Privacy
Plain words on what we collect, why, who can see it, and how to get it deleted. If anything here is unclear, email jackson@hpp.team and you will get an answer from the coach, not a form.
Harding Performance Project (HPP) is a performance coaching business run by Jackson Harding in Sydney, Australia. This policy covers hpp.team, the athlete portal at app.hpp.team (check-ins included), and the HPP Team program. We handle personal information in line with the Australian Privacy Act 1988 and the Australian Privacy Principles.
Your account. Name, email address, and the details you give at onboarding: your goal, race dates, training history, how much time you have, and your maximum heart rate if you know it.
Your training and recovery. The sessions you log, the numbers you enter (times, distances, heart rate, watts, weights), your daily and weekly check-ins, your readiness and wellbeing answers, and the HPP score they produce.
Devices and services you choose to connect. If you connect a wearable, TrainingPeaks or Strava, we receive only what you authorise from that provider. Each is opt-in, can be disconnected at any time, and is described below.
Payments. Team memberships are billed through Stripe. Stripe holds your card details; we never see or store them. We keep your billing status and a Stripe customer reference so we know your membership is active.
Technical. The portal keeps your sign-in session in a cookie in your browser so you stay signed in. We do not run advertising trackers or analytics cookies.
To coach you. Your data is used to write and adjust your program, read your readiness, show you your own trends, and send you the emails that are part of the service (weekly reminders, check-in prompts, program updates). We do not sell your data, we do not share it with advertisers, and we do not use it to train artificial intelligence models.
You see everything you have entered and everything a connected service has sent us about you.
Your coach sees the training log, check-ins and scores you submit, because that is what coaching is.
The Team sees what you choose to submit to the Team board and feed: a completed session, a time, a score. Nothing appears there that you did not log and submit yourself.
Your employer, if you are on a corporate program, only ever receives aggregate and anonymised reporting: team averages, participation rates and trend direction. Never an individual's scores, HRV, sleep or anything that could be attributed to one person. Where a group is smaller than four people the breakdown is suppressed entirely.
If you connect Strava, HPP asks Strava for permission to read your activities. When you record an activity, Strava tells us, and we fetch that activity and its laps and keep them against your account so that when you open a session on that day the portal can offer it to you.
Your Strava data is shown only to you. It appears inside your own portal and nowhere else. It is never shown to your coach, to the Team, to your employer or to any other user. What your coach and the Team see is the HPP log you review and submit yourself.
You are in control. Disconnect Strava from your HPP profile and we delete the access tokens and the Strava activities we hold for you. Revoke HPP inside Strava's own settings and Strava tells us, and we delete them the same way. Each activity also carries a link back to it on Strava.
Our use of Strava data is governed by the Strava API Agreement. HPP is not affiliated with or endorsed by Strava.
If you connect TrainingPeaks, HPP asks TrainingPeaks for permission to read your profile and workouts and to add planned workouts to your calendar.
What we send. The sessions your coach plans for you: each one's name, description, steps and heart rate zones, and a link back to it in HPP, so it reaches your calendar and your watch. A Premium account gets a whole block ahead of time; a free account gets each session on its own day. When your coach changes or removes a session, we change or remove it in TrainingPeaks too. We never change or delete a workout you made yourself, one you have done, or one on a past day.
What we read. Your TrainingPeaks account (whether it is Premium, your time zone and the maximum heart rate in your zones). For the sessions we sent: whether you did them, and the time, distance, heart rate, TSS and effort your watch recorded, and on a Premium account each lap. Workouts you add or record in TrainingPeaks yourself come in too, as your own sessions on your HPP calendar.
Who sees it. You and your coach, as part of your training log. What the Team sees is still only what you submit there yourself.
You are in control. Disconnect TrainingPeaks from your HPP profile and we stop reading it, delete our access to your account and remove the upcoming HPP workouts from your TrainingPeaks calendar; what you already did stays in your HPP history. You can also remove HPP inside TrainingPeaks' own settings. HPP is not affiliated with or endorsed by TrainingPeaks.
If you connect a wearable (WHOOP, Garmin or Oura), we receive the recovery metrics you authorise, typically heart rate variability, resting heart rate and sleep. These feed your own baseline and trend charts. A device can never produce your HPP score; that comes only from your own morning check-in. Disconnecting stops the feed, and you can ask us to delete what was received.
Your data is stored in a Supabase database, encrypted in transit and at rest, with access controls so that each athlete can read only their own records. The app runs on Vercel, emails are sent through Resend and SendGrid, and payments run through Stripe. Each of those providers acts on our instructions and under their own privacy commitments. Some of them store data outside Australia.
We keep your data while you are an athlete with HPP so your history and trends stay intact, because a block-to-block comparison is the point of the system. When you leave, we keep your account for twelve months in case you come back, then delete it.
You can ask for a copy of your data, a correction, or full deletion at any time by emailing jackson@hpp.team. Deletion requests are actioned within 14 days, and connected services are disconnected as part of it.
HPP programs are written for adults. If you are under 18, a parent or guardian needs to set up and hold the account.
If this policy changes in a way that matters to you, we will tell you by email before it takes effect. Questions, requests and complaints go to jackson@hpp.team. If you are not satisfied with how a complaint is handled you can contact the Office of the Australian Information Commissioner at oaic.gov.au.