MyTrainPal is operated by Krzysztof Kostecki, who is the data controller for the personal data described in this policy. For privacy questions or to exercise your rights, email krzysztofkostecki@icloud.com.

We have not appointed a Data Protection Officer because our current processing activities do not require one under Article 37 GDPR. Privacy requests should be sent to the address above.

This policy applies to MyTrainPal's website, mobile applications, APIs, MCP tools, and related services (the “Service”). It does not replace the privacy policies of a connected service such as Intervals.icu or Strava, which also apply when you choose to connect them.

• Personal Data means information relating to an identified or identifiable person.
• Activity Data means information about completed or planned fitness activities, including workout details, routes, timestamps, duration, distance, pace, power, heart rate, training load, and related analytics.
• Wellness Data means health- or recovery-related information such as sleep, HRV, resting heart rate, weight, readiness, body battery, temperature, and similar metrics.
• AI Input means prompts, chat messages, files, images, and the account, training, wellness, or other context supplied to an AI model. AI Output means the response or recommendation generated from that input.
• Usage Data means technical and interaction information created when the Service is accessed or used.
• Service Provider or Processor means a company that processes data on our behalf to help us provide the Service.

• Account and authentication data: name, email address, profile image, password hash where applicable, sign-in provider, verification status, sessions, and account security records.
• Profile and preference data: language, time zone, units, height, date of birth, gender, sport preferences, notification choices, and AI model preferences.
• Activity and training data: completed and planned workouts, routes and location points contained in activity files, training plans, templates, targets, performance metrics, equipment, notes, and derived analytics.
• Wellness and health data: metrics you enter or authorize us to import, including heart rate, HRV, sleep, recovery, readiness, body battery, weight, temperature, and similar measurements.
• Conversation and content data: AI chat messages and outputs, feedback, coaching conversations, attachments, images, and uploaded files such as GPX or activity files.
• Connection data: third-party account identifiers, access and refresh tokens, granted permissions, sync settings, webhook records, and sync history for services you connect.
• Subscription and transaction data: plan, subscription status, purchase source, transaction identifiers, and billing metadata. Payment card details are handled by the relevant payment provider and are not stored by MyTrainPal.
• Usage and device data: IP address, browser or app version, device and operating-system information, pages or features used, timestamps, diagnostics, crash and security logs, and cookie or local-storage preferences.
• Support and communications data: messages, feedback, and other information you send when you contact us or take part in optional research or promotions.

We receive data from the following sources:

• Directly from you when you register, complete your profile, enter a workout or metric, talk to the AI coach, upload content, change settings, or contact support.
• From services you authorize, which may include Intervals.icu, Strava, Apple Health, Android Health Connect, Wahoo, Polar, Hevy, and Ultrahuman. The exact categories depend on the permissions you grant.
• From Apple or Google when you use their sign-in services, limited to the profile and authentication information they make available under your selection.
• From a coach or athlete who is connected to you through a MyTrainPal coaching relationship and is permitted to share or manage relevant training information.
• Automatically from your browser, device, app, and our infrastructure when you use the Service.

• Provide, maintain, personalize, and improve the Service.
• Import, analyze, display, and export activities, plans, and wellness information at your direction.
• Generate AI coaching responses, training plans, summaries, insights, and scheduled recommendations.
• Authenticate users, maintain sessions, manage connected accounts, and protect account security.
• Process subscriptions, confirm entitlements, issue receipts, and meet accounting or tax obligations.
• Provide support and send service messages, security notices, and material policy updates.
• Monitor performance, understand feature usage, troubleshoot errors, and prevent fraud, abuse, or technical problems.
• Send marketing communications only where you have opted in and measure advertising only where you have consented to the relevant technology.
• Comply with law, enforce our terms, and establish, exercise, or defend legal claims.

If the GDPR or UK GDPR applies, our legal basis depends on the data and purpose:

• Contract (Article 6(1)(b)): to create your account and provide the features, integrations, subscriptions, and AI coaching you request.
• Consent (Article 6(1)(a)): for optional marketing, non-essential cookies or advertising measurement, and other processing where we specifically ask for permission.
• Explicit consent (Article 9(2)(a)): for health and wellness data that qualifies as special-category data.
• Legitimate interests (Article 6(1)(f)): to secure, operate, troubleshoot, and improve the Service, prevent abuse, and communicate with you, provided those interests are not overridden by your rights.
• Legal obligation (Article 6(1)(c)): to retain required records and comply with lawful requests or other obligations.

Activity and wellness data is private by default. It is visible to another MyTrainPal user only when you establish a coaching relationship or otherwise grant access through a feature designed for sharing. We exchange data with a connected service only at your direction and within the permissions you authorize.

