Privacy
What Brick stores, what it doesn't, and who else sees it.
Last updated 10 September 2026
Brick is a training planner. It holds your season because that is the product — there is nowhere else for a plan to live. It does not hold anything it doesn't need for that, and this page is specific about which is which rather than reserving the right to collect anything.
What Brick stores
Your account
- Your email address.
- A hash of your password — never the password itself. If you sign in with Google, Brick stores the identifier Google gives it and no password at all.
- Your units (metric or imperial) and which day your week starts on.
- Your date of birth, only if you enter it. It is optional, it is used to estimate heart-rate zones, and it is used for nothing else.
Your training
Everything you'd expect a plan to be made of: your events, the frame you build, its slots and rules, your commitments and availability, the seasons, blocks, weeks and sessions those produce, the steps inside each session, your threshold zones and how they change, and the records of sessions you complete or skip.
Brick also keeps a history of every change to your plan — what changed, what it would take to undo it, and whether it came from the app, the API or an agent over MCP. That history is what makes undo work and what lets you see why a week looks the way it does.
Your sessions and tokens
- A hash of your login session token. The token itself exists only in your browser's cookie, so a copy of the database yields nothing you could sign in with.
- The browser and operating system your session was created from — the user-agent string. It is there so a list of active sessions is something you can actually read, rather than seven identical rows you cannot tell apart before revoking one.
- Hashes of any API tokens you create, along with the name you gave them.
What Brick does not store
Your IP address is never written to the database. It is held in memory for a few minutes to rate-limit sign-in attempts and form submissions, and it is passed to Cloudflare's bot check when you submit the waitlist form. It is not logged, not retained, and not associated with your account.
- No analytics. There is no Google Analytics, no product analytics, no session recording and no heatmaps, in the app or on this site.
- No advertising or tracking pixels, and no third-party trackers of any kind.
- No location data. Brick does not ask for it and cannot read it.
- No health data beyond what you type in yourself, and no data from any wearable unless and until you connect one and are told exactly what it will read.
Cookies
Brick sets one cookie: the session cookie that keeps you signed in. It is strictly necessary — remove it and the app cannot know who you are — so there is no consent banner, because there is nothing to consent to. There are no analytics or advertising cookies to refuse.
Who else sees your data
Brick uses a small number of services to run, and each sees only what it needs to:
| Service | What it does | What it sees |
|---|---|---|
| Railway | Runs the API and the database | Everything stored above — it is the database |
| Vercel | Serves the app and this site | Ordinary web request logs |
| Resend | Sends email you asked for: verification, password reset, email change | Your email address and that message |
| Cloudflare | Bot check on the waitlist form only | Your IP address and a one-time token, at that moment |
| Sign-in, only if you choose it | That you signed in to Brick |
Your training data is not sold, not shared for advertising, and not used to train anything. Nobody buys it because it is not for sale.
Agents and MCP
Brick has an MCP server, so you can let an AI agent read and change your plan. That only ever happens with an API token you create and can revoke, it reaches only your own data, and every change it makes is recorded in your plan history marked as having come from an agent — so you can always tell what you did from what something else did on your behalf.
What you can do
- Export everything. Account → Data gives you your whole account as JSON. Not a summary — the actual data.
- Delete everything. Account → Data deletes your account and all of it. It tells you how many seasons and sessions that is before you confirm, and it cannot be undone.
- Correct anything from inside the app; it is all editable.
- Revoke a session or an API token at any time from Account → Security.
If you are in the UK or EU, these cover your rights of access, portability, rectification and erasure, and you do not need to ask anyone to exercise them. Brick is the data controller for the data described here.
How long it is kept
Your training data stays until you delete it or your account. Login sessions expire on their own. Email verification and password-reset links expire shortly after they are sent. Deleting your account removes your data from the live database immediately; encrypted backups roll off on their own schedule within 30 days.
Changes to this page
If what Brick stores changes, this page changes with it, and the date at the top moves. If a change is significant — a new category of data, or a new service seeing it — you will be told by email rather than left to notice.
Contact
Questions about any of this: privacy@trybrick.io.