to notify us immediately if you suspect unauthorized access to your account.

11. International data transfers

We are based in the United States. If you are located in the EEA, UK, or Switzerland, your personal information is transferred to and processed in the United States. We rely on Standard Contractual Clauses approved by the European Commission for such transfers where applicable. Our service providers (Stripe, AWS, Google, Cloudflare) have their own transfer mechanisms in place.

12. Children's privacy

The Service is not directed to children under 18. We do not knowingly collect personal information from minors. If you are a parent or guardian and believe your child has provided us with personal information, please contact us. We will delete that information promptly.

13. Links to third-party sites

The Site may contain links to external websites, including affiliate product pages and third-party integrations. This policy does not apply to those sites. We encourage you to review the privacy policies of any third-party service you use.

14. Changes to this policy

We may update this policy as the Service evolves. When we make material changes, we will notify you by updating the "last updated" date at the top of this page and, for significant changes, by sending a notice to the email address on your account. Your continued use of the Service after the effective date of the updated policy constitutes acceptance of the changes.

15. Contact us

To exercise any of your rights, ask a question about this policy, or request deletion of your data, contact us at:

• Email: cameron@enduranceblurb.com
• Mail: Hexoglyph Holdings, LLC, PO Box 1004, Clearfield, UT 84089

Please include "Privacy Request" in the subject line so we can route your message to the right person quickly.