You can revoke a connection or device permission at any time. Disconnecting stops future exchanges but does not automatically remove data already imported into MyTrainPal or exported to another service. Use the clear-data or account-deletion controls in Settings to remove MyTrainPal's retained copy, and use the connected service's own controls for copies it holds.

Because health and recovery context is important to personalized coaching, withdrawing consent to process this data may disable or materially limit core features. Withdrawal does not affect processing that was lawful before it was withdrawn.

AI processing is a core part of MyTrainPal. When an AI feature runs, we assemble context reasonably relevant to the request and send it to an AI provider. Depending on the feature, that context may include your prompt, recent or summarized conversation history, profile and preferences, activity history, planned training, wellness and recovery metrics, coach-athlete context, attachments, and tool results. AI outputs and the context needed to continue a conversation may be stored in your account.

AI features may automatically personalize recommendations, rank relevant context, summarize your history, or propose changes to a plan. They do not make decisions that produce legal or similarly significant effects within the meaning of Article 22 GDPR. AI output can be incomplete or inaccurate and is informational only; it is not medical advice or a substitute for a qualified health professional or coach.

Some AI features can use web search. When they do, a query or minimized reformulation of the request may be processed by the search provider to retrieve current public information.

MyTrainPal currently uses Google Cloud Vertex AI with Gemini models for AI generation and search-enabled features. Certain model choices may instead be processed through Vercel AI Gateway, which forwards requests to an upstream inference provider; the available catalog currently includes DeepSeek-family models and may use supporting inference hosts selected by the gateway. The provider or model used can vary by plan, preference, availability, and feature.

We do not use your personal data to train a MyTrainPal foundation model, and we do not instruct Google Cloud to train models on your AI Input or Output. Google's current cloud terms state that customer data is not used to train or fine-tune AI models without the customer's permission and that prompts and outputs are not stored outside the customer's account longer than reasonably necessary to generate the output, subject to limited security and legal exceptions.

For gateway-routed models, Vercel and the selected upstream provider process AI Input and Output under their applicable data terms. Their retention, security monitoring, and model-improvement practices may differ by route. We limit the data sent to what the feature needs, require providers to protect it under applicable contractual terms, and will update this policy when a material change to AI processing affects your rights. You may contact us for current provider-specific information.

• Service providers: vendors process only the data needed to host, secure, operate, support, communicate about, analyze, or bill for the Service, subject to their contracts and applicable law.
• AI providers: the AI Input and related context described above is shared to generate the feature you request.
• Connected services: data is received from or sent to a service such as Intervals.icu or Strava according to the connection and permissions you choose.
• Coaches and athletes: relevant account, activity, wellness, plan, and communication data is shared within a coaching relationship you authorize. Access can be removed by ending that relationship.
• Legal and safety reasons: we may disclose data when we reasonably believe it is necessary to comply with law or legal process; protect rights, property, users, or the public; investigate wrongdoing; or defend against legal liability.
• Business transfers: data may be transferred as part of a merger, financing, reorganization, sale of assets, or similar transaction, subject to appropriate confidentiality and notice where required.

• Hosting, infrastructure, web analytics, and AI routing: Vercel and infrastructure or database providers used to run the Service.
• AI and search processing: Google Cloud (Vertex AI and Gemini) and AI model or inference providers reached through Vercel AI Gateway.
• Authentication, notifications, and platform services: Google, Apple, Firebase Cloud Messaging, and Apple Push Notification service.
• Payments and subscriptions: Stripe, RevenueCat, Apple App Store, and Google Play. These providers handle payment credentials under their own policies.
• Email delivery: Resend.
• User-authorized fitness and wellness integrations: Intervals.icu, Strava, Apple Health, Android Health Connect, Wahoo, Polar, Hevy, and Ultrahuman, when you connect them.

We do not sell personal data for money. We do not use activity, wellness, health, or AI conversation data to build advertising profiles or target ads based on your health.

If you consent to optional web analytics or advertising measurement, limited device, cookie, and website-usage information may be processed by Google or another disclosed measurement provider to understand campaign performance. You can reject these technologies or withdraw consent through the available cookie controls.

We send newsletters or promotional email only where you opt in. You can unsubscribe through the link in a marketing email or in Settings. This does not stop transactional messages such as receipts, security alerts, support replies, or policy notices.

MyTrainPal and its service providers may process data in the EEA and in other countries, including the United States and locations where an AI inference or connected-service provider operates. Those countries may have different data-protection laws from your country.

