Privacy Policy

1. Controller

Yannik Foth, email: yannik.foth97@gmail.com.

2. Data we process

We process the following data: • Account data: email, hashed password, TOTP two-factor secret. • Training & health data from your Garmin account: runs (distance, pace, heart rate, HR zones, VO2max, raw activity data) and personal bests, and the GPS route (location data) and the course of a run over time (heart rate, pace, elevation, cadence), read from Garmin the first time you open that run. • Content you create: training plans, workouts, shoes, settings, notes, and chat messages with the AI coach. • AI usage logs (tokens per call), used for a daily usage limit.

Heart-rate and other health data are special-category data under Art. 9 GDPR.

3. Purpose & legal basis

We process this data to provide personalised training plans, run analysis, and an AI coach. The legal basis is your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), given when you accept the consent screen and revocable at any time by deleting your account (see 7).

4. Recipients / processors

We use the following processors, each under a data-processing agreement (Art. 28 GDPR): • Supabase — database & authentication, hosted in the EU (Frankfurt). • Vercel — web app hosting (Frankfurt function region); no persistent data lives here. • Render — Garmin connection service, hosted in the EU (Frankfurt). • Google — the AI coach (Gemini API); your chat messages and the training data the coach reads (runs, plan, PBs, HR zones, coach notes) are sent to Google when you use the chat. Google does not use this content to train its models and does not have it reviewed by people (Google's paid-service data terms, which apply to accounts in the EU). • GitHub — code hosting and CI. Database backups are stored in Supabase Storage (Frankfurt, EU), not on GitHub. Map tiles (not a processor): the map on a run's page loads its background map from OpenFreeMap (tiles.openfreemap.org, open-source maps built on OpenStreetMap data). Your browser fetches the tiles directly, so OpenFreeMap sees your IP address and which map area is shown; your route itself is drawn in your browser and is not sent to OpenFreeMap. The tile requests carry no cookies.

Some of these providers are US-based companies (Google, GitHub). Transfers to them rely on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses; everywhere data actually resides is EU (Frankfurt), except the AI coach call itself, which Google may process outside the EU.

5. Garmin

You connect your own Garmin account. We read your activities only when you trigger it ("Import runs") and write workouts back only when you trigger it.

6. Retention

We keep your data until you delete your account, with these exceptions: Kit keeps only your 15 newest coach conversations and deletes older ones every month, and AI usage logs are deleted after 12 months. Weekly database backups (without Garmin tokens) are stored in Supabase Storage (Frankfurt, EU) and deleted after about three months, so deleted data can remain in a backup until it rotates out. You can delete your account at any time in Profile → Settings, which removes all your data and your stored Garmin token.

7. Your rights

You have the right to access, rectification, erasure, restriction, data portability, and to withdraw consent at any time. In Profile → Settings you'll find "Export my data" and "Delete my account": • Export — downloads a JSON copy of everything you own. • Delete — permanently removes your account and all associated data, immediately.

Withdrawing consent means deleting your account. You may also complain to a data-protection supervisory authority.

8. Contact

yannik.foth97@gmail.com