This Privacy Policy ("Policy") describes how fuelant collects, uses, shares, and otherwise processes personal information when you use our websites, mobile applications, application programming interfaces (APIs), and related offerings available at getfuelant.com (collectively, the "Services"). It also describes your privacy rights and choices. We aim to be direct about what we collect and why—so you can make informed decisions.
Please also read our Terms of Service ("Terms"), which govern your access to and use of the Services.
As used in this Policy, "fuelant," "we," "us," or "our" means fuelant LLC, the company that provides the Services to you.
§ 01
Introduction
About fuelant: fuelant helps endurance athletes build session-specific fueling plans—carbohydrate, fluid, and electrolyte guidance aligned to the workouts you actually do—and execute those plans with live cues on phone and watch during training and racing.
How to reach us: Questions about this Policy or your personal information may be sent to privacy@getfuelant.com.
§ 02
Information we collect
We collect information you provide to us, information generated when you use the Services, and information from third-party sources you choose to connect (for example, wearable and training platforms).
Information you provide
- Account information: Email address, name, and credentials. You may also sign in with supported third-party identity providers (for example, Google). Passwords are handled by our authentication provider and are not stored by fuelant in plain text.
- Profile and athlete information: Details you enter such as date of birth, gender, weight and unit, height, primary sport, race or event goals, training structure, city/ZIP (or similar location fields), sweat and hydration preferences, allergen or dietary preferences, nutrition stack / "quiver" products, gut concerns, flavor or caffeine preferences, and a profile photo if you upload one.
- Session and plan inputs: Manual session details, fuel logs, symptom or gut check-ins, calculator / plan inputs, and related notes. On a session log you may add up to three photos from your photo library. Those photos stay on your phone with the log and are not uploaded with the notes.
- Waitlist and marketing forms: Email address (and any optional fields) when you join our waitlist or submit an inquiry form.
- Support information: Information you send us when you contact support.
- Payment information: If you subscribe or purchase, our payment processor (Stripe) collects and processes payment details. We do not receive or store full payment card numbers.
Activity, health, and integration data
Depending on how you use fuelant, we process workout-related information ("Activity Data") and related health or performance metrics to build and adjust your fueling plans and live guidance. Activity Data may include session type, duration, distance, intensity cues, heart rate where available, and training metrics (such as load or intensity scores) when supplied by a connected platform.
Health data consent
Heart rate, weight, sweat, sleep, workouts, location during sessions, and menstrual-cycle information are health data. We process them only with your explicit consent. When you set up fuelant on the website or in the app, we ask you to tick a separate box (it is not ticked for you) before you continue, and we record that you agreed, when, and which version of this Policy you agreed to. If you created your account before we asked, we ask once the next time you open your Hub. You can withdraw your consent at any time in Settings, under Data & privacy, or by emailing privacy@getfuelant.com, and give it again there later. We record when you withdraw. While you have not consented, we do not store new data from your connected apps and devices, and we stop updating your fueling model from your health data. We do not delete or change the data you already have because of that choice; you can export it or delete your account in Settings. Withdrawing does not affect processing that took place before.
Connected apps and devices: When you connect a third-party service, we collect information from that integration as described in this Policy and only as permitted by your authorization. If we collect health or fitness information from these integrations, we will not sell it or use it for advertising; we will not disclose it to third parties except as needed to provide the Services or as otherwise described in this Policy; and we will use it only for the purposes described here.
Apple HealthKit (iOS)
With your permission on Apple devices, the fuelant app may read health and fitness data from HealthKit—such as workouts (including duration and related metrics), heart rate, resting heart rate, heart-rate variability, heart-rate recovery, active energy, steps, VO₂ max, respiratory rate, sleep analysis, and recent body weight where available. We use this data to personalize training and fueling. Data from HealthKit is not used for advertising, is not sold, and is not shared with third parties except as needed to provide the Services (for example, syncing a snapshot to your fuelant account) or as otherwise described in this Policy.
Google Health Connect (Android)
With your permission on Android devices, the fuelant app may read comparable metrics through Health Connect—such as heart rate, resting heart rate, sleep sessions, weight, active calories, and exercise sessions—for the same fueling and training purposes described above.
Strava
When you connect Strava, we receive activity information you authorize (read access), such as activity type, duration, distance, elevation, heart rate when shared, and related summary fields. We use this data to power planning and hub features. We do not currently write fueling summaries back to Strava activities.
COROS
When you connect COROS, we receive workout and recovery information you authorize—such as activity type, duration, heart rate, training load, and recovery-related metrics (for example, HRV, resting heart rate, or sleep scores when made available)—to refine fuel targets and planning.
