Privacy policy
Last updated 2026-11-08
Who we are. Coach is run by [not set], a sole trader (enskild firma) in Sweden, organisation number [not set], [not set], email [not set]. We decide why and how your personal data is used (the “controller” under the GDPR).
What we collect
- Account: email address, name, password (stored only as a one-way hash).
- Profile: athlete type, sex, age, weight, resting heart rate, country and city, thresholds (FTP, swim CSS, run pace, heart rate), units and training hours.
- Training data: activities with duration, distance, heart rate, power, speed, altitude and route; plans, planned and completed sessions, notes, effort ratings; races and race results.
- Health data: sleep, heart rate variability, resting heart rate and weight from your devices or files; check-ins where you report sickness, injury, vacation or travel. This is health data under GDPR Article 9.
- Connections you choose to make: a Garmin login token (we do not keep your Garmin password), an Intervals.icu key, WHOOP, Polar and other imports, Apple Health or Health Connect data, an optional calendar address from which we read only the times you are busy, and your calendar feed link.
- Payments: your plan, billing period and Stripe customer reference. Card numbers go to Stripe and never reach us.
- Technical data: a sign-in cookie, settings saved in your browser, error logs, the time of your last visit.
- Messages you send us: feedback and support emails.
Why we use it and our legal basis
| Purpose | Legal basis |
|---|---|
| Run your account and sign you in; build and adjust your plan; sync the devices you ask for | Contract (Art. 6.1.b) |
| Use your health data to adapt your plan | Your explicit consent (Art. 9.2.a), asked in the app before health data is saved; you can withdraw it at any time under My account |
| Sell and manage Premium; keep accounting records | Contract; legal obligation (Art. 6.1.c) |
| Keep the service secure and fix errors | Legitimate interest (Art. 6.1.f) |
| Answer your messages | Contract or legitimate interest |
We do not sell your data, use it for advertising or share it with data brokers.
AI
Coach uses an AI service to write plan wording and daily notes. We send it only what it needs for that task, such as a training summary, your goal and the question being answered, not your name or email. Plans are built by rules in our own software; if the AI service is unavailable a rule-based plan is used. Current provider: [not set].
Who receives your data
- Cloudflare, Inc. (application containers and R2 storage): runs Coach and stores data.
- Cloudflare: secure connection to coach-triapp.com.
- [not set]: AI plan wording and daily notes.
- Stripe: card payments for Premium.
- Cloudflare Email Service: password reset and service email.
- Garmin, WHOOP, Polar, Intervals.icu and other services you connect, at your request.
Where a recipient is outside the EU/EEA, for example in the USA, we rely on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.
How long we keep it
Your data is kept while your account exists. When you delete your account in the app it is removed from the live service at once and from backups within 30 days. Payment records are kept as long as Swedish accounting law requires (currently seven years). Error logs are kept 30 days.
Your rights
You can access, correct, delete and export your data, restrict or object to its use, and withdraw consent. Most of this is in the app: My profile, and My account (Download all my data, Delete my account and data). For anything else write to [not set]; we answer within one month. You can complain to the Swedish Authority for Privacy Protection (IMY, imy.se).
Security
Connections use HTTPS; passwords are hashed; connection secrets are encrypted; each account has its own database file; backups are encrypted. No system is perfectly secure. If a breach puts your rights at risk we will tell you and IMY as the law requires.
Children
Coach is for people aged 18 or over. We do not knowingly collect data from children; contact us and we will delete it.
Cookies and local storage
We use a sign-in cookie and your browser’s local storage to keep you signed in and to remember settings and recent data so the app opens offline. We use no advertising or analytics cookies.
Changes
If we change this policy in a way that matters we will tell you in the app before it applies.