Rift

Privacy Policy

Last updated · September 15, 2026

1. Who we are

Rift is an iOS training app and web service operated by Idol Brand Inc. d/b/a Rift Endurance ("Rift," "we," "us," or "our"). This Privacy Policy explains how we collect, use, share, and protect your information when you use the Rift mobile app, the website at riftendurance.com, and the web app at app.riftendurance.com (together, the "Service").

By using the Service you agree to the practices described here. If you do not agree, do not use the Service.

2. What we collect

2.1 Account information

• Email address — required to create your account and receive transactional emails (beta invitations, plan-ready notifications, account confirmations).
• Authentication identifiers — managed by our authentication provider (Supabase) including a hashed password or OAuth identifier from your sign-in provider.
• Display name — optional, used for personalization inside the app.

2.2 Athlete profile

To generate accurate training plans, the Service collects optional profile data you enter during onboarding or in Settings:

• Date of birth or age, sex / gender, weight, height
• Race goals, target race date, target distance (Sprint, Olympic, 70.3, 140.6)
• Training history, weekly training availability, weekly training volume
• Functional threshold metrics: FTP (bike power), LTHR (lactate threshold heart rate), threshold pace (run), swim CSS (critical swim speed)
• Injury history, time zone, timezone preference
• Gear inventory (bikes, shoes), gear maintenance reminders

2.3 Training and workout data

• Workouts you log manually: date, sport, duration, distance, pace, heart rate, perceived exertion, notes
• Workouts imported from connected services (see §2.4)
• Training programs / plans: scheduled sessions, completion status, plan adaptations over time
• Session reviews and post-session notes
• Per-interval data when available: pace targets, heart-rate targets, completion vs target

2.4 Data from third-party integrations (your explicit consent only)

You can connect the following services to enrich your training data. Each requires your explicit consent, and you can revoke any of them at any time.

• Strava — via Strava's official OAuth flow. With your consent we read your basic athlete profile (Strava ID, first / last name, profile photo), activity summaries (sport, date, distance, duration, elevation, average heart rate / power, GPS polyline), and per-activity streams you opt to import (heart rate, power, cadence, altitude, velocity, distance, time). We do not currently write workouts back to Strava. You can disconnect Strava at any time from inside the app or at strava.com/settings/apps.
• Apple HealthKit — with your permission, the iOS app reads workouts (including routes), heart rate, heart-rate variability (HRV), resting heart rate, sleep, respiratory rate, blood oxygen, steps, distance, active energy, and body weight from Apple Health, and writes workouts you complete in Rift back to it. Some of this Apple Health data is stored in our database so it can power your training history, recovery and readiness features, and AI coaching (§4):
  • Workouts — once you connect, Rift imports your Apple Health workouts into your training history: sport, date and time, duration, distance, calories, heart-rate summary (average, minimum, maximum), swim details, and the app or device that recorded each one. When you open an imported workout, its heart-rate, speed, cadence, and elevation samples, splits, and GPS route may be saved too. Heart rate recorded while you track a workout live in Rift is saved with that workout.
  • Recovery — daily HRV, resting heart rate, sleep (time asleep and in bed, deep and REM sleep), respiratory rate, and blood oxygen, going back up to 90 days when you first connect, plus the readiness score and state the app calculates from them. Recovery is on by default on iPhone; you can turn it off in Settings → Recovery.
  • Stress — only if you turn it on in Settings → Recovery: your daily daytime resting heart rate for the last 14 days, used as its baseline. The minute-by-minute readings behind it stay on your device.
  Steps and body weight are read on your device to show your stats and are not stored on our servers. We use Apple Health data only to provide Rift's features: we never use it for advertising or marketing, we never sell it, and we share it only as described in §4 (including with Anthropic, our AI provider, for AI coaching) and with an AI assistant you connect, if you allow it (§4.1). Turning Recovery or Stress off stops new data for that feature from reaching us, and removing Rift's access on your iPhone (Settings → Privacy & Security → Health → Rift) stops all new Apple Health data. Data already stored stays in your account until you delete it (§7).
• Apple WorkoutKit (Apple Watch) — with your permission, the iOS app pushes scheduled workouts to your Apple Watch and reads completed workout summaries back from the Watch via HealthKit.
• Connected devices via Terra (Garmin, Coros, Wahoo, Oura, Whoop, Polar, Suunto, and others) — with your explicit consent, you can connect a wearable or device account, and we receive that device's data through Terra (tryterra.co), a third-party data aggregator that brokers the connection on our behalf. Depending on the device this may include workouts (sport, date, distance, duration, GPS route, and per-second heart rate, power, cadence, speed) and, where your device records it, sleep, heart-rate variability (HRV), resting heart rate, and respiratory metrics. This imported device data is read-only and is used only for your training history, recovery insights, and AI coaching (§4). If you explicitly choose to send a planned workout, Rift may send that structured workout to a supported Garmin device through Terra; Rift does not otherwise change your device data or Garmin account. If you connect an AI assistant, it can read this data as described in §4.1. You can disconnect any device at any time inside the app, which stops the data from flowing through Terra. Terra processes this data on Rift's behalf as a service provider; see Terra's privacy policy. (Strava and Apple Health connect directly, not via Terra — see above.)

