Privacy Policy

Last updated: 23 August 2026

OSO Performance Technologies (“OSO”, “we”, “us”, or “our”) operates the OSO training platform and website (the “Service”). This Privacy Policy explains what personal data we collect, how we use it, and the rights you have. By using the Service, you agree to this Policy. When you create an account, you confirm you are at least 16 years old — or that a parent or legal guardian has consented on your behalf if you are 13 to 15, as set out in our Terms — and consent to our processing and interpretation of your training and health-related data as described here.

1. Information we collect

Account information — your name, email address, and a securely hashed password when you create an account.
Training & activity data — the activity files you upload (such as .fit files) and the metrics we derive from them (duration, distance, power, heart rate, pace, elevation, GPS routes, training load, and related analytics).
Connected services — if you connect a third-party account such as Strava, we access the activity and profile data you authorise, using tokens you can revoke at any time.
Profile & preferences — settings such as thresholds (e.g. FTP), units, primary sport, and dashboard layout.
Technical & usage data — IP address, browser and device type, and log data, used to operate and secure the Service.
Local storage — a login token and interface preferences stored in your browser (see our Cookie Policy).

2. How we use your information

To provide, maintain, and secure the Service and your account.
To compute training metrics and analytics from your activities.
To sync activities from services you choose to connect.
To personalise your experience (saved layouts, thresholds, units).
To communicate with you about your account, security, and updates.
To improve the Service and develop new features.
To comply with legal obligations and enforce our Terms.

3. Legal bases (EEA / UK users)

Where the GDPR applies, we process your data on the following bases: performance of our contract with you (to provide the Service), your consent (e.g. connecting Strava or opting into communications), our legitimate interests (security and improving the Service), and compliance with legal obligations. You may withdraw consent at any time.

4. How we share information

We do not sell your personal data. We share it only:

With service providers who host and operate the Service on our behalf (e.g. cloud hosting and database providers), under contracts requiring them to protect your data.
With third-party services you connect (e.g. Strava), only as needed to provide the integration you request.
Where required by law, or to protect the rights, safety, and security of OSO, our users, or the public.
In connection with a business transfer (merger, acquisition, or sale of assets), subject to this Policy.

5. Third-party services

If you connect Strava or use maps and routing, your use of those services is also governed by their own terms and privacy policies. We are not responsible for the practices of third parties.

6. Data retention

We keep your personal data for as long as your account is active or as needed to provide the Service. You can delete your account and associated data at any time; we may retain limited records where required by law or for legitimate business purposes.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, and to object to or restrict certain processing. Residents of the EEA/UK (GDPR) and California (CCPA/CPRA) have additional rights, including the right not to be discriminated against for exercising them. To exercise any right, contact legal@trainoso.com. You may also lodge a complaint with your local data-protection authority.

8. Data security

Data security is our top priority. Protecting your account and your training data is something we take seriously at every layer of the Service, and it guides how we build and operate OSO. We use industry-standard technical and organisational measures, including:

Encrypted connections (TLS/HTTPS) for all data in transit.
Passwords stored only as salted, hashed values — never in plain text.
Authenticated, access-controlled endpoints, so your data is only ever accessible to you.
The principle of least privilege for internal and third-party access.
Ongoing monitoring for, and prompt remediation of, security issues.

We continually review and strengthen these safeguards. That said, no method of transmission or storage is ever completely secure, and we cannot guarantee absolute security. If we ever become aware of a breach affecting your data, we will act promptly and notify you where required by law.

9. International transfers

Your data may be processed in countries other than your own. Where required, we use appropriate safeguards for such transfers.

10. Minimum age and junior athletes

You must be at least 16 years old to create an account and use the Service on your own behalf.

Athletes aged 13 to 15. Junior athletes train and race seriously, and the Service is open to them where a parent or legal guardian has accepted our Terms on the athlete’s behalf and supervises the account. That parent or guardian is the account holder, and their consent covers the processing of the athlete’s training and health-related data described in this Policy, including heart rate, heart-rate variability, sleep and body mass. They may ask us to provide, correct, or permanently delete the account and everything in it at any time by writing to legal@trainoso.com.

Where local law sets a higher age. Some countries set a higher minimum age for consenting to online services on your own. Where the law that applies to you sets an age higher than the ages above, that higher age applies instead, and a parent or guardian must consent until you reach it.

Under 13. The Service is not available to anyone under 13, with or without parental consent, and we do not knowingly collect personal data from anyone under 13. If you believe someone under 13 has provided us with data, contact us and we will close the account and delete the data.

11. Changes to this Policy

We may update this Policy from time to time. We will post the new version here and update the “Last updated” date. Material changes may be communicated to you directly.

12. Contact

Questions about this Policy or your data: legal@trainoso.com.