Privacy Policy
1. Data Controller
Digital Creatives UG (haftungsbeschränkt)
Elisabeth-Emter-Weg 6
79110 Freiburg im Breisgau
Germany
Email: help@race-mind.com
2. Overview
This Privacy Policy explains what personal data we collect when you use the app RaceMind – Triathlon & Running Coach (hereinafter “App”) and our website race-mind.com (hereinafter “Website”), how we process it, and what rights you have.
The App is intended for users aged 16 and older. We do not knowingly collect data from anyone under the age of 16.
3. What Data We Collect
3.1 Data You Provide Directly
| Category | Examples | Purpose |
|---|---|---|
| Profile data | Name, year of birth, height, weight | Training plan creation, zone calculation |
| Training experience | Experience duration, current weekly volume, available hours | Plan individualization |
| Performance data | Running personal bests, cycling speed, swim pace, heart rate values (Max HR, LTHR, resting HR) | Threshold calculation, race prognosis |
| Health data | Injuries and conditions (name, severity 1–5, body region) | Plan adjustment, injury management |
| Race data | Target race, date, distance, goal time | Training planning, prognosis |
| Availability | Rest days, time slots (AM/PM) | Weekly planning |
| Chat messages | Questions to the coach, feedback, mood check-ins | Coaching responses, plan adjustment |
| Account data | Email address (when linking account via Apple, Google, or email) | Authentication, data recovery |
3.2 Data From Third Parties
| Source | Data | Purpose |
|---|---|---|
| Strava | Training activities (duration, distance, pace, heart rate, power, lap data, elevation, cadence, device name) | Training analysis, baseline calculation, Performance Score |
| Intervals.icu | Training activities and performance data | Training analysis, plan optimization |
| Garmin Connect | Training activities (duration, distance, pace, heart rate, power, lap data, elevation, cadence, device name); daily wellness summaries (resting heart rate, steps, respiration rate); sleep (duration, score, quality); heart rate variability (HRV) – see Section 6.8 | Training analysis, baseline calculation, training readiness, workout push to watch |
| Apple Health / HealthKit (iOS) | Heart rate variability (HRV SDNN), resting heart rate, sleep duration and stages | Recovery assessment, training readiness |
| Google Health Connect (Android) | Heart rate variability (HRV RMSSD), resting heart rate, sleep sessions and stages | Recovery assessment, training readiness |
Connecting to these services is optional. You can use the App without any connections (manual data entry). When you connect a third-party service, the respective platform’s own privacy policy also applies to the collection and transfer of your data.
3.3 Automatically Collected Data
| Category | Details |
|---|---|
| Technical data | Device type, operating system, app version, error reports (crash logs via Sentry) |
| Usage data | Timestamps of app usage, onboarding progress |
| Anonymous session | An anonymous session ID is created at app launch (no personal identification) |
| Approximate location data | When you open the weekly planning screen, your IP address is converted into an approximate location (city/region level) exclusively on our own server. The IP address is not transmitted to any third party and is not stored persistently. See Section 6.7 for details. |
3.4 Data Processing on Our Website (race-mind.com)
In addition to using the App, we also process personal data when you visit our Website or contact us through it.
Website Hosting and Server Log Files
When you access our Website, the hosting provider automatically collects and stores information in server log files that your browser transmits automatically. This includes:
- Browser type and version
- Operating system
- Referrer URL (the previously visited page)
- Hostname of the accessing device
- Time of server request
- IP address
This data is processed exclusively by the hosting provider (GitHub Pages) as part of operating the Website. We do not store server log files ourselves and do not have access to this data. This data is not merged with other data sources.
- Purpose: Ensuring a smooth connection, system security, and technical reliability of the Website.
- Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and error-free provision of the Website.
