Privacy Policy

DevoSendr is a personalized training app for individual youth mountain bike racers and their parents. This policy explains what information we collect, how we use it, and the choices you have. If you have questions, contact us at cameron@devosendr.com.

1. Information We Collect

Information you provide directly

• Account: email address and account type (athlete or parent).
• Athlete profile: grade level, race category, optional league affiliation, and seasonal training goal.
• Training and wellness data: training logs (pillar, duration, effort), daily wellness check-ins (sleep, stress, and subjective readiness), skill progressions, and post-race reflections. We treat wellness data as sensitive because it reflects your physical and mental state.
• Optional ride-provider data: if you connect RideWithGPS or Strava, we request read-only access to your ride records (distance, duration, elevation, and heart rate where available). Connecting a ride provider is optional. You can disconnect at any time from your profile settings.

Information collected automatically

When you use DevoSendr, our servers log standard technical data needed to operate the app: IP address, browser type, operating system, and request timestamps. We use Mountain Time (America/Denver) for all application-level date and time logic.

Cookies and local storage

We use two small cookies: a session cookie (ds_session) that keeps you signed in, and a theme preference cookie (ds_theme) that remembers your light or dark display choice. We also use your browser's local storage to save your race-day checklist progress on your own device. We do not use advertising cookies or third-party tracking scripts.

2. How We Use Your Information

We use your data only to operate DevoSendr's core features:

• Building and adapting your personalized weekly training plan.
• Tracking your fitness progress, XP, level, and awards.
• Generating race-day preparation metrics and pre-flight checklists.
• Sending you sign-in links, training updates, and (if a parent email is on file) an automated weekly parent digest summarizing your athlete's activity. There is no chat and no operator-composed messaging to athletes.
• AI-personalized plan text (see Section 3 below).

We do not sell, rent, or trade your personal data to any third party for marketing or advertising purposes.

3. AI-Personalized Training

DevoSendr uses an AI model to personalize the text of your weekly training plan: the headline, the "why" behind each session, and short post-ride feedback. The AI does not invent sessions, set effort targets, or override the training structure, which is authored by DevoSendr's program and stays in our control.

To generate this personalized text, we send a de-identified coaching context to a third-party AI provider. That context contains only:

• Your chosen username (not your real name or email).
• Your training tier, recent session history, and wellness signals.
• A terrain-type tag and a relative day offset (never your actual practice location or the real date).

Your real name, email address, grade, league, and any absolute location data never leave DevoSendr's systems. Our code asserts this de-identification before every transmission and refuses to send if any forbidden field is present. Athletes with a restricted account (see Section 5) are completely excluded from AI processing.

The AI provider we currently use is DeepSeek, headquartered in China. Your de-identified context is transmitted to and processed on their servers. We contractually prohibit the provider from using submitted data for model training or any purpose other than generating the requested output. We may substitute a US-based model provider in the future; this policy will be updated if the provider changes in a material way.

AI-generated text is clearly framed as coaching guidance. Any page showing AI output also shows a medical disclaimer. The AI feature can be turned off at the platform level; when it is off, the app delivers a static training plan that is byte-identical to the fallback used when AI is unavailable.

4. Data Sharing and Third-Party Processors

DevoSendr is an individual athlete and parent product. We do not share your data with coaches, teams, or other users.

To operate the platform we rely on these third-party processors, each bound by a data processing agreement:

• Cloudflare (United States): compute (Workers), relational database (D1), key-value store (KV), and object storage for GPX files (R2). All data at rest resides in Cloudflare's infrastructure.
• Amazon Web Services SES (United States): transactional email delivery (sign-in links, training updates, parent digest).
• DeepSeek (China): AI plan personalization, for de-identified coaching context only (see Section 3).
• RideWithGPS / Strava: read-only ride data, only when you explicitly connect an account. You control this connection and can revoke it at any time.

We do not use advertising networks, analytics platforms, or social media tracking pixels.

5. Children's Privacy (COPPA)

DevoSendr is designed for student athletes in grades 7 through 12 and their parents. We take the privacy of young riders seriously.

Riders 13 and older

Riders who are 13 or older may create an account directly using standard sign-up. A parent or guardian email can be added to receive automated weekly training digests.

Riders under 13

We do not knowingly collect personal information from children under 13. If a rider indicates during registration that they are under 13, account creation is blocked and no personal data is collected. We do not currently offer an account pathway for riders under 13. We are building a parental-consent flow that will allow under-13 accounts in a future update, subject to attorney review; this policy will be updated before that feature launches.

If you believe a child under 13 has provided us with personal information without parental consent, contact us at cameron@devosendr.com and we will delete the information promptly.

Parental rights

A parent or guardian has the right to review the personal information collected from their minor athlete, to request its deletion, and to refuse further collection or use at any time. To exercise these rights, email us at cameron@devosendr.com with the subject line "Parental Data Request" and include the athlete's account email. We will verify your identity as the parent or guardian before acting on the request and will respond within 30 days.

For any athlete account flagged as restricted (data_restricted), ride-provider connections are disabled, AI processing is disabled, and no athlete data is shared outside DevoSendr's own infrastructure.

6. Data Retention and Deletion

We retain your information for as long as your account is active or as needed to provide your training history and plans.

To delete your account and personal data, contact us at cameron@devosendr.com with the subject line "Account Deletion Request." We will permanently delete or anonymize your data from our active systems within 30 days. This includes your profile, training logs, wellness records, XP history, ride connections, and AI audit records. We retain your email address on a suppression list after deletion so we do not accidentally re-add you to communications; that record contains no other personal data.

7. Data Security

We use SSL/TLS encryption for all data in transit. Data at rest is stored in Cloudflare's infrastructure, which applies encryption and access controls at the platform level. We apply server-side controls to restrict which code can read which data, and we maintain an append-only audit log of all administrative actions.

No internet transmission is 100% secure. We cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify affected users as required by applicable law.

8. Your Choices and Privacy Rights

Email preferences

We send system-essential emails (sign-in links) and automated training and parent updates. You can unsubscribe from non-essential emails at any time using the unsubscribe link in the footer of those messages.

Ride provider connections

You can revoke DevoSendr's access to your ride provider account at any time from your profile settings. We will stop fetching new ride data immediately.

State privacy rights

Depending on where you live, you may have additional rights under state privacy law, including:

• The right to know what personal information we collect about you.
• The right to correct inaccurate personal information.
• The right to delete your personal information.
• The right to opt out of the sale or sharing of your personal information (we do not sell or share personal data).
• The right to non-discrimination for exercising your privacy rights.

California residents: under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), you have the rights listed above. Wellness check-in data and heart rate data may qualify as sensitive personal information under CPRA; we use this data only to adapt your training plan and never for any other purpose. To submit a privacy rights request, contact us at cameron@devosendr.com with the subject line "Privacy Rights Request." We will respond within 45 days (extendable by an additional 45 days with notice).

To exercise any of these rights, email us at cameron@devosendr.com. We will ask for enough information to verify your identity before acting on the request.

9. International Data Transfers

DevoSendr is based in the United States. Your data is stored and processed on Cloudflare's and AWS's US-based infrastructure. When the AI coach feature is active, de-identified coaching context (see Section 3) is transmitted to DeepSeek, which processes it in China. No other personal data is transferred outside the United States.

10. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy here and updating the "Last updated" date. For significant changes (such as adding a new data use or a new third-party processor), we will also send an email notification to active account holders.

11. Contact Us

For questions, data requests, or concerns about this Privacy Policy: