Privacy Policy

Last updated 30 July 2026 · Version 1.0

The short version. Trisect has no accounts, no analytics, and no database. Your workout data is read from Apple Health on your iPhone, turned into an activity file on your iPhone, and sent from your iPhone straight to Strava under your own authorisation. It does not pass through us.

One small server exists so that a secret needed to sign in to Strava doesn't have to ship inside the app. It handles sign-in only. It never receives a workout, a route, a heart rate, or a name — it has no ability to, and no database to put one in.

The detail below is complete rather than reassuring. Where something does leave your phone, it says so.

Who we are

Trisect is an independent iOS app that splits an Apple Watch multisport workout into separate Strava activities. This policy covers the Trisect iOS app and the website at trisect.app.

Questions, requests, or corrections: hello@trisect.app.

What Trisect reads from Apple Health

With your permission, and read-only. Trisect can never write to, change, or delete anything in Health. It only ever queries swim-bike-run multisport workouts — other workouts, and every other category in Health, are invisible to it.

These are read on demand while you are using the app. Trisect has no background access and does not run when you aren't using it.

Health data is never used for anything else

Apple requires us to state this, and we mean it literally: health and fitness data read from Apple Health is used solely to build the activity files you choose to upload. It is never used for advertising or marketing, never shared with data brokers, never sold, and never disclosed to anyone other than Strava at your explicit instruction.

Where your data goes

Everything that leaves your iPhone, and why.

RecipientWhat they receiveWhy
Strava One activity file per leg: GPS route, altitude, per-second heart rate, distance, cadence, power where recorded, timestamps, plus the activity name and optional description you set This is the whole point of the app. Sent directly from your iPhone, authorised by your own Strava account
Trisect sign-in server
api.trisect.app
A one-time Strava sign-in code, or a Strava refresh token, plus an App Attest assertion from your device Exchanges them with Strava for an access token. Holds a secret that cannot safely ship inside an app
Apple — geocoding A single GPS coordinate: the first point of your route To turn it into a place name so the activity can be called "Salem Triathlon" instead of a date. Happens once per race, and the result is cached
Apple — Maps The map area your route falls within To draw the map you see before uploading. Standard Apple Maps behaviour; your route is drawn on your device, not sent to Apple
Apple — App Attest A cryptographic key generated on your device, specific to this app Proves requests to the sign-in server come from a genuine copy of Trisect, so the server can't be abused. Not an identifier for you, and it resets if you reinstall
Apple — App Store Your purchase, if you buy the unlock Apple is the merchant. Trisect never sees your payment details, name, or Apple Account. It only asks your device a yes/no question: has this been purchased?

That is the complete list. There is no other network destination in the app.

The sign-in server, in detail

The one piece of infrastructure we run. Its entire job is to swap a Strava sign-in code for an access token, because doing so requires a client secret and any secret shipped inside an app can be extracted from it.

The one thing it does keep, briefly

To stop the server being abused, it counts recent requests per device. It stores a one-way hash of your device's App Attest key identifier together with request timestamps, in memory only, for fifteen minutes, after which it is discarded. The hash cannot be reversed, is not linked to you or your Strava account, and is not written to disk.

Hosting metadata

Stated plainly because most policies gloss over it: our application logs contain no IP addresses. However, like any internet service, the hosting provider that operates the server may record standard connection metadata such as IP address and timestamp at the network level, for security and abuse prevention. We do not use that data and do not combine it with anything else.

What stays on your iPhone

Stored locally, never transmitted.

StoredWhat it is
Strava tokensYour access and refresh tokens, in the iOS Keychain. Not synced to iCloud
Sync historyWhich legs of which races have been uploaded, the Strava activity IDs, any error message, and the names you gave them. Identifiers and status only — no coordinates, no heart rates, no distances
One preferenceWhether to note transition times in activity descriptions
App Attest key IDA reference to the device key described above
First-launch dateThe date you first opened Trisect, so that people who arrive during the free beta keep full access if the app later charges. A date and nothing else — no identifier, and it is never transmitted

The activity files themselves are built in memory, uploaded, and discarded. They are never written to your device's storage and never retained after an upload finishes.

What Trisect never does

  • No user accounts, sign-ups, passwords, or email addresses
  • No analytics, telemetry, crash reporting, or usage tracking of any kind
  • No advertising, ad identifiers, or ad networks
  • No third-party SDKs
  • No cookies in the app
  • No location permission — routes come from the workout your Watch already saved, so Trisect cannot track where you are
  • No background activity — it does nothing when you aren't using it
  • No selling, renting, or sharing of data with anyone
  • No tracking across apps or websites, as Apple defines it

Your choices and controls

Apple Health

Revoke or adjust access at any time in Settings → Health → Data Access & Devices → Trisect. Trisect keeps working with whatever remains; a leg simply uploads without the data you withheld, and the app tells you which streams it found before you upload anything.

Strava

Tap Disconnect Strava at the bottom of the race list to remove the sign-in from your iPhone. You can also revoke Trisect entirely at strava.com/settings/apps, which we recommend if you are selling or giving away the device.

Activities already uploaded belong to your Strava account. Delete or edit them there; Trisect has no ability to touch them, having only ever asked for permission to add activities, not to read or change them.

Deleting the app

Deleting Trisect removes its local sync history and preferences. One caveat worth knowing: iOS may retain Keychain items after an app is deleted, so use Disconnect Strava before deleting if you want the stored tokens gone from the device.

Requests

Because we hold no data about you, there is nothing for us to export, correct, or delete on request — there is no record to look up. If you would like that confirmed in writing, email hello@trisect.app and we will respond.

Legal basis and your rights

If you are in the UK, EU, or a jurisdiction with comparable law: we do not act as a controller of personal data, because we neither collect nor retain any. Health data is processed entirely on your own device under your control, and transmitted to Strava on your explicit instruction — your consent, given by tapping upload, is the basis for that transfer.

Rights of access, rectification, erasure, restriction, portability, and objection apply to data a controller holds about you. We hold none. For the activities themselves, Strava is the controller: see Strava's privacy policy. For data held by Apple, see Apple's privacy policy.

If you are a California resident: we do not sell or share personal information, and never have. There is no financial incentive programme and no discrimination for exercising any right.

Children

Trisect is not directed at children under 13, and we do not knowingly collect information from anyone. A Strava account is required to use the app; Strava sets its own minimum age.

The website

trisect.app is a static page. It sets no cookies, runs no analytics, and has no tracking pixels or embedded social widgets.

Two honest caveats. Web fonts are currently loaded from Google Fonts, which means your browser makes a request to Google and Google may log your IP address; we intend to self-host these to remove that dependency. And the static hosting provider serving the page records standard web-server access logs, as every web host does.

If you email us, we hold your email address for as long as it takes to answer you.

Changes to this policy

If this policy changes materially — if any new data is transmitted, or anything begins to be retained — the date at the top will change and the app will tell you before the change takes effect. We will not quietly start collecting something.