Privacy policy

Last updated November 2, 2026

1. Who is responsible

The controller for the processing of your personal data in EffortTrace is:

Balint Schmidt
Avenida del Oasis Sn
35100 Maspalomas
Spain
Palm Beach Karat

Email: hello@efforttrace.com

2. What this covers

EffortTrace analyses training data for cycling and running. Much of that data is health data in the sense of Article 9 GDPR, because heart rate, heart rate variability, sleep and how you feel say something about your health. This policy explains what we store, why, who helps us run the service, and what you can do about it.

3. The data we process

  • Account: your email address and, if you set one, a password (stored only as a hash by our authentication provider).
  • Profile: display name, year of birth, sex, height, training thresholds (FTP, maximum and resting heart rate, heart rate zones), your language and units, and any notes you write about injuries or conditions the coach should train around.
  • Activities: the files you upload (FIT, TCX, GPX) and what we derive from them: GPS tracks and locations, time, distance, speed, elevation, heart rate, power, cadence, temperature, laps, power and pace curves, splits, segments and your rating of effort.
  • Wellness: overnight data you sync or enter (resting heart rate, HRV, sleep and sleep stages, stress, body battery, SpO2, respiration) and your morning check in (fatigue, soreness, stress, motivation, illness, notes).
  • Connected services: if you connect Garmin, Polar or Wahoo, the activities (including their FIT files) and wellness data that service sends us, your user ID at that service, the permissions you granted there, and the access tokens that let us read on your behalf, which we store encrypted. If you send a workout or a route to your device, we send it to that service.
  • Training plans: planned sessions, workouts and gear.
  • AI coach: your conversations with the coach (the questions you ask, the coach's replies and the short notes it writes to summarise long conversations), its reviews of your activities, the lines you agreed it may remember, and how much of the coaching allowance you used. Conversations are kept until you delete them or your account.
  • About you, for the coach: the text you choose to write about yourself in the settings, and the check ins you agree the coach may come back to (a question and a date).
  • Images for the coach: photos and screenshots you choose to send the coach, a short description the coach writes of each, and when you agreed to send images. We re-encode every image on our servers and remove its location data and other metadata. Images are kept until you delete the conversation they are in or your account; an image the coach finds unrelated to training is deleted straight away.
  • Subscription: your plan, its status and billing period, and the customer and subscription identifiers from our payment provider. We never see or store your card details.
  • Requests to join the test: if you ask to join the test before launch, the answers you give in that form (name, email address, country, language, sports, main device, what you record and use today, weekly training time, age range, optionally gender, phone type, a link to your public profile and what you would like from the app).
  • Feedback: the reports you send with the feedback button, together with the page you sent them from, your screen size, your browser and the app version, and any reply we send you.
  • Technical data: IP address, browser and time of request in our hosting provider's logs, and the cookies described in section 9.

4. Why we process it, and on what legal basis

  • To provide the service you signed up for (account, storage, analysis, plans, subscription): Article 6(1)(b) GDPR, the contract with you.
  • Health data: Article 9(2)(a) GDPR, your explicit consent, which you give when you create your account. Without it we cannot provide the service, because analysing this data is what the service does.
  • Reviewing requests to join the test: Article 6(1)(a) GDPR, the consent you give in the request form, which you can withdraw at any time by emailing us. Feedback reports: Article 6(1)(f) GDPR, our legitimate interest in fixing and improving the service you use.
  • Security and abuse prevention (server logs, rate limits): Article 6(1)(f) GDPR, our legitimate interest in keeping the service and everyone's data safe.
  • Invoices and accounting records: Article 6(1)(c) GDPR, our legal obligation to keep them.

We do not sell your data, use it for advertising, or build profiles of you beyond the training analysis you can see in the app. The readiness and load figures are computed automatically but are guidance for you, not decisions with legal or similarly significant effect.

5. Who helps us run the service

These providers process data on our behalf under data processing agreements. Where data leaves the European Economic Area, the transfer relies on the EU US Data Privacy Framework or the European Commission's standard contractual clauses.

  • Supabase (Supabase, Inc., USA): database, file storage and sign in. Your data is stored in the EU (Ireland).
  • Vercel (Vercel Inc., USA): hosting of the web application and its server logs.
  • OpenAI (OpenAI, USA): only when you use the AI coach (a Plus feature). To answer, the coach is sent your question and the training context it needs: profile, thresholds, your notes about injuries or conditions, recent activities, load and fitness figures, and wellness figures. We ask OpenAI not to store the responses, and OpenAI does not use API data to train its models. OpenAI may keep requests for up to 30 days to detect abuse. If you attach images to a question, they are sent with it, and so is what you wrote about yourself for the coach.
  • Stripe (Stripe Payments Europe, Ltd., Ireland): payments, subscriptions, invoices and tax calculation. Stripe is also an independent controller for fraud prevention and its own legal obligations; see stripe.com/privacy.
  • Visual Crossing (Visual Crossing Corporation, USA): weather for an activity. Our server sends only the start coordinates and date, with nothing that identifies you.
  • OpenFreeMap: map tiles, drawn from OpenStreetMap data. Your browser loads them directly, so this service receives your IP address and the map area you are looking at.

