Privacy Policy
Your workouts stay on your phone
Corsai analyzes training on your device. Sessions, GPS traces, heart rate, notes and every analysis Corsai computes from them are stored on the phone and are not uploaded to our servers.
Photos and videos, if you give permission. Corsai looks through the photos and videos from the day of each workout so it can offer them for your story. It shows them to you as small previews that it does not keep. A photo or video you choose is copied into Corsai's own storage on your phone. They stay on your phone: Corsai never uploads them, and a story you share goes only where you send it.
Saving to Photos. When you save a sticker or a video story, Corsai adds it to your photo library. That is the only thing it writes there.
We do not sell your data, and we do not use it for advertising.
What does leave your phone
In the App Store version, nothing unless you connect Strava. It has no diagnostics and no analytics of any kind: no usage events, no crash reports. Our server exists for the Strava connection, so a phone that never connects Strava never contacts it. The rest of this section is what happens when you do, and what test (TestFlight) builds also send.
An id for this phone. There are no accounts and nothing to sign in to, and Corsai never asks for your name or email. The phone makes up a random id and keeps it in the iOS Keychain. The App Store version registers it with our server when you connect Strava; a test build registers it on first launch. Our server keeps that id, the platform and app version the phone reports, and when it registered and when it was last seen. For a test build it also keeps an identifier joining the id to the diagnostics below, and notes that the phone registered and whether connecting Strava worked, because those happen on the server itself; for the App Store version it records no such events. No workouts, ever. All of it is kept until you forget this phone.
The server's error log. Our server also writes its own errors to a log file: the fault and the time, never a workout, and nothing that identifies you or this phone (no id, no username, no Strava account). It keeps about 30 MB, overwriting the oldest first. Like any web server, it also notes each request it receives: the internet address it came from, the time, the address asked for and the app version. That record is joined to nothing else, and it too is overwritten, oldest first, after about 30 MB.
Your Strava connection, if you make one. The keys Strava issues are kept on your phone, in the Keychain. When you connect, and when the keys are renewed, they pass through our server on their way to your phone, because that step needs Corsai's own Strava credentials, and our server does not keep them. It keeps a one-way check that tells your connection apart from somebody else's, which cannot be turned back into the keys or used to reach your Strava account, and it counts connected phones, because Strava limits how many athletes an app may connect. If Strava refuses to renew a connection, the server notes when, for an hour, so that a fault on Strava's side does not disconnect everyone at once. Importing from Strava goes straight from Strava to your phone.
Disconnecting Strava (Profile → Disconnect Strava) revokes Corsai's access and removes the workouts that came only through the Strava connection. Photos and notes you added to a removed one stay, on a dated entry without the Strava details. Workouts that are also in Apple Health or a FIT file stay, without the Strava details. The one-way check on our server is removed too.
Workouts you imported from your own Strava export file are not limited to seven days, and disconnecting Strava does not remove them. They are removed when you delete them (swipe a workout right, then Delete) or when you delete the Corsai app. Forget this device leaves them, like every other workout on this phone.
Diagnostics, in test builds only. A short list of things that went right or wrong: that an import finished, that a screen opened, which kinds of story you chose when you set up (ride or golf, say), which app version and iOS version you are running. The complete list is shown inside the app under Profile → Diagnostics, generated from the code that does the filtering so it cannot fall out of date, and you can switch it either way there. It is on in test builds; the App Store version has no diagnostics at all. Diagnostics go to Corsai's own server and nowhere else; no analytics company receives them.
Your workouts, heart rate, sleep, injuries, priorities and anything you wrote in your own words are not on that list and have no way of getting onto it.
Golf course maps. In a build with golf course maps, to draw each hole on a golf story Corsai sends our server a rough area around the round: a grid square about 2 km across, never your exact location and never your photos. If you make a golf round from photos, the date and place are read from them on your phone, and only the grid square leaves it. Our server asks OpenStreetMap's Overpass service for the golf courses in that square and keeps the course map for the square, not who asked for it. It also notes the time of each request, without the place, to limit how often one phone can ask. The map is kept on your phone too. That request names a place, never a person. Course data is © OpenStreetMap contributors, available under the Open Database License (ODbL).
What you send to Strava, when you ask. Connecting Strava is your choice and each upload is confirmed by you before it happens.
A story you save, where you post it. Saving is your choice. A story is saved to your photo library, and where you post it from there is up to you. Corsai itself sends it nowhere.
Apple Health
Corsai reads your workouts from Apple Health, with their heart rate and route, with your permission, to analyze training on your device. It also notes which app recorded each workout (Garmin Connect, for example), and that stays on your phone with the workout. Corsai does not read sleep or heart rate variability, and it never writes to Apple Health. Health data is never used for advertising, never sold, and never sent to a third party for their own purposes. You can revoke access at any time in the Health app, and Corsai keeps working with whatever you import by other means.
Bluetooth
If you record a workout on a Concept2 monitor, a smart trainer or a heart-rate strap, Corsai connects to it over Bluetooth, and for an ERG workout it sets the trainer's power. What it records stays on your phone, like any other workout.
Forgetting this phone
Profile → Forget this device removes this phone's id from our server, with everything kept alongside it, including any diagnostic recorded for it. On the phone it also forgets the Strava connection, any keys you have saved, the app lock and your settings, so the next launch starts as a new install would. Because your training data lives on your phone rather than on our server, forgetting the phone does not delete it. The app says so before you confirm, and your history stays on the device until you delete the app or remove it yourself.
Deleting the app does not forget the phone. iOS keeps the id in the Keychain after the app is gone, so a reinstall comes back as the same phone, with the Strava connection cleared. To remove the id from our server, use Forget this device before you delete the app, or reinstall and use it then. You can also ask at privacy@corsai.app.
AI
The App Store version of Corsai has no AI coach, no chat, and no generated training advice. Nothing you enter or import is sent to a model provider.
The golf shot tracer on this website
The golf shot tracer at corsai.app/tracer runs in your browser. The video you open there is read, traced and exported by the page itself and is never uploaded, and that page loads no analytics.
Children
Corsai is not directed at children under 13 and we do not knowingly collect information from them.
Changes
If this policy changes in a way that affects what leaves your phone, the change will appear here and in the app before it takes effect.
Contact
Questions about this policy can be sent to privacy@corsai.app.