The controller of the personal data collected via the Trainetic application ("the Service") is the company CAMAF.PARTICIPATIONS, a simplified joint-stock company (SASU) with a share capital of 2,000 €, whose registered office is located at Résidence La Molinie, Appt D108, 3 rue des Baccharis, 33138 Lanton, France.
SIREN: 981 999 691 — RCS: 981 999 691 R.C.S. Bordeaux — Intra-Community VAT number: FR57981999691.
Editor: Franck Marcq.
Contact: hello@trainetic.io.
At this stage, Trainetic has not appointed a data protection officer (DPO). The contact point for any questions regarding your personal data or for exercising your rights is: hello@trainetic.io.
We collect only the data necessary for the operation of the Service. Some of this data is health data, falling under a special category as defined in Article 9 of the GDPR (these are indicated below).
Email address.
Password (stored in encrypted/hashed form, never in plain text).
Garmin, Google, and/or Withings ID if you log in via these services.
Consents collected (Terms of Use and health declaration), timestamped.
Proofs of your other choices, each with its date and the version of the text displayed: agreement to nutritional tracking, recording of your diet and allergies, and your personalized assessments (section 2.12), sending your heart rate curve to Strava (section 2.13), reading the installation source (section 2.11), objection to usage measurement and deactivation of coaching reminders (sections 2.11 and 2.14).
IP address, browser type (user-agent), and date when accepting the Terms of Use, as proof of consent.
If you subscribe to the paid offer: depending on the channel used, the Stripe customer ID (subscription on the website) or the purchase and transaction ID provided by the Application Store (subscription via in-app purchase on the Apple App Store or Google Play), as well as the status and expiration date of your subscription. No banking data is collected or retained by the Publisher — see section 5.
The promotional code you enter, if applicable, and its activation date, stored with your subscription. When this code is from a partner, it is also used to calculate the share due to that partner (section 2.16).
Your Friend Code and, if you registered with another user’s Friend Code, the link to that Referrer (section 2.17).
Your profile picture, if you add one.
Account creation and update dates.
Goal (distance, date, target time), level, experience (free text field), personal record.
The path you choose at registration (e.g., running, triathlon, or weight management), which guides the initial screens and coaching messages (section 2.14).
Weekly volume, number of sessions per week, available days, type of terrain, other sports practiced.
Date of birth, gender.
Health data (Art. 9): height, weight, VMA, maximum heart rate, resting heart rate, personalized heart rate zones, including your cycling-specific zones, power threshold (FTP), injuries, and medical precautions (free text field). Heart rate zones and power threshold are entered by you and stored with their history.
Content of generated Race Plans.
Reported feeling after a session or free workout (normal / too hard / too easy) — health data (Art. 9). The feeling and the "completed" status you enter for a session in your plan remain in the plan if you delete the corresponding activity, to avoid disrupting the rest of the plan; you can delete this feedback from the session in the plan itself.
Details of the blocks completed during each session: role, label, duration, and distance of each block.
Reviewing a session to correct the Service. When a recording issue is identified — because you report or request it, or because an error is noted in the usage log (section 2.11) — authorized personnel of the Publisher may review the relevant session to verify and correct the proper functioning of its recording. Each review is logged: who performed it, when, on which session, and for what reason. Your session remains on our servers: it is not transmitted to any external tool or service provider, even in part. To reproduce an issue, we use test sessions or fictitious data. If technical data related to the recording (e.g., outlying GPS points or sensor events) is retained to correct an issue, it is deleted no later than ninety days after the session.
If you connect a sports or health service or device, Trainetic imports or records, with your explicit consent, the data below, at the time of connection and on an ongoing basis. This data constitutes health data (Art. 9) and is processed solely on the basis of your explicit consent, which you may withdraw at any time by disconnecting the service or dissociating the device, or by withdrawing your consent for the processing of health data (Section 8).
Google Health API (Fitbit and compatible device data):
Authorization tokens (OAuth).
Activity sessions: activity type, date and time, duration, distance, average and maximum heart rate, calories.
Cardiac indicators: resting heart rate, heart rate variability (HRV).
Sleep: sleep duration.
Garmin:
Authorization tokens (OAuth).
Health data (Art. 9): resting heart rate, Body Battery, sleep (duration and score), VO2max, heart rate variability (HRV).
Activities: type, date and time, distance, duration, average speed, average and maximum heart rate, cadence, positive elevation gain, altitude profile, step count, calories, and the Garmin device model, as well as the original activity file transmitted by Garmin. Details are provided in Section 12.
Withings:
Authorization tokens (OAuth).
Health data (Art. 9): weight and body composition, heart rate, sleep.
Activity sessions.
Bluetooth sensors (heart rate monitor, cadence sensor, wheel speed sensor, connected bike, watch used as a sensor):
When you pair a sensor in the application, after authorizing Bluetooth access in your device settings, Trainetic reads your heart rate, cadence, speed, and power during the session. The following data is recorded with the session: your average and maximum heart rate, cadence, and a curve of your measurements taken every five seconds. This data is encrypted, included in your data export, and deleted with the activity or your account. On both iOS and Android, reading continues when the screen is locked, during the session.
After disconnecting a service. When you disconnect Google Health, Withings, or Garmin, the authorization tokens and data specific to that service (daily health indicators, raw data received) are deleted immediately. Sessions and weigh-ins already copied to your "Activities" are retained as long as your account exists: they are part of your training history. You may delete them one by one from "Activities" or all at once by deleting your account. For Garmin, the original activity files are also retained, encrypted, until the activity or your account is deleted (Section 12.6).
History of changes to the "injuries" field.
History of acceptance of the Terms of Use by version.
Conversations with the coaching assistant, retained only for the duration of your visit (temporary session memory, not stored permanently).
Password reset codes (stored in hashed form).
Cookies and other information stored on your device, described in Section 11.
Data related to voice commands is covered in Sections 2.7 and 2.8 below.
Data for measuring Service usage and the origin of registrations is covered in Section 2.11 below; nutritional tracking data is covered in Section 2.12; Strava connection data in Section 2.13; coaching and notification data in Section 2.14; newsletter data in Section 2.15; and partner data in Section 2.16.
If you start an activity with GPS tracking (outdoor running or cycling, "free ride" function), Trainetic collects your precise location (GPS coordinates) throughout the activity, including when the application is running in the background or the screen is off: this is technically necessary to continuously track your route.
When the application records your route while your phone screen is locked, the points are temporarily stored on your phone and then attached to the session.
When your phone has a barometer, the application may also use the altitude it measures to calculate your elevation gain more accurately.
Map Display. When a page of the Service displays a map (your activities, a session, the preview before sending to Strava), your browser downloads the map background images from the OpenStreetMap Foundation, based in the United Kingdom, and the map display tool from the cdnjs service, operated by Cloudflare, Inc., a company based in the United States. As with any download, these services receive your browser's IP address; the OpenStreetMap Foundation also receives the designation of the requested map sections, which correspond to the area of your route. Your actual route, your sessions, and your account data are not transmitted to them.
What We Do With This Data. This data is used to calculate the distance, pace or speed, elevation gain, and route trace, to generate voice announcements during your effort, and, if a recording issue is identified, to verify and correct the recording functionality under the conditions set out in section 2.3. It is not used for any other purpose.
Legal Basis. This collection is based on your consent (Article 6.1.a of the GDPR): GPS tracking is never activated automatically. It only starts when you voluntarily begin an activity after granting location access in your device's settings. You may withdraw this authorization at any time from your device's or the application's location settings, without this affecting the lawfulness of the collection carried out before such withdrawal or your access to the rest of the Service (only the GPS tracking features become unavailable).
Retention Period. The trace of an activity is retained as part of your training history, just like your other sessions: you may delete each activity individually at any time—its content, including the trace, is then erased—and deleting your account erases all your traces.
Sharing. Your GPS traces are hosted by our hosting provider OVHcloud (France) and are not transmitted to any other recipient, unless you choose to send an activity to Strava (section 2.13). The indicators calculated from GPS (distance, pace, elevation gain) are attached to your sessions and follow the regime described for your training data in this Policy.
The Service allows you to control the application and ask questions by voice during a session, without handling your phone. You activate the voice command by pressing the microphone button on the session screen or, if you have enabled this option, by saying a pre-agreed word (see section 2.8).
When you use the voice command, we process:
The audio clip corresponding to your question or command. The recording stops automatically after a short silence and its duration is capped at sixty seconds.
The text resulting from the transcription of this clip, i.e., what you said.
The duration of the clip, expressed in seconds, solely for the purpose of tracking your monthly dictation volume.
How the Clip is Processed. The clip is transmitted to our server, which in turn sends it to our processor Mistral AI to be converted into text (see section 5). This exchange occurs server-to-server: our access key to Mistral AI is never present in the application installed on your phone. The resulting text is sent back to the application, which responds to it.
What is Not Retained. The audio clip is never stored: the temporary file is deleted as soon as your request is processed. The transcribed text is not retained when the question is asked during a session: it is interpreted and then discarded. Our technical logs only record the model used, the duration of the call, and its status, never the content of what you said.
What We Do Not Do With Your Voice. We do not process any information derived from your voice itself. We do not attempt to recognize you by your voice, we do not authenticate you by voice, and we do not analyze your emotional state or fatigue level from the sound. Your voice is therefore not processed as biometric data within the meaning of Article 4.14 of the GDPR.
Dictating a Meal. The voice command also allows you to dictate a meal in the nutrition tracking (section 2.12). The transcribed text is not retained: only the foods you validate are recorded in your meal journal. If the dictated sentence could not be broken down into foods, it may become, within the limit of one hundred twenty characters and only if you validate it, the name of a food in your journal.
Health Content. If the content of your question pertains to your health—such as pain, an injury, or a sensation—it is treated as other health data described in this Policy, with the same safeguards and on the same basis of your explicit consent.
If, and only if, you have enabled this option in your account settings, the application may continuously listen during a session to detect an agreed-upon word, which allows you to avoid pressing a button.