Terra and other wearables
You may connect additional wearables and platforms through our Terra integration (for example WHOOP, Polar, Wahoo, or other providers Terra supports, depending on availability). When you do, Terra processes connection and sync on your behalf, and we receive activity, body, and/or sleep information you authorize so we can personalize the Services. TrainingPeaks, if you connect it, shares the workouts you authorize for planning. Peloton, Rouvy, Zwift, and Flo are described below. Garmin Connect is described separately below.
Peloton
When you connect Peloton through Terra, we receive the workout information you authorize, such as activity type, duration, distance, heart rate when shared, and power when the workout includes it. For indoor rides, elevation samples may be used to estimate grade. We use this information to personalize fueling. We do not write information back to Peloton. Live power from a Peloton Bike+ that broadcasts it is described under Bluetooth.
Rouvy
When you connect Rouvy through Terra, we receive the ride information you authorize, such as duration, distance, heart rate when shared, power when the ride includes it, and elevation samples that may be used to estimate grade. We use this information to personalize fueling for indoor rides. We do not write information back to Rouvy. Live power from a trainer that broadcasts it is described under Bluetooth.
Zwift
When you connect Zwift through Terra, we receive the activity information you authorize, such as indoor rides and runs, including activity type, duration, distance, and heart rate or power when the activity includes them. We use this information to personalize fueling. We do not write information back to Zwift.
Flo
When you connect Flo through Terra, we receive menstrual-cycle information Flo shares, such as period dates, cycle and period length, day in cycle, and phase when provided. We store that information with your cycle record. Cycle-aware fueling stays off until you turn it on, as described below. We do not write information back to Flo. We do not use this information for advertising, and we do not sell it.
Garmin Connect
When you connect a Garmin account, we use the Garmin data you authorize to personalize your fueling plan. That data may include activity summaries (sport, duration, distance, heart rate, power, and elevation), daily health summaries when you share them (heart rate, sleep, stress, respiration, and body composition), menstrual-cycle summaries only if cycle-aware fueling is on, and course files you choose for a plan. We use this information to set and adjust carbohydrate, fluid, and sodium guidance for your training. When you choose to send a plan, we write that fueling plan to Garmin Connect so it can appear on your Garmin training calendar. We keep the raw notifications Garmin sends us for seven (7) days after we process them, then delete them. We do not write other account information back to Garmin. We do not sell Garmin data, do not use it for advertising, and do not send raw Garmin files, GPS tracks, or Garmin account credentials to other companies. Connecting Garmin does not send your data to Anthropic. A session summary that began as Garmin data is sent to Anthropic only if you turn Octane on, and only as described in AI transparency. You can disconnect Garmin in Settings. Some Garmin connections are completed through Terra; a direct Garmin Connect connection follows the same limits.
Concept2
If you connect a Concept2 Logbook account, we receive the workout results you authorize, such as duration, distance, pace, stroke rate, and heart rate when the result includes it. During a live session, a Concept2 PM5 may send pace, power, and stroke rate over Bluetooth, as described below. We use this information to personalize fueling for those sessions. We do not write results back to Concept2.
Bluetooth
With your permission, the mobile app uses Bluetooth to read heart rate from a paired strap, power and cadence from a trainer or bike that broadcasts them, and live pace, power, and stroke rate from a Concept2 PM5.
Apple Watch and the Garmin data field
The fuelant app on Apple Watch reads heart rate during a session you start and keeps your fuel plan on the watch. The Garmin data field reads the current heart rate of the activity and keeps your fuel plan on the device. That plan can include aid stations you marked. This is separate from writing a fueling plan to your Garmin Connect training calendar, described above. During an open session, the Apple Watch and the Garmin data field may use location, while the app is in use, to tell when you are near an aid station on that plan.
Cycle-aware fueling (optional)
Cycle-aware fueling is off by default. If you opt in, we may store a last period start date, typical cycle and period length, whether you use hormonal contraception, a derived cycle phase, and (when you connect a wearable) related nightly signals such as skin-temperature deviation, HRV, and readiness. We use this only to personalize fueling suggestions. It is stored separately from your main training history, is not used for advertising, and is not sold. You can delete all cycle-aware data from Hub settings without deleting your account. Connecting Oura does not by itself give fuelant your Cycle Insights or period log: Oura does not expose those features through its third-party API. Period dates may come from you, Apple Health (when you permit menstrual data on iOS), or Flo, as described above, when you connect it and it shares that data.
