Privacy policy

Last updated 15 October 2026

elastride is an AI running coach. We collect as little as possible, never sell data, run no analytics, ads or tracking, and you can download or delete everything at any time.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is Andreas Katzer, Swizerland. Contact: katzer.andreas@gmail.com.

2. What we process and why

• Your Google account – name, email address, profile picture and Google account ID, received when you sign in with Google. We never see or store a password. Purpose: your account. Legal basis: contract (Art. 6(1)(b)).
• Your Apple ID, if you sign in with Apple – your name (Apple sends it only on the first sign-in; we keep it then), your email address – or, if you chose “Hide My Email”, a private relay address that forwards to you – and your Apple user ID. We never see or store a password. An Apple sign-in is linked to an existing elastride account only when Apple confirms the email address is verified; a relay address is an account of its own. Purpose: your account. Legal basis: contract (Art. 6(1)(b)).
• Sign-up details – date of birth, country (and US state or Canadian province), the name you want to show and when you accepted this policy. Purpose: elastride is for adults only – we check that you have reached the age of majority where you live (at least 18) – and age groups for race standards. If you are under that age we delete the account immediately. Your date of birth is never sent to AI providers. Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).
• Access status – elastride is invite-only: when you first sign in we record your access request and whether the administrator approved it (with the date). The administrator sees your name, email, profile picture and sign-in dates to decide. Legal basis: legitimate interest in controlling who uses the service (Art. 6(1)(f)). You can download or delete your data at any time, also while you wait.
• What you enter – goals (races and things to improve, with timeframe and priority), the coach's plan outline, planned workouts, training buddies and weekly challenge target. Legal basis: contract (Art. 6(1)(b)).
• Optional runner profile – birth year, race category and marathon / half-marathon best times, only if you fill them in (Races page or plan builder). Birth year and category are used only to check age-graded qualifying times and never leave elastride; your best times also help the AI coach judge your goals (see below). Clear the fields to delete them. Legal basis: contract (Art. 6(1)(b)).
• Your activities, if you connect Intervals.icu and allow reading them – the runs and other activities your watch synced to Intervals.icu (date, sport, distance, time, pace, elevation, heart rate, cadence, the recording device and the start area – and, when you open one activity, its recorded track: GPS route, altitude, heart rate, speed and cadence along the way, plus what Intervals.icu computed such as training load, calories and heart-rate zones) and your max, threshold and resting heart rate settings are read live from Intervals.icu while you use the app and are not stored by us. To open faster, your browser keeps a copy of your last loaded activities for up to 24 hours on your own device (see section 4). Heart-rate and other fitness data can be health data (Art. 9), so we only process it with your explicit consent, given when you switch on “Read my activities” (Art. 9(2)(a), Art. 6(1)(a)). Withdraw it any time on the Connectors page. Activities Intervals.icu received from Strava are never read.
• Workouts recorded on several devices – when the same workout comes from two devices (e.g. a watch and the phone), elastride compares the recordings on the activity page; they are read live from Intervals.icu like any activity and not stored. Only your choice of which one counts (the average or one device by name) is saved with your account (Art. 6(1)(b)) and deleted with it.
• Your wellness data, if you connect Intervals.icu and allow reading it – the daily values your watch sends to Intervals.icu (sleep duration and score, HRV, resting and sleeping heart rate, steps, blood oxygen) are read live while you use the app, shown in your metrics and Energy and used by the coach; they are not stored by us (not even on your device). This is health data (Art. 9), so we only read it with your explicit consent, given separately when you switch on “Read my wellness data” (Art. 9(2)(a), Art. 6(1)(a)); withdraw it any time on the Connectors page.
• Strava – no longer supported (since 9 October 2026): Strava's API terms don't allow its data in an AI coach, so elastride stopped reading Strava. Connections made before are revoked at Strava and deleted together with everything we held from Strava (account ID, name, picture link, tokens); nothing from Strava is kept.
• Daily check-ins and VO₂max values, if you use them – resting heart rate, heart rate variability (HRV), hours of sleep, energy, soreness, how hard your session felt (RPE), an optional note and “not feeling 100 %” reports (tired, ill or a niggle, how bad, pain 0–10 and where), per day; and VO₂max values you log (measured tests with optional threshold heart rates, or your watch's estimate). Purpose: your recovery trends on the Metrics page and context for the AI coach when you ask it. This is health data (Art. 9), so we store it only after your explicit consent, given with your first check-in (Art. 9(2)(a), Art. 6(1)(a)). Withdraw it any time with “Delete my health data” on the Metrics page – that deletes every check-in and VO₂max value immediately.
