MCP Connector Privacy Policy

Last updated: September 6, 2026 · Stride (“we”, “us”) · Melbourne, Victoria, Australia · privacy@runstri.de

1. What the connector does

The Stride MCP connector lets your AI assistant (ChatGPT or Claude) retrieve the Strava and WHOOP data you authorise when you ask about your training. It cannot create, change, or delete data in either provider account. We retain the account and OAuth records needed to authenticate requests.

2. Data we store

We store only what is necessary to operate the connector:

• Your Stride account: account identifiers, name, and email address managed through Clerk. We use these to identify you and secure your connector connection.
• Strava OAuth tokens: the access and refresh tokens that allow the connector to call the Strava API on your behalf. Stored encrypted at rest (AES-256-GCM).
• WHOOP OAuth tokens (if connected): same as above, stored encrypted, used only to fetch data when your AI assistant requests it.
• MCP authorisation records: the OAuth consent, client registration, and access records needed to authenticate your AI assistant's connection to Stride.

The connector retrieves only the data required to fulfil a request. We do not sell personal information or use your connected athletic data for advertising.

3. Data we do not collect

• Your conversation content or AI prompts
• Your Strava or WHOOP activity records (fetched live, not stored)
• Continuous location or GPS tracking. Some Strava activity responses can include route or location-derived data, such as an encoded route polyline, when Strava supplies it for the activity you ask about.
• Advertising identifiers or targeted-advertising profiles

4. How your data flows

When your AI assistant calls the connector:

• It presents your MCP bearer token to authenticate the request.
• The connector validates the token, then calls the Strava or WHOOP API using your stored OAuth tokens to fetch the requested data.
• The data is returned directly to your AI assistant and is not written to any database.
• Your AI provider (Anthropic or OpenAI) then processes it according to their own privacy policy and your conversation context.

5. Third parties

• Strava: source of your activity data. You authorise the connector scope during setup and can revoke access in Strava at any time.
• WHOOP: source of your recovery, sleep, and physiological data (if connected). Revoke access in WHOOP at any time.
• Anthropic / OpenAI: your AI assistant processes the data returned by the connector. See their respective privacy policies for how they handle it.
• Railway: the connector runs on Railway's infrastructure (hosted in the United States). Request logs may be retained briefly for reliability purposes.
• Neon: hosted PostgreSQL that stores your account, OAuth tokens, and MCP token hash. Data is stored in the United States.

6. Retention and deletion

Your account and stored tokens are retained while your connector is active. You can disconnect Strava or WHOOP at any time from Stride Settings This immediately revokes the stored OAuth tokens and stops the connector from fetching new data. To delete your account entirely, email privacy@runstri.de and we will remove your data within 30 days.

7. Security

OAuth tokens are stored encrypted at rest using AES-256-GCM. MCP tokens are stored only as SHA-256 hashes. All traffic between your AI assistant, the connector, and Strava/WHOOP is served over TLS.

8. Your rights

You may access, correct, or request deletion of your data at any time. Disconnect integrations via Stride Settings or email privacy@runstri.de. You may also lodge a complaint with the Office of the Australian Information Commissioner.

9. Changes

We may update this policy when the connector's data practices change. Material changes will be reflected by updating the date above.

Questions? privacy@runstri.de · Full Stride Privacy Policy · Terms of Service