Weather and location
To estimate weather-aware hydration targets, we may use the city or ZIP you enter and, when you allow location access, your device location while the app is in use. During an open outdoor session we may use precise location to estimate distance and to match fluid and sodium targets to conditions. We request that access only while the app is in use. We do not collect location in the background. If you upload a course file, we store that file with your course. A connected activity may include a start location, which we use for weather and elevation at that point. We do not use location to follow where you go outside an open session. To get weather and elevation, we send the city, ZIP, or coordinates (not your name or account) to OpenWeather and Open-Meteo. To turn a postal code into a city, we send the postal code to Zippopotam.us.
Aid stations
If you mark an aid station on a course, we store that mark, including its location, with your course so we can build your plan, and we store a copy of the mark, including its location, against the race. We may combine marks from athletes on the same race to help other athletes plan it. Marks are not attributed to you.
Manual entry
Information you enter manually—such as session notes, fuel logs, symptom check-ins, or adjustments you make inside fuelant.
Information we collect automatically
- Device and log data: Technical information from the browser or device you use—such as device type, operating system, app or browser version, and similar identifiers needed to deliver and secure the Services.
- Operational diagnostics: Error logs and related performance signals needed to keep the Services reliable. Our servers send error reports to Sentry so we can fix problems. On the website, while you are signed in, and in the mobile app, error and crash reports are sent only when your data region allows it or after you agree; the app uses a Sentry region (EU or US) that matches your data region. Error reports include the error, the page or screen, device, operating system, browser or app version, and in the app and on the website a scrambled form of your account id. We remove request contents, email addresses, cookies and health or training values before they are sent. They do not include screenshots or screen recordings.
- Network data: IP address and related metadata used for security, fraud prevention, abuse detection, and (where enabled) approximate region preferences. IP addresses are not stored in our product analytics. Events sent to PostHog from the website, the mobile app, and our servers have the IP address and location fields removed before they are sent, and the PostHog project is configured to discard IP data. On the website, if you have not chosen a region yet, your browser asks our own servers for your approximate country, which our host Vercel works out from your IP address, so we can show the right privacy notice. If that is not available, we use your browser's language setting. No other company is asked for your location.
- Notifications: If you allow notifications on mobile, the app schedules caffeine, check-in, and session reminders on your phone. It also stores your phone's Expo push token with your account. When you change a plan or session on another device, our servers send that token a silent push through Expo's push service (and from there Apple or Google) so the app can update its reminders. These pushes have no title or text, do not appear on your screen, and contain no health or fueling data. Signing out removes the token.
Advertising measurement and product analytics
If you allow it, we use PostHog and AppsFlyer to see which pages, campaigns, and ads led you to create an account or start a subscription. Event payloads are limited to that measurement: plan, price and currency when a purchase occurs, whether you are on the web or in the iOS or Android app, billing source, campaign parameters from the link you opened, which setup step you reached (its name and number, never your answers), and an account id after you sign in. We do not send your name, email, health, fitness, fueling, sweat, symptom, or Activity Data to these tools.
- PostHog: Counts page and screen views, signup, setup-step, and subscription events. On the website, automatic click capture and session replay run only on marketing and account pages (such as the homepage, pricing, signup, and login). Text you type is masked. Hub, calculator, plan, race, nutrition, and other health or fueling screens are excluded from replay and from automatic click capture. Screen names on those product screens may still be counted when analytics is allowed. They do not include fueling numbers.
- AppsFlyer (mobile apps): Attributes an install, trial, or subscription to an ad campaign. On iOS we ask for App Tracking Transparency before AppsFlyer sends the install. If you decline, the app still works, and Apple's SKAdNetwork can report an aggregated install without your advertising identifier. AppsFlyer is not used on the website. Website campaigns are measured with the campaign parameters in the link.
- Ad networks: When you allow tracking, attribution results may be shared with the network that showed the ad (Meta, TikTok, Google, or Apple Search Ads) so that network can measure its campaign. Those results are not your health or fueling data.
What we do not collect (or do not use for ads)
We do not sell personal information. We do not use health, fitness, fueling, or Activity Data for advertising or for the analytics and attribution tools above. We do not access your contacts, microphone, or camera. If you set a profile photo, we access your photo library, with permission, so you can choose that image, and we store it with your profile. Session photos, described above, stay on your phone.
§ 03
How we use your information
We use personal information for the purposes below. We limit use to what is relevant and proportionate for those purposes.
To provide the Services
- Create and maintain your account; authenticate you; sync data when you connect integrations.
- Generate, display, and update personalized fueling plans, live session cues, and hub insights based on your Activity Data and profile, including optional cycle-aware fueling if you enable it.