2.5 Communications

• Email messages you send us (support inquiries, feedback)
• Responses you submit through forms on our website (beta signup, newsletter)
• Direct messages on social platforms where you initiate contact with us

2.6 Device and usage data

• Device model, operating system version, app version, locale, timezone
• Pages or screens viewed, features used, taps and scrolls (via analytics — see §4)
• Crash logs and error events (via Sentry — see §4)
• IP address (collected automatically by our hosting providers for fraud prevention and rate limiting; not used to track you across sites)
• How you found us — the campaign tags in the link you arrived through (utm_source, utm_medium, utm_campaign and similar), the website that linked you, and the first page you landed on. If you join the beta waitlist we store this alongside your email so we can tell which channels reach athletes like you. We keep the host of the referring site (for example instagram.com) and never the full referring address, because that address can carry personal information. This is first-party only: it is not shared with advertisers and is not used to track you across other sites.

We do not use Apple's Identifier for Advertisers (IDFA). We do not track you across other apps or websites for advertising purposes.

2.7 Payment information (future)

The Service is currently free during beta. When paid subscriptions are introduced, payments will be processed by a third-party payment processor (likely Stripe and / or Apple's In-App Purchase system). We will not store your full credit card number on our servers; we will only receive transaction metadata (subscription tier, renewal date, last four digits) needed to operate your subscription.

3. How we use your information

We use the information we collect to:

• Operate the Service — create your account, generate your training plan, sync data across your devices, display your training history
• Personalize — calibrate workouts to your fitness data, race goals, and life schedule
• Generate AI coaching content — send training context, without your name or email, to our AI provider (Anthropic) to generate plan content and answer your training questions (see §4)
• Communicate — send transactional emails (beta invites, password resets, important service updates) and (with your opt-in) newsletters
• Improve the product — analyze aggregated usage to identify bugs, prioritize features, and improve plan quality
• Ensure security — detect abuse, prevent fraud, debug errors
• Comply with law — respond to legal requests, enforce our Terms

4. Third-party services we share data with

We share data with the following service providers, each of whom is bound by their own privacy commitments and processes data only on our behalf:

