Privacy Policy

AthleteSpace ("we", "our", "us") is a fitness and performance application designed to provide training insights to endurance athletes. We respect your privacy and are committed to protecting your personal data. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

With your explicit consent, AthleteSpace may collect the following categories of data:

• Account information: email address, name, and authentication provider (Google, Apple)
• Activity data: workouts, duration, distance, and pace from connected services
• Health and fitness data: heart rate, active energy burned, and running/cycling distance from Apple Health
• Wearable recovery and wellness data: sleep stages, heart-rate variability (HRV), resting heart rate, body-temperature deviation, SpO2, daily stress, readiness, resilience, and user-added wellness tags (e.g. illness, injury, travel, caffeine) from connected wearables such as Oura and Whoop, and steps, respiratory rate, VO2 max, weight and body fat from Apple Health or Health Connect when you allow them (read-only access)
• Training preferences: goals, availability, sport type, and injury information provided during onboarding
• Voice data: audio from voice coaching sessions, processed in real time and not stored after the session ends

How we use and share health data, and your rights over it, are also set out in our Consumer Health Data Privacy Policy.

We also collect usage and diagnostic data about how the site and app are used. Unlike the categories above, this does not wait for an account: it also applies to visitors who never create one. In the EU, EEA, UK and Switzerland it begins only if you accept it. Section 5 sets out what this covers.

2. How We Use Your Data

We use collected data solely to:

• Provide personalized training insights and performance analysis
• Generate recovery and fatigue trends
• Power the AI coaching features, including training plan generation and voice coaching
• Improve the functionality and accuracy of the application

AthleteSpace does not provide medical diagnosis or treatment. All AI-generated recommendations are informational and should not replace professional medical advice.

3. AI and Automated Decision-Making

AthleteSpace uses internally integrated AI-powered systems and third-party AI providers (OpenAI, Anthropic and Groq) to generate training plans, analyze performance, and provide coaching recommendations. When you use AI coaching features, the following data may be sent to these providers for processing:

• Your training profile (sport, goals, availability, experience level)
• Recent workout history and performance metrics
• Fitness and fatigue indicators (training load, CTL, ATL)
• Recovery and wellness signals from connected wearables (e.g. sleep, HRV, resting heart rate, body-temperature deviation, readiness, resilience, and wellness tags from Oura or Whoop) when those integrations are connected
• Messages you send to the AI coach

This data is sent solely to generate your coaching response or plan. The providers process it under their API terms, which do not allow them to train models on it, and may keep it for a limited period for abuse monitoring. Data is encrypted in transit. Messages you send the coach are also screened by Lakera for prompt-injection and safety risks.

You give explicit consent to this processing when you sign up. You can withdraw it at any time in Settings > Security, by emailing us, or by deleting your account. AI coaching is the core of the product, so it stops when you withdraw and starts again if you agree again.

These AI features:

• Are informational decision-support tools, not a substitute for professional coaching
• Do not make binding decisions about your health or training
• Can be overridden: you retain full control over your training schedule

Voice coaching sessions are processed in real time using OpenAI's API. Audio is streamed for transcription and response generation only, it is not recorded or stored by AthleteSpace.

4. Data Sharing

We do not sell, rent, or share individual user data with advertisers or third parties for marketing purposes.

We share data with the following third-party service providers strictly for app functionality:

• AI providers (OpenAI, Anthropic, Groq): process your training data and messages to power AI coaching features (training plans, performance analysis, voice coaching, form analysis). See section 3.
• Safety screening (Lakera): screens messages you send the coach.
• Web search (Tavily): receives search queries the coach writes to answer questions, such as race or course details.
• Weather (Open-Meteo, OpenWeatherMap): approximate location, to adjust training for conditions.
• Hosting (Render): stores and serves all data.
• Email and push delivery (our email provider, Firebase Cloud Messaging): your email address and device token, to deliver messages and notifications.
• Authentication providers (Google, Apple): for secure sign-in only.
• Fitness platforms (Strava, Garmin, Apple Health, Health Connect), to sync workout data, and from Apple Health and Health Connect the recovery data you allow, only when you connect these services.
• Wearable platforms (Oura, Whoop): to sync sleep, readiness, HRV, body-temperature, resilience, and wellness-tag data, only when you connect these services. We use read-only access and do not write data back to these providers.
• Calendar providers (Google Calendar): to add your planned workouts to your calendar, only when you connect it. See section 11.
• Analytics providers (PostHog, HeyCatch): receive usage data about how the site and app are used, including from visitors without an account. See section 5.
• Error monitoring (Sentry, Grafana Cloud): receive crash and performance diagnostics. Configured not to send personal information; reports from signed-in users carry an account identifier only.
• Install attribution (Meta): our mobile app tells Meta when it is installed and opened, so we can measure our ads. Automatic event logging and advertising-ID collection are turned off, and Meta receives no health, workout or account data. In the EU, EEA, UK and Switzerland the app does not contact Meta at all.
• Partner shops and affiliate networks (for example Wahoo, Running Warehouse, Booking.com, and the networks that run their programs, such as Awin, Impact, CJ and AvantLink): when you tap a partner link, we send you to the shop with a random click code. We do not send your name, email, health, training or equipment data. If you buy, the network reports the order amount, our commission and that click code, so we can count sales. See section 5.