This detection runs entirely on your phone, using a model embedded in the application. As long as the word is not recognized, no sound leaves your phone: nothing is recorded, nothing is transmitted, nothing is retained—neither by us nor by any third party. Only the segment following the word’s recognition, corresponding to your question, is transmitted for transcription under the conditions described in section 2.7.
This option is disabled by default. You enable it yourself in your account settings, and you may disable it in the same place, at any time, without justification and without any impact on the rest of the Service: the microphone button remains available.
On Android, when this listening is active, a permanent notification indicates microphone usage.
The Service previously allowed you to publish a session as a web page accessible to anyone with its address. This feature was removed from the Service on September 10, 2026.
What was deleted. On September 10, 2026, all public pages, their images, view counters, and sharing settings were deleted. Their addresses no longer lead to any content. This data only remained in automatic backups created before that date, retained for thirty-one days and restored only in case of an incident: it will have disappeared by October 11, 2026, at the latest. Monthly backups, implemented on September 28, 2026, do not contain them.
What remains. Access logs maintained by our hosting provider recorded the IP address of individuals who viewed these pages. They follow the rule described in section 7 for these logs. If you viewed a sharing page and wish to exercise your rights regarding this record, write to us at hello@trainetic.io.
Sharing an image of your session. You may still create an image of your session. It is generated on your phone: you save or share it yourself, using the application of your choice, and it does not pass through our servers. If your session includes a GPS track, the image may display it: check what it shows before sharing. The image may also display your heart rate, which is health data: it is hidden by default and only appears if you choose to display it. If you use the automatic caption rephrasing, only the caption text, which you may edit, and the sport type are transmitted to our processor Mistral AI (section 5).
When you contact us for assistance, to report a malfunction, or to suggest an improvement, your request is recorded to be processed and tracked. You may contact us through the help section of the Service, via the support form on our website, or at hello@trainetic.io.
What we record. Your email address, the subject of your request, the text of your messages and our responses, the request category, the channel through which it was received, the language, the name of the screen from which you opened it, its status, as well as the dates of receipt, first response, last message, and closure. When you are logged in, the request is linked to your account.
The technical context of your request. To reproduce and fix the issue you report, we also record, with each request, a line of technical context: the screen from which it originates, the platform (website, Android or iOS application), the application version, the system version, and your device model, and, on the website, your browser. We do not record, for your support requests, your IP address, the address of pages visited, or any device identifier.
Files you attach. You may attach images to your messages. They are re-encoded upon recording, which removes the file’s technical metadata and its original name. They are stored in a closed space, without a direct address: they only open for you, logged into your account, and for authorized personnel of the Publisher processing your request.
If your request concerns your health. The text of your messages is free, and the subject of your request includes its beginning: you may describe pain, an injury, or a contraindication, and an image you attach may relate to your health. This information is then health data under Article 9 of the GDPR and benefits from the same guarantees as those described in the rest of this Privacy Policy. You are never required to provide health information to receive assistance.
Who has access. Your requests are only accessible to authorized personnel of the Publisher, bound by confidentiality. We do not use a third-party request management tool. The emails notifying you of the receipt of your request and our responses are sent by our email service provider, Brevo (section 5): they contain the subject of your request and the tracking link, never the text of your messages or our responses.
The tracking link. When you contact us without being logged in, we send you a link that allows you to reread your request and respond to us. This link contains a randomly generated string of characters, it is not guessable, and it only opens your request, never a list. It stops working ninety days after the last message exchanged; each new message extends it by the same duration. Attached files do not open from this link: they are only accessible from your account.
Hosting. Your requests, messages, and attached files are hosted in France by our hosting provider, like the rest of your data, under the conditions described in section 5.
If you delete your account. The text of your messages, the subject of your requests, and the files you attached are erased. We retain only the category of the request, the channel through which it was received, the screen from which it was opened, its status, and its dates, without any content or any information allowing you to be identified, in order to maintain a record of the malfunctions that have been reported to us. The retention period is specified in section 7.
To determine whether the Service is useful to those who try it, and which actions make it known, we maintain three internal logs. These are used to produce overall statistics for the Publisher; the usage log is also used to identify an error encountered on your account in order to correct it (section 2.3). They are not used to send you advertising or to create a profile of you. The accompanying messages, which are based on the date of your last visit, are described in section 2.14.
Your days of use. On the first page of the Service you open in a day (Paris time), we record a line containing your account, that day, the date of your registration, and the platform used (website, Android application, or iOS application). We do not record the time, the pages viewed, or your IP address. This log allows us to measure how many people return after registering.
The usage log. When you are logged in, we record, in the form of codes, certain actions performed in the Service, such as replacing a session or downloading your plan, as well as technical errors encountered in your browser (affected screen and type of error). When an account is deleted, we also record, without linking it to that account, its seniority bracket and status. This log never contains what you enter in the Service or any health data. It allows us to know which functions are used and to identify errors in order to correct them. It is separate from the technical access logs described in section 7.
The source of your registration. When you create an account, we record, in the form of codes: the campaign through which you arrived (source, medium, and campaign name), the domain name of the site that directed you to us, the path of the page on our site through which you arrived, the campaign code you entered, the source channel, the method by which this source was obtained, the platform, the language set on your device, the registration method, and the date. Only the codes of our campaigns are recorded as such: any other code entered is recorded under a generic mention, without its value. We do not record your IP address, the full address of the pages you visited, or any free text.
The source is obtained in one of the following three ways.
During the visit in which you register. When you arrive on our site via a campaign link or from another site, the source is passed from page to page in the address of the site's links, then kept on our server with your session, for up to two hours from your arrival on the registration page. If you register within this time, it is linked to your account; otherwise, it is erased, and your registration is counted as a direct arrival. No additional cookie is placed for this purpose.
During a subsequent visit, if you accept. If you accept, in the cookie management panel, that we remember your source, a cookie keeps it on your browser for thirty days: a registration made within this period, during a subsequent visit, is then linked to it. Without your consent, this cookie is never placed (see section 11).
At the installation of the Android application, if you accept. Starting from version 1.9 of the Android application, if you are not already logged in, a screen asks you at first launch, before any reading, if you accept that the application read once the source information recorded by Google Play during its installation. This choice is separate from all your other consents. If you refuse, nothing is read. If you accept, only the source, medium, and campaign name are retained, and any other element is discarded; the information is kept on your phone for up to two hours, the time it takes you to create your account, then linked to it. The proof of your choice (its date, the choice itself, and the version of the displayed text) is retained with your account. You may withdraw your consent at any time from the "Account" section of the application; the source linked to your account is then erased.
Links to the App Store. The links from our site to Apple's App Store include a campaign code. Apple only provides us with overall statistics in return, without any data concerning you individually.
Who has access. These logs are hosted in France by our hosting provider, like the rest of your data, under the conditions described in section 5. They are not transmitted to any other recipient and are used by the Publisher's authorized personnel in the form of overall statistics, except for the examination of an error described in section 2.3. We do not use any third-party audience measurement tool or any advertising tool for this purpose.
If you delete your account. The link between these logs and your account is erased. The remaining lines contain only dates and codes; they remain subject to the retention period indicated in section 7, after which they are deleted.
Your choices. You may object at any time to these logs from the consent screen, in the "Account" section of the Service; as long as your objection is active, nothing more is recorded for your account, and what had already been recorded under your name is erased. You may also withdraw at any time your consent to the memorization of your source or to the reading of the installation source. Section 8 specifies these rights.
The source of a subscription taken out using the code or link of a partner is covered in section 2.16.
If you use nutritional tracking, Trainetic records the data below. This data provides information about your diet and, for some, your weight: we process it as health data within the meaning of Article 9 of the GDPR. It is processed only with your explicit consent, collected through an agreement specific to nutritional tracking, separate from the one covering your training, before its first use. The only exceptions are the foods you dislike and recovery benchmarks, the basis for which is indicated in section 3.
Your weight goal. The target weight, the direction of the goal, its start and end dates, and whether it is active or not.
The question asked before a weight goal. Before each new weight goal, we ask you if a situation that advises against it applies to you (pregnancy or breastfeeding, eating disorder, medical monitoring of your weight or diet). If you answer "yes," nothing is recorded, and no goal is created. If you answer "no," we retain only the date of your response, the version of the question, and the link to the created goal, without your IP address or device. This record contains neither your weight nor your numerical goal. It proves that the question was asked and that you answered "no": since it indirectly provides information about your health, we process it as health data, with restricted access. It is retained as long as your account exists, even if you withdraw your consent to nutritional tracking, and it is deleted with your account (section 7).
Your meal journal. For each food: the date, the time of the meal, how it was added, its name, the quantity, calories, and intake of proteins, carbohydrates, fats, and saturated fats, as well as the product barcode when it comes from the Open Food Facts database. Your hydration log, meals marked as completed, and favorite foods you had saved before this feature was removed. The name, quantity, and nutritional values are encrypted, as is your target weight.
Your habits. Your weigh-in day, your workdays, and the times of your meals, if you provide them, so we can send you reminders at a time that suits you.
What you do not eat. If you wish, you can indicate in the "Account" section, under "Your habits," the foods you dislike, chosen from a list, as well as your diet (vegetarian, vegan, or pescatarian) and your food allergies or intolerances, selected from the fourteen allergens defined by European regulations, as well as lactose. This information serves only one purpose: to remove these foods from the examples Trainetic suggests to you. Your diet and allergies may provide information about your health or beliefs: they are recorded only with a separate agreement, distinct from the agreement to nutritional tracking, requested via an unchecked box when you provide them. The foods you dislike are not sensitive data: they are used for settings you configure yourself, and no reason is required. This information is encrypted. It is not shared with any service provider, including Mistral AI. It is not used to send you targeted messages or to create statistics. You can withdraw the separate agreement for your diet and allergies at any time in the "Account" section: they are then deleted. Withdrawing your consent to nutritional tracking also deletes everything you have indicated here.