Provider	Purpose	Data shared
Supabase Privacy	Database, authentication, file storage	All account, profile, and training data persisted to the cloud, including the Apple Health data described in §2.4
Anthropic (Claude) Privacy	AI plan generation, AI coaching responses, and workout recaps	Training metadata (workout types, durations, paces, HR zones, race goals), including workouts imported from Apple Health. A workout recap also includes that workout's metrics, such as average heart rate. For workouts synced from a connected device, the recap and the workout notification also include your latest readiness score and state, sleep time, and HRV, which may come from Apple Health. We do not send your name or email to Anthropic for these features.
Netlify Privacy	Website hosting + serverless functions that proxy Strava and AI calls	Request logs (IP, user-agent), form submissions, function invocations
Strava Privacy	Activity import via OAuth	Only the OAuth identifier we use to fetch your activities (data flows from Strava to us, not the other way)
Terra Privacy	Aggregates wearable / device data from the providers you connect (Garmin, Coros, Wahoo, Oura, Whoop, Polar, Suunto)	Training and health data from connected devices — workouts, heart rate, HRV, sleep, GPS routes — flow from your device, through Terra, to us. If you explicitly send a planned workout, its structured steps may be sent through Terra to a supported Garmin device.
Apple (HealthKit + APNs) Privacy	Apple Health (HealthKit) reads and writes on your iPhone, Apple Push Notifications	APNs device tokens (for push delivery). With your permission, workouts you complete in Rift are written to Apple Health on your iPhone. The Apple Health data Rift stores is described in §2.4
Sentry Privacy	Error monitoring and crash reporting	Native crash, app-hang, and error events (stack traces, pseudonymous account UUID, device model, OS, app version). We do not include email, training data, form text, screenshots, console logs, or app session replay.
Mixpanel Privacy	Product analytics in the app and on the marketing site	Usage events, without your name, your email, or the text of your notes. In the app, some events include workout details (such as type and sport, duration, pain and energy ratings, plan adherence, and PRs) and onboarding answers (such as plan type, weekly hours range, experience levels, number of injuries, and motivation); they're linked to a pseudonymous account ID, and IP collection is off. On the marketing site they're linked to a random ID stored in your browser, and Mixpanel uses your IP address to estimate your city, region, and country.
HeyCatch Privacy	Product analytics in the app and on public marketing pages	Pseudonymous account or browser ID, page and feature interactions, device/browser context, and privacy-scrubbed product events. Rift does not send your name, email, note text, or form contents to HeyCatch.
Google Analytics, TikTok Pixel, Microsoft Clarity	Website analytics (marketing site only)	Page views, conversion events (hashed email only for ad attribution), session replays of your interactions with the marketing site (Clarity)
Loops / Klaviyo (email)	Transactional and marketing email delivery	Email address, name, list-membership, email open / click events
Stripe / Apple In-App Purchase (future)	Subscription payment processing	Limited transaction metadata (no full credit card number)

We do not sell your personal information. We do not share your training data, athlete profile, or contact information with data brokers, advertisers, or unrelated third parties.

4.1 AI assistants you connect (Claude, ChatGPT)

You can connect Rift to an AI assistant you already use, such as Claude (Anthropic) or ChatGPT (OpenAI), and ask it about your training. Nothing is shared unless you set this up, and during the beta it is available only to invited accounts. Unlike the providers above, an assistant's provider does not process this data on Rift's behalf: it receives the data at your direction and handles it under its own terms and privacy policy (Anthropic, OpenAI).

• Your permission — an assistant gets access only after you sign in to Rift and choose Allow on Rift's own consent page, and only that assistant gets access.
• What it can read — your training plan and sessions, completed workouts (including ones imported from Strava, from Apple Health, or from a device connected through Terra), your training thresholds and preferences (such as training days, units, and time zone), and notes saved to Rift's coach memory, except notes about injuries or your health.
• Health data is a separate choice — injuries, recovery data (readiness score, HRV, sleep, and resting heart rate, which can come from Apple Health or a device connected through Terra), notes about injuries or your health, your notes on workouts, and your recent messages with Rift's in-app coach are shared only if you turn on health data for that assistant. If you turn Recovery off in Settings → Recovery, no assistant gets the data Recovery reads from Apple Health or your device, even with health data on. You can change this for each assistant at any time in Settings → Connected assistants.
• What it can save — short notes about your training, such as a goal or a scheduling limit. Rift's in-app coach uses them too. An assistant can't change your training plan.
• What we record — which assistants you connected and your health-data choice for each, and for each request the tool used, whether it worked and how long it took. We don't record what you asked the assistant or what Rift sent back.
• Stopping access — disconnect an assistant in Settings → Connected assistants and it loses access right away. What it has already read stays with its provider, under that provider's terms.

