Last updated 30 July 2026 · Version 1.0
The short version. Trisect has no accounts, no analytics, and no database. Your workout data is read from Apple Health on your iPhone, turned into an activity file on your iPhone, and sent from your iPhone straight to Strava under your own authorisation. It does not pass through us.
One small server exists so that a secret needed to sign in to Strava doesn't have to ship inside the app. It handles sign-in only. It never receives a workout, a route, a heart rate, or a name — it has no ability to, and no database to put one in.
The detail below is complete rather than reassuring. Where something does leave your phone, it says so.
Trisect is an independent iOS app that splits an Apple Watch multisport workout into separate Strava activities. This policy covers the Trisect iOS app and the website at trisect.app.
Questions, requests, or corrections: hello@trisect.app.
With your permission, and read-only. Trisect can never write to, change, or delete anything in Health. It only ever queries swim-bike-run multisport workouts — other workouts, and every other category in Health, are invisible to it.
These are read on demand while you are using the app. Trisect has no background access and does not run when you aren't using it.
Apple requires us to state this, and we mean it literally: health and fitness data read from Apple Health is used solely to build the activity files you choose to upload. It is never used for advertising or marketing, never shared with data brokers, never sold, and never disclosed to anyone other than Strava at your explicit instruction.
Everything that leaves your iPhone, and why.
| Recipient | What they receive | Why |
|---|---|---|
| Strava | One activity file per leg: GPS route, altitude, per-second heart rate, distance, cadence, power where recorded, timestamps, plus the activity name and optional description you set | This is the whole point of the app. Sent directly from your iPhone, authorised by your own Strava account |
| Trisect sign-in server api.trisect.app |
A one-time Strava sign-in code, or a Strava refresh token, plus an App Attest assertion from your device | Exchanges them with Strava for an access token. Holds a secret that cannot safely ship inside an app |
| Apple — geocoding | A single GPS coordinate: the first point of your route | To turn it into a place name so the activity can be called "Salem Triathlon" instead of a date. Happens once per race, and the result is cached |
| Apple — Maps | The map area your route falls within | To draw the map you see before uploading. Standard Apple Maps behaviour; your route is drawn on your device, not sent to Apple |
| Apple — App Attest | A cryptographic key generated on your device, specific to this app | Proves requests to the sign-in server come from a genuine copy of Trisect, so the server can't be abused. Not an identifier for you, and it resets if you reinstall |
| Apple — App Store | Your purchase, if you buy the unlock | Apple is the merchant. Trisect never sees your payment details, name, or Apple Account. It only asks your device a yes/no question: has this been purchased? |
That is the complete list. There is no other network destination in the app.
The one piece of infrastructure we run. Its entire job is to swap a Strava sign-in code for an access token, because doing so requires a client secret and any secret shipped inside an app can be extracted from it.
To stop the server being abused, it counts recent requests per device. It stores a one-way hash of your device's App Attest key identifier together with request timestamps, in memory only, for fifteen minutes, after which it is discarded. The hash cannot be reversed, is not linked to you or your Strava account, and is not written to disk.
Stated plainly because most policies gloss over it: our application logs contain no IP addresses. However, like any internet service, the hosting provider that operates the server may record standard connection metadata such as IP address and timestamp at the network level, for security and abuse prevention. We do not use that data and do not combine it with anything else.
Stored locally, never transmitted.
| Stored | What it is |
|---|---|
| Strava tokens | Your access and refresh tokens, in the iOS Keychain. Not synced to iCloud |
| Sync history | Which legs of which races have been uploaded, the Strava activity IDs, any error message, and the names you gave them. Identifiers and status only — no coordinates, no heart rates, no distances |
| One preference | Whether to note transition times in activity descriptions |
| App Attest key ID | A reference to the device key described above |
| First-launch date | The date you first opened Trisect, so that people who arrive during the free beta keep full access if the app later charges. A date and nothing else — no identifier, and it is never transmitted |
The activity files themselves are built in memory, uploaded, and discarded. They are never written to your device's storage and never retained after an upload finishes.
Revoke or adjust access at any time in Settings → Health → Data Access & Devices → Trisect. Trisect keeps working with whatever remains; a leg simply uploads without the data you withheld, and the app tells you which streams it found before you upload anything.
Tap Disconnect Strava at the bottom of the race list to remove the sign-in from your iPhone. You can also revoke Trisect entirely at strava.com/settings/apps, which we recommend if you are selling or giving away the device.
Activities already uploaded belong to your Strava account. Delete or edit them there; Trisect has no ability to touch them, having only ever asked for permission to add activities, not to read or change them.
Deleting Trisect removes its local sync history and preferences. One caveat worth knowing: iOS may retain Keychain items after an app is deleted, so use Disconnect Strava before deleting if you want the stored tokens gone from the device.
Because we hold no data about you, there is nothing for us to export, correct, or delete on request — there is no record to look up. If you would like that confirmed in writing, email hello@trisect.app and we will respond.
If you are in the UK, EU, or a jurisdiction with comparable law: we do not act as a controller of personal data, because we neither collect nor retain any. Health data is processed entirely on your own device under your control, and transmitted to Strava on your explicit instruction — your consent, given by tapping upload, is the basis for that transfer.
Rights of access, rectification, erasure, restriction, portability, and objection apply to data a controller holds about you. We hold none. For the activities themselves, Strava is the controller: see Strava's privacy policy. For data held by Apple, see Apple's privacy policy.
If you are a California resident: we do not sell or share personal information, and never have. There is no financial incentive programme and no discrimination for exercising any right.
Trisect is not directed at children under 13, and we do not knowingly collect information from anyone. A Strava account is required to use the app; Strava sets its own minimum age.
trisect.app is a static page. It sets no cookies, runs no analytics, and has no tracking pixels or embedded social widgets.
Two honest caveats. Web fonts are currently loaded from Google Fonts, which means your browser makes a request to Google and Google may log your IP address; we intend to self-host these to remove that dependency. And the static hosting provider serving the page records standard web-server access logs, as every web host does.
If you email us, we hold your email address for as long as it takes to answer you.
If this policy changes materially — if any new data is transmitted, or anything begins to be retained — the date at the top will change and the app will tell you before the change takes effect. We will not quietly start collecting something.