Food examples. Trainetic suggests food examples for your next meal, for recovery after a session, and in your weekly summary. They are chosen by the application itself, without artificial intelligence, from foods you frequently log and a list of basic foods reviewed by a dietetics professional, excluding what you have indicated you do not eat. If you have indicated an allergy or intolerance, only foods from this basic list are suggested. These examples are part of your nutritional tracking and rely on the consent you gave for it; they do not leave Trainetic. They are suggestions: Trainetic does not guarantee the absence of allergens, and a product's composition may vary. Always check the label.
Checks performed on our server. Before displaying a summary, our server verifies that it does not mention any food you have indicated you do not eat; if it does, the summary is not displayed. In the coaching assistant, if a response mentions a food affected by your diet or allergies, a warning appears below the response. These checks occur within Trainetic: your diet and allergies are not shared with Mistral AI, the warning is not recorded in the conversation, and no food or allergen is logged in our records.
Your weight milestones. The 500-gram milestones you reach toward your goal. You can choose to share a milestone reached: the image is created on your phone, and you share it yourself using the application of your choice; nothing is shared without your action.
What is calculated but not recorded. Your basal metabolic rate and the distribution of your intake are recalculated each time they are displayed based on your profile (date of birth, sex, height, weight). The same applies to recovery benchmarks for proteins and carbohydrates displayed after a session, calculated from your weight, which does not appear on the screen. These benchmarks never appear in a notification, email, sharing image, or export to Strava.
The count of your analyses. A monthly counter of the number of analyses performed by artificial intelligence in nutritional tracking.
Food search. When you search for a food or scan a barcode, our server queries the public Open Food Facts database with the search terms or barcode. Open Food Facts does not receive your identity, IP address, or any data from your account. The food records obtained are kept in a shared pool for all users, with no link to your account.
AI-completed food data sheets. When a food data sheet opened in the Service is incomplete, our server requests once from our processor Mistral AI to estimate the missing values. Only the product's data is transmitted to it: its name, the labels on its data sheet, and its known nutritional values. No data about you accompanies this request: no identifier, date, quantity, or meal. The result completes the shared database, with no link to your account. The "high in" alerts displayed on a data sheet are based on these same values.
The barcode scanner on the website. When you open the barcode scanner from the website, your browser downloads the scanning tool from the cdnjs service, operated by Cloudflare, Inc. (see section 2.6 for cards). As with any download, Cloudflare then receives the IP address and technical characteristics of your browser. No data from your account is transmitted to it, and no cookie is placed on this occasion.
Photo meal analysis. When this feature is offered to you, you can photograph your plate. The photo goes through our server, which transmits it to our processor Mistral AI with the sole question of what the plate contains: no identifier and no data from your profile accompanies it. Mistral AI returns a list of foods, which you verify; nothing is recorded before your validation. The photo is never retained: the temporary file is deleted as soon as processing is complete, and it does not appear in our database or our logs. A photo may show something other than your meal: frame it on your plate.
Voice meal analysis. You can dictate your meal, under the conditions described in section 2.7.
Your personalized reports. With Trainetic Premium (subscription, Free Month, or Gift Card), and during your Free Trial, you can obtain a written report of your day and a written report of your week. They are only produced with your consent, distinct from the consent to nutritional tracking, requested the first time you open them, via an unchecked box. To draft them, our server transmits to our processor Mistral AI the foods and intakes from your meals over the relevant period, your needs calculated by Trainetic, notably based on your weight (which is not itself transmitted) and your weight goal, your sessions during the period, and the direction of your goal (weight loss, maintenance, or gain). Your weight, name, photo, identifier, diet, or allergies are never transmitted to it. The food examples accompanying these reports are chosen by Trainetic, not by the artificial intelligence. Each report is drafted by artificial intelligence, as indicated on the screen; it is stored encrypted. Meal analyses written before the introduction of reports remain displayed on the relevant meal page as long as you benefit from Trainetic Premium; they are based on the consent you had given for personalized analysis and are deleted if you withdraw this consent or your consent to nutritional tracking. You can withdraw this consent at any time in the "Account" section: no further reports will then be produced, and previously written reports and analyses will be deleted. Withdrawing your consent to nutritional tracking also withdraws this consent.
Estimates. The displayed calories and intakes, whether they come from a database, a photo, a voice input, or artificial intelligence, are estimates. They do not constitute medical or dietary advice, any more than your reports, recovery benchmarks, or food examples.
Withdraw your consent. You can withdraw your consent to nutritional tracking at any time from the consent screen, in the "Account" section of the Service. No further data will then be recorded, and your nutritional tracking data will be deleted: weight goals, meal and hydration journal, meals marked as completed, favorite foods, habits, weight milestones, foods you dislike, diet, allergies and intolerances, written reports and analyses, and analysis counter. The record of your answer to the question asked before a weight goal is not deleted by this withdrawal: it is retained as proof, under the conditions described above. Your weigh-ins, which appear in your "Activities," and the weight in your profile relate to your training and are not deleted by this withdrawal. This withdrawal does not affect the lawfulness of processing carried out before it, nor your access to the rest of the Service.
You may link your Strava account to Trainetic from the "Account" section of the Service. You choose on the Strava screen whether to grant access or not.
What we record. Your Strava account identifier, the authorization tokens (encrypted), their expiration date, and the permissions granted. Trainetic does not read your Strava activities: the requested authorization is used to send activities to it.
What we send to Strava. When this feature is offered to you, you may send an activity to Strava, at your request and on an activity-by-activity basis. The following are then transmitted: the activity file, which contains, depending on the chosen format, either your complete GPS track with the time of each point, or the duration, distance, and estimated calories, as well as, when measured, your speed, cadence, and power; its name; and a description including the prescribed steps, strength training sets and their loads, and the line of your plan. You may modify the name and description before sending. The transmitted track is complete: it may reveal the location from which you start.
The heart rate ranges of your plan. When the activity corresponds to a session in your plan, the description includes the targets for each step, including the heart rate ranges calculated from your zones and, where applicable, heart data imported from your connected services (Garmin, Google Health, or Withings). These are health data. The confirmation screen notifies you of this before sending, and you may remove them from the description. By confirming the sending without removing them, you explicitly consent to their transmission to Strava.
Your heart rate curve, if you choose. For an activity recorded in Trainetic with a heart rate monitor or sensor (section 2.4), you may also choose to send your heart rate curve to Strava, meaning your heart rate recorded during the activity. This is health data. This choice is made via an unchecked box, presented for each sending and valid for that sending only; we retain proof of your response (agreement or refusal, date, version of the displayed text, concerned activity). By checking the box, you explicitly consent to this transmission. Strava then displays your curve according to your Strava privacy settings; what is already on Strava is deleted from Strava. This box is never offered for an activity imported from a connected service.
No health data is transmitted to Strava outside of these ranges and the curve you choose to send.
Activities imported from a connected service. You may send to Strava an activity recorded in Trainetic, as well as an activity imported from Garmin, Google Health, or Withings. In this case, only the data necessary to create the activity on Strava is transmitted (including its duration, distance, and calories), along with the name and description you have verified. No health measurement from these services is transmitted as is; only the heart rate ranges described above, which may be derived from them, may be included in the description. Sections 10 and 12 specify this for Google Health and Garmin.
After sending. The sent activity is held by Strava, which is responsible for it under its own Privacy Policy. Deleting it from Trainetic does not delete it from Strava. Strava, Inc. is a company established in the United States (see section 6).
Disconnection. When you disconnect Strava, or when you delete your Trainetic account, access is revoked with Strava and the connection data we hold is deleted.
Coaching messages. After you sign up, we send you welcome and onboarding messages for your first few days via email and, if you have enabled notifications, via notification, as well as reminders if you do not return to the Service after 7, 14, and then 30 days. These reminders are calculated from the date of your last visit and tailored to the journey you selected upon sign-up (section 2.2). They contain no commercial offers, and nothing more is sent on this basis after the 30-day reminder.
Click measurement. The links in these messages go through our own website (and, like all links in our emails, through Brevo for simple global counting), which records, linked to your account, the message whose link you followed and the relevant step. This measurement is used solely to adapt subsequent coaching messages, for example, to avoid sending you a message whose link you have already followed. It is not used for advertising, nor to build a profile about you, and is not shared with anyone.
Stop receiving these reminders. Each coaching email includes a link "Stop receiving these reminders," which works without you logging in and takes effect immediately; the same option exists in the "Account" section under the name "Coaching reminders." It stops coaching emails and notifications, as well as click measurement, without affecting either the newsletter (section 2.15) or your daily session email. You may reactivate these reminders at any time.
Your daily session email. If you are following a training plan, we send you your daily session email each morning. Its subject line is always "Your session for today." It includes your first name, the title and full breakdown of the session (durations, paces, and, when your plan includes them, your heart rate or power targets), the session’s purpose as written by our artificial intelligence, and, when the session replaces another, the reason for this replacement. These elements may provide information about your health: your heart rate targets are calculated based on your maximum and resting heart rates, and the purpose or reason for a replacement may refer to discomfort or an injury you have reported. We process these as health data, and the email explicitly states this in a boxed notice, along with a link to disable it. It is sent via our email service provider (see below) and then arrives in your inbox, which we do not control: it is up to you to choose to receive it. It is only sent if you have given your consent to the processing of your health data. It is enabled by default when you create your account, and we inform you of this on the screen where you provide this consent. You may disable it at any time in two ways: via the "Stop receiving this email" link at the bottom of each email, which works without you logging in (it opens a page where you confirm with a button; opening the link alone does nothing), or in the "Account" section under "Notifications." Disabling it only stops this email, not the newsletter (section 2.15), notifications, or coaching reminders. You may reactivate it at any time. It is automatically paused when you are no longer using the Service.
How our emails are sent. All our emails, including address verification, password reset, daily session, support, coaching, subscription, and newsletter emails, are sent by our processor Brevo (section 5): your address and the content of each email pass through this provider. Our emails contain an open-tracking pixel and links that pass through Brevo, used solely to count opens and clicks globally, without linking them to you. We have configured Brevo in anonymous tracking mode: no open or click is linked to your address. However, Brevo rewrites the links in our emails and inserts this pixel, and we cannot, as of this date, disable them; if your email client blocks image loading, the pixel is not loaded.