• AI coach and plan builder – when you send a message or let the coach plan, your message (or your goals and run days) plus a compact training summary (weekly volume, consistency, fitness estimate and predicted times, fitness/form, heart-rate range, metric trends, recent runs from Intervals.icu, your best times, plan and goal – and, if you use them, your check-in and wellness trends) is sent to the AI provider you pick to produce the answer. Chats are not stored by elastride; they disappear when you reload. Legal basis: your consent given when you allow reading your activities or wellness data, and contract (Art. 6(1)(b)).
• Sending workouts to your watch, if you connect a platform – for Suunto and Garmin we store your account ID and encrypted access tokens; for Intervals.icu your athlete ID and your API key, encrypted. Your planned sessions of the next weeks – date, title, notes, steps and target paces – are sent to that platform automatically whenever your plan changes (and at most once a day when you open the app), or when you press “Send to watch”; you can switch the automatic sending off on the Connectors page. We keep which session went where (to update or delete it later). Nothing is read from Suunto or Garmin; reading from Intervals.icu is described above. Legal basis: your consent given when connecting (Art. 6(1)(a)); withdraw it by disconnecting – the workouts already sent stay in your account there.
• Local weather – the place you choose on Today (“Use my location”, which your browser asks you to allow, or a town you type), else the start area of your latest run, rounded to about 10 km, is used to look up the forecast (16 days) for the weather card, heat-adjusted paces and the forecast on your planned sessions (see Open-Meteo below). If you chose “Use my location” and your browser already allows it, the location is refreshed once per visit (so the weather follows you when you travel), again rounded. For races from the race calendar, the race city and date are used for race-day weather (forecast, or typical weather from past years). The place is kept only on your device (local storage), never on our servers; it is deleted on sign-out and with “Forget this place”. A town you type is sent to Open-Meteo's place search. Legal basis: contract (Art. 6(1)(b)); your location only with your consent (Art. 6(1)(a)) – you can withdraw it any time by forgetting the place.
• Tracking a workout with your phone's GPS (Track workout) – only while you record, your browser gives elastride your exact position about once a second (your browser asks you to allow location first). Time, distance, pace and the route are worked out on your device and kept only on your device (local storage) until you finish, so a reload doesn't lose the workout. When you choose “Save to Intervals.icu”, the route with its times passes through our server straight to your Intervals.icu account as a GPX file and becomes one of your activities there; we keep no copy. “Download GPX” saves the file on your device only, “Discard” deletes it. The screen is kept on while recording (no data involved). Legal basis: your consent for location (Art. 6(1)(a)) – withdraw it any time in your browser; saving the workout: contract (Art. 6(1)(b)).
• The elastride app – when you sign in to the app, you confirm it on our website; the app then gets sign-in tokens that allow it to read your plan, mark sessions done and save workouts you record to your Intervals.icu. We store only a fingerprint (hash) of each token, which app it is for, when it expires and the device name the app reports (e.g. “iPhone · iOS 18”), so you can see and sign out each phone in Account. Tokens expire after 90 days without use and are deleted with your account. Legal basis: contract (Art. 6(1)(b)).
• Your gel for guided runs, if you choose one – the gel's name and carbs, gels you added and the carbs an hour, so the app can remind you when to take one. Changed or removed in Account → Gels or the app's Settings → Gels; deleted with your account. Legal basis: the contract (Art. 6(1)(b)).
• Your shoes, if you add them (Account or the app) – each pair's name, the km it had when you added it, when to replace it, and which pair you chose for a run (the run's Intervals.icu id). Its km are worked out from your runs when you open the list. Deleted with the pair or your account. Legal basis: the contract (Art. 6(1)(b)).
• Push notifications in the app, if you allow them – the app registers your phone with a push token (a random address for this app on this phone, handed out by Expo) and the phone's time zone, so we can tell you when your plan changes and remind you of sessions. Each message is also kept in the app's notifications inbox for 60 days. Messages go through Expo's push service and Apple Push Notification service (or Google's Firebase Cloud Messaging on Android); they contain only the message itself. Switch them off in the app or in your phone's settings; signing the app out removes the token, deleting your account removes tokens and inbox. Legal basis: your consent when you allow notifications (Art. 6(1)(a)).
• Apple Health in the app (iPhone, opt-in) – the app reads your resting heart rate, HRV, sleep and your watch's VO₂max from Apple Health to show them in the app; this data stays on your iPhone and is never sent to elastride's servers. When you record a workout in the app, it is also saved to Apple Health (activity, distance, route). You control access in the Health app (Sharing → Apps → elastride).
• iPhone calendar in the app (opt-in) – the app creates an “elastride” calendar on your phone with your planned sessions for the next 8 weeks and keeps it up to date; switching it off deletes that calendar. The app doesn't read your other calendars, and nothing from your calendar is sent to us.
• Technical logs and abuse protection – our host processes IP addresses and request data in short-lived server logs to deliver and secure the service. To prevent abuse we count requests per IP address in memory for one minute, and AI requests per account in our database (counters are deleted after a day). Legal basis: legitimate interests (Art. 6(1)(f)).

