Platform

Security and privacy

CorrConnect gives each app the least it needs and keeps the rest out of reach, including from its own logs. Here is what that means in practice, and what we ask of you.

What CorrConnect stores, and how

Data	How it's kept
Activity summaries	Encrypted at rest (Fernet: AES-128-CBC with an HMAC-SHA256 check)
Webhook secrets and queued event bodies	Encrypted at rest
Device-connection credentials	Encrypted at rest
Access tokens, refresh tokens, codes, sessions, CSRF tokens	Only an HMAC-SHA256 hash keyed with a server secret. The token itself is never stored.
Passwords	Argon2id hashes
GPS points and sensor streams from files	Not stored. Files are checked, summarized, then discarded.
Original workout files	Not stored. Only a keyed fingerprint, to spot an exact re-upload.

Because tokens are stored as hashes, nobody at CorrConnect can read a token back to you or to anyone else. If you lose one, get a new one.

What your app can see

Only what the athlete approved, through scopes they can withdraw at any time.
A pairwise sub instead of an account ID or an email address, different for every app.
Webhook events with IDs only. Activity data is fetched with the athlete's token, so a misdirected or logged webhook leaks no workout data.

Transport

The hosted service is HTTPS only, with HSTS. API responses carry Cache-Control: no-store. The console session cookie is __Host- prefixed, Secure, HttpOnly and SameSite=Lax, and changes made with it also need the exact Origin and a CSRF token. The separate API host, if you use it, never sees session cookies.

Outbound, CorrConnect only delivers webhooks to public HTTPS addresses on port 443. It checks every address a host name resolves to and connects to the address it checked, so a DNS change can't point a delivery at a private network.

Retention

What	Kept for
An athlete's activities and grants	Until the athlete deletes their account, then removed at once
Expired access tokens	7 days after expiry (the newest one per active grant is kept so the grant can still be revoked)
Webhook delivery records	30 days after the delivery finishes
Sign-in and token audit records with no account attached	30 days

Audit records store the event, the outcome, the account and app involved, and a request ID. They store no IP address. Backups are encrypted; their retention period isn't set yet and will be stated in the CorrConnect privacy policy.

Athlete controls

Athletes can, from their CorrConnect account:

see every app with access, its scopes and when that last changed,
revoke any app, which ends its tokens immediately,
export everything CorrConnect holds about them as JSON,
delete their account, which removes their data and ends every grant.

A password reset also signs them out everywhere and ends every app's grant.

What we ask of you

Keep tokens and webhook secrets encrypted at rest and out of logs, URLs, analytics and error trackers.
Ask only for the scopes you use.
Verify every webhook signature against the raw body before acting on it.
When you get grant.revoked, delete that athlete's tokens, and consider deleting what you copied.
Tell the athlete in your own privacy policy what you do with their CorrConnect data.

Reporting a vulnerability

Email [email protected] with "Security" in the subject. Include what you found and how to reproduce it, and don't access other people's data to prove it. We'll reply to say we have it.