Privacy Policy

We process the account details you provide, such as your name and email address; your athlete profile, goals, training plans and preferences; activities and files you upload; and messages, feedback and other information you enter into Athuno.

When you connect a supported device service, we receive the information you authorize it to share. Activity records can include timestamps, duration, distance, speed, pace, power, heart rate, elevation, GPS routes, laps and device information. We also retain connection identifiers, authorization details and delivery records needed to operate and troubleshoot synchronization. Some training measurements may reveal information about your health.

If you enable push notifications, we store a device notification token and platform information to deliver messages and workout comments. We also store read and unread states for conversations and comments.

Our hosting and authentication services process technical information needed to operate the app, including request logs, network information and session identifiers. Session cookies keep you signed in; preference cookies remember choices such as your display theme.

We use your information to provide your account, calendar, training plans, activity analysis and coaching features; synchronize activities and planned workouts with services you connect; respond to support requests; and maintain the reliability and security of Athuno.

Where applicable data-protection law requires a legal basis, we rely on performance of our agreement with you to provide requested services, legitimate interests in maintaining a secure and reliable service, consent for optional processing where required, and legal obligations where applicable. Health-related processing that requires explicit consent must be based on that consent. You may withdraw consent without affecting processing that was lawful before withdrawal.

You choose whether to connect a supported training service. Athuno connects directly to Garmin Connect and uses Terra for other supported providers, with the permissions you grant during connection. Authorized activity information supports your calendar and analysis. Planned workout information is sent to supported connected services when you request or enable workout synchronization.

The connected service also handles information under its own privacy policy. You can disconnect a service in Devices or revoke its permissions with the provider to stop future synchronization. Disconnecting does not delete activity history already imported into Athuno. Contact us if you want that history deleted as well.

We do not sell connected-service activity data or use it for advertising. Information imported from a connected service may form part of the training context used by AI coaching as described below.

When you connect Garmin Connect, Athuno receives the completed activities you authorize, including activity times, sport, distance, route coordinates, elevation, heart rate, power, cadence, laps and device information where available. We store activity summaries and recordings in our database to display your training calendar, maps and charts and calculate training load. Technical delivery records support reliable synchronization and troubleshooting.

If you enable planned workout synchronization, Athuno sends your planned workouts and their scheduled dates to Garmin Connect so you can sync them to a compatible device. Garmin authorization credentials are encrypted in our database. You can disconnect in Settings → Devices or revoke Athuno in Garmin Connect to stop future synchronization. Existing imported history remains until you delete it or request deletion.

Garmin data is made available to AI tools only with your separate permission, as described in the AI section below. We do not sell Garmin data or use it for advertising or to train our own AI models. Our hosting and database providers process it to operate Athuno; external AI providers receive relevant training context only when AI access is enabled. The AI and service-provider sections explain this processing further.

To request access, correction or deletion of Garmin data, contact info@koopai-endurance.com. Our retention and security section applies to imported activities, authorization records and technical delivery records. Garmin also processes your data under its own privacy policy.

AI coaching processes your messages and relevant athlete information, which may include training plans, activity summaries, goals and feedback, to generate personalized responses and training suggestions. This involves sending relevant context to external AI service providers. Avoid including information in a conversation that you do not want processed for that purpose.

The current implementation uses OpenRouter to access model-hosting providers. Its routing configuration requests providers that do not collect prompts for model training. Conversation history and related coaching records are stored by Athuno so conversations can continue. AI responses can be inaccurate and should be reviewed by you or your coach; they are not medical advice.

In Settings → Devices, use “KoopAI Coach can see my sessions” to grant or withdraw permission for AI tools to access your training data. We record your choice, its time and the version of the consent wording. With this permission off, athletes with connected-device history are excluded from the training data available through our AI tool access controls, including after a device is disconnected. Device synchronization and your own calendar and analysis remain available. Turning permission off stops future AI tool access; it does not erase earlier conversations or data already processed. Contact us to request deletion of those records.

Voice dictation is optional and asks for microphone permission. When you finish a recording for transcription, Athuno sends the audio through its server to OpenAI to convert it into text. Athuno does not save the audio recording in its server database. The resulting text is handled as a message, comment or other content if you submit it. OpenAI processes the audio under its own service and retention terms.

You can type instead, discard a recording before transcription, or revoke microphone permission in your device or browser settings.

If you allow notifications, Athuno sends your device token and notification content through Expo and your platform notification service, such as Apple Push Notification service. Notifications can contain the sender's name, a message or comment preview, and identifiers used to open the related conversation or workout. You can turn off notifications or hide previews in your device settings. Signing out unregisters the device from your account when the server is reachable.

On the website, optional session replay uses PostHog to help us understand usability problems. It runs only if the service is configured and you choose to allow it. It records what you see and type in the app, linked to your account identifier, with password fields masked. You can turn it off in Settings under General. The native mobile app does not include this replay feature.

Coaches or collaborators you authorize can access information made available through their role in Athuno. Service providers process information needed to deliver the app: Render for hosting, Supabase for authentication and database services, Terra and the training services you connect, OpenRouter and model providers for AI coaching, OpenAI for voice transcription, Expo and platform notification services for push notifications, and PostHog for optional website diagnostics.

Third parties receiving personal information must provide protection equivalent to that described in this policy. Providers acting on our behalf must use information only to deliver their services, protect it against unauthorized access, and comply with applicable deletion and data-protection requirements.

We may also disclose information when required by law or when necessary to investigate abuse, protect rights or respond to a security incident. We do not sell your personal information.

Our company and service providers may process information outside your country, including in the United States. Where international-transfer rules apply, appropriate safeguards are required. Contact us for information about the arrangements applicable to your data.

We retain account information, training history and conversations for as long as needed to provide the services you use, unless you request deletion or applicable law requires otherwise. Technical records may also be retained as needed for troubleshooting, security, legal obligations or resolving disputes. Disconnecting a device does not automatically remove these records. Deleted information may remain temporarily in backups until those backups are replaced.

We use access controls and other technical measures to protect information. No system can guarantee absolute security. Please protect your account credentials and contact us if you suspect unauthorized access.

Depending on the law that applies to you, you may request access to or a copy of your information, correction, deletion, portability, restriction of processing, or object to certain processing. You can also withdraw consent where processing relies on consent. We may need to verify your identity before acting on a request.

To delete your account, open Profile, then Account in the mobile app, or Settings, then Account on the website, and choose Delete account. This removes your login and training data you own. Information already shared with a coach or collaborator, and records we must retain for legal obligations, may remain. You can contact us to request deletion of specific records or ask about any information retained after account closure.

You may complain to your local data-protection authority. To exercise your rights or ask about the information held in Athuno, use the contact address below. We will explain any applicable limits, including records we must retain by law.

We will update this page when our practices change. Material changes will be communicated through an appropriate channel, and we will request new consent when required before beginning the affected processing.