Hi,
I'm building a running app that creates personalised training plans.
Before I submit a request for higher access, I'd like to make sure my
architecture is compliant, because the FAQ states that applications
which "expose athlete data to third party AI tools" will not be approved.
What my app does with Strava data:
- The athlete connects their own Strava account and the app imports
their own activities (date, distance, duration, pace, heart rate,
elevation, cadence).
- Those activities are passed server-side to a large language model
(Anthropic API) as input for generating that athlete's weekly
training plan.
- The generated plan is shown only to that athlete.
What my app does NOT do:
- No chat or conversational interface over Strava data. The athlete
cannot query their activities through an AI assistant.
- No sharing with other users, no public display, no third-party
access, no export.
- The API provider does not train models on the data (Anthropic's
commercial API terms).
- No intermediary platform holds my credentials; my own server makes
all API requests.
- Data is deleted when the athlete deletes their account, and the
Strava connection can be revoked in the app at any time.
My questions:
1. Does using an LLM API as an internal, server-side processing step
count as "exposing athlete data to third party AI tools" under your
policy, or is that clause aimed at applications that give athletes
conversational access to their data?
2. If the current approach is not acceptable: would it be compliant to
send only derived metrics (e.g. weekly volume, longest run, average
pace trend) instead of individual activities?
I'd rather get this right before submitting than have an application
denied.
Thanks for any clarification.