Audience Measurement with Cloudflare Web Analytics
On individual pages of our Website (home page, Kona calculator, race time projection, partner page, campaign landing pages) we use Cloudflare Web Analytics, a service provided by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. It collects aggregated usage data such as the page visited, the previously visited page (referrer), approximate load times, and browser and device type.
Cloudflare Web Analytics operates without cookies and neither stores nor reads any information on your device. No fingerprinting takes place, and no profiles are built across multiple visits or across websites. Your IP address is processed only transiently to attribute the page view and is not stored permanently.
- Purpose: Understanding the reach and use of our Website in order to tailor content and services to actual demand.
- Legal basis: Art. 6(1)(f) GDPR. The legitimate interest lies in the statistical evaluation of usage behaviour to improve our offering. Consent under Sec. 25(1) TDDDG is not required, as no information is accessed on your device.
- Objection: You may object to this processing at any time under Art. 21 GDPR (see section 9).
Contact Form and Email Contact
If you send us inquiries via the contact form on the Website or by email, your details from the inquiry form (name, email address) including the message you entered are stored for the purpose of processing your request and in case of follow-up questions. We do not share this data without your consent.
Your message is stored directly in our own database at Supabase (server location EU/Ireland); no external form service is involved. To prevent spam and automated bulk submissions, we additionally store a checksum (hash) of your IP address generated with a secret key. The IP address itself is not stored and cannot be reconstructed from this checksum.
- Purpose: Processing and responding to your individual inquiry, and protecting the form against abuse.
- Legal basis: If your inquiry relates to the conclusion of a contract (e.g., questions about subscriptions or app usage), the legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures). In all other cases, processing is based on our legitimate interest in effectively handling inquiries directed to us and in protecting against spam under Art. 6(1)(f) GDPR.
- Retention: The data you enter in the contact form remains with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after your request has been fully processed). Mandatory statutory provisions – in particular retention periods – remain unaffected.
3.5 Campaign Landing Pages
We run ads on Facebook and Instagram. On the landing pages these ads point to (race-mind.com/start/), we use no advertising trackers and no cookies. The Meta Pixel previously used there has been removed; no script from Meta is loaded any more and no data is transmitted to Meta.
As on the rest of our Website, we measure audience cookielessly with Cloudflare Web Analytics (see section 3.4).
Campaign identifier when moving to the app stores
When you tap the link to the App Store or Google Play on a landing page, we append an identifier for the ad you came from to that link. Apple and Google then report back how many installations can be attributed to a campaign – as an aggregated figure only. We receive no information about individual people and cannot trace an individual installation back to you.
- Purpose: Measuring which of our ads lead to installations.
- Legal basis: Art. 6(1)(f) GDPR – legitimate interest in measuring the success of our advertising. Consent under § 25(1) TDDDG is not required, as no information is stored on or read from your device in the process.
- Recipients: Apple and Google as the operators of the respective app stores. Their own privacy policies apply to their processing.
- Retention: Nothing is stored on your device. The aggregated campaign reports from Apple and Google are subject to their retention periods.
4. Legal Basis for Processing
| Processing activity | Legal basis |
|---|---|
| Training plan creation, analysis, prognosis, chat coaching | Art. 6(1)(b) GDPR – Performance of a contract |
| Processing health data (injuries, heart rate, HRV) | Art. 9(2)(a) GDPR – Explicit consent |
| Deletion of inactive anonymous profiles (cleanup) | Art. 6(1)(f) GDPR – Legitimate interest (data hygiene) |
| Connection to Strava, Intervals.icu, Garmin Connect, Apple Health | Art. 6(1)(a) GDPR – Consent |
| Display of weather forecast in weekly planning (IP-based geolocation) | Art. 6(1)(f) GDPR – Legitimate interest (providing relevant training context information) |
| Audience measurement on the Website (Cloudflare Web Analytics) | Art. 6(1)(f) GDPR – Legitimate interest (cookie-free statistics to improve our offering) |
Your consent for processing health data is obtained as a mandatory step during onboarding. Since the App’s core functionality (training planning, analysis, injury management) requires processing health-related data, consent is a prerequisite for using the App.