6. Connected services (Garmin, Polar, Wahoo)

Connecting a service is your choice, and on that service's own consent screen you decide what it may share with us. We use data from a connected service only to provide the features you see in EffortTrace: importing and analysing your activities, showing your recovery and readiness, sending workouts and routes to your device and, only if you use it, the AI coach. We do not sell it, use it for advertising, or pass it to anyone other than the providers in section 5.

  • Garmin: with your permission, Garmin sends us your activities and activity files and your daily health summaries, such as sleep, heart rate variability and resting heart rate. When you send a workout or a route from EffortTrace to your Garmin device, we send it to Garmin Connect. Garmin data is processed by Supabase and Vercel to run the service, and by OpenAI only when you use the AI coach (section 7), and by no one else.
  • Polar and Wahoo: the same, for the activities and, with Polar, the overnight data they send us. With Wahoo, workouts and routes you send go to your Wahoo device.

You can disconnect a service at any time under Settings, Connected services. We then delete its access tokens and, for Garmin, end your registration with EffortTrace at Garmin so that Garmin stops sending us data. You can also remove our access in the service's own account settings. Activities already imported stay in your account until you delete them or your account.

7. AI coach (AI transparency statement)

The AI coach uses a large language model from OpenAI (section 5). It runs only when you ask it a question, ask it to analyse an activity or ask it to build a workout. Nothing is sent to OpenAI otherwise.

  • What it receives: your question and the training context it needs to answer, which can include data from connected services such as Garmin: activities, load and fitness figures, and wellness figures.
  • What it is for: coaching answers for you. They are guidance, not medical advice, and no decision about you is made automatically.
  • Your consent: you give it explicitly when you create your account. You can withdraw it at any time, with effect for the future, by no longer using the coach, because nothing is sent unless you use it, or by writing to hello@efforttrace.com.
  • Images and sensitive data: sending images is optional, and we ask for your agreement before the first one. Images can show sensitive information, such as your health, an injury, documents or other people. By sending an image you choose to share it and explicitly consent to it, including any health data it shows, being processed by us and by OpenAI as described here (Art. 9 (2) (a) GDPR). Only send images of other people with their permission. You can withdraw this consent at any time, with effect for the future, by no longer sending images and by deleting the conversations that contain them.
  • No training: neither we nor OpenAI use your data, data from Garmin or other connected services, or anything derived from them to train, evaluate or improve AI models.

8. How long we keep it

We keep your data for as long as you have an account. When you delete your account (Settings, Account, Delete account), your account, profile, activities, files, wellness, plans and usage records are deleted immediately. Copies in our database backups are overwritten within 7 days. Invoices and payment records are kept for the periods tax and commercial law require (up to 10 years in Germany), and nothing else about you is kept with them. A request to join the test is kept until the test ends and deleted within six months afterwards; a request that is not accepted is deleted within six months of our decision. Feedback reports are deleted with your account.

9. Cookies and local storage

We only use what the service needs to work: a sign in cookie that keeps you signed in, cookies that remember your chosen language and units, and your browser's local storage for your theme, your coach preferences and similar settings. There is no analytics, no advertising and no tracking, so there is nothing to agree to beyond signing in (§ 25 (2) TDDDG).

10. Your rights

You have the right to:

  • access the data we hold about you (Article 15 GDPR);
  • have it corrected (Article 16);
  • have it deleted (Article 17), which you can do yourself at any time by deleting your account;
  • restrict its processing (Article 18);
  • receive it in a portable format (Article 20), which you can do yourself under Settings, Backup;
  • object to processing based on our legitimate interests (Article 21);
  • withdraw your consent at any time with effect for the future (Article 7(3)). Because the service cannot work without processing health data, withdrawing consent means deleting your account, or writing to us and we will delete it;
  • complain to a data protection supervisory authority, in particular the one where you live or work or where the alleged infringement took place (Article 77).

For anything else, write to hello@efforttrace.com.

11. Age

EffortTrace is for people aged 16 and over.

12. Changes

When this policy changes in a way that affects what you agreed to, we ask for your agreement again the next time you open the app. See also our terms of service.