These providers process data under contract and do not retain it beyond the scope of service delivery. Aggregated and anonymized data may be used internally for product improvement.

5. Analytics, Cookies and Similar Technologies

We use analytics to understand how people find and use AthleteSpace, and error monitoring to find bugs. Outside Europe this begins when you first load the site, including on our marketing pages and before you create an account. In the EU, EEA, UK and Switzerland we ask first, and analytics stay off unless you accept. Error monitoring runs everywhere, because we need it to keep the service working.

What we collect: pages viewed, links and buttons clicked, navigation between screens, the actions you take during signup and onboarding, approximate location inferred from your device time zone, and browser and device characteristics. We do not use this data to target advertising, and we do not sell it.

Who processes it:

• PostHog: product analytics. Records page views and specific actions we choose to measure. It does not automatically capture every click.
• HeyCatch: product analytics. Automatically captures page views, clicks and navigation between screens.
• AthleteSpace (first-party): our own usage analytics, stored on our servers and not shared with an analytics provider. Records page views, the buttons and links you click and where on the page, time on a page and how far you scroll, page speed, and JavaScript errors. It does not record what you type into fields, and it does not record your screen.
• Sentry: error and performance monitoring. Samples a share of page loads for performance timing, and captures a replay of the session when an error occurs so we can reproduce the fault.

Session replay: when you are signed in, PostHog may record a replay of your session in the app. Sentry records one when an error occurs. We do not record replays in the EU, EEA, UK or Switzerland, or for anyone who has turned analytics off. Replays capture on-screen activity and interactions. Password fields are masked by the recorder, and we use replays only to diagnose problems and improve the product.

Partner links: some pages and screens show links to partner shops for gear, fuel, race entries and travel, always marked “Ad”. We show one only where it fits what you are doing, such as fuel on a long run or a place to stay for a race away from home. Partners never receive your training, health or equipment data. When you tap a link, our server records the tap (the partner, where it appeared, your country from your connection, your platform and, when analytics are on, your visitor or account identifier) and then sends you to the shop. The shop and its affiliate network may set their own cookies on their own sites, under their own privacy policies; we do not set advertising cookies on ours. In the EU, EEA, UK and Switzerland, until you accept analytics, the link goes to the shop without our click code, so nothing ties the visit to you and we earn no commission. We keep click records for 13 months and use them only to count clicks and sales and to choose which partners to show.

What is stored on your device: we do not use advertising cookies. We do store data in your browser: an authentication cookie that keeps you signed in, analytics identifiers that let us recognise a repeat visit, and preferences such as your language, theme and interface state. Some of these persist until you clear your browser data.

Once you sign in, we link this usage data to your account, so product analytics reflect real usage rather than anonymous sessions. Before that point it is tied to a randomly generated identifier rather than to you.

Your choices: you can turn analytics on or off at any time in Settings > Security > Usage analytics. The choice is stored in the browser or app you make it in. You can also block these tools through your browser settings or a content blocker, and the app will keep working. You can also contact us at the address in section 16 to ask what usage data we hold about your account, or to have it deleted. Your other rights are set out in section 9.

6. Data Storage and Transfers

Your data is stored on secure servers in the United States. If you are located outside the United States, your data will be transferred to and processed in the United States. We implement appropriate safeguards including encryption in transit and at rest.

Apple Health data is read on your device and transmitted to our servers over encrypted connections. Voice audio is streamed directly to AI processing services and is not persistently stored.

7. Data Retention

We retain your personal data for as long as your account is active. When you delete your account:

• All personal data, health and wellness data from connected wearables, training plans, conversations, and preferences are permanently deleted
• Workout metrics (such as sport, duration and distance) are kept only in anonymized form: names, notes, GPS routes, heart-rate streams and any link to you are removed
• One anonymous exit record is kept to improve the product: when the account was created and deleted, the reason and note you chose to give, your plan's outline and first sessions, which services were linked, and which screens you used. It holds no name, email, health or injury answers, coach conversations, or any link to you
• Deletion is immediate and irreversible
• Third-party service connections (Strava, Garmin, Apple Health, Health Connect, Oura, Whoop, Google Calendar) are unlinked and the access tokens we hold are deleted. To remove AthleteSpace from the provider's own list of connected apps, use that provider's settings

You can export your data in JSON or CSV format before deleting your account via Settings > Data Management.