3. Who processes data for us

• Neon – our database (account, sign-in sessions, plan, buddies, check-ins, encrypted tokens), EU region.
• Supabase – our previous database and sign-in, used only while accounts are moved to Neon (October–November 2026); afterwards the project is deleted.
• Vercel – hosting.
• Google and Apple – sign-in (Apple only if you choose Sign in with Apple).
• Intervals.icu – only if you connect it: receives your planned workouts and, if you allow it, is the source of your activities and wellness data.
• Suunto or Garmin – only if you connect them, to receive your planned workouts.
• Expo (650 Industries, USA) and Apple / Google – only if you allow notifications in the app: deliver push messages to your phone (push token and message only; EU–US transfers under the EU–US Data Privacy Framework / standard contractual clauses).
• Groq or Anthropic – AI answers, per request, depending on the model you choose.
• OpenFreeMap (EU) – the map under your routes on Activities. Our server fetches the map pieces (tiles) for the area of a route and passes them to your browser, so the map service never receives your IP address or who you are – only which map area was requested. Your GPS track itself stays between Intervals.icu, our server and your browser; it is read live and not stored.
• Open-Meteo (Switzerland) – the weather forecast, the town search and the historical weather for race days. Our server asks for the forecast at your place rounded to about 10 km, and passes on a town name you type or a race's city and date; your IP address and identity are not sent.

Some of these providers are based in or access data from the USA. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses (Art. 46). All are bound by data processing agreements.

4. Cookies and local storage

We only use what is strictly necessary to run the service – no analytics, advertising or third-party tracking cookies. Strictly necessary cookies don't require consent (Art. 5(3) ePrivacy Directive, § 25(2) TDDDG, Art. 45c Swiss Telecommunications Act); we tell you about them in the cookie notice and here:

• elastride.session_token and elastride.session_data (first-party, httpOnly): keep you signed in – a random session ID (the session itself is stored in our database) and a signed copy of your name, email and session expiry so pages don't look it up on every request (renewed every 5 minutes); valid for up to 90 days, renewed while you use the app, removed when you sign out. Signing in with Google or Apple also sets a short-lived state cookie that protects the sign-in step against forgery.
• sb-…-auth-token (Supabase, first-party, only from before the move): read once to keep you signed in after the move to the new sign-in, then removed.
• connector OAuth state (first-party): protects the connection step (Suunto, Garmin) against forgery; expires after 10 minutes.
• Local storage (stays in your browser): theme (light/dark), preferred training days, and that you have seen the cookie notice.
• elastride.data.v2 (local storage, stays on your device): a copy of your last loaded activities (date, sport, distance, time, elevation, heart rate and time in heart-rate zones, training load, start area rounded to ~10 km) and account status, so the app opens instantly and refreshes in the background. Never sent anywhere; replaced on every refresh, ignored after 24 hours, and deleted when you sign out or delete your account.
• elastride.place.v1 (local storage, stays on your device): the place for the local weather – its name and coordinates rounded to about 10 km – if you chose one. Deleted on sign-out or with “Forget this place”.
• elastride.stretchBody.v1 (local storage, stays on your device): whether the stretch gym shows the woman's or the man's figure, if you chose one in Account. Nothing else; deleted with your account.
• elastride.coachSeen.v1 (local storage, stays on your device): the titles of the coach notes you have already seen in the bell, so only new ones get the red badge. Nothing else; deleted with your account.
• elastride.stretchVoice.v1 (local storage, stays on your device): whether the stretch gym's spoken guide is on or off. The voice clips are prerecorded files served by elastride – no speech service is involved.
• elastride.track.v1 (local storage, stays on your device): a workout you are recording or haven't saved yet – its GPS points with times, sport and the planned session it's for. Deleted when you save or discard it, when you sign out and with your account.
• elastride.steady.v1 (local storage, stays on your device): for each run, three numbers worked out from its recording for the VO₂max estimate – the pace and heart rate of its steady part and how many minutes that was – so each run is only analysed once. Deleted when you sign out or delete your account.

Fonts, images and brand logos are served from our own domain – your browser makes no requests to third parties while you browse elastride.

5. How long we keep data

Account data stays until you delete your account. Disconnecting a connector revokes our access there (where the platform supports it) and deletes the stored tokens or key immediately. Deleting your account permanently removes your profile, plan, buddies, check-ins and connections.

6. Your rights

You have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, and to withdraw consent at any time with effect for the future. Download or delete everything yourself on the Account & privacy page, or contact us at katzer.andreas@gmail.com. You can also lodge a complaint with a data protection supervisory authority.

elastride makes no automated decisions with legal or similarly significant effects. Coach answers are suggestions, not medical advice.