Why we couldn't sell your workout data—even if we wanted to
A route can reveal where you live, when you leave, and how predictable your week is. Over time, a workout log becomes a record of your life.
Trailhead is built around one constraint: useful activity tracking should not require us to keep that record. Your activities, routes, and profile are protected with keys Trailhead doesn't possess. We cannot turn readable workout histories into an advertising product because our systems never receive them.
A shared activity is readable only on the trusted devices at either end.
The phone is the source of truth
The durable activity history lives in an encrypted vault on the owner's phone. The app can record a route, calculate pace, show elevation, and build weekly summaries without first uploading a readable workout to Trailhead.
If you record a run and never share it, Trailhead's relay never needs a copy.
Sharing starts with a decision. You choose an activity, choose a trusted recipient, review what will be sent, and approve the delivery. Only then does the phone create an encrypted package.
Delivery is temporary
The relay is closer to a courier than a social network. It checks a temporary access grant and moves a sealed package; it never receives the key needed to open it.
Acknowledged deliveries are removed when no grants remain. Anything uncollected expires within 7 days.
The phone remains the durable copy. A sender can cancel an unexpired share, and the relay exists only long enough to complete an approved handoff.
What “we can't read it” means
“We can't read it” is a precise claim, not a claim that the internet sees nothing.
| The relay can handle | The relay cannot read |
|---|---|
| Request timing | Your route |
| Ciphertext size and expiry | Your workout details |
| Opaque delivery identifiers | Your shared profile content |
Network infrastructure may also process an IP address while handling a request. We minimize this operational data, avoid sensitive logs, and keep retention short so metadata does not become a substitute tracking system.
Privacy is not a premium feature
Premium pays for the private social layer—not protection from data monetization.
Basic tracking is free: record activities, keep local history, review routes and progress, edit workouts, and move data with GPX. Premium adds a trusted Circle, review-first sharing, and encrypted relay delivery.
Both use the same local-first protection. We can charge for useful connection features, but we cannot sell a readable workout dataset our systems never possess. That boundary is stronger than a privacy policy—and it is the reason we built Trailhead this way.