What data Grepiac collects and where it lives

What Grepiac stores about an athlete

Identity

• First name, last name, email (used as sign-in).
• Date of birth, sex.
• Public ID (a short opaque string for URLs).
• Password hash (PBKDF2, never reversible).

Body

• Height (cm).
• Weight (kg), tracked over time as MetricHistory.
• Optional anthropometric details (body composition, body fat, RMR) when logged.

Training data

• Activity files (FIT, TCX, GPX) you upload. Stored as Activity rows plus the original file in cloud storage.
• All per-second data the parser extracts (power, HR, pace, GPS, cadence, etc.).
• Lap-level summaries (ActivityLap).

Race data

• Races on your calendar (Race).
• Saved race plans (CalculatorResult).
• Race recaps (RaceRecap).

Wellness

• Daily wellness logs (WellnessLog) when you fill them in. Includes sleep, HRV, RHR, stress, soreness, mood, motivation, illness, alcohol, optional menstrual phase.
• Wellness and menstrual data are consent-gated: stored only after you turn them on, and shared with your coach only under separate switches. See Managing your privacy and consent and the privacy notice.

Consent history

• An append-only record (ConsentEvent) of every time you turned a privacy switch on or off — with a timestamp and the policy version. Included in your data export.

Equipment

• Bike setups, swim equipment, run equipment.
• Bike change logs.

Coach interactions

• Coach notes about you (CoachNote). Visibility gated; see Coach note privacy.
• Assessment records (Assessment).
• Activity comment threads (ActivityNote).
• CoachAthleteRelationship records, including ended ones for history.

Settings

• Notification preferences.
• Premium tier and source (direct payment, coach grant, admin grant).

What Grepiac stores about a coach

• Identity (name, email, password hash).
• Coach billing state (billing_until, billing_active, billing_grace_started_at).
• Team memberships (TeamCoachAssignment).
• Athletes on your roster (CoachAthleteRelationship).
• Notes you authored.
• Assessments you logged.
• Activity notes you wrote.

What Grepiac does NOT store

• Credit card numbers. Payment goes through Stripe; Grepiac stores only a Stripe customer ID.
• Real-time location. Grepiac stores GPS tracks from uploaded files, not your live position.
• Direct device sync data. Grepiac does not pull from Garmin, Strava, Apple Health, etc.
• Social graph data. Grepiac has no social features.

Where the data lives

• Database: Postgres, hosted on infrastructure controlled by Grepiac.
• Activity files: cloud object storage (S3-compatible).
• Static assets: standard CDN.
• Logs: server logs with PII minimised (no passwords, no full FIT contents).

Audit and edit history

Grepiac keeps an EditLog of important changes to athlete records: anthros, threshold zones, premium grants, etc. The log is admin-readable and serves as the record of who changed what when.

What you can do

• Export your data: see CSV exports for what is exportable today.
• Delete your account: not self-service today; see Deleting your account.
• Audit edits: ask admin for a full edit log.

See also: Coach note privacy, What your coach can see, CSV exports.