Privacy Policy

Performance Signal respects your privacy. This policy explains, in plain language, what we collect, how we use it, how we protect it, and the choices available to you when using the Performance Signal website, dashboard, ChatGPT application, and related services. How we use artificial intelligence is explained under AI processing and transparency.

Who we are

Performance Signal (ABN 68 349 278 281) is an Australian business. We handle personal information in accordance with applicable Australian privacy laws, including the Privacy Act 1988 (Cth).

For privacy enquiries, contact privacy@performancesignal.ai.

What we collect

When you create an account or use Performance Signal, we may collect your email address, authentication identifiers, login information, account status information, subscription information, support communications, and service usage information.

With your explicit authorisation, we request access to your Strava activity history through Strava's official login. This may include activity names, dates, distances, elevation, pace, speed, heart rate, cadence, activity stream data, and other activity information made available through the Strava API.

We never see or store your Strava password, and we never post, edit, or delete anything in your Strava account.

Garmin Connect

You may choose to connect your Garmin Connect account to Performance Signal through Garmin's authorised connection process. We only receive the Garmin information you authorise.

If you connect Garmin Connect, we access your running and activity data, such as distance, duration, pace, speed, elevation, heart rate and cadence. Where you specifically authorise it, we also access health and recovery information such as sleep, resting heart rate, heart rate variability and stress.

Garmin access may not include activities recorded before you connect. We never see or store your Garmin password, and we do not add, change or delete anything in your Garmin Connect account. Garmin is an independent service, and its handling of your information is described in Garmin's privacy notice.

Health and recovery information may be sensitive personal information. We collect it only with your consent, and use it only to provide the analysis you ask for. Performance Signal is not a medical or healthcare service.

How your data is used

Your information is used to provide Performance Signal, authenticate your account, connect and synchronise Strava and Garmin Connect, answer the questions you ask, generate activity insights, manage subscriptions and account access, respond to support requests, improve reliability and security, investigate misuse or fraud, and comply with legal obligations.

Your activity data is never sold, never shared with advertisers, and never used by Performance Signal to train artificial intelligence models.

AI processing and transparency

What AI is used for. Performance Signal uses OpenAI's ChatGPT to provide conversational running analysis and personalised insights. Performance Signal uses artificial intelligence technologies, including OpenAI services, to generate responses, summaries, analysis, and insights requested by you. The purpose of this processing is to answer the questions you ask about your own activity information.

How it works. When you ask questions about your activity history through ChatGPT, relevant activity information you have authorised may be transmitted to and processed by OpenAI in order to generate a response. This is processing to answer your request; it is not used by Performance Signal to train AI models.

No AI model training by Performance Signal. Performance Signal does not provide Strava activity data to OpenAI or other AI providers for the purpose of training foundation models. Garmin information, and any conversations, summaries, recommendations or insights derived from it, are used only to provide the service you request. Performance Signal does not use them to train, test, evaluate, benchmark, improve or otherwise develop any AI model, and does not include them in any training or evaluation dataset.

OpenAI's handling. Processing performed by ChatGPT and OpenAI is also subject to OpenAI's own privacy policies and terms of use, and to your ChatGPT account settings. Depending on your ChatGPT plan, privacy settings, and any feedback you give, OpenAI may use conversation information, including information provided by Performance Signal, to improve its models. Performance Signal does not control OpenAI's independent data processing or your ChatGPT settings.

Your ChatGPT settings. Users are responsible for reviewing and configuring any privacy, memory, or data-sharing preferences available within third-party platforms they choose to use, including ChatGPT. If you do not want OpenAI to use conversation information for model improvement, you should turn off the relevant model-training setting in ChatGPT and avoid submitting feedback on responses (such as a thumbs up or thumbs down), which may allow OpenAI to use that conversation. Garmin-derived information must not be used for AI model training or improvement, so our Terms and Conditions require these steps when you use Garmin information in ChatGPT.

Your explicit consent for Garmin information. Before Garmin-derived information is processed using ChatGPT, Performance Signal will obtain your explicit consent to that AI processing. This consent is separate from your authorisation to connect your Garmin Connect account, and Garmin information will not be provided to ChatGPT without it. You may withdraw your AI-processing consent at any time by contacting privacy@performancesignal.ai or using any withdrawal option provided in Performance Signal. Withdrawing consent stops future AI processing of Garmin-derived information through Performance Signal.

What we don't do

Performance Signal does not sell personal information, sell Strava activity data or Garmin information, use Strava activity data or Garmin information for advertising, use Strava activity data or Garmin information to train artificial intelligence models, provide user activity data to OpenAI for training foundation models, share activity history with other users, or access your Strava or Garmin password.

Third-party services

Performance Signal uses trusted third-party providers to operate the service, including Auth0 for authentication, Supabase for database services, Vercel for website hosting, Render for application hosting, Cloudflare for DNS and network services, OpenAI for AI processing, Strava and Garmin for activity data access, Stripe for payment processing when subscriptions are enabled, and Google for website analytics (Google Analytics).

Connected activity data is stored by Supabase and processed by our application, which is hosted on Render. OpenAI processes relevant activity information when you use Performance Signal in ChatGPT.

These providers may store or process information in Australia, the United States, Europe, and other jurisdictions in which they operate.

International processing and disclosure

In order to operate Performance Signal, personal information may be disclosed to or processed by service providers located in Australia and overseas.

By using Performance Signal, you acknowledge that information may be transferred to these jurisdictions and may be subject to different privacy laws than those that apply in Australia.

We take reasonable steps to engage reputable service providers and to protect personal information when it is transferred internationally.

