Privacy Policy

Mosaic — Last updated 17 May 2026

Mosaic ("we", "us") is a personal training plan application for iOS. This policy explains what data we collect, how we use it, who we share it with, and your rights over it. Mosaic is operated by Tristan Louveaux, based in the United Kingdom.

Data we collect

Mosaic collects data from the following sources, only with your explicit authorisation:

• Strava — activity history (type, distance, duration, heart rate, pace, power, GPS route, elevation), race best efforts, and athlete profile (name, gender, measurement preference). Access is granted via Strava OAuth and can be revoked at any time.
• Garmin Connect — activity summaries, daily resting heart rate, HRV status, and sleep data, delivered via Garmin's official webhook integration where enabled. Access is granted via Garmin OAuth and can be revoked at any time.
• Apple Health — resting heart rate, heart rate variability, VO2 max, sleep analysis, and (where you grant access) workout routes. Read on-device only; permissions are controlled in iOS Settings.
• You (manual entry) — age, biological sex, body weight, race goals, personal bests, training availability, injuries, illness, and check-in responses. You enter this during onboarding and can edit it at any time.
• Run-to-work routes (optional) — if you enable commuting by run, Mosaic stores the start and end points of your declared commute and may detect drift between the declared and actual routes from your synced Strava activities. Full route geometry stays in Strava; only summary points and pattern flags are stored on Mosaic's servers.
• Account data — your email address (only if you create an account; anonymous use is supported), used to authenticate via Supabase.

How we use your data

All data is used exclusively to provide Mosaic's training plan and fitness tracking features to you. Specifically:

• Activity history is used to calibrate fitness benchmarks (VDOT, FTP, CSS) and compute training load.
• Heart rate and HRV data inform readiness and recovery scores.
• Sleep data contributes to daily readiness calculations.
• Race goals and personal bests shape your weekly training plan.
• No data is used to train AI or machine learning models, by us or by our processors.
• No data is shared with other users or sold to third parties.
• No data is used for advertising or profiling.

AI Coach (private beta in this release)

Mosaic includes code for an optional AI Coach feature. In this release the AI Coach is available only to a limited set of users on an internal access list while the subscription path is being built. If you are not on the access list, no AI Coach data flows to any third party from your device.

When the AI Coach is enabled for your account, the following is sent each session to Anthropic's Claude API (the Haiku model) for the sole purpose of generating coaching responses:

• A summary of your last four weeks of training activity (type, distance, duration, heart rate aggregates, pace, power) — no raw GPS routes are sent.
• Your current readiness signals (recent HRV, resting heart rate, sleep, training stress balance).
• This week's planned workouts.
• Your current fitness benchmarks (VDOT, FTP, CSS).
• Optional injury/illness flags you have entered.
• Your message to the coach.

The following is never sent to Anthropic: your name, email, GPS coordinates, raw routes, Strava or Garmin credentials, payment information.

Anthropic retains messages for up to 30 days under their Commercial Terms, after which they are deleted. Anthropic does not use these messages to train their models. See the Anthropic Privacy Policy for full detail.

When the AI Coach becomes generally available you will be asked to consent to this data flow the first time you open the feature. You can decline at any time, and you can use the rest of Mosaic without the AI Coach enabled.

Data storage and security

Your activity data is stored in a secured Supabase database hosted on AWS infrastructure in the EU. Data is encrypted in transit (HTTPS) and at rest. Row-level security policies enforce that you can only read and write your own data. Apple Health data is processed on-device and is not transmitted to our servers unless you also have the same metric synced via Strava or Garmin.

Sub-processors

Mosaic uses the following third-party services to operate. Each is contracted as a data processor and is governed by their own privacy policy.

• Supabase — database, authentication, and serverless edge functions. Hosted on AWS in the EU. Privacy policy.
• Strava — source of your activity history, where you authorise it. Privacy policy.
• Garmin — source of activity, sleep, and physiology data, where you authorise it. Privacy policy.
• Apple — operates the App Store and Apple Health framework. Data read from Apple Health stays on-device. Privacy policy.
• Anthropic — provider of the Claude AI model used by the optional AI Coach. Data sent is limited to the fields listed above. Privacy policy.

Data retention

We retain your data for as long as your account is active. If you disconnect Strava, syncing stops and Mosaic's access is removed immediately; to erase Strava-sourced data already stored, delete your account or email us and we will remove it. If you delete your account from inside the app, your data is marked for deletion immediately and permanently purged within 30 days. The 30-day window lets you sign back in and cancel the deletion if you change your mind.

Your rights

Under the UK GDPR, the EU GDPR, and applicable data protection law, you have the right to:

• Access the data we hold about you (in-app data export, JSON format).
• Request correction of inaccurate data.
• Request deletion of your data (in-app account deletion, or by email).
• Withdraw consent and disconnect any data source at any time.
• Lodge a complaint with your national data protection authority. In the UK that is the Information Commissioner's Office.

To exercise any right that is not available in-app, email tristan@mosaicrunning.run.

Revoking access and deleting data

To disconnect Strava, open Mosaic, go to Account, and tap Disconnect on the Strava row. You can also revoke from your Strava app settings directly.

To disconnect Garmin, open Mosaic, go to Account, and tap Disconnect on the Garmin row.

To disconnect Apple Health, open iOS Settings, Health, Apps, Mosaic, and turn off the relevant permissions.

To delete your account and all data Mosaic holds about you, open Mosaic, go to Account, and tap Delete account. You can also email tristan@mosaicrunning.run with the subject "Delete my data".

Children

Mosaic is not directed to children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us with personal data, email us and we will delete it.

Changes to this policy

Material changes will be flagged in-app and noted at the top of this page. The "Last updated" date above always reflects the most recent revision.

Contact

Questions about this policy: tristan@mosaicrunning.run

---

Terms of Use · Support

← Back to Support