Privacy Policy

1. Data Controller

The data controller is Eric Lindholm.

Contact for privacy matters, access requests, rectification, or erasure: info@fartlek.io

2. Data We Process

• Account data: email address and authentication data via Supabase Auth.
• Training data: workouts, segments, distance, pace, heart rate, elevation, cadence, and planning data.
• Health data (special category of personal data under GDPR art. 9): HRV, resting heart rate, and health/injury history.
• Optional profile details you provide yourself: gender and birth year. They are used to make the coach’s heart-rate, pace and load references more accurate, and are shared with our AI providers for the same purpose. They are optional — the app works without them — and you can add, change or remove them at any time under Settings. Combined with training data they can say something about your health, so they are processed on the basis of your explicit consent (GDPR art. 9(2)(a)).
• Goal and race data: focus distances, race dates, priorities, and target times.
• Messages in the coach chat.
• Location data: the city you choose in settings, plus the start position and route of the workouts you sync from Intervals.icu. Routes power the map view in the app and are never shared with our AI providers. You can turn location collection off in the app — doing so also deletes the routes and start positions already saved.
• Weather data linked to your workouts and to your city, plus the place name for workouts done far from home (for example while travelling). The place name is shared with our AI providers so the coach can take it into account — coordinates never are.
• Device data for push notifications (device tokens).
• Purchase history and subscription status (handled by App Store, Google Play, and RevenueCat).

3. How Data Is Collected

• Directly from you in the app (onboarding, chat, goals, settings).
• From Intervals.icu when you connect your account via OAuth, including location data for activities recorded with GPS.
• From OpenWeather, which returns weather data for your city or a workout’s start position.
• Automatically for technical operations, such as error monitoring.

4. Purpose and Legal Basis

• Contract: to provide coaching, planning, and app functionality.
• Consent: for health data, the optional profile details (gender and birth year), and certain notification features.
• Legitimate interests: troubleshooting, security, and service improvement.

5. Third-Party Processors

We use the following services to operate Coach Fartlek. Data Processing Agreements (or equivalent) are in place with those that process personal data on our behalf. OpenWeather and Photon/Komoot receive only data that cannot be linked to you (rounded coordinates and a timestamp, and your search string respectively) and therefore do not process personal data on our behalf:

• Supabase (authentication and data storage within the EU).
• Anthropic (generates AI coaching responses based on your context).
• OpenAI (text embeddings for semantic memory in the chat).
• Sentry (error and performance monitoring).
• Expo (push notifications and OTA updates).
• Intervals.icu (import of training history after you connect your account).
• OpenWeather (weather forecasts and historical weather — we send coordinates and a timestamp, never anything that identifies you).
• Photon/Komoot (the city search in settings, and place-name lookups for workouts far from home — we send your search string and rounded coordinates respectively).
• App Store, Google Play Billing, and RevenueCat (purchase and subscription handling).
• Railway and Vercel (hosting environments for the API and website).

6. Data Retention

While your account is active we retain your data to provide the service.

When you delete your account from the app, your personal data is removed from our production systems immediately. Encrypted backups are purged within 30 days.

We may need to retain certain accounting data (purchase receipts) for up to 7 years under Swedish accounting law.

Error and operational logs in Sentry are deleted automatically after 90 days.

7. Automated Decision-Making and AI

Coach Fartlek uses a large language model (AI) to suggest training plans, comment on your workouts and reply in the chat. These suggestions are generated automatically from your training and health data.

The suggestions have no legal effects and do not constitute automated decision-making within the meaning of Article 22 GDPR. You are always free to follow, adapt, or ignore the coach’s suggestions.

You can stop using the app or delete your account at any time if you do not want your data to be used for AI-generated coaching.

8. Your Rights

Under GDPR, you have rights to access, rectification, erasure, restriction, objection, and data portability.

You can withdraw consent for processing of health data by deleting your account from the app or by contacting info@fartlek.io.

You can also lodge a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.

9. Security

We use technical and organisational safeguards, including encryption in transit (TLS) and separate encrypted storage for sensitive tokens (OAuth tokens and similar).

10. International Transfers

Our primary databases and authentication services (Supabase) are located within the EU/EEA.

Anthropic, OpenAI, Sentry, Expo, Vercel, Google, and RevenueCat may process data outside the EU/EEA (e.g. in the US). Where this happens, transfers are based on the European Commission’s Standard Contractual Clauses or other appropriate safeguards under Chapter V of the GDPR.

OpenWeather is based in the United Kingdom and Photon/Komoot in Germany. The UK is covered by the European Commission’s adequacy decision.

11. Children

The service is intended for persons aged 18 or over and is not intended for use by children.

12. Cookies and Tracking

The website uses a technical cookie to remember your language preference, and Vercel Analytics for aggregated visitor statistics. Vercel Analytics is cookieless, builds no profile of you, and does not follow you to other websites. We do not use marketing tracking.

The app does not use tracking cookies.

13. Changes to this Policy

We may update this policy when needed. The latest version is always published on this page with an effective date.

Material changes are communicated in the app or by email.