Last updated: October 2026 · Effective: October 2026
Short version: We collect only what we need to run your dashboard. We never sell your data. Your health and training data stays yours. You can delete everything at any time.
Decode Strength ("we", "us", "our") is a personal athletic dashboard product operated by Decode Strength, Bengaluru, India. You can reach us at [email protected].
This is the single privacy policy for everything Decode Strength makes. One document rather than one per app: the products share an operator, a jurisdiction and a position on selling data, and a policy you have to hunt for per app is a policy nobody reads.
It covers:
Where a product differs, the difference is called out in the section it belongs to rather than left to a general statement. The largest difference is IMPULSO, which is covered in section 2.5.
When you sign up, we collect:
Decode Strength integrates with multiple training platforms. You connect the platforms you already use — we read only what is needed to show your training and health in the app and populate your public page. Each integration is described below; all are activated by you and can be disconnected at any time.
If you ask for early access on decodestrength.com, we store your name, your email address, the handle you asked for, the kind of phone you asked from (Android, iPhone or other) and the date. We use them to hold that handle for you while you wait for a place, to send you one welcome email with the way into the app when your place is ready, and to give you the handle when you sign up with the same email. Nothing else.
Getting the app during early access means we add your email to the early access list for our app on Google Play, and you install through Google Play. Both are Google's services, under Google's privacy policy; we see only that you created an account, not anything about your Google account.
A request we offer a place to, and you do not follow up, is released seven days after that email and deleted thirty days later. A request we decline is deleted thirty days after we decline it. We do not add these addresses to a marketing list, sell or share them, or send promotional email. To have a request deleted sooner, write to [email protected].
If you connect Strava, we access (with your permission):
We access only what you authorise via Strava's OAuth flow. We do not access private activities unless you explicitly set them to public. We do not access your Strava followers, payment information, or email address.
If you install the Decode Strength Android app and grant permission, we read the following from Android Health Connect on your device:
We do not read reproductive health data (menstruation, ovulation, sexual activity) or exercise sessions from Health Connect.
We read only the last 30 days and never write anything back to Health Connect. We read while you use the app and, only if you turn on "Sync in the background", about once an hour while it is closed — so last night's sleep is ready when you open it. You can turn that off in the app at any time. Your phone works out one figure per day for each of these — for example total steps, average heart rate, the day's last weight — and sends only those daily figures, labelled with the app that recorded them (for example Garmin Connect or Samsung Health), so that you can choose which app each figure comes from.
Sleep is the exception. Your phone sends each sleep session as Health Connect holds it: when it started and ended, the app that recorded it, your time zone, the times of each sleep stage (deep, light, REM, awake), and the average heart rate, blood oxygen, respiratory rate and skin temperature during it. It is sent once, after the night is recorded, and again only if the app that recorded it changes it. We keep these so that last night can be worked out the same way every time, and they are deleted with the rest of your data.
This data is shown to you, in the Health tab of the app. It is never sold, never shared with advertisers or anyone else, and never used for any purpose other than showing you your own health metrics and your Decode Score.
Your public page shows none of it unless you choose. In the app you can turn on the Decode Score tile, which shows visitors two things only: your daily Decode Score (one number worked out from your sleep, recovery, training and movement, with no underlying readings) and, if you also switch it on, your resting heart rate. Both are off until you turn them on, and you can turn them off at any time.
You can revoke Health Connect permissions at any time through your Android device settings; revoking stops further reading. Closing your account deletes this data with the rest of your account, and it can be deleted earlier on request.
On a race in the app you can add your official result: a PDF, a screenshot of the results page or a finisher certificate. We read it once, on Cloudflare's infrastructure (Workers AI), to fill in your finish time, splits, bib, category and placings, and you check them before anything is saved. No other company sees the file.
A results page often shows other athletes too. We keep only what belongs to you: the text taken from the file is not stored, and the file itself is deleted after seven days. What you saved stays with the race until you change it or close your account.
We collect basic usage information to keep the service running:
We do not use third-party analytics tracking. We do not install advertising cookies.
