|Your email||Your password1||Access tokens||Activity metadata|
..until you disconnect your account or they are no longer needed, whichever is sooner
Access tokens allow exercisync to perform actions on your behalf. By using access tokens, exercisync never needs to store your username or password. In order to obtain an access token, exercisync may need to ask for your credentials - which are erased immediately after being exchanged for an access token.
Activity Medatada are the basic details of any activity: start time, time zone, duration, distance, and type. exercisync needs to store this information to determine which activities should be synchronized to each of your accounts.
Activity data is the complete record of an activity: the GPS track, sensor data, and all metadata. To improve synchronization performance, exercisync temporarily stores (caches) this data from your Dropbox account.
1 I've done a good deal to keep your password safe, but there has to be a way for exercisync to use it to sync your account. Therefore, anyone with enough access and resources to the exercisync database and servers could access it, too.
2 The email address you used to pay is stored so that you can transfer or recover your payment.
All the juicy details
exercisync moves your activities between the services you connect - period. Other than the basic metadata mentioned above, your activity data is not stored on exercisync servers. No activity data or metdata is ever shared with third parties beyond the accounts you connect.
Limited data regarding your interaction with exercisync.com is recorded in order to monitor the performance of the website itself. Google Analytics is used to track website performance, while Sentry records internal server errors.
Exporting & erasing your personal data
Most of the data exercisync stores regarding your accounts and activities is automatically deleted once you disconnect your last service from exercisync.com. Only diagnostic logs regarding your account will remain for a limited period afterwards - but are not stored permanently. During this process, any activities that exercisync synchronized to the services you connected will remain untouched. If you wish to receive a copy of all the data exercisync has stored regarding your user account, or request the deletion of this data, please contact me and mention GDPR in the subject line.