Privacy Policy

OUTLIER ("we") is a Brazilian training platform for hybrid and HYROX athletes, available at app.outlier.run. It connects athletes with their coaches: the coach prescribes the weekly plan and monitors execution; the athlete logs workouts and results. OUTLIER is the data controller under the Brazilian General Data Protection Law (LGPD, Law 13,709/2018). Privacy contact: suporte@outlier.run.

• Account: name, email and credentials (or Google/Apple sign-in).
• Sports profile and self-reported biometrics: weight, height, date of birth, training level and goals.
• Training data: logged workouts, times, loads, rate of perceived exertion (RPE), comments and race/benchmark results.
• Connected devices and apps (optional): if you connect Strava, Garmin or Apple Health/Apple Watch, we import completed activities (type, duration, distance, calories, heart rate) and, where available and authorized, recovery metrics (resting heart rate, sleep, heart rate variability — HRV).
• Usage data: in-app navigation and interaction events, plus anonymous session analytics via Microsoft Clarity, used to improve the product.

• To provide the service: show your plan, log workouts and compute your results.
• To give your coach visibility into your execution, training load and recovery — the core purpose of the platform.
• To generate feedback and analyses with the help of AI (e.g., post-workout feedback). Data sent to AI providers is limited to what is needed for the analysis and is not used by them to train models.
• To improve the product using aggregated usage metrics.

Health and training data is never used for advertising or marketing, never sold, and never shared with data brokers. Data obtained from Apple Health (HealthKit) is used solely to provide the service to you and your coach, as required by Apple's guidelines.

• Your coach: sees your training data, biometrics and, if you connect a device, your imported metrics — that is what the service exists for.
• Service providers (sub-processors): Supabase (database, authentication and hosting), Microsoft Clarity (usage analytics), AI providers (feedback generation), Resend (transactional email) and, where applicable, payment providers. All process data under contract, only on our instructions, with protection consistent with this policy.
• Authorities, when required by law.

Some providers host data outside Brazil (international transfer under LGPD arts. 33+, with contractual safeguards).

• Connecting is always optionaland requires your explicit consent, given on the provider's own authorization screen (Strava, Garmin) or through iOS permissions (Apple Health).
• We import only the categories you authorize. Imported workouts only become official records in your history after you confirm them in the app.
• You can disconnect at any time in the app settings — access tokens are revoked and imports stop immediately. You can also revoke access on the provider's side (Strava/Garmin Connect settings, or Settings > Health on iOS).
• After disconnecting, you may request deletion of already-imported data via the contact above; deleting your account removes everything (section 7).

• Performance of contract: account, training plan, logs and coach monitoring.
• Consent (including for sensitive health data): device connections and import of health/recovery metrics. Revocable at any time.
• Legitimate interest: usage metrics and platform security, always with minimized data.

We keep your data while your account is active. You can delete your account in the app or by emailing us — deletion removes your personal data, including device-imported data, except where retention is legally required. Backups are purged on regular rotation cycles.

Under the LGPD you may request, at any time: confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing, and withdrawal of consent. Write to suporte@outlier.run.

We use encryption in transit (TLS), row-level access control in the database (RLS) — each athlete can only access their own data and each coach only their athletes' — and integration tokens stored with infrastructure-restricted access, never exposed to the browser.

The platform is intended for adults (18+). Minors may only use it with the consent and supervision of their legal guardians.

We may update this policy to reflect product or legal changes. The date at the top indicates the current version; material changes will be announced in the app.