- Generate optional Octane outputs about your sessions. Octane is off until you enable it. The choice, the fields, and how to turn it off are in AI transparency. Your fuel plan and live cues work the same if you leave Octane off.
- Process subscriptions and billing through our payment processor when you purchase.
- Provide customer support and respond to your requests and waitlist / inquiry submissions.
To communicate with you
- Send transactional and service-related messages (for example, account security, password reset, subscription receipts, and material changes to our terms or this Policy).
- Send product tips or updates where permitted; you can opt out of non-transactional messages via unsubscribe links or in-app controls where available.
To analyze and improve the Services
- Use operational logs, crash diagnostics, and aggregated or de-identified information to improve reliability and product experience.
- Measure which pages and ads led to signup or subscription, using PostHog and AppsFlyer as described in Sections 2 and 4, and only with the choices in Section 7. This measurement excludes health, fitness, fueling, and Activity Data.
To protect you, others, and the Services
- Monitor for fraud, abuse, and security incidents; enforce our Terms; and protect the integrity of fuelant.
To meet legal and compliance obligations
- Comply with applicable law, regulation, or lawful requests from public authorities.
Health, fitness, and advertising: We do not use your health, fitness, or Activity Data for advertising. We do not sell your personal information.
AI transparency
What it is. Octane is optional. When you turn it on, Anthropic, PBC writes short notes for you through its Claude API: observations and recommendations about your recent sessions. Your fueling plan and in-session guidance work without it.
What we send. Summaries already stored in your account, never raw activity files: your profile and training details; recent sessions (date, sport, duration, heart rate, the fuel and fluid you logged, and your notes); and estimates based on them. If you use them, also cycle information and records from connected sources (resting heart rate, heart-rate variability, sleep, workouts). We never send your email, payment details, GPS tracks or other precise location, or passwords.
How Anthropic handles it. Neither we nor Anthropic use it to train models; Anthropic'sCommercial Termsdo not allow it. Anthropic deletes prompts and outputs within 30 days, except that it may keep a request flagged by its safety systems for up to two years. We have no zero-retention agreement with Anthropic and use no other AI provider.
Your choice. Nothing is sent to Anthropic until you turn Octane on, and we ask before the first import from any connection. While it is on, notes may also be written in the background, for example after you connect a source. Turning it off in Settings stops all further sending; your account, connections, and fueling plan stay as they are.
Not medical advice. Notes can be wrong or incomplete. They are general information, not medical advice, diagnosis, or a substitute for a qualified professional.
§ 05
Data storage and security
We implement administrative, technical, and organizational safeguards designed to protect personal information commensurate with the risks involved. No method of transmission or storage is completely secure; we work to follow industry practices and periodically review our controls.
- Hosting: Account data, profiles, and related content are stored using Supabase (cloud database, auth, and storage). The website and APIs run on Vercel, and our fueling computation engine runs on Render. Exact cloud regions depend on our project configuration and may be updated as we scale.
- Encryption in transit: We require TLS for data transmitted between your device and our Services where supported.
- Encryption at rest: We rely on encryption at rest provided by our cloud providers for databases and backups where supported.
- Integration credentials: OAuth tokens and similar secrets for connected platforms are stored with safeguards appropriate to credential material (including encryption at rest where supported by our stack).
- Passwords: Managed by our authentication provider using industry-standard one-way hashing—not stored in plain text by fuelant.
- Access: Employee access to personal information is limited to personnel who need it to support the Services, subject to policies appropriate to their role.
- Incident response: If we confirm a breach affecting your personal information where notification is required, we will notify affected users without undue delay and within applicable legal timelines (for example, where required, within seventy-two (72) hours of becoming aware), together with guidance on protective steps.
§ 06
Data retention
We retain personal information only as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law.
- Account information: Retained while your account remains open.
- Activity and integration data: Retained while needed to operate features you use and while an integration stays connected, unless you delete it earlier or disconnect the integration.
- Waitlist / inquiry emails: Retained as needed to manage early access, respond to you, and operate related communications, unless you ask us to delete them where we can.
- Cycle-aware fueling: If you opt in, retained while the feature stays on. You can delete this data at any time in Hub settings (cycle-aware fueling). Deleting it does not delete your account.