Notifications. If you agree to receive notifications, the application or your browser provides us with a device token, which allows us to send you notifications. A notification contains this token, a title, text, and, where applicable, a link to the screen to open. It never contains your account identifier or any health data. On Android and iOS, notifications are delivered via Google’s Firebase Cloud Messaging service (section 5), which relays them, on iOS, to Apple’s notification service. On the website, they are handled by your browser’s notification service (depending on the browser: Google, Mozilla, or Apple). You may disable them at any time in your device or browser settings.
You may subscribe to our newsletter from our website. Your subscription is only recorded after you confirm it by clicking on the link we send you. We record your email address and the date of your subscription and its confirmation, in a list specific to Trainetic hosted by our processor Brevo (section 5).
Each newsletter includes an unsubscribe link, which takes effect immediately. Your address is retained until you unsubscribe. The newsletter is separate from your account: subscribing to or unsubscribing from it does not affect your account or the service emails described in section 2.14. Like our other emails, it contains an open-tracking pixel and links used solely to count openings and clicks globally, without linking them to you.
Trainetic works with partners (clubs, associations, content creators, stores) that promote the Service. Each receives a code, a link, or a QR code. When a paid subscription is taken out through them, we pay them a share of its price.
Linking your account to a partner. If you create your account or subscribe using a partner's code, link, or QR code, we record with your account: the partner, the code used, the date of its activation, and, where applicable, the date and reason for the end of the link (for example, the definitive expiration of the subscription). An account can only be linked to one partner.
Payment register. To calculate what is due to each partner and maintain our accounting records, we record each paid, refunded, or contested installment of your subscription, regardless of the subscription channel (website, App Store, or Google Play): the channel, the nature of the transaction, its date, its amount, the value-added tax applied, the country used for this tax, and the transaction reference. For a payment on the website, this country is that of your bank card, which Stripe indicates to us; we do not receive your card number or any other banking data.
What the partner receives. Nothing concerning you. The partner only receives aggregate figures: number of registrations and subscriptions linked, amounts due and paid. They do not know your name, your address, or any data allowing you to be identified. If they distribute Gift Cards, they can also know whether each has been activated, never by whom.
Gift Cards. A partner may distribute Trainetic Premium Gift Cards, by selling them in their store or offering them, for example, as a prize in a contest. The person who receives the card activates it themselves on the website, using its code; the partner does not communicate their name or contact details to us. The partner can know if a card they distributed has been activated, never by whom, and a subscription obtained through a Gift Card is not linked to that partner. The processed data are described in section 2.18.
Legal basis. The linking is based on our legitimate interest, which consists of executing our partnership contracts and proving the amounts paid (Art. 6.1.f). The payment register is based on our accounting and tax obligations (Art. 6.1.c).
Retention periods. The link is retained as long as it lasts, then for five years, during which a partner may contest the amounts paid. If you delete your account, your account number is removed from the link: only the partner, the code, the dates, and the end of the link remain, with nothing allowing you to be identified. The payment register is retained for ten years, like accounting documents, even if you delete your account (section 7).
If you want to become a partner. The "Become a Partner" form on our website sends us your identity, contact details, your organization, and a description of your audience. This information is used solely to review your request and respond to you; it is read by the Publisher's team and retained for three years after our last exchange.
Words beginning with a capital letter in sections 2.17 and 2.18 (Friend Code, Referrer, Referred Friend, Free Month, Gift Card, Buyer, Recipient) have the meaning assigned to them in the Terms of Use (article 3).
Processed data. Your Friend Code and your invitation link; the link between a Referrer and their Referred Friend, and the code used; the status of the referral (pending, threshold reached, Free Month awarded, in reserve, limit reached) and its dates; the way the Referrer’s Free Month was awarded (free period, subscription extension on the website or on Google Play, Apple offer code, reserve); where applicable, the Apple offer code provided to the Referrer.
What is counted. To determine whether a Referred Friend has reached the threshold set out in the Terms of Use (article 16 ter.4), we count, from their registration, the sessions they have recorded or declared completed and the meals they have logged in their meal journal (section 2.12). Only these two numbers are used: neither the content of the sessions or meals nor any health data are included in this calculation, and these numbers are not disclosed to anyone.
What the Referrer sees. The number of people registered with their Friend Code, the number of those who have reached the threshold, and their Free Months. They receive a notification “Your friend has started training” when one of their Referred Friends reaches the threshold. If you register using someone’s Friend Code, that person will therefore know that you have started using Trainetic. Your name, email address, sessions, meals, and health data are never disclosed to them.
Sharing your Friend Code. The invitation is sent by you, using the sharing function on your device (messaging, SMS, email) or by copying your link. Trainetic does not access your contacts and does not send any messages to the people you invite.
The Gift Card is purchased on the website, with or without a Trainetic account. It may also be distributed by a partner (section 2.16).
For the Buyer: the email address provided at the time of purchase, the language, the amount paid, proof of acceptance of the Terms of Use, and the technical payment identifiers at Stripe (session and payment). No banking data is received or retained by the Publisher.
For the Gift Card: its code, its activation deadline, its status, and, where applicable, the batch and the partner through which it was distributed.
For the Recipient: the account on which the card was activated and the activation date.
The email containing the Gift Card is sent by our processor Brevo. The payment is processed by Stripe (section 5).
A Race Prep is purchased on the website, from the race page. It includes a training plan aligned with the race date, a Race-Day Guide accessible online and downloadable in PDF format, and fifteen days of Trainetic Premium. Your Race Plan is a plan like any other: it is generated and stored under the conditions set out in section 2.3.
What we record for each Race Prep: the race (name, date, event) and the end date of the Race Prep; the email address provided at the time of payment and your language; the amount and date of payment, and the technical payment identifiers at Stripe; the version of the Terms of Use accepted; a backup code, which links the Race Prep to your account; the account to which the Race Prep is linked, as well as the date and method of linking; its status and, where applicable, its cancellation date. If you withdraw, we also record your withdrawal declaration: your first and last name, the address to which we send the acknowledgment of receipt, your declaration, its date and time, and the IP address of the connection used. No banking data is received or retained by the Publisher.
Proof of the start of your Race Prep. Before paying, you check a box by which you request immediate access to your Race Prep and waive your right of withdrawal from its first use (Terms of Use, article 18). We record, linked to your Race Prep and your account: the date and time at which you checked this box and the version of the displayed statement; the date and time of sending the purchase email and its identifier; then the first of the events marking the start of your Race Prep, i.e., the creation of your plan for the race, the first opening of your Race-Day Guide, or the first download of a PDF of the plan or Race-Day Guide, along with its type, date, and time. These elements are used solely to determine until when you could withdraw and to prove it in case of disagreement.
Creating your account. If you do not have a Trainetic account, you provide on the race page, before paying, the same consents as at registration, as well as your date of birth; proof of these is recorded at the time you provide them (section 2.1). Upon receipt of payment, your account is created with the email address provided at the time of payment, without a password: the purchase email informs you of this and contains a link to set your password, which also confirms your address. If an account already exists with this address, no account is created, and the Race Prep is linked to it as soon as the address is confirmed.
Your Race-Day Guide. It is generated when you open or download it, based on the race and your profile, then sent to your browser; it is not stored on our servers, and only your account can open it. If your profile includes your weight, it is used to calculate carbohydrate and fluid quantities; your weight is neither recorded again nor transmitted to anyone. Without weight, the Race-Day Guide provides values per kilogram, without calculation. No data is sent to our artificial intelligence provider to generate the Race-Day Guide.
If you come via a partner's link, or if the race organizer is a partner. If you purchase your Race Prep using a partner's link or QR code, we record the partner and their code along with the Race Prep. Failing that, if you purchase it on a race page where the organizer is a Trainetic partner, we record that organizer, inferred from the race, along with the Race Prep: no other data is collected. In both cases, this is used solely to calculate the portion of the price that goes to the partner. Your account is not subsequently linked to them, and the partner only receives aggregate figures, never any data concerning you (section 2.16).
Measurement. We count, per race and per week, clicks on the purchase button and purchases: these are numbers, without identifiers (section 2.11). This measurement is separate from the proof of the start of your Race Prep described above, which is, in turn, linked to your account.
Payment is processed by Stripe and the purchase email is sent by Brevo (section 5).
Creation and management of the account, authentication (account data): performance of the contract (art. 6.1.b).
Generation of Race Plans, training monitoring, and adjustment of session load based on your "daily form" (Athlete Profile, plans and monitoring, data from connected services and Bluetooth sensors): explicit consent for health data (art. 9.2.a); performance of the contract for other data (art. 6.1.b).
Review of a session by authorized personnel, without transmission to a third party, when a recording defect is identified, in order to verify and correct the functioning of the Service (sections 2.3 and 2.6): performance of the contract (art. 6.1.b); for the session's health data, the explicit consent you provided for monitoring your training (art. 9.2.a), of which correcting its recording is a part.
GPS tracking of outdoor activities — calculation of distance, pace, elevation gain, and route, voice announcements during effort (location data, section 2.6): consent (art. 6.1.a), revocable at any time.
Connection to third-party services (Garmin, Google Health, Withings) and pairing of Bluetooth sensors: consent (art. 6.1.a), and explicit consent for imported or measured health data (art. 9.2.a).
Nutritional tracking — weight goal and question asked before a goal, meal journal, habits, weight milestones, food examples, analysis of a meal via photo or voice (section 2.12): explicit consent (art. 9.2.a), obtained through a specific agreement for nutritional tracking and revocable at any time.
Protein and carbohydrate recovery benchmarks displayed after a session, calculated based on your profile weight (section 2.12): explicit consent (art. 9.2.a) given upon your registration for monitoring your training programs; they are only displayed if you have also agreed to nutritional tracking.
Personalized daily and weekly summaries written by artificial intelligence (section 2.12): explicit consent (art. 9.2.a), obtained through a separate agreement, distinct from the agreement for nutritional tracking, and revocable at any time.
Exclusion, from the proposed food examples, of what you indicate you do not eat (section 2.12): for your diet and your allergies or intolerances, explicit consent (art. 9.2.a), obtained through a specific agreement and revocable at any time; for foods you dislike, performance of the contract (art. 6.1.b).
