Your training data stays on your phone.

Part 1: the Cadexa app

What Cadexa records

• Profile: name (optional), weight, FTP, estimated maximum heart rate, observed peak heart rate, heart-rate response setting (for example medication that lowers heart rate), heart-rate alert, training goal.
• Sessions: time, power, cadence, speed, heart rate, targets, your effort rating, the pre-ride check-in answer in Heart Mode, and, for runs and walks with GPS enabled, location, altitude and distance.
• Devices: the Bluetooth identifiers of the trainer and heart-rate sensor you paired, so they reconnect automatically.
• Photos: a picture you choose for a session or a route is copied into the app’s own storage. The app never reads your photo library beyond the picker you open.

All of this is stored in the app’s private storage on your phone. Deleting the app deletes it. Individual sessions can be deleted from the result screen.

Health data

Heart rate, weight, medication-related settings and check-in answers are health-related. Cadexa uses them only to coach you and to produce the report you can choose to share. They are never uploaded by Cadexa, never analysed on a server, and never sold or shared with third parties. The heart report and the share card leave your phone only when you tap Share and choose where to send them.

Location

With “GPS on runs and walks” enabled (Profile → Devices), Cadexa uses your location during a run or walk to record distance, pace, climbing and the track. It is not used indoors and not used when the app is idle. Location data is part of the session on your phone and is included in a session you choose to upload to Strava. Turn the setting off and Cadexa never asks for location.

Route place names

When you import a route, Cadexa can look up the names of its climbs so the coach can say “a minute to the top of Ulriken” instead of “a minute to the top”. That sends the coordinates of up to eight points on that route to the map provider built into your phone, once, while importing. Nothing is sent during a ride, no names or coordinates reach us, and the result is stored in the route on your phone. Switch it off under Profile → Privacy and Cadexa uses only the names the route file already contains.

Strava

If you connect Strava, you authorise Cadexa on Strava’s site; Cadexa never sees your Strava password. The access token is stored in the phone’s secure storage. Sessions are uploaded only when you tap “Sync to Strava” or turn on auto-upload. To let the app work without embedding a secret, the sign-in exchange passes through a small service run by us; it forwards the exchange to Strava and stores nothing, not your tokens and not your activities. Disconnecting Strava in Profile revokes the authorisation and deletes the token from the phone.

Usage statistics

To see which parts of Cadexa are used and which are not, the app sends a small set of anonymous counts to our own server: which workout or route type was started and whether it was finished, its length in minutes, the sport, whether heart rate, GPS or the simulator were in use, which features were tapped (share card, photo, route import, screen lock), settings such as Heart Mode on or off, the app version, the phone platform and the country from your phone’s region setting. Each install is identified by a random number that is created on first launch, is not tied to you or your device, and resets if you reinstall.

The counts never include heart-rate values, power, locations, tracks, photos, names, Strava identities or the contents of a session. They are stored on our server in Finland, kept for at most 24 months, used only to decide what to improve, and never shared or sold. You can turn reporting off at any time under Profile → Privacy; the app then sends nothing and deletes anything queued.

What the app does not do

• No user accounts, no sign-up, no email collection.
• No third-party analytics, crash-reporting or advertising SDKs.
• No selling, renting or sharing of data.
• No AI service receives your data; coaching runs from fixed rules on the phone.

Permissions the app asks for

• Bluetooth: to connect to the trainer and heart-rate sensor.
• Location (while using the app): only for runs and walks, only when you have enabled it.
• Photos: the system photo picker, only when you tap “Add a photo”.
• Background audio and Bluetooth: so the coach keeps talking and the trainer stays connected while the screen is locked.

Part 2: this website (cadexa.org)

What we collect

• Page views. The path, the referring site, a device class (mobile or desktop) and a visitor hash. The hash is computed from your IP address and browser, salted with a value that changes every day, so it cannot follow you across days or sites. No cookie is set.
• Retailer clicks. When you use a retailer link we record which product and retailer, the page you came from and the same daily visitor hash, so we can see which content is useful and report to affiliate programmes. The retailer or network you land on has its own privacy policy and may set cookies.
• Feature use. Counts of comparison, recommender and compatibility checks, without personal data.
• Server logs. Standard access logs (IP address, page, time) kept for up to 14 days for security and troubleshooting.

Cookies and third parties

The website sets no cookies for visitors. Fonts are self-hosted and no social widgets are embedded. If we add an analytics service that uses cookies, it will ask for consent first.

Affiliate links

Links to retailers may be affiliate links that pay us a commission. They are labelled, they pass through our own redirect, and they never influence what we recommend.

Children

Cadexa is not directed at children under 13 and does not knowingly collect data from them.

Your rights, changes and contact

Because the app holds your data on your phone and the website holds no account data, there is normally nothing for us to export or delete. If this policy changes, the date at the top changes and the new version is published here. Questions: ojbirke@gmail.com.

Kort på norsk

Cadexa lagrer treningen din på telefonen. Ingen konto, ingen annonser. Anonyme brukstall (hvilke økter som startes og fullføres, hvilke funksjoner som brukes) sendes til vår egen server og kan slås av under Profil → Privacy. Puls, vekt og medisinrelaterte innstillinger brukes bare til å trene deg og deles bare når du selv trykker Del. Posisjon brukes kun på løpe- og gåturer når du har slått det på. Når du importerer en rute kan appen slå opp navn på toppene hos telefonens kartleverandør; det kan slås av. Strava-innlogging går via en liten tjeneste vi driver som ikke lagrer noe. Sletter du appen, er dataene borte. Nettstedet cadexa.org setter ingen informasjonskapsler; sidevisninger telles anonymt, og forhandlerlenker kan gi oss provisjon.