Data controller
Your data controller is Triathlify, based in Wrocław, Poland ("Triathlify", "we"). For data-related inquiries: privacy@triathlify.com.
What we collect
Account data: email address, name (optional), password (stored as a hash).
Training data: sessions, benchmark results, zones, training plans — synced from Garmin Connect, Strava, Apple Health, Polar, Coros, Suunto, Oura, Whoop, or entered manually.
Onboarding data: your answers from the initial assessment (goal, distance, available hours, experience level).
Payment data: processed by Stripe and TPay — we do not store card numbers. We store your subscription ID, transaction dates, and amounts.
Technical data: IP address, browser type, operating system — collected automatically in server logs and by Google Analytics / Google Tag Manager.
AI coach data: conversation content with the AI coach, processed by third-party AI providers (Anthropic, OpenAI, or Google) solely to generate responses.
Legal basis for processing (GDPR)
Art. 6(1)(b) — contract performance: processing account, training, and onboarding data is necessary to provide the service (generating and adapting your training plan).
Art. 6(1)(f) — legitimate interest: analytics (Google Analytics), fraud prevention, improving the adaptation engine using aggregated, anonymized patterns.
Art. 6(1)(a) — consent: push notifications, weekly digest email. You can withdraw consent at any time in Settings.
Art. 6(1)(c) — legal obligation: retention of billing data per applicable tax law.
How we use your data
Generating and adapting your personalized training plan based on your data and goals.
Processing payments and managing subscriptions.
Transactional communication: confirmations, plan changes, session notifications.
Weekly training digest — you can turn it off in Settings.
Improving the service using aggregated, non-identifying statistics (adherence rates, adaptation patterns). You can opt out in Settings.
Third-party processors
Stripe, Inc. (USA) and Krajowy Integrator Płatności S.A. / TPay (Poland) — payment processing.
Google LLC (USA) — Google Analytics and Google Tag Manager (analytics).
Anthropic, PBC / OpenAI, Inc. / Google LLC (USA) — AI coach query processing. These providers do not retain your training data beyond generating a response.
Infrastructure providers (EU) — application and database hosting.
We do not sell, rent, or share your data with advertisers. We do not have advertisers.
International data transfers
Application servers and databases are located in the EU (Frankfurt, Paris). Some processors (Stripe, Google, Anthropic, OpenAI) are based in the USA — transfers are made under Standard Contractual Clauses (SCCs) or an EU adequacy decision (EU–US Data Privacy Framework).
Data retention
Account and training data: retained while your account is active. After account deletion, data is permanently erased within 30 days.
Billing data: 5 years from the end of the tax year, per applicable law.
Server logs: 90 days.
AI coach conversations: 30 days after the last message in a thread.
Your rights
Access — export your data as JSON or CSV from Settings → Export.
Rectification — edit your profile in the app or email privacy@triathlify.com.
Erasure — Settings → Delete account. Completed within 30 days.
Restriction, portability, objection — email privacy@triathlify.com.
Withdraw consent — at any time, without affecting the lawfulness of prior processing.
Lodge a complaint — with your local data protection authority. For EU residents, this includes the supervisory authority in your country of residence.
Security
Encryption at rest (AES-256) and in transit (TLS 1.3). Passwords stored as hashes (bcrypt). Production data access restricted to minimum necessary personnel.
Children
Triathlify is intended for users aged 16 and over. We do not knowingly collect personal data from anyone younger. If you learn that a person under 16 has provided us with data, please contact us — we will delete it promptly.
Changes to this policy
We will notify you of material changes by email and/or in-app notification at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.