Completion of food fact sheets by artificial intelligence (section 2.12): this processing does not involve any personal data.
Connection to Strava and sending of your activities, at your request (section 2.13): consent (art. 6.1.a), revocable at any time by disconnecting Strava; explicit consent (art. 9.2.a), given by confirming the sending, for the heart rate ranges included in the description, and given by checking the provided box, on a per-send basis, for your heart rate curve.
Application of a promotional code to your subscription: performance of the contract (art. 6.1.b).
Referral program (section 2.17) — allocation of Free Months, counting of the Referred Friend's sessions and meals, information to the Referrer: performance of the contract (art. 6.1.b), the referral program rules being set out in the Terms of Use (article 16 ter), which the Referrer and the Referred Friend have accepted. Monitoring compliance with these rules and preventing abuse: legitimate interest (art. 6.1.f), consisting of preserving the fairness of the program. The count only involves numbers, without any health value.
Gift Cards (section 2.18) — sale, sending, activation, withdrawal, and refund: performance of the contract (art. 6.1.b). Retention of sales records: compliance with our accounting obligations (art. 6.1.c).
Race Prep (section 2.19) — sale, creation of your account, purchase email, production of the Race-Day Guide, withdrawal, and refund: performance of the contract (art. 6.1.b). Calculation of the Race-Day Guide quantities based on your profile weight: explicit consent (art. 9.2.a) given upon your registration for monitoring your training programs. Calculation of the partner's share: legitimate interest (art. 6.1.f), consisting of executing our partnership contracts and proving the amounts paid. Proof of your request for immediate access, your waiver of the right of withdrawal, the sending of the purchase email, and the start of your Race Prep: legitimate interest (art. 6.1.f), consisting of establishing and proving the date on which your right of withdrawal ended. Retention of sales records: compliance with our accounting obligations (art. 6.1.c).
Linking your account to the partner whose code or link you used, and calculation of their share (section 2.16): legitimate interest (art. 6.1.f), consisting of executing our partnership contracts and proving the amounts paid. Payment register (section 2.16): compliance with our accounting and tax obligations (art. 6.1.c).
Review of a partnership request submitted via the "Become a Partner" form (section 2.16): pre-contractual measures taken at your request (art. 6.1.b).
Downloading, when displaying a page, of tools and images served by third parties — barcode reader tool and map display tool from the cdnjs service, map backgrounds from OpenStreetMap (sections 2.6 and 2.12): legitimate interest (art. 6.1.f), consisting of providing you with these functions.
Management of the subscription and payment for the paid offer (Stripe customer ID or Application Store transaction ID, subscription status and expiration, billing history): performance of the contract (art. 6.1.b) and compliance with accounting and invoicing obligations (art. 6.1.c).
Proof of the collection of consents and, when it was collected before September 4, 2026, of the waiver of the right of withdrawal (IP, user-agent, timestamp, Terms of Use history), and proof of your other choices (section 2.1): legal obligation and legitimate interest (art. 6.1.c and 6.1.f).
Account security (reset codes): performance of the contract / legitimate interest (art. 6.1.b / 6.1.f).
Assistance via the coaching assistant, in written form (conversations, and recall of your health data to personalize responses): performance of the contract (art. 6.1.b); explicit consent for health data (art. 9.2.a).
Processing of your support requests and tracking of related exchanges (section 2.10): performance of the contract (art. 6.1.b); explicit consent for health data you choose to include (art. 9.2.a). Recording of the technical context of the request to reproduce and correct the reported issue: legitimate interest (art. 6.1.f).
Voice Command — allowing you to control the application and ask questions by voice during a session without handling your phone (audio recording, transcribed text, section 2.7): performance of the contract (art. 6.1.b). The microphone is only activated following your voluntary press of the button, which constitutes your express request; explicit consent if the content relates to your health (art. 9.2.a).
Activation Word Detection — triggering voice command without pressing a button (sound captured and analyzed locally, not transmitted, section 2.8): your consent (art. 6.1.a), given by activating the option and withdrawable at any time.
Counting of monthly dictation volume (duration of recordings, in seconds): performance of the contract (art. 6.1.b).
Support messages and measurement of clicks on their links (section 2.14): legitimate interest (art. 6.1.f), consisting of helping you get started with the Service you have chosen; you may object to this at any time with one click.
Email of your session of the day and Service notifications (section 2.14): performance of the contract (art. 6.1.b), and explicit consent for health data that the session email may contain: heart rate targets, session intention, and reason for any replacement (art. 9.2.a); notifications are only sent after your authorization in your device or browser settings.
Global counting of email openings and clicks, without linking to an individual (sections 2.14 and 2.15): legitimate interest (art. 6.1.f), consisting of verifying that our emails are properly delivered.
Newsletter (section 2.15): consent (art. 6.1.a), confirmed by the link we send you and withdrawable at any time.
Technical logging of access to the Service by our hosting provider (IP address, date, requested page, browser), for security purposes, abuse prevention, and incident diagnosis: legitimate interest (art. 6.1.f).
Backups of the database and files to restore the Service after an incident: legitimate interest (art. 6.1.f). Deletion logs, which allow re-deletion after a restoration of what had been removed (section 7): compliance with our deletion obligations (art. 6.1.c).
Measurement of your usage days to determine how many people return after signing up (section 2.11): legitimate interest (art. 6.1.f), consisting of evaluating the usefulness of the Service and improving it.
Usage log to identify which features are used and detect technical errors (section 2.11): legitimate interest (art. 6.1.f), consisting of ensuring the proper functioning of the Service and correcting it.
Source of sign-ups to identify which campaigns and sites promote the Service (section 2.11): legitimate interest (art. 6.1.f) for the source observed during the visit in which you sign up; consent (art. 6.1.a) for the source stored in your browser for thirty days and for the source of the Android application installation, withdrawable at any time.
Proof of your choice in the cookie management panel (section 11): legal obligation (art. 6.1.c), the Publisher must be able to demonstrate your consent.
Non-essential cookies and trackers: consent (art. 6.1.a).
Withdrawal of consent for health data processing is possible at any time. It results in the inability to generate or update Race Plans, as the processing of this data is essential to the Service, the deletion of your current plan, and the erasure of health data based on this consent, under the conditions of section 8.
Race Plans are generated in a fully automated manner, based on your Athlete Profile and, where applicable, your data from connected services. The written content of sessions relies on an artificial intelligence system provided by Mistral AI. In accordance with Article 22 of the GDPR, you may contact us with any questions regarding this processing at hello@trainetic.io.
The coaching assistant, on the other hand, is an information tool based on artificial intelligence: it operates in read-only mode, provides advice only, does not modify your Race Plan, and does not make any automated decisions producing effects concerning you. The same applies to voice commands: the conversion of your speech into text is an automated process, which may be inaccurate, and does not produce any legal effect or decision concerning you. The same applies to the estimation of a meal from a photo or dictation, which is only recorded after your validation, and to your daily and weekly summaries, which are merely informational texts.
Your personal data is never sold. It is accessible to authorized personnel of the Publisher and to the following service providers.
OVHcloud (OVH SAS) — hosting, and encrypted backup storage in Strasbourg — France (EU) — processor (article 28 of the GDPR).
Mistral AI (French company) — generation of written session content, operation of the coaching assistant, transcription of your voice commands (Voxtral service), analysis of your meals from a photo or dictation, drafting of your daily and weekly summaries, completion of food fact sheets, and reformulation of the caption for a session image — European Union — processor (article 28 of the GDPR). In the application, this provider may be referred to as "our artificial intelligence." In this capacity, certain of your health data and, if you use voice commands, a temporary audio excerpt are transmitted to Mistral AI. For meal photo analysis, only the photo is transmitted, without any identifier or data from your profile. For your summaries, the transmitted data is as described in section 2.12, excluding your weight, name, any identifier, diet, or allergies. For the completion of food fact sheets, only the product data is transmitted. Regarding data imported from Garmin, your health data (resting heart rate, HRV, sleep, Body Battery, VO2max) and the summary of your sessions are transmitted to Mistral AI; details are provided in section 12. Regarding data imported from Google Health and Withings, only derived fitness indicators—and not the raw imported data—are transmitted to Mistral AI. These processes are governed by a data processing agreement (DPA); they are carried out within the European Union, subject to the details in section 6, are not used to train Mistral AI's models, and the data is retained by Mistral AI only for a limited period, solely for security and abuse prevention purposes.
Brevo (French company) — sending of all our emails (section 2.14) and hosting of the newsletter list (section 2.15) — European Union — processor (article 28 of the GDPR). Your email address and the content of each email pass through Brevo, including, for the email of your daily session, your first name, the targets of your session, the session's intention, and, where applicable, the reason for a replacement. Brevo globally tracks openings and clicks without linking them to you. Its sending logs are deleted after one month, and it does not retain a copy of the content of our emails.
Google (Firebase Cloud Messaging service) — routing of Android and iOS application notifications (section 2.14) — processor (article 28 of the GDPR). It receives your device token, as well as the title, text, and link of each notification, never your account identifier or any health values. On iOS, it relays the notification to Apple's notification service.
Stripe (Stripe Payments Europe, Ltd — Ireland) — payment service provider, only if you subscribe to the paid offering on the website or if you purchase a Gift Card or a Race Prep. Payment is made on a secure page hosted by Stripe; Trainetic does not collect, process, or retain any banking data (card number, cryptogram). Stripe acts as a processor for payment execution, on our instructions, and as an independent controller for fraud prevention and compliance with its own legal obligations (fraud prevention, know-your-customer requirements). Trainetic, for its part, retains only the Stripe customer identifier, the status of your subscription, the billing history, and the country of your bank card, which Stripe provides to us for value-added tax application (section 2.16), as well as, for a Gift Card or a Race Prep, the sales data described in sections 2.18 and 2.19. The processing of your payment data is governed by Stripe's Privacy Policy (stripe.com).
