Slinga.
Documentation & Data Privacy

How Slinga Ingests, Tracks & Stores Your Workout Data

Slinga is a local-first running atlas and coaching workspace. Before you create an account or import a single GPS track, here is the complete specification of what Slinga collects, how your routes are processed, and how your account is isolated.

Create Account with Google Sign In to Existing Account

Zero Background Scraping

Slinga only ingests workouts you explicitly upload via GPX/TCX files or push from a paired iOS HealthKit sync bridge. It never tracks your browser location in the background.

200m Endpoint Redaction

By default, Slinga trims the first and last 200 meters of every GPS route on maps, share cards, exports, and AI/MCP queries so home and work addresses stay private.

Strict Per-User Isolation

Every account is keyed by your cryptographic OIDC subject (sub). Newly signed-up accounts start with a clean, isolated workspace and never see another runner's workouts or routes.

Step 1 · Data Ingestion

How Workout & GPS Data Is Ingested

Slinga supports two explicit ingestion paths. Every workout record is tagged with its exact source provenance (apple_health_synced, imported_gpx_file, or imported_tcx_file):

Ingestion Path How It Works Exact Fields Ingested
1. iOS Companion App + Apple Health
Ongoing automatic sync		 Depends on Apple Health on iOS. The companion iPhone app reads workouts and GPS routes from Apple Health (whether recorded on an Apple Watch, an iPhone app, or synced into Apple Health from another device) and pushes encrypted payloads to Slinga. Workout UUID, activity type, start/end timestamps, total distance, active energy (kcal), heart rate series, and raw GPS route coordinates.
2. Strava / GPX / TCX Export
Static archive import		 Upload standard .gpx (GPX 1.1) or .tcx files exported from Strava or your GPS watch via Import GPX/TCX (`POST /api/import`). Imported archives are static until you upload new files; duplicates are skipped automatically via SHA-256 hash. Trackpoint latitude (lat), longitude (lon), elevation in meters (ele / AltitudeMeters), and UTC timestamp (time).
Step 2 · Route Tracking & Analytics

How Routes Are Processed, Analyzed & Redacted

When Slinga renders a workout or computes longitudinal insights, all calculations run deterministically on the server without sending your coordinates to third-party analytics providers:

Moving vs. Elapsed Pace

  • Consecutive GPS intervals where speed drops below 0.5 m/s for ≥ 15s are classified as stopped/paused time.
  • Per-mile splits, grade-adjusted climb, and share cards distinguish Moving Time from Elapsed Time.

Endpoint Privacy Trim

  • By default, redact_endpoint_radius(points, 200.0) strips all GPS points within 200 meters of the true start and end points.
  • Share cards strip street and neighborhood names and support a No Map · Stats Only layout.

Repeat-Loop Clustering

Step 3 · Storage, AI & Portability

How Your Data Is Stored, Isolated & Exported

Layer Storage & Security Architecture
Authentication & Sessions Sign-up and sign-in use Auth0 + Google OIDC with Authorization Code + PKCE (S256). Sessions use HMAC-SHA256 signed, HttpOnly; SameSite=Lax; Secure cookies (slinga_session) stored in SQLite with 7-day expiration.
Per-User Data Isolation Each user account is isolated by its OIDC sub identifier in user_accounts and imported_workouts. The host's personal HealthKit database is strictly restricted to the instance owner; member accounts only access workouts they import themselves.
Local Ollama Coaching Optional AI workout reviews run exclusively against a local Ollama instance on loopback (127.0.0.1:11434). Raw GPS coordinates are never included in prompts by default, and no workout data is sent to external cloud LLM APIs.
Map Tile Caching Map tiles (CARTO Dark Matter, Voyager, Positron, OpenStreetMap, OpenTopoMap) are proxied and cached by the server so tile providers only see tile grid coordinates (z/x/y), never your GPS polyline.
Full Data Portability You can export any individual route as standard GPX 1.1 or GeoJSON, or download your entire account archive as a single GeoJSON FeatureCollection at any time.
Step 4 · Getting Started

What Happens When You Sign Up

  1. Authenticate with Google via Auth0: Click Create Account with Google. Slinga receives your verified email, display name, and unique OIDC sub identifier.
  2. Choose Your Data Path & Defaults: On first sign-in, Slinga outlines the two ways runs enter your workspace:
    • iOS App + Apple Health Sync (Ongoing): Automatic sync depends on Apple Health via the iOS companion app (whether you run with an Apple Watch or sync another app/watch into Apple Health).
    • Strava / GPX / TCX Export (Static): Upload .gpx or .tcx files exported from Strava or any GPS watch—static until you import new files.
  3. Confirm Privacy & Units: Set your default units, basemap, and 200m start/end privacy trim, then either pair the iOS app or import your first .gpx / .tcx file.