You can withdraw your consent at any time by triggering the withdrawal in the App under Settings → Legal → Revoke consent (alternatively via Delete Account) or by emailing us (see Section 9). Because your data is strictly required to provide the coaching features, the withdrawal results in deletion of your account and all associated data.
5. Recipients and Third-Party Services
We use the following service providers to operate the App and Website:
| Service provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase Inc. | Database, authentication, serverless functions | EU (Ireland) | Data processing within the EU |
| Google LLC (Gemini API) | Training plan generation, training analysis, coach chat | USA | EU Standard Contractual Clauses (SCCs) |
| Google LLC (Firebase Cloud Messaging) | Push notification delivery (FCM to Android devices) | USA | EU Standard Contractual Clauses (SCCs), Data Privacy Framework |
| Strava Inc. | Training import (only when connected) | USA | You authorize access directly with Strava (OAuth) |
| Garmin International, Inc. | Training import, workout push to watch (only when connected) | USA | You authorize access directly with Garmin (OAuth); EU Standard Contractual Clauses (SCCs) |
| intervals.icu Ltd | Training import (only when connected) | UK (operator); data processing in Germany/Finland | You authorize access directly (OAuth); EU data processing; UK adequacy decision |
| GitHub Inc. (GitHub Pages) | Website hosting and server log files | USA | EU Standard Contractual Clauses (SCCs), Data Privacy Framework |
| Cloudflare, Inc. | Cookie-free audience measurement on individual Website pages (Cloudflare Web Analytics) | USA | EU Standard Contractual Clauses (SCCs), Data Privacy Framework |
| Sentry (Functional Software, Inc.) | Error and crash monitoring of the App | EU (Frankfurt) | EU hosting (Sentry EU/Frankfurt), Data Processing Agreement (DPA), data processing within the EU |
| IONOS SE | Domain registration and DNS for race-mind.com | Germany | Data Processing Agreement (DPA), data processing within the EU |
| Expo, Inc. | Push notification delivery (relay to Apple APNs and Google FCM) | USA | EU Standard Contractual Clauses (SCCs) |
| Open-Meteo | Retrieval of the 7-day weather forecast based on coarse coordinates (no IP transmission) | Switzerland | EU Commission adequacy decision for Switzerland; open-source weather service (CC-BY 4.0) |
Note on third-country transfers: Some of our service providers are based in the USA. We ensure an adequate level of data protection through EU Standard Contractual Clauses (SCCs) and Data Processing Agreements (DPAs) pursuant to Art. 46(2)(c) GDPR.
6. Data Processing in Detail
6.1 Training Plan Generation
The training plan itself (weekly structure, intensity distribution, load management) is calculated entirely deterministically on our servers — using mathematical formulas, threshold models, and load ratios. No AI is involved in this calculation.
For the accompanying coaching texts (e.g., plan introduction, week descriptions, motivational notes), we send relevant profile and plan-context data to Google Gemini to phrase these texts in a personalized way. In this process:
- No real names are sent to Gemini (only anonymized user IDs)
- Data is used solely for text generation and is not used by Google for its own purposes
- Results are stored in our database (Supabase, EU)
6.2 Training Analysis
After each training session, your activity data (imported from Strava, Intervals.icu, or Apple Health) is analyzed:
- Metrics such as Efficiency Factor, Drift, and Pacing are deterministically calculated (no random element)
- The qualitative interpretation is provided by Google Gemini
- You receive a Performance Score (0–100) and actionable coaching advice
6.3 Coach Chat
Your chat messages are sent to Google Gemini along with relevant training context to provide personalized answers. Chat histories are stored in our database.