Google (Google Commerce Limited — Ireland) — only if you subscribe to the paid offering via in-app purchase from the Android application. The purchase is made on Google Play: Google processes the payment and the Publisher does not receive or retain any banking data. Google does not act as our processor but as a separate controller for the transaction; its own Privacy Policy applies. Google does not share your identity or contact details with us: we receive only the purchase identifier, the status and expiration date of your subscription, and notifications of its renewals, which allow us to grant and track your access rights.
Apple (Apple Distribution International Ltd — Ireland) — only if you subscribe to the paid offering via in-app purchase from the iOS application. The purchase is made on the App Store: Apple processes the payment and the Publisher does not receive or retain any banking data. Apple does not act as our processor but as a separate controller for the transaction; its own Privacy Policy applies. Apple does not share your identity or contact details with us: we receive only the transaction identifier, the status and expiration date of your subscription, and notifications of its renewals, which allow us to grant and track your access rights.
Referral Program and Gift Cards. Stripe processes payments for Gift Cards; Brevo sends the email containing them. For a Referrer subscribed via Google Play, we request Google to postpone the date of their next payment. For a Referrer subscribed via the App Store, we provide them with an Apple offer code: Apple does not receive any data from us; it is the Referrer who activates the code in their Apple account.
Race Prep. Stripe processes the payment for the Race Prep; Brevo sends the purchase email. Our artificial intelligence provider does not receive any data for the Race-Day Guide.
When you connect your account to Garmin, Google, or Withings, these companies act as independent controllers for the data they hold; their own Privacy Policies apply.
When you send an activity to Strava (section 2.13), Strava, Inc. receives it as an independent controller; its own Privacy Policy applies.
When you open a map or the barcode reader from the website (sections 2.6 and 2.12), Cloudflare, Inc., which operates the cdnjs service, and, for maps, the OpenStreetMap Foundation receive your browser's IP address under their own responsibility; their own Privacy Policies apply.
When you enable notifications on the website (section 2.14), the notification service of your browser (depending on the browser: Google, Mozilla, or Apple) routes each notification under its own responsibility; it receives the title, text, and link of the notification, never your account identifier or any health data.
Trainetic's partners (section 2.16) receive only aggregate figures and, for the Gift Cards they distribute, whether each has been activated or not, never any data concerning you.
The same applies to Apple and Google when you subscribe to a subscription from a mobile application: the sale is carried out by the Application Store, which processes the transaction data under its own responsibility. The connection to Google Health / Fitbit (section 10), the routing of notifications, and the purchase on Google Play are separate processing operations, carried out by different entities within the Google group and governed by different terms.
The hosting and core processing of your data are carried out within the European Union (OVHcloud in France; Mistral AI, a French company, within the European Union; Brevo, whose data is hosted within the European Union according to this provider). Your health data and all data imported from your connected services (Garmin, Google Health, Withings) are processed and stored within the European Union, subject to what you yourself choose to send to Strava (section 2.13).
Our processor Mistral AI prioritizes the use of technical providers established within the European Union. However, it may, on an exceptional basis and for ancillary operations, use providers established outside the European Union. These potential transfers are governed by the standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914 of June 4, 2021), which constitute appropriate safeguards within the meaning of Article 46 of the GDPR. You may obtain a copy of these safeguards by writing to us at hello@trainetic.io.
The routing of application notifications by Firebase Cloud Messaging may involve transfers to the United States, limited to your device token and the content of the notification, which does not include your account identifier or any health data. These transfers are governed by Google LLC’s certification under the EU-U.S. Data Privacy Framework and, on a subsidiary basis, by the European Commission’s standard contractual clauses. Browser notification services, used on the website, may also be established outside the European Union; they process notifications under their own responsibility.
If you send an activity to Strava (section 2.13), it is transmitted to Strava, Inc., a company established in the United States, which processes it under its own responsibility and according to the safeguards described in its Privacy Policy. This transmission occurs only at your request, activity by activity, to provide the service you request.
When you open a map or the barcode reader (sections 2.6 and 2.12), your browser’s IP address is received by Cloudflare, Inc., a company established in the United States, and, for maps, by the OpenStreetMap Foundation, established in the United Kingdom. These organizations process it under their own responsibility and according to the safeguards described in their Privacy Policies.
If you subscribe to the paid offering on the website or purchase a Gift Card or Race Prep, payment processing by Stripe may involve data transfers to the United States (particularly for technical support and fraud prevention). These transfers, limited to payment-related data, are governed by appropriate safeguards under the GDPR: Stripe, Inc.’s certification under the EU-U.S. Data Privacy Framework and, on a subsidiary basis, the European Commission’s standard contractual clauses, supplemented by technical measures (tokenization, encryption).
If you subscribe to the paid offering via in-app purchase (App Store or Google Play), the transaction is carried out by a company established in Ireland (Apple Distribution International Ltd or Google Commerce Limited). These companies act as separate controllers and may, as part of their own processing, transfer data to the United States; these transfers are governed by the appropriate safeguards they implement (certification under the EU-U.S. Data Privacy Framework and/or the European Commission’s standard contractual clauses) and are described in their respective Privacy Policies. The data the Publisher receives from these Application Stores (transaction identifier, subscription status, and expiration) is hosted in France and is not subject to any transfers outside the European Union.
Account and associated data (profile, plans, tracking, data from connected services and sensors): for the entire duration of the account's existence, then deletion upon account deletion, including profile photo; health data is also deleted if you withdraw your consent for health data processing (section 8). In the absence of activity, deletion or anonymization after 3 years of inactivity.
Activity you delete: its content (GPS track, sensor curves, blocks, health data, notes, original file) is deleted immediately. We only keep the source of the activity, its identifier with that source, and the deletion date, so that a new synchronization does not recreate it. A manually entered activity, without an identifier from a source, is entirely deleted. The feedback and status entered for the corresponding session in your plan remain in the plan (section 2.3).
Location data (GPS tracks of activities, section 2.6): retained as training history for the entire duration of the account; deletable activity by activity at any time, and deleted upon account deletion (same inactivity rules as above).
Data imported from Google Health / Fitbit and Withings: upon disconnection of the service, access (OAuth token) is revoked and service-specific data (health indicators, raw data received) is deleted immediately; sessions and weigh-ins already copied into your "Activities" are retained as long as your account exists and remain deletable one by one (section 2.4). All data is deleted upon account deletion.
Data imported from Garmin: upon disconnection, the OAuth token is revoked and your daily health indicators from Garmin (resting heart rate, HRV, sleep, Body Battery, VO2max) are deleted; your already imported sessions and their original, encrypted files are retained as training history and remain deletable at any time (see section 12.6). All your Garmin data is deleted upon account deletion.
Billing data and subscription proof (Stripe customer ID or Application Store transaction ID, status and expiration, billing event history): during the subscription period, then archived for accounting and evidentiary purposes; accounting documents (invoices) and the payment register (section 2.16) are retained for 10 years in accordance with the legal obligation (article L123-22 of the French Commercial Code).
Linking of your account to a partner (section 2.16): for its duration, then 5 years; if you delete your account, your account number is removed immediately (section 2.16). Partnership request sent via the "Become a Partner" form: 3 years after our last exchange.
Referral program (section 2.17): your Friend Code, the status of your referrals, your Free Months, and, if applicable, your Apple offer codes are retained for the life of your account. The link between a Referrer and a Referred Friend is deleted upon deletion of either account.
Gift Cards (section 2.18): the Buyer's email address is deleted 3 months after the card's activation deadline. Other sales data (amount, date, payment identifiers, card code) is retained for 10 years, pursuant to our accounting obligations (article L123-22 of the French Commercial Code). Upon deletion of the Recipient's account, the link between the card and that account is deleted.
Race Preps for an event (section 2.19): the email address provided during payment and the backup code are deleted 3 months after the end of the Race Prep, i.e., the fourteenth day following the event date, or its new date in case of postponement. The version of the Terms of Use accepted, proof of the start of your Race Prep (checked box, sending of the purchase email, first usage event), and, if applicable, your withdrawal declaration are retained for 5 years after the end of the Race Prep, as evidence. Other sales data (event, amount, date, payment identifiers, partner) is retained for 10 years, pursuant to our accounting obligations (article L123-22 of the French Commercial Code). Upon deletion of your account, the link between the Race Prep and your account is deleted. If payment for a Race Prep fails, the agreements and date of birth provided on the event page are deleted no later than 24 hours after entry. An account created during purchase but never used (no password set, no address confirmed, no login, no plan, no other Race Prep) is deleted 3 months after refund of the Race Prep in case of withdrawal. Before each deletion, a backup copy is made; it is destroyed after 30 days.
Proof of consents and, where collected before September 4, 2026, of the waiver of the right of withdrawal (IP, user-agent, timestamp, Terms of Use history), and proof of your other choices (section 2.1): 5 years after the end of the relationship. The record of your answer to the question asked before a weight goal is retained as long as your account exists and deleted with it (section 2.12).
Password reset codes: 24 hours.
Technical application logs, including logs of calls to artificial intelligence services: 12 months. Regarding voice commands, these logs only contain the model called, the duration of the call, and its status, never the content of what you said; they never contain a photo of a meal.
Technical data for creating a session recording, when retained to correct a defect (section 2.3): 90 days maximum, then deletion. The session itself follows the rule of your training history.
Access logs maintained by our hosting provider (IP address, date, requested page, browser): we review them for a maximum of ninety days; our hosting provider retains them under its own responsibility, for the duration required by its legal obligations.
Automatic, encrypted backups of the database and files: one backup per day, retained for 30 days; then one backup per month, retained for 12 months. Deleted data may therefore remain in a backup for up to thirteen months after its deletion. It is not retrieved. Every deletion you request is recorded in a deletion log, which contains only the nature of the deletion, the reference of the deleted item, your account, and the date, never any content. In the event of a backup restoration, this log is replayed before any service is resumed, so that what had been deleted is deleted again. The automatic deletions provided for in this section are also replayed before service is resumed. The only limitation: in the event of a total loss of our server, deletions made in the twenty-four hours preceding the incident might need to be redone; you might then have to renew your request. The deletion log is retained for 13 months.
