Last updated: March 16, 2026
1. Who We Are
Le Directeur ("we", "us", "our") is a community web application that generates AI-powered commentary on cycling and fitness activities. The app is operated as a personal project and is available at ledirecteur.app.
For questions about this privacy policy or your data, contact us at: privacy@ledirecteur.app
2. What Data We Collect
When you connect a fitness platform to Le Directeur, we collect the following data with your explicit authorization:
Account Data
- Name and profile picture (from your connected platform)
- Platform user ID (Strava, Wahoo, and/or Garmin)
- Weight (if provided by you or your platform profile, used for power-to-weight calculations)
- Your sharing preferences
Activity Data
- Activity name, type, and start time
- Distance, duration, elevation gain
- Speed (average and max)
- Power output (average and max watts, if available)
- Heart rate data (if available)
- Suffer score (Strava only, if available)
- Device name (Garmin only, for required attribution)
- GPS tracks and location data (from uploaded activity files)
- Lap and split data (if available)
- Cadence and temperature data (if available)
Google Sign-In Data
If you sign in with Google, we collect:
- Your Google profile name and picture
- Your Google account ID (for authentication)
- Your email address (stored only for account identification, never shared or used for marketing)
What We Do NOT Collect
- Payment information
- Photos or social content
- Health data beyond what is listed above
3. How We Collect Data
We collect data exclusively through official platform APIs after you explicitly authorize our application via OAuth:
- Strava: Via the Strava API with OAuth 2.0 authorization. We request
read and activity:read_all scopes.
- Wahoo: Via the Wahoo Cloud API with OAuth 2.0 authorization. We request
user_read, workouts_read, and offline_data scopes.
- Garmin: Via the Garmin Connect API with OAuth 2.0 PKCE authorization. We request activity read access.
New activities are delivered to us via webhooks (push notifications) from each platform. We do not poll or scrape any platform.
You may also upload activity files (.FIT, .GPX, .TCX) directly. These files are parsed server-side to extract activity data, including GPS tracks, and are deleted from our storage after processing.
4. How We Use Your Data
Your activity data is used for one purpose: generating AI-powered commentary on your workouts using the Claude API (by Anthropic). Specifically:
- Activity statistics (distance, time, speed, power, lap splits, etc.) are sent to the Claude API as context for generating a short humorous commentary about the activity.
- GPS tracks from uploaded files are used to compute distance and elevation. GPS coordinates are not sent to the Claude API or displayed to other users.
- We use Claude for inference only. Your data is never used for model training, fine-tuning, or building datasets.
- If you opt in to group sharing, your activities and commentary are displayed on the shared leaderboard visible to other opted-in users. GPS tracks are never shared.
5. How We Share Your Data
Your data is never sold, leased, licensed, or disclosed to advertisers, data brokers, or other third parties.
Data is shared only in the following limited ways:
- With other users (only with your consent): If you enable "Share my activities with the group," your activity data and commentary are visible to other opted-in users on the leaderboard. You can disable this at any time in Settings.
- With Anthropic (Claude API): Activity statistics are sent to Anthropic's API to generate commentary. Anthropic processes this data according to their privacy policy. No personal identifiers beyond your first name are included in API requests.
- With Supabase: Your data is stored in a Supabase-hosted PostgreSQL database. Supabase processes data according to their privacy policy.
- With Netlify: The application is hosted on Netlify. Netlify processes requests according to their privacy policy.
- With Google: If you sign in with Google, authentication is handled via Google OAuth. Google processes data according to their privacy policy.
6. Data Retention
- Strava-sourced activity data: Automatically deleted after 7 days, as required by the Strava API Agreement.
- Wahoo-sourced activity data: Retained for up to 30 days, then automatically deleted.
- Garmin-sourced activity data: Retained for up to 30 days, then automatically deleted.
- Uploaded activity files: Raw files are deleted from storage immediately after parsing. Extracted activity data follows the same 30-day retention as Wahoo/Garmin.
- Account data: Retained until you disconnect your account or request deletion.
- AI-generated commentary: Deleted when the associated activity is deleted.
A scheduled process runs daily to enforce these retention limits.
7. Data Security
We implement appropriate technical and organizational measures to protect your data:
- All data is transmitted over HTTPS (encrypted in transit)
- OAuth tokens are stored encrypted in our database
- API keys and secrets are stored as environment variables, never in code
- The application uses HttpOnly, Secure, SameSite cookies for session management
- We do not store passwords — authentication is handled entirely by each platform's OAuth system
In the event of a data breach, we will notify affected users and relevant platform partners within 24 hours of discovery.
8. Your Rights
You have the following rights regarding your data:
For All Users
- Access: View your data in the Settings page and personal feed.
- Disconnect: Remove any platform connection at any time via Settings. This deletes all activities sourced from that platform.
- Deletion: Request complete deletion of your account and all associated data by contacting us.
- Withdraw consent: Revoke our access at any time by disconnecting in our app or revoking access directly in Strava, Wahoo, or Garmin settings. We will delete your data upon revocation.
- Opt out of sharing: Disable group sharing at any time in Settings.
Additional Rights (EU/EEA/UK — GDPR)
If you are in the EU, EEA, or UK, you additionally have the right to:
- Request a portable copy of your data
- Request rectification of inaccurate data
- Object to processing of your data
- Lodge a complaint with your local data protection authority
Our legal basis for processing your data is your explicit consent, provided when you authorize our application via OAuth.
Additional Rights (California — CCPA)
If you are a California resident, you have the right to:
- Know what personal information we collect and how it is used
- Request deletion of your personal information
- Opt out of the sale of personal information — we do not sell your personal information
- Non-discrimination for exercising your privacy rights
9. Third-Party Platform Terms
Your use of Le Directeur is also subject to the terms of the platforms you connect:
Strava, Wahoo, and Garmin may collect usage data related to your use of our application in accordance with their respective privacy policies.
10. Cookies
We use a single essential cookie (directeur_session) to maintain your login session. This cookie is:
- HttpOnly (not accessible to JavaScript)
- Secure (only sent over HTTPS)
- SameSite=Lax (prevents cross-site request forgery)
- Expires after 30 days
We do not use analytics cookies, advertising cookies, or any third-party tracking.
11. Children
Le Directeur is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.
12. Changes to This Policy
We may update this privacy policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of Le Directeur after changes constitutes acceptance of the updated policy.
13. Contact
For privacy questions, data requests, or concerns:
Email: privacy@ledirecteur.app