6.4 Health Data (Apple Health / Google Health Connect)
If you choose to connect Apple Health (iOS) or Google Health Connect (Android), the App reads the following data locally on your device:
- Heart rate variability (HRV) – SDNN (iOS) or RMSSD (Android)
- Resting heart rate
- Sleep duration and stages (e.g., deep sleep, REM, light sleep)
This data is used to calculate your daily Training Readiness – a recovery indicator that helps you decide whether to train as planned, reduce intensity, or take a rest day.
How the data is processed:
- Health data is read directly from Apple Health / Health Connect on your device via the respective platform APIs
- Daily summaries (HRV, resting HR, sleep duration) are transmitted to our database (Supabase, EU) and stored there, linked to your user ID
- If you also have Intervals.icu connected, health data from that source takes priority; Apple Health / Health Connect data only fills in missing values
- The raw values from Apple Health / Health Connect (HRV, resting heart rate, sleep stages) are never shared with third parties, used for advertising, or sent directly to AI services. Training metrics derived from them (e.g., thresholds, recovery status) may be included in AI-based coaching text generation (see Section 6.1). Injury information you enter during onboarding may also be included in those texts.
- On first connection, the App backfills the last 14 days of health data to establish a stable baseline
Connecting Apple Health or Health Connect is entirely optional. You can use all other features of the App without it. You can disconnect at any time in the App under Settings → Connections, which stops further data synchronization. Previously synced data remains in your account until you request deletion.
- Legal basis: Art. 9(2)(a) GDPR – Explicit consent (you actively choose to connect and grant permissions via the platform’s permission dialog)
6.5 Automated Processing
Training plans, metrics, and prognoses are primarily based on deterministic calculations (mathematical formulas, threshold models, workload ratios). Google Gemini provides supplementary qualitative interpretation and coaching text. This does not constitute solely automated decision-making with legal or similarly significant effects within the meaning of Art. 22 GDPR. All outputs are recommendations for fitness purposes — you are free to adjust or disregard them at any time.
In accordance with Art. 50 of Regulation (EU) 2024/1689 (AI Act), we inform you that the coach chat, training plans, and analysis texts are generated with the assistance of an AI system (Large Language Model). AI-generated content is labeled accordingly in the App.
6.6 Anonymous Usage and Account Linking
When you start the App, an anonymous session is created. You can initially use the App without personal registration. After onboarding, we recommend linking your account with Apple, Google, or email to enable data recovery on device changes.
6.7 Weather Forecast in Weekly Planning
On the weekly planning screen, we display a 7-day weather forecast for your approximate location to help you plan your training accordingly. For this, we process location data at city/region level:
- When you open weekly planning, our server (Supabase, EU) reads the IP address of your request.
- We derive your approximate location (coordinates and city) from that IP address exclusively on our own server. The IP address never leaves our infrastructure and is not transmitted to any third party. Accuracy is typically at city or regional level, not at street level.
- We send Open-Meteo (Switzerland) only the derived coordinates in order to retrieve the 7-day forecast. Your IP address is not transmitted there.
- We do not store the IP address, the derived coordinates, or the city name permanently. They are processed only during the lookup. If an error occurs, the IP address may be temporarily logged in our error monitoring (Sentry, EU).
- The weather forecast is an optional convenience feature. You can disable it at any time under Settings → App → Weather forecast. Your IP address is then not processed for geolocation.
- Legal basis: Art. 6(1)(f) GDPR – Legitimate interest (providing relevant training context information such as precipitation and wind that supports your training decisions).
6.8 Garmin Connect
If you connect Garmin Connect, you authorize the connection directly with Garmin (OAuth). We never receive your Garmin password. Connecting is entirely optional — every other feature of the App works without it.
What data we receive
- Training activities – sport type, start time, duration, distance, pace and speed, heart rate, power, cadence, elevation, lap data, the measurement series recorded during the activity, and the name of the recording device
- Daily wellness summaries – resting heart rate, steps, and average respiration rate. Garmin also transmits stress level, Body Battery and pulse oximetry (SpO₂) in the same category; we discard these values on receipt and do not store them.