Days of use, usage log, and source of registrations (section 2.11): 13 months from their recording, then automatic deletion, performed daily. If your account is deleted, the link to it is erased immediately; the remaining lines, which contain only dates and codes, are deleted at the same deadline.
Clicks measured on the links in the coaching messages (section 2.14): 13 months, then deletion; the measurement stops as soon as you deactivate the coaching reminders, and these clicks are deleted if the account is deleted.
Email sending logs at Brevo: 1 month. Address subscribed to the newsletter (section 2.15): until you unsubscribe.
Device notification token: as long as you accept notifications and your account exists.
Source remembered on your browser, if you have accepted it: 30 days, and immediate deletion if you withdraw your consent. Source of Android application installation, stored on your phone pending your registration: 2 hours at most.
Your choice in the cookie management panel: stored for 6 months on your browser, after which it is requested again. Proof of this choice: 13 months.
Conversations with the assistant: not retained beyond your visit (temporary session memory).
Nutritional tracking (section 2.12), including habits and weight milestones: for the entire lifetime of the account; deleted as soon as you withdraw your consent to nutritional tracking, and in the event of account deletion. Summaries and meal analyses already written: until the withdrawal of the specific consent or the consent to nutritional tracking, or until account deletion. Your diet and your allergies or intolerances: until the withdrawal of the specific consent or the consent to nutritional tracking, or until account deletion. Foods you dislike follow the nutritional tracking rule. Photo of a meal: no retention.
Connection to Strava (section 2.13): until disconnection from Strava or deletion of your account. Activities sent to Strava are retained according to Strava's rules.
Support requests, messages, attached files, and technical context (section 2.10): 3 years from the closure of the request, then deletion. A request with no exchange for twelve months is considered closed. In the event of account deletion, the text of messages, subject, and attached files are deleted immediately; only the category, channel, origin screen, status, and dates remain until the same deadline.
Audio recording of your voice command: no retention. The temporary file is deleted as soon as your request is processed.
Transcribed text: no retention when the question is asked during a session; it is interpreted and then discarded.
Duration of excerpts, in seconds, used to count your monthly dictation volume: 3 rolling months, then deletion.
In accordance with the GDPR, you have the rights of access, rectification, erasure, restriction, objection, and portability of your data, as well as the right to withdraw your consent at any time. You may, in particular, withdraw your consent on a service-by-service basis by disconnecting a connected service (Garmin, Google Health / Fitbit, Withings) at any time, without this affecting the lawfulness of processing carried out prior to such withdrawal.
Withdrawing your consent to the processing of health data. You may withdraw it at any time in the "Account" section. A screen will first show you what will be erased and offer you the option to export your data. Upon confirmation, the health data that relied on this consent will be erased: the health data in your profile (resting and maximum heart rate, heart rate zones, VMA, power threshold, height, weight, injuries, including their history); in your activities, heart rate, calories, your perceived exertion and that of your watch, training effects and the written analysis, as well as the heart rate from your sensor curves; health data imported from your connected services, including the original activity files from Garmin; your weigh-ins, measurements, and daily steps; in your completed plans, heart rate, injuries, target weight, heart rate targets, your perceived exertion, and the health data that were included, and your ongoing plan will be entirely deleted (see below). What you have already sent to Strava remains there: you can delete it from Strava. The agreements that depend on it (nutritional monitoring, diet and allergies, personalized assessments, sending your heart rate curve to Strava) terminate with it, and imports from your connected services stop. Your ongoing plan is deleted, along with its PDF and the frozen copies of its scheduled sessions; the confirmation screen warns you before you confirm. If your Garmin account is connected, the sessions from this plan scheduled on your watch are removed from Garmin Connect before disconnecting Garmin; if this removal fails (expired authorization, unavailable service), your plan is still deleted, the screen indicates this, and it is your responsibility to delete these sessions from your Garmin Connect account. Your completed plans are kept as archives, stripped of heart rate, injuries, target weight, and heart rate targets, and their PDF is regenerated; they retain their paces. However, they may contain, in the description of your profile at the time of their creation, your VMA or power threshold, as well as session texts written by our artificial intelligence, which may have taken into account an injury you had declared: if you wish to have them erased, write to us at hello@trainetic.io. Your account and your activities, reduced to their non-health data (type, date, duration, distance, pace, cadence, power, elevation, route), are retained. As long as your consent is withdrawn, no health data is recorded, and no new Plan may be generated. If you give it again, collection resumes from that moment; nothing that was erased is restored.
Your rights regarding voice commands. You may deactivate the activation word at any time in your account settings. This deactivation constitutes withdrawal of your consent; it takes effect immediately and does not affect the lawfulness of processing carried out prior to such withdrawal. The microphone button remains available: it only opens the microphone when you press it. Since your audio clips and their transcriptions are not retained, a request for access, rectification, or erasure regarding them is without object: there is no data to communicate or erase.
Your rights regarding nutritional monitoring, your assessments, and Strava. You may withdraw your agreement to nutritional monitoring, your agreement to the recording of your diet and allergies, and your agreement to personalized assessments at any time, under the conditions set out in section 2.12, and disconnect Strava at any time from the "Account" section of the Service. The sending of your heart rate curve to Strava is decided on a per-send basis: simply do not check the box. These withdrawals take effect immediately and do not affect the lawfulness of processing carried out prior to them.
Your rights regarding coaching, notifications, and the newsletter. You may object at any time to coaching messages and the measurement of their clicks, via the "No longer receive these reminders" link present in each of them or via the "Coaching reminders" setting in the "Account" section. You may disable notifications in your device or browser settings and unsubscribe from the newsletter via the link present in each newsletter. These choices take effect immediately.
Your rights regarding your support requests. You may request at any time the communication, rectification, or erasure of a request and the files you attached to it by writing to hello@trainetic.io. The deletion of your account results in the erasure of the content of your requests under the conditions set out in section 2.10.
Your rights regarding the measurement of usage and origin. You may object at any time to the recording of your usage days, the usage log, and the recording of the origin of your registration, from the screen of your consents in the "Account" section of the Service, or by writing to hello@trainetic.io. As long as your objection is active, nothing more is recorded for your account; the origin linked to your account and what had already been recorded under your name are erased. Your choice is timestamped, and you may revoke it at any time. You may withdraw your agreement to the memorization of your origin at any time via the "Manage my cookies" link, present at the bottom of each page of the site, and your agreement to the reading of the installation origin from the "Account" section of the Android application. This withdrawal takes effect immediately and does not affect the lawfulness of processing carried out prior to it. The linking of your account to a partner (section 2.16) is not affected by this objection: it serves as proof of the amounts paid.
You may export your data and delete your account directly from the "Account" section of the Service, or exercise your rights by writing to hello@trainetic.io.
You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL (the French data protection authority) — www.cnil.fr) or the supervisory authority of the European Union Member State where you reside.
Trainetic implements appropriate technical and organizational measures to protect your data: hosting in the European Union (OVHcloud, France), connection to third-party services via the secure OAuth 2.0 protocol, hashed passwords and reset codes, encryption at rest of the health data you enter in your Athlete Profile, those imported from your connected services, sensor curves, and original activity files from Garmin, encrypted backups, and access control. Any consultation of a session by authorized personnel requires a reason and is logged (section 2.3). Your training plans, which include some of these values, particularly your heart rate zones, are stored on our servers without specific encryption; they benefit from the same hosting and access control measures. Regarding voice commands, the access key to the transcription service is stored on our server and is never exposed in the application installed on your phone.
When you connect your Fitbit data or compatible devices via the Google Health API, Trainetic accesses restricted scopes regarding your physical activity, heart metrics, and sleep (see section 2.4).
Trainetic's use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including its Limited Use requirements. In particular:
Access: via the OAuth 2.0 protocol, after your explicit consent, and limited solely to the necessary data described in section 2.4.
Use: exclusively to provide you with the in-app functionalities for customizing your training plans and adjusting the load of your sessions based on your "daily fitness level"; and, at your request, sending a session imported from Google Health to Strava (section 2.13). No other purpose.
Storage: within the European Union (OVHcloud, France); health data is encrypted at rest.
Sharing: no sale, no advertising use, no transfer to a data broker. This data is not shared with any third party, with one exception, which depends on you: if you have linked your Strava account, you may send a session imported from Google Health to Strava on a session-by-session basis; only the data necessary for its creation on Strava is then transmitted (including its duration, distance, and calories), with no raw heart or sleep measurements. The description may, however, contain heart rate ranges calculated from your zones and, where applicable, heart data imported from Google Health; these are indicated to you before sending, and you may remove them (section 2.13). Furthermore, only derived fitness indicators (and not raw Google data) may be transmitted to our processor Mistral AI (European Union) to generate session descriptions. This data is never used to develop, improve, or train artificial intelligence models.
Retention and deletion: you may disconnect the service at any time; access is then revoked, and service-specific data is erased, while sessions already copied to your "Activities" remain stored and can be deleted individually (see sections 2.4 and 7).
A cookie is a small file saved by your browser. We collect your consent ourselves, without any tool provided by a third party: your choices remain with Trainetic. Cookies that are not strictly necessary for the Service, or for a function you have requested, are only placed with your consent.
When cookies are placed. The site's presentation pages do not place any cookies by themselves. The cookies described below are placed when you open the application pages, for example the registration page, or when you make a choice in the cookie management panel.
The cookie management panel. When you arrive on our site via a campaign link or from another site, a panel offers to remember your origin for thirty days (see section 2.11). It includes three equally important buttons: "Accept," "Reject," and "Customize." Nothing is recorded before your choice. If you refuse, or if you later withdraw your consent, the stored origin is deleted immediately. You can revisit your choice at any time via the "Manage my cookies" link, located at the bottom of every page on the site. Your choice is stored for six months, after which it is requested again.
Proof of your choice. We keep for thirteen months a randomly generated identifier, your choice, the version of the panel text, and the date. This proof contains neither your IP address, nor your browser characteristics, nor your account.
