Privacy Policy

Taper is an endurance-training app built for multisport athletes. It is operated by Construkt Ltd, a company registered in New Zealand, trading as “Taper”. Construkt Ltd is the agency responsible for your personal information under the Privacy Act 2020, and is who to contact about it.

This policy explains what personal data Taper collects, how it is used, who it is shared with, and how you can withdraw consent or delete your data.

Questions? Email kadewallis@gmail.com.

• Account information: email address, first name, password hash (managed by Supabase Auth).
• Training preferences: goals, sports, available training days, weekly hours target.
• Manual session logs: date, sport, duration, distance, perceived effort, notes.
• Wellness check-ins: sleep duration and quality, fatigue, optional HRV, notes.
• Coach conversations: messages exchanged with the in-app coach.
• Consent records: when you accepted our terms, which version, and when you acknowledged the health and safety notice.
• Waitlist: if Taper Core was full when you arrived and you asked to be told when a spot opens, we keep your email address for that, and delete it once you are in or you ask us to.

If you connect Strava, Taper uses Strava’s official OAuth API to read your activities. We never scrape, screen-scrape, or access Strava data through any unofficial channel.

What we read from Strava:

• Activity name, sport type, and local start date/time.
• Duration, elapsed time, distance, elevation gain, average pace/speed, average heart rate.
• Start and end coordinates, route polyline.
• Strava activity ID (used to match planned sessions and detect deletions).
• Your numeric Strava athlete ID.

How long we keep raw Strava data:

Raw Strava data is held in a temporary table for no more than 7 days. After 7 days the row is automatically deleted. This is required by the Strava API Agreement, and Taper enforces it via a scheduled purge job.

Derived data Taper keeps permanently:

Taper computes its own training outcomes from Strava data (whether a planned session was completed, weekly load summaries, training flags) and stores those derived values permanently against your account. Derived data does not include raw activity payloads and remains your data. It stays with your account if you disconnect Strava, and is deleted if you delete your account.

Strava deletions:

If you delete an activity in Strava, it is removed from Taper within 48 hours via Strava webhooks and a daily reconciliation job. If you revoke Taper’s access from Strava, syncing stops and activities already in Taper stay in your training history.

On Taper Core:

Strava sync is part of Taper Coach. If your account moves to Taper Core, Strava is paused: nothing new is synced, your Strava activities are not shown, and nothing is deleted.

• To generate and adjust your training plan.
• To mark planned sessions as completed when matched to a Strava activity.
• To detect training overload, missed sessions, and elevated fatigue.
• To provide context to the in-app coach so its replies are grounded in your real training.

We do not use your Strava data to train any AI or machine-learning model.Your data is not sold and is not used for advertising.

Taper uses the following processors to run the service:

• Supabase: database and authentication hosting.
• Anthropic: generates coach replies. Per Anthropic’s API terms, customer data is not used to train Anthropic’s models.
• Vercel: application hosting and edge network.
• Strava: source of activity data when you choose to connect.
• Vercel Web Analytics: counts visits to taper.nz so we know how many people look at the site. It does not use cookies, does not follow you to other sites, and does not identify you.

We also keep our own count of visits to taper.nz, including from people with no account. For each page opened we record the page, the country, region and city the request came from, and the site you arrived from if there was one. We do not store your IP address and we do not record which account you are signed in to. To count people rather than clicks we store a one-way code made from your IP address and browser, which changes every day and cannot be turned back into either, so the same person tomorrow is a different code and nobody can be followed from one day to the next.

Taper does not currently take payments. When it does, card details will be handled by a third-party payment provider and we will never see or store your full card number. We will name that provider here before any payment is taken.

We do not share your data with any other third party, and we do not sell it.

You can at any time:

• Disconnect Strava from Settings → Strava connection. This revokes our access token at Strava and stops syncing. Activities already synced stay in your training history. To have them removed, delete your account or email us.
• Delete your account from Settings → Delete account. This permanently removes your profile, sessions, wellness logs, coach history, and all Strava data.
• Export or request a copy of your data by emailing kadewallis@gmail.com.

Strava OAuth tokens are stored encrypted at rest in Supabase and are never exposed to the browser. They are only used by Taper’s server when talking to Strava on your behalf. Row-level security ensures one user’s data cannot be read by another.

Material changes will be announced in-app before they take effect. The last-updated date at the top of this page reflects the most recent revision.

For any privacy question, data-access request, or Strava-related concern, email kadewallis@gmail.com.