IMPULSO is a race simulator for HYROX and Yoddha. It runs entirely on your device and it has no account: there is nothing to sign up for and nothing to sign in to.
Google Play collects its own installation and crash information under Google's privacy policy, which we do not control. Aside from that, IMPULSO makes no network requests for your training data.
If IMPULSO ever gains an account or a sync feature, this section changes before the feature ships, not after.
| Data | Why we use it |
|---|---|
| Account data | To create and manage your account, send you sign-in codes and account emails, and identify you when you sign in. |
| Strava activity data | To show your training in the app and, as you choose, on your public dashboard: heatmap, personal bests (training and race), yearly totals, and route maps of highlighted races. |
| Early access requests | To hold the handle you asked for, send your welcome email when your place is ready, and give you that handle when you sign up. |
| Health data | To show you your activity, heart, sleep, body, vitals and nutrition figures in the app's Health tab, visible only to you. Never on your public page, and never for any other purpose. |
| Usage data | To keep the service running, fix bugs, and understand which features are used. |
We do not use any of your data for advertising. We do not sell your data. We do not share your data with third parties except as described in Section 5.
Your public dashboard at username.decodestrength.com is off when you join. It is visible to anyone with the link only once you turn it on in the app and agree to the public page terms, and only until you turn it off. While on, it displays the data you have chosen to make public:
Activities come from Strava whatever their visibility there, private ones included. Every section can be hidden from the app. Health data from Health Connect (activity, heart, sleep, body, vitals and nutrition) is shown only to you in the app. The one exception is the Decode Score tile, off by default: if you turn it on, your page shows your daily Decode Score and, only if you choose, your resting heart rate — never the readings behind them.
| Third Party | Purpose | Data Shared |
|---|---|---|
| Strava | Activity data source | OAuth tokens only — used to fetch your data on your behalf |
| Resend | Transactional email | Your email address and name — for sign-in codes and your early access welcome |
| Early access — the Play list we add you to, and the Play Store you install from | Your email, added by us to that list. You install with your own Google account, under Google's privacy policy | |
| Open-Meteo | The weather on the app's Today screen | The name of the city in your profile, and that city's map coordinates — nothing that identifies you. Not your location: the app does not read it |
| Cloudflare | Infrastructure — hosting, database, queues, and reading a results file you add (Workers AI) | All data is processed in Cloudflare's infrastructure — governed by Cloudflare's privacy policy |
We do not share your data with any other third parties. We do not share your data with advertisers, data brokers, or analytics companies.
Your data is stored on Cloudflare's infrastructure, primarily in data centres in the Asia-Pacific region. Cloudflare is SOC 2 Type II certified.
We protect your data using:
No system is perfectly secure. If we become aware of a security breach affecting your data, we will notify you at your registered email address within 72 hours.
You have the right to:
To exercise any of these rights, email [email protected]. We will respond within 30 days.
You can delete your account and all associated data at any time.
In the app: Go to Profile → Close my account and confirm with your password. You are signed out on every device at once and your public page stops showing.
Thirty days to change your mind: signing back in within 30 days cancels the closure. After that, your account and all associated data are permanently deleted, and this cannot be undone.
If you no longer have the app installed: Email [email protected] from your registered email address and we will delete your account and all associated data on your behalf.
What is deleted: your profile and account details, photos, connected-source credentials (Strava, Health Connect), and all activities, races, personal bests, and health metrics.
Timeline: everything is deleted 30 days after you close your account. Some data may persist in encrypted backups for up to 90 days, after which it is permanently erased.
Decode Strength is not directed at children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal information, please contact us at [email protected] and we will delete it promptly.
Health and fitness data is sensitive. We apply additional protections:
We use minimal cookies:
We do not use advertising cookies, tracking pixels, or analytics cookies from third parties. We do not use Google Analytics.
We may update this Privacy Policy as the product evolves. When we make material changes, we will:
Continued use of Decode Strength after changes are posted constitutes acceptance of the updated policy.
For any privacy questions, data requests, or concerns:
Privacy requests: [email protected]
General support: [email protected]
General enquiries: [email protected]
We aim to respond to all privacy requests within 30 days.