- Account deletion: When you delete your account in Settings, we first close your Stripe customer record, which cancels any website subscription, and revoke our access to Garmin, Terra, Strava, and COROS. We then delete your sign-in account, your profile photo, and your profile, training, session, fueling, sweat, sleep, and cycle data, and the raw Garmin notifications we still hold. We remove your email address and account id from our discount-code records. We delete or irreversibly de-identify any remaining personal information within thirty (30) days, except where we must retain specific records for legal, tax, accounting, or security purposes (for example, billing records held by Stripe, Apple, or Google). Subscriptions bought in the App Store or Google Play are managed by Apple or Google; cancel them there.
- Raw Garmin notifications: Deleted seven (7) days after we process them.
- Aggregated / de-identified data: May be retained in a form that does not reasonably identify you.
- Disconnecting integrations: When you disconnect a platform, we stop new syncs and revoke our access. For Strava and COROS, we also delete the stored tokens and the synced activity data held for that connection. For Garmin, we deregister your account with Garmin and delete the stored tokens. For providers connected through Terra, we deauthorize the connection at Terra. Sessions, plans, and fueling history already built from that data stay in your account until you delete them or your account.
§ 07
Your rights and choices
Depending on where you live, you may have additional statutory rights. Regardless of location, we provide the following controls:
- Access / portability: Use Export my data in Settings (Data & privacy on the website, or Settings in the app) to download a JSON file with your account details and everything we store for your account: profile, training, sessions, fuel plans, nutrition stack, sweat and cycle data, connected-platform records, and raw Garmin notifications we still hold. Passwords, sign-in tokens, and the access tokens for connected platforms are left out. You can also ask us for a copy by email.
- Correction: Update profile and athlete information in the Services.
- Deletion: Delete your account in settings, subject to lawful exceptions. Section 6 describes what happens. You can also delete optional cycle-aware fueling data on its own from Hub settings.
- Health data consent: You can withdraw your consent to health-data processing at any time in Settings, under Data & privacy, or by emailing us. See Health data consent.
- Octane: Turn it off in Settings at any time; see AI transparency.
- Notifications: Turn off caffeine reminders in the app, or deny notifications in your phone's settings, to stop reminders and the silent update pushes described in Section 2.
- Marketing preferences: Opt out via links in emails or in-app settings where available; operational messages may continue.
- Integrations: Disconnect Garmin, Strava, COROS, Terra connections, and other linked services in settings at any time. Section 6 describes what happens to the data.
- HealthKit: Manage permissions on your iPhone under Settings → Privacy & Security → Health.
- Health Connect: Manage permissions in Android Health Connect / system privacy settings.
- Location: Deny or revoke location permission in system settings; you can still use city/ZIP-based weather where you have provided it.
- Analytics and ads measurement: On the website, use the analytics notice to allow or refuse measurement. In the EU, UK, and other regions that require opt-in, we do not measure until you allow it. In California you can opt out from that notice. On iOS, allow or deny tracking when asked, or later in Settings → Privacy & Security → Tracking. On Android, opt-in regions see the same choice in the app before measurement starts. Declining does not change training or fueling features.
Submit privacy requests to privacy@getfuelant.com. We will respond within a reasonable period and, where applicable, within thirty (30) days.
EU / UK users
If you are in the European Economic Area, United Kingdom, or Switzerland, we process personal information under GDPR/UK GDPR as applicable. Legal bases may include contract (providing the Services), legitimate interests (for example, securing our platform, improving reliability—balanced against your rights), and consent where required. We process health data on the basis of your explicit consent. You may have rights to access, rectify, erase, restrict, object, and port your data, and to lodge a complaint with your supervisory authority. Contact gdpr@getfuelant.com.
U.S. state privacy notices (including California)
Residents of certain U.S. states may have rights to know, delete, and correct personal information, and to opt out of certain types of processing. fuelant does not "sell" personal information as that term is commonly defined in state privacy laws, and we do not use sensitive health information for targeted advertising. Advertising measurement described in Section 2 is limited to how you arrived and whether you subscribed, and you can opt out as described above. We will not discriminate against you for exercising privacy rights. Submit requests through privacy@getfuelant.com.
§ 08
Children’s privacy
The Services are not directed to children under thirteen (13), and we do not knowingly collect personal information from children under thirteen. If you believe a child has provided us information, contact privacy@getfuelant.com and we will take steps to delete it.
§ 09
Changes to this policy
We may update this Policy from time to time to reflect changes to our practices or the law. If we make material changes, we will provide notice as required—such as by email, in-product notification, or by posting the updated Policy with a new effective date. Your continued use of the Services after the effective date of an update may constitute acceptance where permitted by law. Prior versions are available on request.
§ 10
Contact us
- General privacy: privacy@getfuelant.com
- GDPR / UK requests: gdpr@getfuelant.com
- Place of formation: Utah, United States of America