Where the GDPR or UK GDPR requires a transfer mechanism, we rely on an adequacy decision, the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful safeguard made available by the relevant provider. You may contact us for more information about safeguards applicable to a particular transfer.

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including providing the Service, maintaining security and continuity, meeting legal obligations, resolving disputes, and enforcing agreements.

Account, profile, training, wellness, plan, and conversation data is generally retained while your account is active or until you use an available deletion control. You can clear training and wellness data, disconnect integrations, and delete your account in Settings. Account deletion revokes sessions and connected-account credentials and deletes or anonymizes account-linked data, except where limited information must be retained for legal, accounting, fraud-prevention, security, backup, or dispute-resolution purposes.

Billing and accounting records are kept for the period required by applicable law. Operational, security, and diagnostic logs are retained for shorter periods appropriate to their purpose. Deleted data may remain temporarily in routine backups until those backups rotate and may be retained by a third party under its own lawful retention obligations.

Depending on where you live, you may have the right to ask whether we process your data and to request access, correction, deletion, restriction, objection, or a portable copy. You may withdraw consent at any time without affecting earlier lawful processing, and you may object to direct marketing at any time. We may ask you to verify your identity before completing a request.

Many controls are available directly in Settings. You can update profile information, manage health permissions, disconnect services, clear training data, manage marketing preferences, and delete your account. You can also email the controller using the address in Section 1.

You may lodge a complaint with your local supervisory authority. In Poland, the authority is the President of the Personal Data Protection Office (UODO).

We use essential cookies and similar local storage for authentication, OAuth security, language and display preferences, consent choices, app state, and other functions needed to operate the Service. Rejecting essential storage may prevent parts of the Service from working.

We use Vercel Web Analytics to understand aggregate website usage. Optional Google advertising or analytics tags load only after you accept analytics in the cookie banner. You can reject optional tracking without losing access to the core Service and can clear cookies or site data through your browser. Mobile operating systems may provide separate controls for permissions and identifiers.

We use appropriate technical and organizational measures designed to protect personal data, including access controls, encrypted transport, credential protection, and service monitoring. No method of Internet transmission or electronic storage is completely secure, so absolute security cannot be guaranteed.

If a personal-data breach creates a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it. If the breach is likely to create a high risk to you, we will also notify you without undue delay where required by law.

To protect accounts against unauthorized access, we record a security signal for every successful interactive sign-in — whether you sign in with email and password, Google, Apple, register for a new account, or use the iOS or Android apps.

• On sign-in we may generate a device fingerprint using the open-source FingerprintJS library in your browser or app webview. The fingerprint is immediately pseudonymized on our servers with an HMAC-SHA256 keyed hash before storage; the raw visitor identifier produced by your device is never written to our database. Because the identifier is keyed and hashed, it cannot be reversed by us or linked back to your device by anyone without the secret key.
• Alongside the hashed fingerprint we store a confidence score reported by the fingerprinting library, your login provider (credentials, Google, or Apple) and flow (sign-in or registration), the platform (web, iOS, or Android), the app version when available, the browser, operating system, and device type parsed from the user agent our server observes, and a truncated IP address (the first three octets for IPv4 addresses, or the first four blocks for IPv6 addresses). We never store your full IP address.
• This processing is strictly limited to account security purposes such as detecting suspicious sign-in patterns, shared fingerprints across multiple accounts, and potential account takeovers. Device fingerprinting for this purpose is performed independently of the analytics cookie preference described in Section 16 — opting out of analytics cookies does not affect these security records, and the security records are not used for advertising or profiling.
• Login events are visible to the single designated administrator of the Service in a read-only internal administration panel, for the purpose of investigating abuse and account-security incidents.
• Login events, including hashed fingerprints, are deleted automatically after 180 days.
• Device fingerprints are a heuristic signal only. They are never used as proof of identity for authentication and cannot replace your password or other sign-in credentials.

MyTrainPal is not directed to children. You must be at least 16 years old, or any higher minimum age required by the law where you live, to use the Service. We do not knowingly collect personal data from anyone below the applicable minimum age. If you believe a child has provided personal data, contact us and we will investigate and delete it where appropriate.

The Service may link to or connect with services we do not operate. Their privacy policies govern their independent processing, including data you ask MyTrainPal to send to them. We are not responsible for third-party content or privacy practices, and we encourage you to review the relevant policy before connecting an account or following a link.

We may update this Privacy Policy to reflect changes to the Service, our providers, or applicable law. We will post the revised policy here and update the date above. Where a change materially affects your rights or how sensitive or AI-related data is processed, we will provide additional notice in the app, on the website, or by email and request new consent where required.