Privacy
Last updated 20 October 2026. This describes the app as it is built today, not as it is planned.
The short version
- Your roster lives on your device. Oval has no readable copy of it. If you add an assistant coach and pair with them, it travels between your two devices scrambled with a key only your devices hold.
- If you sign in, Oval keeps a backup of your sessions, templates and seasons, so clearing your browser does not lose them. In it, each athlete is a random code: no athlete name.
- A workout link carries lap times and a track outline. It carries no athlete name.
- To email a workout, Oval passes the athlete's address to a mail company and then forgets it. That is the one time an address leaves your device.
- Oval never sells data, never shows adverts, and runs no advertising or tracking software.
Who this covers
Oval is a workout timer for running coaches. The coach is the user. Athletes never sign in and never have an Oval account.
Coaches enter details about their athletes, and those athletes are often under 18. Everything below is written with that in mind. If you are a coach at a school, read Schools and districts as well.
What is on your device
Your roster and your training history are stored on the device you use Oval on. Your roster is never uploaded in a form we can read. If you sign in, your training history is also backed up without names, as described under When you sign in. The roster moves only if you invite an assistant coach and pair your devices; that is described further down, and it is scrambled so that we cannot read it. On the device, this covers:
- Athlete names, email addresses, graduation year and gender
- Personal records and pace targets
- Every workout you have timed, including each athlete's splits
- Your saved workout templates and your team name
On the iPhone and Android apps, Oval also writes a second copy into the app's own storage, so a browser storage clear cannot wipe a season's work. That copy is eligible for the device backup you may already have switched on — iCloud on an iPhone, Google on an Android phone. The backup goes to your own Apple or Google account, never to Oval, and each company encrypts it with your device passcode, so neither they nor we can read it. Turn off backup for Oval in your phone's settings if you would rather it did not.
Deleting the app deletes this data from the phone. A backup copy can outlive the app. If you had backup switched on, the last backup stays in your Apple or Google account after you uninstall, and reinstalling Oval can bring your roster back. To remove that copy as well, delete Oval's backup in your account settings, or turn backup off for Oval before you uninstall.
That device backup is yours, not ours. We cannot return it, and we cannot delete it on your behalf.
When you send a workout to an athlete
After a session you can send each athlete a link to their own results, which they can upload to Strava. Two things happen.
The link
Oval stores that athlete's lap times, plus the outline of the track you timed on, under a random eight-character code on a Cloudflare server. The athlete's name is not included — the field is deliberately sent empty. Anyone holding the code can read the times, which is why the code is random and why the link is not listed anywhere. Oval deletes the stored workout after 180 days.
The server also counts how many times you emailed each link, to stop one link being used to send unlimited mail.
The email
Oval passes the athlete's email address, the link code and your team name to Brevo, the company that delivers the mail. Oval does not store the address. Brevo holds it in its delivery logs for a limited period, as any mail provider does.
If an address permanently fails, or a recipient reports the mail as spam, Oval records a one-way scrambled form of that address so it never mails it again. That record cannot be turned back into an email address without a secret key, and it is kept until you ask us to remove it.
If you have no signal, Oval falls back to opening your own mail app instead. In that case the message never touches Oval's servers at all.
When you sign in
A coach account is optional and the app works fully without one. If you create one, Oval uses Supabase to hold your email address and to sign you in, by a link or a code in an email. No password is ever typed into Oval or stored by it.
Signed in, Oval also syncs, tied to your account:
- Your own name, your team name, the level you coach at, and the school or club you name — the details you are asked for when you first sign in. They sign the emails Oval sends for you and label the invitations you send an assistant coach. Every one of them is optional except your name, and you can change them at any time on the Profile screen.
- Tracks you have saved, and any names you gave them
- Corrections you submit to a track's shape, which are shared with other coaches so the same track does not have to be mapped twice
- A backup of your sessions, templates, seasons and a few app settings, one copy for each device you use. Only you can read it.
The backup holds no athlete's name, email address, graduation year, gender or personal record. Each athlete in it is a random code. It does hold the times, distances and paces recorded against those codes, your workout notation, the names of your templates and seasons, and where each session was timed. If you type an athlete's name into a workout or template name, the backup keeps it as you typed it.
To get your work back on another device, or after clearing your browser, sign in and pick a copy. Athlete names come back from your own roster file, or you type them in. The backup cannot supply them.
