Your data, in plain words

Sign-in is Google-only — TrailGoat never sees or stores a password. From Google we keep exactly four things: your name, email address, profile picture URL, and Google's stable account ID (so your account survives an email change). Your email is used to identify your account and for nothing else — no newsletters, no marketing.

Signing in sets one signed, HttpOnly session cookie (tg_session). It contains only your account number, cryptographically signed so it can't be forged.

• Courses you save in the Course Creator (the GPX route, name, aid stations, elevation profile).
• Fueling & pacing plans from the Run Planner.
• Training plans — your wizard answers (race, fitness, weekly schedule, terrain, free-text notes) and the generated plan, plus which workouts you've checked off.
• Fitness profile — if you upload watch or Strava export files, the files themselves are parsed in memory and never stored. We keep only the aggregate result: weekly mileage and vert, run frequency, longest run, and typical run days.

All of it is owner-scoped: only you (signed in) can see or change your stuff. One exception to know about: a training plan's calendar feed is a secret-token URL so your phone's calendar app can subscribe without signing in — anyone you give that URL to can read that plan's workouts. Deleting the plan kills the feed.

Preferences live in your browser's local storage, not on our server: units (miles/km), temperature scale, and theme.

Your location: the "Add local weather" feature asks for your location only when you tap it — never automatically. The coordinates are rounded to roughly 100 m, saved only in your browser, and sent directly from your browser to the Open-Meteo forecast service when a forecast is fetched. Our server never receives them.

Three first-party cookies, zero trackers:

• tg_session — keeps you signed in (only exists after you sign in).
• tg_vid + tg_vday — an anonymous random ID used to count unique visitors once per day. It isn't linked to your account, doesn't follow you across other sites, and exists because we count our own visitors instead of installing Google Analytics.

TrailGoat runs on a small set of infrastructure providers. What each one sees:

• Google — sign-in only (the standard "Sign in with Google" flow).
• Anthropic (Claude) — when you build a training plan, your wizard answers (including fitness aggregates, never your raw files) are sent to the Claude API to write the plan. Under Anthropic's API terms this data is not used to train their models.
• Open-Meteo — weather forecasts, called directly from your browser with your device-stored coordinates.
• Render — hosts the site and server (United States).
• Turso — the database where your account and creations live.

That's the whole list. No ad networks, no data brokers, no social-media pixels.

• Sell, rent, or share your data for advertising or marketing.
• Run third-party analytics, ad trackers, or fingerprinting.
• Email you anything except replies to emails you send us.
• Pull data from your Strava or watch accounts behind your back — the only activity data we ever have is what you explicitly upload.
• Keep your data after you delete it. Deletes are real deletes, not "deactivations."

This erases your account and everything in it, immediately and permanently: your profile, saved courses, fueling plans, training plans (and their calendar feeds), and fitness profile. There's no grace period and no way for us to undo it.

One carve-out, in the open: if a course you saved has been linked into the public race catalog that other runners plan from, the course itself stays in the catalog but is fully disconnected from you — nothing about it points to your account, because your account no longer exists.