8. Data Security

We implement reasonable technical and organizational safeguards to protect your data, including encrypted storage, secure communication protocols (HTTPS/TLS), and secure authentication via industry-standard OAuth providers.

9. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of your data (available via Settings > Data Management > Export, which downloads everything we hold about you except sign-in credentials and raw sensor streams)
• Deletion: Delete your account and all associated data (available via Settings > Privacy & Security)
• Correction: Update your personal information through the app settings
• Portability: Export your data in a machine-readable format (JSON or CSV)
• Withdraw consent: Withdraw health-data consent in Settings > Security, disconnect integrations, or delete your account at any time

You control which services you connect and may revoke access at any time through Settings > Integrations.

10. Apple Health Data

AthleteSpace requests access to the following Apple Health data types, with your explicit permission:

• Workouts (all activity types)
• Heart rate
• Active energy burned
• Running distance
• Cycling distance
• Workout routes (for workouts you record in AthleteSpace)
• Heart rate variability and resting heart rate
• Sleep, including time in each sleep stage
• Steps
• Respiratory rate and blood oxygen
• VO2 max
• Sleeping wrist temperature
• Weight and body fat percentage

This data is synced to AthleteSpace and used exclusively to provide training insights and performance analysis. When you have consented to AI coaching, Apple Health data may be included in the context sent to the AI providers named in section 3 for generating personalized recommendations. When you allow it, workouts you record in AthleteSpace (including their route, distance and energy) are saved to Apple Health. We do not write any other data to Apple Health. Apple Health data is never sold, used for advertising, or shared with third parties beyond what is described in Section 4. You can disconnect Apple Health at any time via Settings > Integrations.

Health Connect Data (Android)

On Android, AthleteSpace can read the following from Health Connect, with your explicit permission:

• Exercise sessions (workouts from apps such as Samsung Health and Google Fit)
• Distance
• Heart rate
• Sleep, including time in each sleep stage
• Heart rate variability and resting heart rate
• Steps and active calories burned
• Respiratory rate and oxygen saturation
• VO2 max
• Weight and body fat

Access is read-only and happens only while the app is open. This data is synced to AthleteSpace and used exclusively to provide training insights and performance analysis. When you have consented to AI coaching, it may be included in the context sent to the AI providers named in section 3 for generating personalized recommendations. We never sell Health Connect data, never use it for advertising, and never share it with data brokers. You can revoke access at any time in Health Connect or by disconnecting it in Settings.

Garmin Data

When you connect Garmin Connect, you choose on Garmin's consent screen what AthleteSpace may access. With your permission:

• What we collect: the activities you record with Garmin, sent to us by Garmin. This covers the sport, start time, duration, distance, elevation, calories, laps, heart rate, pace, power, cadence, GPS route and the name of the device that recorded it. We also store your Garmin user ID and the permissions you granted. We do not collect sleep, stress, body composition or other daily health data from Garmin.
• How we use it: to show your activities, work out your training load, fitness and training zones, compare what you did with what was planned, and adapt your training plan and coaching.
• What we send to Garmin: if you turn on "Send planned workouts to Garmin Connect", we send your planned workouts for the coming days (name, sport, steps, targets and date) to your Garmin Connect calendar, and update or remove them when your plan changes. Turning the setting off removes the workouts we scheduled.
• How we store it: on our hosting provider's servers (Render) in the United States, encrypted in transit and at rest. Garmin access tokens are stored encrypted.

No sharing with third parties: we do not sell, rent, license, share or transfer Garmin data to any third party for its own use. It is never used for advertising, never given to data brokers, other apps or other companies, and never used to train AI models.

Where it is processed: Garmin data is received, stored and analysed on AthleteSpace's own servers, hosted with Render. How AthleteSpace uses AI, and the safeguards that apply to it, are set out in section 3.

You can disconnect Garmin at any time in Settings > Integrations. This ends our access with Garmin and deletes the stored tokens, and Garmin stops sending us data. Activities already imported stay in your account until you delete your account, which is handled as described in section 7.

11. Google User Data

AthleteSpace uses Google data in two places, each only when you choose to:

• Sign in with Google: we receive your name, email address and profile picture, and use them only to create and identify your AthleteSpace account.
• Google Calendar: when you connect Google Calendar, we request the calendar.events permission. We use it to add your planned workouts to your calendar as events, update them when your plan changes, and remove them when a workout is cancelled. We read events only to find the workouts AthleteSpace created, so that moving or deleting one in Google Calendar updates your plan. We do not store, analyze or use your other calendar events.

Google user data is stored encrypted, is never sold, is never used for advertising, and is not shared with third parties except the hosting provider needed to run the service (Render). Google Calendar data is never sent to AI providers and is never used to develop, improve or train AI or machine-learning models. No person at AthleteSpace reads your calendar data unless you ask us to for support, it is needed for security or to comply with the law.