- Sleep – duration, sleep score, and sleep quality
- Heart rate variability (HRV) – overnight average
- Connection data – your Garmin user ID and the OAuth access token that authorizes us to retrieve data on your behalf
Garmin transmits this data to our server (Supabase, EU) by push notification as soon as a new activity or daily summary becomes available. We do not query your Garmin account on a schedule. Which data types are transmitted depends on the permissions you grant during authorization at Garmin.
How we use this data
- Training analysis – metrics such as Efficiency Factor, Drift, and Pacing, and your Performance Score (see Section 6.2)
- Thresholds and load – your Garmin activities update the threshold values and load metrics (e.g., FTP, threshold pace, critical swim speed, training load, personal bests) from which your training plan is calculated. The plan structure itself is computed deterministically on our servers; Garmin raw data is not transmitted to Google Gemini for this purpose.
- Training Readiness – HRV, resting heart rate, and sleep data feed into the daily recovery indicator (see Section 6.4)
- Workout push – if you use this feature, we transmit planned workouts back to your Garmin account so they appear on your watch
Processing with AI (Google Gemini)
For the qualitative interpretation of a session and for coach chat responses, we transmit the relevant training context to Google Gemini (USA, EU Standard Contractual Clauses). This includes values that originate from your Garmin data — for example duration, distance, pace, heart rate zones, calculated metrics, and recovery status. In this process:
- No real names are sent to Gemini (only anonymized user IDs)
- The original payload transmitted by Garmin is not forwarded to Gemini
- Data is used solely for text generation and is not used by Google for its own purposes
- AI-generated content is labeled accordingly in the App (see Section 6.5)
Storage
- Activities and wellness data (resting heart rate, sleep, HRV, respiration) are stored in our database (Supabase, EU/Ireland), each linked to your user ID.
- For daily wellness summaries we additionally retain the original payload transmitted by Garmin, so that subsequent corrections and recalculations remain possible.
- Incoming Garmin events are held for up to 14 days in a technical queue so that failed imports can be replayed. They are deleted afterwards. The measurement series recorded during an activity are deleted immediately after processing.
- Garmin data is never sold, shared with third parties for their own purposes, or used for advertising.
- Your Garmin access token is stored in your profile and is deleted when you disconnect.
- All further retention periods follow Section 7.
Disconnecting and deletion
- You can disconnect at any time in the App under Settings → Connections → Garmin Connect. We then revoke our access authorization at Garmin, delete your Garmin tokens and your Garmin user ID, and stop processing further Garmin data.
- You can also revoke the authorization directly at Garmin by removing RaceMind at connect.garmin.com → Account Settings → Connected Apps. Garmin then notifies us and we mark the connection as terminated.
- If you only change individual permissions at Garmin (for example, allow activities but not health data), Garmin notifies us of the change and we only process the categories that are still permitted.
- When you delete your account, we actively revoke our access authorization at Garmin and delete all imported data (see Section 7).
- Legal basis: Art. 6(1)(a) GDPR – Consent; for health-related data (heart rate, HRV, sleep) additionally Art. 9(2)(a) GDPR – Explicit consent
7. Data Retention
| Data | Retention period |
|---|---|
| Profile and training data | As long as your account is active |
| Chat histories | As long as your account is active |
| Anonymous profiles without completed onboarding | 48 hours, then automatically deleted |
| System logs (Gemini Logs) | 90 days, then anonymized or deleted |
After account deletion, all personal data is fully removed within 30 days.
8. Data Security
We implement the following technical and organizational measures:
- Row Level Security (RLS): Every database query is restricted to the user’s own ID. You can only access your own data.
- Encryption: All data is encrypted in transit (TLS/HTTPS) and at rest (database encryption).
