Privacy Policy

Last updated: 15 November 2026

1. Who we are

Coldray Endurance is an online running and endurance coaching business run by Josh Coldray in Sydney, Australia. In this policy, "we", "us" and "our" mean Coldray Endurance. "You" means anyone who uses our website, our client portal or the Coldray training app.

This policy explains what personal information we collect, why, who we share it with, and the choices and rights you have.

Contact for privacy questions or requests:

• Email: josh@coldrayendurance.com
• Based in Sydney, NSW, Australia

We aim to reply within 30 days, or sooner where the law requires it.

2. What information we collect

We only collect what we need to coach you well and run the business.

Some of this is health information (for example injuries, heart rate and training load). We treat it as sensitive and only collect it with your consent (see section 4).

3. Garmin and other connected devices

Connecting your Garmin (or other watch) account is optional. You choose to connect it in the app, and you can disconnect it at any time.

How connecting works. You sign in on Garmin's own page and approve access there. We never see or store your Garmin password.

What we receive from Garmin after you connect:

• Completed activities and their files: date, sport, duration, distance, pace, speed, heart rate, power, cadence, elevation, GPS route, laps, and your post-workout effort rating where your watch records one
• Basic health summaries only if we ask for them and you approve, for example resting heart rate (we do not currently use these)

What we send to Garmin: your planned workouts (steps, targets and notes) and, for trail sessions, routes. These go to your Garmin Connect account and watch.

Before you connect, you agree that your planned workouts and routes will be sent to Garmin so they appear in Garmin Connect and on your watch. Garmin handles that data under the Privacy Policy for Garmin Connect and Compatible Garmin Devices. If you are not allowed to upload data to your Garmin Connect account, please don't connect it.

What we use Garmin data for: only to coach you. We match each activity to its planned session, show planned vs done, update your training zones and load, and let your coach review your training.

What we never do with Garmin data:

• Sell it, rent it or trade it
• Share it with anyone except the service providers in section 5 who store and run the app for us
• Use it for advertising
• Change your data in your Garmin account, other than the workouts and routes we send

Disconnecting. Tap Disconnect Garmin in the app's settings, or remove Coldray in your Garmin Connect account. We stop receiving data straight away. You can also ask us to delete the Garmin data we already hold (see section 6).

The same rules apply to COROS or any other device service we add later.

4. How we use your information

We use your information to:

• Coach you: write and adjust your training, review your sessions and reply to your comments
• Run the portal and app: logins, calendars, notifications, reminders and bookings
• Send emails you'd expect, such as welcome emails, booking confirmations, race reminders and check-ins
• Bill you and keep business and tax records
• Keep our systems secure and fix problems

We don't use your information for advertising, and we never sell it.

Health information needs your consent. When you join, we ask for your clear, separate consent (an unticked box) before collecting health and training data, including that it's stored in Australia and with the providers in section 5. You can withdraw consent at any time by emailing us or using the app's settings. If you do, we stop collecting it, but we may not be able to keep coaching you.

Legal basis (UK and South African clients). We process your information to deliver the coaching you signed up for (contract), with your explicit consent for health data, and for our legitimate interest in running the business securely.

AI transparency statement

We use an AI service (Anthropic's Claude) in one place only: to help your coach draft race plans and post-race reviews from the race forms you fill in. Your coach checks and edits every draft before you see it. We don't use AI with your coaching notes, health notes or messages.

• Your Garmin and other device data is not processed by AI unless you opt in. If we ever want to, we'll ask for your explicit consent first, explain exactly what it's for, and let you switch it off at any time in the app's settings.
• Your information is never used to train AI models. Anthropic doesn't train on data sent through its business service.
• AI never makes decisions about you on its own. Your coach does.

If we ever want to use AI in any other way, we'll update this policy and ask for your consent first.

5. Who we share it with

We never sell, rent or trade your personal information. We only share it with the service providers below, who store or process it for us under contract, and only as needed for the job they do.

Overseas storage. Some providers store data outside Australia, mainly in the USA. We choose providers with strong security and privacy commitments. For UK and South African clients, we rely on your consent and on the providers' standard contract terms for these transfers.

We may also share information if the law requires it, or to protect someone's safety.

6. Keeping, protecting and deleting your data

Security. Data is encrypted when it travels and when it's stored. Only Josh can see client records, and logins time out. Passwords are stored scrambled. We use providers with recognised security standards and keep software up to date.

How long we keep it.

• While you're a client: everything we need to coach you
• After you leave: training and health data for up to 1 year, so we can pick up if you return, unless you ask us to delete it sooner
• Billing records: 5 years, as Australian tax law requires
• Garmin data: deleted within 30 days of a deletion request, or when you close your app account

Deleting or exporting your data. You can download a copy of your data or ask us to delete it, in the app's settings or by emailing josh@coldrayendurance.com. We'll do it within 30 days and confirm when it's done. We may keep billing records the law requires.

If something goes wrong. If a data breach could seriously affect you, we'll tell you and the relevant regulator as quickly as we can, and within the time the law requires (72 hours for the UK regulator). Breaches involving Garmin data are also reported to Garmin.

7. Your rights

Wherever you live, you can ask us to:

• See the personal information we hold about you
• Correct it
• Delete it
• Give you a copy in a common format (export)
• Stop or limit how we use it, or object to a use
• Withdraw any consent you've given, at any time

Email josh@coldrayendurance.com. We won't charge you, and we won't treat you differently for using these rights. We may need to confirm your identity first.

UK representative. If we're required to appoint one, their contact details will be added here.

8. Cookies, children and changes

Cookies. We use only the cookies needed to keep you logged in and the site working. Our visit statistics don't use advertising or tracking cookies.

Children. Our services are for adults. We don't knowingly collect information from anyone under 18 without a parent's or guardian's consent.

Changes. If we change this policy, we'll update the date at the top. If a change is significant, for example a new use of your health or Garmin data, we'll tell you first by email or in the app, and ask for your consent where needed.

Complaints. Please contact us first at josh@coldrayendurance.com, and we'll try to fix it within 30 days. If you're still not happy, contact the regulator in section 7.