Privacy Policy

Mosaic — Last updated 17 May 2026

Mosaic ("we", "us") is a personal training plan application for iOS. This policy explains what data we collect, how we use it, who we share it with, and your rights over it. Mosaic is operated by Tristan Louveaux, based in the United Kingdom.

Data we collect

Mosaic collects data from the following sources, only with your explicit authorisation:

Strava — activity history (type, distance, duration, heart rate, pace, power, GPS route, elevation), race best efforts, and athlete profile (name, gender, measurement preference). Access is granted via Strava OAuth and can be revoked at any time.
Garmin Connect — activity summaries, daily resting heart rate, HRV status, and sleep data, delivered via Garmin's official webhook integration where enabled. Access is granted via Garmin OAuth and can be revoked at any time.
Apple Health — resting heart rate, heart rate variability, VO2 max, sleep analysis, and (where you grant access) workout routes. Read on-device only; permissions are controlled in iOS Settings.
You (manual entry) — age, biological sex, body weight, race goals, personal bests, training availability, injuries, illness, and check-in responses. You enter this during onboarding and can edit it at any time.
Run-to-work routes (optional) — if you enable commuting by run, Mosaic stores the start and end points of your declared commute and may detect drift between the declared and actual routes from your synced Strava activities. Full route geometry stays in Strava; only summary points and pattern flags are stored on Mosaic's servers.
Account data — your email address (only if you create an account; anonymous use is supported), used to authenticate via Supabase.

How we use your data

All data is used exclusively to provide Mosaic's training plan and fitness tracking features to you. Specifically:

Activity history is used to calibrate fitness benchmarks (VDOT, FTP, CSS) and compute training load.
Heart rate and HRV data inform readiness and recovery scores.
Sleep data contributes to daily readiness calculations.
Race goals and personal bests shape your weekly training plan.
No data is used to train AI or machine learning models, by us or by our processors.
No data is shared with other users or sold to third parties.
No data is used for advertising or profiling.

Artificial intelligence

Mosaic ships with no AI or machine learning feature. No part of your training data, from Strava or from any other source, is sent to a language model or any third-party AI service. Every number Mosaic shows you is produced by a deterministic physiological model, documented in full on our methodology page.

Data storage and security

Your activity data is stored in a secured Supabase database hosted on AWS infrastructure in the EU. Data is encrypted in transit (HTTPS) and at rest. Row-level security policies enforce that you can only read and write your own data. Apple Health data is processed on-device and is not transmitted to our servers unless you also have the same metric synced via Strava or Garmin.

Sub-processors

Mosaic uses the following third-party services to operate. Each is contracted as a data processor and is governed by their own privacy policy.

Supabase — database, authentication, and serverless edge functions. Hosted on AWS in the EU. Privacy policy.
Strava — source of your activity history, where you authorise it. Privacy policy.
Garmin — source of activity, sleep, and physiology data, where you authorise it. Privacy policy.
Apple — operates the App Store and Apple Health framework. Data read from Apple Health stays on-device. Privacy policy.

Data retention

We retain your data for as long as your account is active. If you disconnect Strava, syncing stops and Mosaic's access is removed immediately, and Strava-sourced data already stored is deleted within 30 days; we confirm by email once deletion is complete. If you delete your account from inside the app, your data is marked for deletion immediately and permanently purged within 30 days. The 30-day window lets you sign back in and cancel the deletion if you change your mind.

Your rights

Under the UK GDPR, the EU GDPR, and applicable data protection law, you have the right to:

Access the data we hold about you (in-app data export, JSON format).
Request correction of inaccurate data.
Request deletion of your data (in-app account deletion, or by email).
Withdraw consent and disconnect any data source at any time.
Lodge a complaint with your national data protection authority. In the UK that is the Information Commissioner's Office.

To exercise any right that is not available in-app, email tristan@mosaicrunning.run.

Revoking access and deleting data

To disconnect Strava, open Mosaic, go to Account, and tap Disconnect on the Strava row. You can also revoke from your Strava app settings directly.

To disconnect Garmin, open Mosaic, go to Account, and tap Disconnect on the Garmin row.

To disconnect Apple Health, open iOS Settings, Health, Apps, Mosaic, and turn off the relevant permissions.

To delete your account and all data Mosaic holds about you, open Mosaic, go to Account, and tap Delete account. You can also email tristan@mosaicrunning.run with the subject "Delete my data".

Children

Mosaic is not directed to children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us with personal data, email us and we will delete it.

Changes to this policy

Material changes will be flagged in-app and noted at the top of this page. The "Last updated" date above always reflects the most recent revision.

Contact

Questions about this policy: tristan@mosaicrunning.run

← Back to Support