Staying in control

You can revoke Performance Signal's access at any time from your Strava account settings. Once revoked, we stop receiving new Strava data.

Historical activity information already stored within Performance Signal may remain available until it is deleted in accordance with this Privacy Policy.

For Garmin information, you can:

• Disconnect Garmin Connect at any time. Once disconnected, we stop receiving new Garmin information.
• Withdraw your consent to AI processing of Garmin information. This stops future AI processing of Garmin-derived information through Performance Signal. You can keep your account and your Garmin connection.
• Request deletion of the Garmin information Performance Signal stores about you.
• Request deletion of your Performance Signal account.
• Exercise your other privacy rights, including access to or correction of your Garmin information and, where applicable law provides, restriction of its processing or a copy of it.

To exercise any of these choices, contact privacy@performancesignal.ai.

Withdrawing a permission, disconnecting a service, or deleting your Performance Signal account stops future sharing with ChatGPT, but it does not erase information already included in your ChatGPT conversations. Performance Signal cannot delete information from OpenAI's systems. Those conversations remain subject to OpenAI's controls and retention practices, and you manage them in ChatGPT.

You may request deletion of your Performance Signal account by contacting privacy@performancesignal.ai.

Data retention and deletion

We retain information only for as long as reasonably necessary to provide the service and meet legal, operational, security, fraud-prevention, accounting, taxation, and business requirements.

When a verified account deletion request is received, account access may be restricted or disabled immediately, connected integrations may be disconnected, and the account may enter a pending deletion state while deletion is processed.

Personal information is generally deleted within a reasonable period following completion of the deletion process.

Certain information may be retained where reasonably necessary for legal obligations, accounting and taxation requirements, fraud prevention, security investigations, dispute resolution, backup restoration, operational recovery, or regulatory compliance.

Subscription, billing, and financial records may be retained for longer periods where required by applicable taxation, accounting, or financial reporting laws.

Security

We use reasonable and industry-standard security measures to protect personal information.

These measures include encrypted communications, authenticated access controls, restricted administrative access, and monitoring and security controls designed to protect service integrity.

While no system can guarantee absolute security, we take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure.

Data breaches

If we become aware of an eligible data breach involving personal information, we will take steps required under applicable law, including investigating the incident and notifying affected individuals and regulators where required.

Payments

When subscriptions are available, payments will be processed by Stripe or another authorised payment provider.

Performance Signal does not store complete credit card numbers or full payment card details.

Payment information is handled in accordance with the privacy and security practices of the relevant payment provider.

Your rights

Subject to applicable law, you may request access to personal information we hold about you, correction of inaccurate or incomplete information, deletion of personal information, information about how your personal information is processed, and withdrawal of certain consents where applicable.

Requests can be made by contacting privacy@performancesignal.ai.

Cookies and sessions

Performance Signal uses cookies, session technologies, and similar mechanisms to maintain login sessions, support security measures, improve website functionality, and provide a reliable user experience. These are needed for the website and dashboard to work.

Separately, and only as described under Website analytics below, Google Analytics cookies are used to measure how the website is used.

Most browsers allow you to control cookie settings, although disabling cookies may affect functionality.

Website analytics

We use Google Analytics 4, a website analytics service provided by Google, to understand how the Performance Signal website and dashboard are used, so that we can improve them.

When Google Analytics is on, it records the pages you view, the page or campaign link that brought you to the website, general information about your device and browser, your approximate location (country, region and city, estimated by Google from your IP address), and a small number of actions on the website: opening the dashboard, starting or finishing an archive upload or import, starting a trial, and selecting a membership option or starting checkout.

We do not send Google Analytics your name, email address, account identifiers, Strava activity data, uploaded file names, or payment information. Google Analytics is set up for measurement only: storage and use of data for advertising and ad personalisation are switched off.

Google Analytics stores first-party cookies in your browser (named _ga and _ga_ followed by an identifier), which hold a randomly generated number used to tell one browser from another and last for up to two years. While an archive import that you started is running, the website also keeps a short-lived note of it in your browser's local storage so that its outcome is counted once. That note is not sent to Google.

The information is processed by Google on our behalf and may be stored in the United States and other countries in which Google operates. Google's handling of it is described in Google's Privacy Policy.

Your analytics choices

If you visit from the European Economic Area, the United Kingdom, or Switzerland, or if we cannot tell which country you are visiting from, Google Analytics is not loaded and none of its cookies are set unless you accept when asked. Elsewhere, Google Analytics is on unless you turn it off. To decide this, the country your connection comes from is checked when you first visit. We do not store it.

If your browser sends a Global Privacy Control signal, we treat it as a request not to be measured: Google Analytics stays off, wherever you are, unless you choose to allow it below while the signal is on.

You can change your choice at any time here. Turning analytics off stops any further measurement and removes the Google Analytics cookies from this browser.

Your choice is remembered in this browser's local storage for 12 months and applies only to this browser, so you may be asked again on another device or after clearing your browser data. You can also block or delete cookies in your browser settings, or install Google's Analytics opt-out browser add-on.

Children

Performance Signal is not intended for children.

Users under 18 years of age should only use the service with the involvement or permission of a parent or guardian.

Privacy complaints

If you believe we have mishandled your personal information, please contact us at privacy@performancesignal.ai.

We aim to investigate and respond to privacy complaints within 30 days.

If you are not satisfied with our response, you may contact the Office of the Australian Information Commissioner (OAIC) or another applicable privacy regulator.

Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal obligations, or business practices.

Updated versions will be published on the Performance Signal website and take effect when published unless otherwise stated.

Contact

Questions about privacy? Reach us at privacy@performancesignal.ai.