An assistant coach on your staff can see your name and your team details, because that is the team they have joined. Nobody else can, and it stops the moment you remove them.
Signing in does not upload your roster. No athlete name, address or personal record is sent because you have an account. The only thing that moves roster data is pairing with an assistant coach, below, and you have to set that up yourself.
Coaching with someone else
A head coach can invite an assistant coach. The invitation is an email with a link; Oval holds the assistant's name and address to send it, and forgets the address once they accept. The record that the two of you coach together stays on Oval's server, so that a head coach can end it at any time and have that stick.
What paired devices send each other is not kept on Oval's server. When you pair two devices, the data is scrambled on the sending device and only unscrambled on the receiving one. The key is passed between the two devices — by a code you read out, or a square you scan — and never reaches us. What passes through our server is therefore a block of characters we cannot read, and it is deleted as soon as the other device has collected it.
We can still see that two coaches are linked, and how large and how frequent the messages between them are. We cannot see what is in them.
Nothing moves without both sides acting: after the first handover, each of you reviews the other's changes athlete by athlete and workout by workout before anything lands.
Removing an assistant coach stops any further sync — our server refuses it from that moment, whether or not their phone is switched on. It cannot reach back and erase what they already received, and we will not pretend otherwise. Their app offers to delete what came from you; that is their choice to make.
Finding a track
When you search for the track you are standing on, Oval asks your device for its location and sends those coordinates to public map services — OpenStreetMap and Overpass for the track's shape and name, and Carto and Esri for the map and satellite images you see. Those companies receive your approximate location as part of serving the request. Oval asks for your location only when you use this feature, and you can refuse.
This is your location as the coach. Athletes' locations are never involved.
Product analytics
On the web version, Oval may record which screens are used and how long they are open, using PostHog. Only named events with simple values are sent. Automatic capture, page recording and session replay are all switched off, so no athlete name, address or workout text can be picked up. Analytics are switched off entirely in the iPhone and Android apps.
Strava
Uploading to Strava happens on the athlete's own device, in the athlete's own Strava account, after they approve it. The coach never sees the athlete's Strava login, and Oval does not keep it. Oval passes the workout file through to Strava and keeps no copy.
Companies that handle data for Oval
| Company | What it handles |
|---|---|
| Cloudflare | Stores workout links: lap times and a track outline, under a random code. No names. |
| Brevo | Delivers workout emails. Receives the athlete's address. |
| Supabase | Coach sign-in, saved tracks, track corrections, and the coach's backup of sessions, templates and seasons. No athlete names. |
| Vercel | Serves the website and the app. |
| PostHog | Screen-usage statistics on the web version only. |
| OpenStreetMap, Overpass, Carto, Esri | Map data and imagery. Receive the coach's approximate location during a track search. |
| Strava | Receives a workout file, on the athlete's own instruction, into the athlete's own account. |
What Oval never does
- Sell or rent any data, to anyone, for any purpose
- Show adverts, or include advertising or cross-app tracking software
- Build profiles of athletes
- Upload a roster we can read, to any server
Schools and districts
Where a school is the party responsible for its students' records, Oval acts on the coach's instruction and holds no record that names a student. The design reason is above: the roster does not leave the device, the workout link carries no name, and the coach's backup files each athlete under a random code that only the coach's own roster can turn back into a name.
The one place a student's own detail reaches a third party is the email address, when a coach chooses to send a workout by email. A coach who cannot share addresses with a mail provider should send the link another way, using the share option instead of the email option.
Oval does not knowingly let anyone under 18 create an account, because athletes have no accounts at all.
How to remove data
- An athlete — delete them in the app. The record goes with them.
- Everything on the device — delete the app, or clear the site data in your browser. If you use the iPhone or Android app with backup switched on, also delete Oval's backup in your Apple or Google account settings. Without that step a reinstall can restore your roster.
- A workout link — it deletes itself after 180 days. Write to us with the code to have it removed sooner.
- A backup — write to us and we will delete it. Deleting your coach account deletes every backup with it.
- A coach account — write to us and we will delete it and everything tied to it.
Changes
If what Oval collects changes, this page changes with it and the date at the top moves. The date is the honest record of when this was last checked against the code.
Contact
Questions, or a request to delete something: ggg@ovaltimer.com.