- OAuth: Strava, Garmin Connect, and Intervals.icu connections use industry-standard OAuth authorization (the protocol version depends on the respective provider). We store only access tokens, not your passwords.
- Anonymous authentication: Before account linking, the App operates with an anonymous session – no email or personal identification required.
9. Your Rights
Under the GDPR, you have the following rights:
| Right | Description |
|---|---|
| Access (Art. 15) | You can request to know what data we store about you at any time. |
| Rectification (Art. 16) | Inaccurate data can be corrected. |
| Erasure (Art. 17) | You can request deletion of your account and all data. |
| Restriction (Art. 18) | You can request restriction of processing. |
| Data portability (Art. 20) | You can receive your data in a machine-readable format. |
| Objection (Art. 21) | You can object to processing based on legitimate interests. |
| Withdrawal of consent (Art. 7(3)) | You can withdraw your consent at any time. The lawfulness of processing prior to withdrawal remains unaffected. |
How to exercise your rights:
You can withdraw your consent directly in the App under Settings → Legal → Revoke consent or delete your account under Settings → Legal → Delete Account. Both paths result in deletion of all associated data and withdraw any previously given consent. Alternatively, send an email to help@race-mind.com. We will respond within 30 days.
Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Lautenschlagerstraße 20
70173 Stuttgart, Germany
www.baden-wuerttemberg.datenschutz.de
10. Disconnecting Third-Party Services
- Strava: In the App under Settings → Disconnect. Additionally at strava.com → Settings → My Apps.
- Garmin Connect: In the App under Settings → Disconnect. Additionally at connect.garmin.com → Account Settings → Connected Apps.
- Intervals.icu: In the App under Settings → Disconnect.
- Apple Health / Health Connect: In the App under Settings → Connections. Additionally, you can revoke the App’s access in your device’s health settings (iOS: Settings → Health → Data Access; Android: Settings → Health Connect → App permissions).
Disconnecting a service stops further data import. Previously imported training and health data remains in your account until you request deletion.
11. Cookies and Tracking
The App uses no cookies. The same applies to our Website: we employ no cross-device tracking, no advertising networks, and no profiling there.
Since August 2026 this also covers our campaign landing pages. The Meta Pixel previously loaded there after consent has been removed, and the corresponding consent banner has been dropped. Details in section 3.5.
On individual pages of the Website we use Cloudflare Web Analytics for cookie-free audience measurement, which neither stores nor reads any information on your device (see section 3.4). No consent banner is required for this.
Fonts are served from our own server; no connection to external font services takes place.
12. Push Notifications
The App uses push notifications to remind you of training sessions, send coach tips, and deliver other relevant updates. Push notifications are delivered via the Expo Push Notification Service (Expo, Inc.), which acts as a relay to Apple Push Notification Service (APNs) on iOS and Firebase Cloud Messaging (FCM) (Google LLC) on Android. Firebase Cloud Messaging is a service of Google LLC (USA); data transfer is based on EU Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework.
For delivery, a device-specific push token (Expo Push Token) is generated and stored in our database (Supabase, EU). This token is a technical identifier tied to your device and app installation — it does not contain personal information such as your name or email address.
Push notifications are optional. You can disable them at any time in your device settings (iOS: Settings → Notifications → RaceMind; Android: Settings → Apps → RaceMind → Notifications).
- Purpose: Delivery of training reminders, coaching tips, and app-related updates.
- Legal basis: Art. 6(1)(b) GDPR – performance of a contract (notifications as part of the coaching service); Art. 6(1)(f) GDPR – legitimate interest (general product updates).
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time, for example when adding new features or in response to changed legal requirements. We will notify you of material changes via in-app notification. The current version is always available in the App and on our website.
14. Contact
For questions about data protection, you can reach us at:
Digital Creatives UG (haftungsbeschränkt)
Elisabeth-Emter-Weg 6
79110 Freiburg im Breisgau, Germany
Email: help@race-mind.com