Request to grow beyond 10 athlete limit for api

Question

Hi all — hoping someone from the team or community can help.

I'm struggling to grow beyond the 10 athlete limit for my app:

App: GFN Coach (https://app.getfitwithnats.com)

Client ID: 277244

GFN Coach is a training-plan platform for runners. Athletes connect their own Strava account via OAuth so their activity data (distance, duration, pace, heart rate, elevation, training-load signals) feeds into our readiness and training-load calculations — this removes the need for manual workout entry.

Scopes: read, activity:read_all (read-only, no write access)

Endpoints used:

GET /athlete/activities

GET /activities/{id}

GET /activities/{id}/streams (time, distance, heart-rate streams)

Webhooks: Not currently used for Strava — we poll the activities endpoint when an athlete syncs. (We do use webhooks for a separate, unrelated Garmin integration via a third-party aggregator.)

Data retention: We retain compact activity-summary metrics (date, sport, distance, duration, pace, heart rate, elevation, training-load metrics) while the athlete's account is active. Detailed imported activity data is reduced to summary-only after 7 days. We don't request or store GPS/route streams.

Privacy: Athletes connect via OAuth and can disconnect anytime from their GFN Coach account, which deauthorizes the connection and deletes the stored Strava data. We don't sell or share data with third parties.

Hosting: Our backend (Supabase) is in Mumbai, ap-south-1.

We're at our 10-athlete cap and can't onboard more clients who want to connect Strava. I've submitted an email request but was told capacity requests aren't handled that way and to post here instead.

Would appreciate any guidance on next steps, or if someone from the team can help review. Happy to provide any further detail needed.

Thanks!

Vinod

Jan_Mantau · Accepted Answer

Please lookupfor the link to the form to submit for a review. Also note that using Strava webhooks for activities and deauthorizing is mandatory.

Hardyfuturz · Answer

Update: GFN Coach (Client ID 277244) has now completed the compliance improvements discussed before our athlete-capacity review.

The following changes are live in production:

• A Strava webhook subscription is active and verified.

• Athlete deauthorization events are handled automatically.

• Deauthorization triggers an atomic cleanup that removes the athlete’s stored Strava connection and tokens, cached activities, and Strava-derived check-in data.

• The cleanup function is restricted to the service role and cannot be executed by public, anonymous or authenticated application users.

• All cached Strava-derived data is deleted within seven days, with a daily retention purge active in production.

• Routine activity synchronization remains user-initiated; the app does not continuously poll Strava in the background.

• Verification challenge, duplicate delivery, unknown-athlete handling, retention cleanup, reconnection and fresh activity import have been tested.

We also completed a live revoke-and-reconnect cycle successfully. The athlete reconnected with a fresh connection and the recent activities were imported again. Because the reconnection happened before we inspected the intermediate database state, we are not claiming that we captured a database-zero snapshot between those two actions.

GFN Coach is currently at its 10/10 athlete capacity, and our formal request to increase the limit to 100 athletes is already under review. This post is an update to the existing request, not a new or duplicate application.

Thank you to everyone who pointed us toward the webhook and retention requirements.

Sign up

Login to the community