Privacy policy

Last updated September 17, 2026

1. Who is responsible

The controller for the processing of your personal data in EffortTrace is:

Balint Schmidt
Cäcilienstrasse 39
74072 Heilbronn
Germany

2. What this covers

EffortTrace analyses training data for cycling and running. Much of that data is health data in the sense of Article 9 GDPR, because heart rate, heart rate variability, sleep and how you feel say something about your health. This policy explains what we store, why, who helps us run the service, and what you can do about it.

3. The data we process

Account: your email address and, if you set one, a password (stored only as a hash by our authentication provider).
Profile: display name, year of birth, sex, height, training thresholds (FTP, maximum and resting heart rate, heart rate zones), your language and units, and any notes you write about injuries or conditions the coach should train around.
Activities: the files you upload (FIT, TCX, GPX) and what we derive from them: GPS tracks and locations, time, distance, speed, elevation, heart rate, power, cadence, temperature, laps, power and pace curves, splits, segments and your rating of effort.
Wellness: overnight data you sync or enter (resting heart rate, HRV, sleep and sleep stages, stress, body battery, SpO2, respiration) and your morning check in (fatigue, soreness, stress, motivation, illness, notes).
Training plans: planned sessions, workouts and gear.
AI coach: how much of the daily coaching allowance you used. Your coach conversations are kept in your browser, not on our servers.
Subscription: your plan, its status and billing period, and the customer and subscription identifiers from our payment provider. We never see or store your card details.
Technical data: IP address, browser and time of request in our hosting provider's logs, and the cookies described in section 7.

4. Why we process it, and on what legal basis

To provide the service you signed up for (account, storage, analysis, plans, subscription): Article 6(1)(b) GDPR, the contract with you.
Health data: Article 9(2)(a) GDPR, your explicit consent, which you give when you create your account. Without it we cannot provide the service, because analysing this data is what the service does.
Security and abuse prevention (server logs, rate limits): Article 6(1)(f) GDPR, our legitimate interest in keeping the service and everyone's data safe.
Invoices and accounting records: Article 6(1)(c) GDPR, our legal obligation to keep them.

We do not sell your data, use it for advertising, or build profiles of you beyond the training analysis you can see in the app. The readiness and load figures are computed automatically but are guidance for you, not decisions with legal or similarly significant effect.

5. Who helps us run the service

These providers process data on our behalf under data processing agreements. Where data leaves the European Economic Area, the transfer relies on the EU US Data Privacy Framework or the European Commission's standard contractual clauses.

Supabase (Supabase, Inc., USA): database, file storage and sign in. Your data is stored in the EU (Ireland).
Vercel (Vercel Inc., USA): hosting of the web application and its server logs.
OpenAI (OpenAI, USA): only when you use the AI coach (a Pro feature). To answer, the coach is sent your question and the training context it needs: profile, thresholds, your notes about injuries or conditions, recent activities, load and fitness figures, and wellness figures. We ask OpenAI not to store the responses, and OpenAI does not use API data to train its models. OpenAI may keep requests for up to 30 days to detect abuse.
Stripe (Stripe Payments Europe, Ltd., Ireland): payments, subscriptions, invoices and tax calculation. Stripe is also an independent controller for fraud prevention and its own legal obligations; see stripe.com/privacy.
Open-Meteo: weather for an activity. Our server sends only the start coordinates and date, with nothing that identifies you.
OpenFreeMap and OpenStreetMap: map tiles. Your browser loads them directly, so these services receive your IP address and the map area you are looking at.

6. How long we keep it

We keep your data for as long as you have an account. When you delete your account (Settings, Account, Delete account), your account, profile, activities, files, wellness, plans and usage records are deleted immediately. Copies in our database backups are overwritten within 7 days. Invoices and payment records are kept for the periods tax and commercial law require (up to 10 years in Germany), and nothing else about you is kept with them.

7. Cookies and local storage

We only use what the service needs to work: a sign in cookie that keeps you signed in, cookies that remember your chosen language and units, and your browser's local storage for your theme, your coach conversations and similar preferences. There is no analytics, no advertising and no tracking, so there is nothing to agree to beyond signing in (§ 25 (2) TDDDG).

8. Your rights

You have the right to:

access the data we hold about you (Article 15 GDPR);
have it corrected (Article 16);
have it deleted (Article 17), which you can do yourself at any time by deleting your account;
restrict its processing (Article 18);
receive it in a portable format (Article 20), which you can do yourself under Settings, Backup;
object to processing based on our legitimate interests (Article 21);
withdraw your consent at any time with effect for the future (Article 7(3)). Because the service cannot work without processing health data, withdrawing consent means deleting your account, or writing to us and we will delete it;
complain to a data protection supervisory authority, in particular the one where you live or work or where the alleged infringement took place (Article 77).

For anything else, write to hello@efforttrace.com.

9. Age

EffortTrace is for people aged 16 and over.

10. Changes

When this policy changes in a way that affects what you agreed to, we ask for your agreement again the next time you open the app. See also our terms of service.