AthleteSpace's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Calendar at any time in Settings > Integrations, which revokes our access and deletes the stored token. You can also remove access at myaccount.google.com/permissions. Deleting your account deletes all Google data we hold.

12. Third-Party Services

AthleteSpace integrates with the following third-party services only with your explicit authorization and in accordance with their respective privacy policies. You can disconnect any integration at any time via Settings > Integrations.

• Fitness platforms: Strava, Garmin, Apple Health, Health Connect
• Wearables: Oura, Whoop
• Calendar: Google Calendar

Refresh tokens and access tokens for these integrations are encrypted at rest. When you disconnect a service, we revoke the token with the provider where supported and delete the local credential immediately.

13. AI Assistant Connectors (ChatGPT and Claude)

The AthleteSpace connector lets you build a training plan from inside an AI assistant such as ChatGPT or Claude. It works without an AthleteSpace account. How to set it up: ChatGPT, Claude, other assistants.

• What we receive: only the answers the assistant sends to build your plan: goal race distance and date, current weekly distance, days per week you can run, your unit (miles or kilometres), and either a recent race result or your usual easy pace. If you ask to adjust a plan, we also receive the dates of the sessions you missed. For a season in another sport, we receive the sport and event, your level, the hours and days a week you can train, the event date if there is one, and your unit system.
• What we do not receive: your conversation, your name, email, or assistant account, or any other data from the assistant.
• How we use it: only to calculate the plan returned in that response. The calculation runs on our servers; no AI model sees your answers on our side.
• Storage and retention: the answers and the plan are not stored and are not linked to any account. Our servers keep short-term operational logs (time, which assistant sent the request, race distance or sport, and plan length) for troubleshooting and security; these contain no name or contact details and are deleted on a rolling basis. Your IP address is held in memory for about a minute to limit request rates, then discarded. We also count each request to measure use of the connector: the count records only the time, which assistant sent it, and which tool it called, never your answers or the plan.
• Sharing: we do not sell or share connector data with anyone. The assistant provider handles your conversation under its own privacy policy.
• Your controls: your answers and plan are never stored, and the request count holds nothing that identifies you, so there is nothing to delete. You can disconnect AthleteSpace at any time in your assistant's settings, and the assistant only calls it when you ask for a plan.
• Opening the plan on AthleteSpace: the "Open in AthleteSpace" link carries your answers in the address so the same plan or season appears on our site. From there, the rest of this policy applies, including Section 5 for site analytics.

Questions about the connector: privacy@athletespace.ai.

14. Children's Privacy

AthleteSpace is intended for users aged 16 and older. We do not knowingly collect personal data from anyone under 16. If you believe someone under 16 has provided us with personal data, please contact us so we can delete it.

15. Changes to This Policy

This policy may be updated as the product evolves. Material changes will be communicated via in-app notification or email. The "Last updated" date at the top reflects the most recent revision.

16. Contact

For privacy-related questions or to exercise your data rights, contact us at privacy@athletespace.ai.

17. If You Are in the EEA, the United Kingdom or Switzerland

This section adds to the rest of the policy for people in those places, under the GDPR and the laws that mirror it.

Who is responsible: AthleteSpace is operated by Athlete Space AI LLC, 810 Oak Meadow Drive, Franklin, TN 37064, United States, which is the controller of your data. Reach it at privacy@athletespace.ai.

Why we may use your data (legal bases):

• Your explicit consent: health and fitness data used for coaching, including sending it to the AI providers in section 3; data from a device or wearable you connect; text and push coaching; analytics and similar technologies (section 5).
• Our contract with you: your account, sign-in, and the service emails needed to run it.
• Our legitimate interests: keeping the service secure and working, which covers error and performance monitoring.

Consent is yours to take back: health-data consent and analytics in Settings > Security, a device in Settings > Integrations, texts by replying STOP. Taking it back does not affect what was done before.

Transfers: your data is stored and processed in the United States, by us and by the providers in section 4. Where a provider offers them, the transfer relies on the European Commission's standard contractual clauses or on the provider's certification under the EU-US Data Privacy Framework. Ask us for details of a specific provider.

How long we keep it:

• Account, training and health data: while your account is open. Deleting the account removes it at once (section 7).
• Page views and click analytics: 13 months.
• Raw messages from device providers that are not tied to an account: 90 days.
• Detailed diagnostic traces: 30 days.
• Guest accounts that are never saved: 30 days.

Your rights: as well as those in section 9, you can ask us to restrict how we use your data, object to uses that rest on our legitimate interests, and complain to the data protection authority where you live. We answer requests within one month.

Automated decisions: the coach's plans and suggestions are advice. Nothing in AthleteSpace makes a decision about you that has legal or similarly significant effect.