The cookies used.
| Cookie | Purpose | Duration | Your consent |
|---|---|---|---|
| trainetic_sess | Maintain your session and protect forms against fraudulent submissions (security token). | Until the browser is closed if you are not logged in; 90 days, extended with each use, once logged in. | Not required: strictly necessary. |
| trainetic_remember_, followed by your account number | Log you in automatically. | 90 days. | Not required: necessary for logging into the Service. |
| trainetic_compte_actif | Remember the last account used in this browser. | 90 days. | Not required: necessary for the account selector. |
| trainetic_comptes | Remember the list of accounts you have added to switch between them (account selector); it contains the email address and name of these accounts. | 90 days. | Not required: function you have requested. |
| trn_consentement | Store your choice in the cookie management panel. | 6 months. | Not required: necessary to respect your choice. |
| trn_provenance | Store the origin of your visit, to attribute it to a subsequent registration (section 2.11). | 30 days. | Required: placed only if you accept it. |
On your phone and in your browser. The application stores on your phone, only for functions you use: sessions recorded without a network connection; the current session and its recovery points, deleted after six hours; GPS points recorded with the screen locked, pending attachment to the session; pending feedback; three display preferences; and a technical log of the application, deleted fourteen days after being written, during a subsequent opening of the application. On the site, data from a current session is kept in your browser for up to thirty days. If you accept notifications, your phone or browser also stores the subscription that allows them to be sent to you (section 2.14). None of this information is used for advertising or audience measurement. On Android, and only if you have accepted it, the application also stores the installation campaign for up to two hours (see section 2.11).
No Garmin data is collected until you have linked your account. The link is established from Account › Third-Party Applications and goes through Garmin's authorization screen (OAuth 2.0 protocol with PKCE), where you choose whether or not to grant access. We never see your Garmin credentials.
Once the link is established, the data is transmitted to us by Garmin in real time, via notification (push), as your synchronizations occur. Trainetic does not query your Garmin account on its own initiative to extract data.
Authorization tokens (OAuth) enabling the link.
Health data (Art. 9): resting heart rate, Body Battery™, sleep (duration and score), VO2max, heart rate variability (HRV).
Activities: type, date and time, distance, duration, average speed, average and maximum heart rate, cadence, positive elevation gain, altitude profile, step count, calories, and the Garmin device model used for the measurement.
Original file of each activity (FIT file), as transmitted by Garmin, stored encrypted on our servers, in a space inaccessible from the web.
To calibrate and adapt your training plans (volume, paces, load, recovery).
To populate the "My Daily Fitness" display and your history in the "Activities" module.
To enable the coaching assistant to respond while taking into account your fitness and recent sessions.
When a recording defect is identified, to verify and correct the Service's operation, through an examination by authorized personnel of the Publisher, without transmission to a third party (section 2.3).
It is not used for any other purpose. It is never sold, never used for advertising purposes, and never transmitted to third parties except as described in point 12.4, including the sending to Strava that you decide yourself.
Two service providers, and only two, process data from Garmin. Both act as processors within the meaning of Article 28 of the GDPR, on the Publisher's instructions and under a data processing agreement (DPA).
OVHcloud (OVH SAS) — hosting and storage — France (European Union).
Mistral AI — European Union. Your health data from Garmin (resting heart rate, HRV, sleep, Body Battery™, VO2max) and the summary of your sessions from Garmin are transmitted to Mistral AI, an artificial intelligence service, for the drafting of your session content and for the operation of the coaching assistant. This data is processed within the European Union, subject to the details in section 6, is not used to train Mistral AI's models, and is retained by Mistral AI only for a limited period, solely for security and abuse prevention purposes.
Sending to Strava, at your request. If you have linked your Strava account (section 2.13), you may send, activity by activity, an activity imported from Garmin. Only the data necessary for its creation on Strava is then transmitted (including its duration, distance, and calories), along with the name and description you have verified. None of your health measurements from Garmin (heart rate, HRV, sleep, Body Battery™, VO2max) is transmitted as such. The description may, however, contain heart rate ranges calculated from your zones and, where applicable, from cardiac data imported from Garmin; these are health data, they are indicated to you before sending, and you may remove them (section 2.13). Strava, Inc., a company established in the United States, receives the activity as an autonomous controller (see section 6).
Outside of these cases, no other third party receives your Garmin data. Garmin, for its part, remains an autonomous controller for the data it holds; its own Privacy Policy applies to this data.
Data is stored on OVHcloud's infrastructure, in France (European Union). Health values from Garmin and original activity files are encrypted.
They are retained for the entire duration of your account's lifespan, then deleted upon its deletion, or earlier if you withdraw your consent for health data processing (section 8). In the absence of activity, they are deleted or anonymized after three years of inactivity.
You may withdraw access at any time, in two ways: from Trainetic (Account › Third-Party Applications › Disconnect), or from your Garmin Connect™ account (Connected Apps). Both produce exactly the same effect, immediately:
Your authorization tokens are deleted: Trainetic can no longer access your Garmin account.
The link between the two accounts is deleted and no new data is imported from Garmin.
Your daily health indicators from Garmin (resting heart rate, HRV, sleep, Body Battery™, VO2max) are erased.
Your previously imported sessions are retained, along with their original files, encrypted: they constitute your Trainetic training history and are used to personalize your future plans. These sessions include measurements recorded during exercise, such as average and maximum heart rate—you were informed of this when you linked Garmin. You retain control of this history at all times: you may delete it session by session from the "Activities" module, which also erases the original session file, or in its entirety by deleting your Trainetic account.
If you withdraw your consent for health data processing, the sessions from your current Race Plan scheduled on your watch are removed from Garmin Connect before disconnecting from Garmin (section 8).
This section is an English translation of section 12 above, provided for international readers. In case of discrepancy, the French version prevails.
This section brings together, in a single place, how the data from your Garmin Connect™ account is collected, used, processed and stored. It complements sections 2, 3, 5 and 7 without replacing them.
No Garmin data is collected until you have linked your account. The link is set up from Account › Third-party applications and goes through Garmin's authorization screen (OAuth 2.0 protocol with PKCE), on which you choose whether or not to grant access. We never see your Garmin credentials.
Once the link is established, the data is sent to us by Garmin in real time, by push notification, as your syncs occur. Trainetic does not query your Garmin account on its own initiative to extract data from it.
Authorization tokens (OAuth) enabling the link.
Health data (sensitive data within the meaning of Article 9 GDPR) : resting heart rate, Body Battery™, sleep (duration and score), VO2max, heart rate variability (HRV).
Activities : type, date and time, distance, duration, average speed, average and maximum heart rate, cadence, elevation gain, elevation profile, step count, calories, and the model of the Garmin device that recorded the measurement.
Original file of each activity (FIT file), as sent to us by Garmin, stored encrypted on our servers, in an area that cannot be reached from the web.
To calibrate and adapt your training plans (volume, paces, load, recovery).
To power the "My form today" display and your history in the "Activities" module.
To allow the coaching assistant to respond taking into account your form and your recent sessions.
When a recording fault is identified, to check and correct the operation of the Service, through a review by the Publisher's authorized staff, without any transfer to a third party (section 2.3).
It is not used for any other purpose. It is never sold, never used for advertising purposes, and never shared with third parties other than in the cases described in point 13.4, including the sending to Strava that you decide yourself.
Two providers, and only two, process the data from Garmin. Both act as processors within the meaning of Article 28 GDPR, on the Publisher's instructions and under a data processing agreement (DPA).
OVHcloud (OVH SAS) — hosting and storage — France (European Union).
Mistral AI — European Union. Your Garmin health data (resting heart rate, HRV, sleep, Body Battery™, VO2max) and the summary of your Garmin sessions are sent to Mistral AI, an artificial-intelligence service, for the writing of your session content and for the operation of the coaching assistant. This data is processed within the European Union, subject to the clarifications in section 6, is not used to train Mistral AI's models, and is retained by Mistral AI only for a limited period, solely for security and abuse-prevention purposes.
Sending to Strava, at your request. If you have linked your Strava account (section 2.13), you can send an activity imported from Garmin to Strava, one activity at a time. Only the data needed to create it on Strava is then sent (in particular its duration, distance and calories), together with the name and description you have checked. None of your Garmin health measurements (heart rate, HRV, sleep, Body Battery™, VO2max) is sent as such. However, the description may contain heart-rate ranges calculated from your zones and, where applicable, from heart-rate data imported from Garmin; these are health data, they are pointed out to you before sending, and you can remove them (section 2.13). Strava, Inc., a company established in the United States, receives the activity as an independent controller (see section 6).
Apart from these cases, no other third party receives your Garmin data. Garmin, for its part, remains an independent controller for the data it holds ; its own privacy policy applies to that data.
The data is stored on OVHcloud's infrastructure, in France (European Union). The health values from Garmin and the original activity files are encrypted.
It is kept for the entire lifetime of your account, then erased when the account is deleted, or earlier if you withdraw your consent to the processing of health data (section 8). In the absence of activity, it is deleted or anonymized after three years of inactivity.
You can withdraw access at any time, in two ways : from Trainetic (Account › Third-party applications › Disconnect), or from your Garmin Connect™ account (Connected applications). Both produce exactly the same effect, immediately :
Your authorization tokens are deleted : Trainetic can no longer access your Garmin account.
The link between the two accounts is deleted and no new data is imported from Garmin.
Your daily health indicators from Garmin (resting heart rate, HRV, sleep, Body Battery™, VO2max) are erased.
Your already-imported sessions are kept, together with their original files, encrypted : they form your Trainetic training history and are used to personalize your future plans. These sessions include the measurements recorded during exercise, including average and maximum heart rate — you were informed of this when you linked Garmin. You retain control of this history at all times : you can delete it session by session from the "Activities" module, which also erases the session's original file, or in full by deleting your Trainetic account.
If you withdraw your consent to the processing of health data, the sessions of your current plan that were scheduled on your watch are removed from Garmin Connect before Garmin is disconnected (section 8).
This Privacy Policy may be updated to reflect legal or technical developments. The date of the last update is indicated at the top of the document; in the event of a substantial modification, you will be informed.
← Back to home