5. How we protect your data

• Encryption in transit — all data is sent over HTTPS / TLS 1.2+
• Encryption at rest — Supabase encrypts your data at rest using AES-256 on the underlying AWS infrastructure
• Row Level Security — all user data tables in our database have RLS policies that allow only your authenticated account to read or write your own records
• Access controls — only a small number of operators have administrative access to production systems, with multi-factor authentication enforced
• Apple Health data — the Apple Health data we store (§2.4) is protected by the same encryption and Row Level Security as the rest of your data, and is never used for advertising or sold
• API keys and secrets — managed through environment variables in our hosting providers; never committed to source control

No system is perfectly secure. If we become aware of a data breach affecting your personal information, we will notify you and the relevant authorities as required by law (within 72 hours for GDPR jurisdictions).

6. Your rights

Depending on where you live, you may have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Correction — update inaccurate or incomplete data (most can be done directly inside the app under Settings → Profile)
• Deletion — request that we delete your account and associated data (see §7)
• Portability — request a machine-readable export of your training data (you can also download it directly inside the app under Me → Download My Data)
• Restriction / objection — restrict or object to certain processing (such as marketing emails — unsubscribe links are in every email)
• Withdraw consent — withdraw consent for any integration (Strava, Apple Health, etc.) or AI assistant connection (§4.1) at any time inside the app; for Apple Health, you can also remove Rift's access in your iPhone's Health settings (§2.4)
• Lodge a complaint — with your local data protection authority (for EU / UK residents)

To exercise any of these rights, email app@riftendurance.com. We will respond within 30 days.

7. Data retention and deletion

We retain your data for as long as your account is active. You can delete your account at any time from Settings → Account → Delete Account inside the iOS app.

When you delete your account:

• Your profile, workouts, programs, gear, reviews, recovery and other health data (including data from Apple Health), and Strava connection are permanently deleted from our database within 30 days
• Your AI assistant connections, the notes assistants saved (including archived ones), and the record of their requests are deleted with your account
• Your data is removed from active database backups within 90 days
• Email records (transactional history) are retained for up to 12 months for compliance and fraud prevention, then deleted
• Usage analytics, which are linked to a pseudonymous ID such as your account ID, are not deleted and may be retained indefinitely

You can also email app@riftendurance.com to request deletion.

8. International data transfers

Rift is operated from the United States. If you access the Service from outside the US, your data will be transferred to and processed in the US. By using the Service you consent to this transfer.

For users in the European Economic Area, United Kingdom, or Switzerland, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required for cross-border transfers via our processors.

9. Children's privacy

The Service is not directed to children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at app@riftendurance.com and we will delete it.

10. California, Colorado, Virginia, and other state privacy rights

Residents of certain US states have additional rights including the right to know, delete, correct, and opt out of the sale or sharing of personal data. Rift does not sell or share personal data in the way these laws define those terms. To exercise rights under your state's law, email app@riftendurance.com.

11. iOS Privacy Nutrition Label

For our App Store listing, the data we collect maps to the following Apple Privacy categories:

• Contact Info — email address (linked to user, used for app functionality)
• Health & Fitness — health data, including data from Apple Health (heart rate, HRV, resting heart rate, sleep, respiratory rate, blood oxygen, workouts), and fitness data (workouts, body metrics) (linked to user, used for app functionality + analytics)
• Identifiers — user ID (linked to user, used for app functionality + analytics)
• Usage Data — product interaction (linked to user, used for analytics + app functionality)
• Diagnostics — crash data, performance data (linked to user, used for app functionality)

We do not collect: financial info (until paid subscriptions launch), location data outside of workout GPS routes that you explicitly import, contacts, browsing history, search history, or sensitive info.

12. Changes to this Privacy Policy

We may update this Policy from time to time. When we do, we will update the "Last updated" date at the top. For material changes that affect how your data is used, we will notify you via email and / or an in-app notice at least 30 days before they take effect. Continued use of the Service after changes constitutes acceptance.

13. Contact us

Questions, requests, or complaints? Email app@riftendurance.com.

Postal address: Idol Brand Inc. d/b/a Rift Endurance, 1051 Franklin Avenue, Unit 313, Garden City, NY 11530.