TindraFit privacy policy
1. Status of the app
TindraFit is a training dashboard for endurance athletes. It is currently paused and in a closed beta. Sign-up is closed, and we do not accept new users. Beta users who already have an account can still sign in, see their data, download it and delete it.
While the app is paused, we do not collect new training data from other services, and the AI features are switched off.
The direct connection to Garmin Connect described in this policy is not active yet. We will only switch it on after Garmin has approved us. We collect no Garmin data about you until you have connected your Garmin account and given the consents described below. We will update this policy before anything else changes.
2. Who is responsible
The controller is Ness Development, a sole proprietorship (enkeltpersonforetak) owned by Tore Olav Ness, organisation number 838 783 112, Hvitsteinveien 5B, 3085 Holmestrand, Norway.
Email: post@nessdevelopment.no. Use the same address to ask about your data or to report misuse of the service.
3. Artificial intelligence (AI) transparency statement
TindraFit has three features that use the AI model Claude from Anthropic: a weekly training summary, an AI chat where you can ask about your training, and workout suggestions. All three are switched off while the app is paused, and nothing is sent to Anthropic. When we switch them on again, the following applies:
- What the AI receives: your training sessions and training-load figures, heart rate, heart rate variability (HRV), resting heart rate, sleep and your readiness, including what you have recorded about how you feel. It also receives what you have written about your goals, level and constraints in the AI coach profile, and what you type in the chat, exactly as you typed it. The weekly summary uses the week in question, with a 7-day baseline. The chat uses the last 14 days of sessions and the last 30 days of readiness. The workout suggestions use the last 14 days: your latest training-load figures (CTL, ATL and TSB), your latest readiness (HRV, resting heart rate, sleep hours and sleep score), a list of your sessions with sport, duration, load (TRIMP) and date, your maximum heart rate and your AI coach profile (goal, goal date, years of training, sports, level, hours per week, days, time of day and equipment). If you ask for suggestions for a whole week, the AI also receives your weekly plan. The workout suggestions do not receive GPS tracks or heart rate streams. None of the three features receives your name or email address, the notes you have written on your sessions, or the injury history and the note about fatigue in your AI coach profile. Sessions from Strava are not sent to the AI. The training-load figures are still calculated from all your sessions, including those from Strava, so Strava sessions can affect these figures.
- Think about what you type in the chat: the text is sent as it is. If you write about injuries or your health, the AI receives that too. Do not write about other people or about anything you do not want the AI to process.
- Purpose: only to give you training guidance in the app. The answers are not medical advice. It is not used to make decisions about you that have legal or similarly significant effects.
- Who processes it: Anthropic (contracting party Anthropic Ireland, Limited, processing in the USA) processes the data on our behalf as our data processor. Anthropic does not use it to train its models. Under Anthropic’s policy, inputs and outputs are deleted within 30 days, unless they are flagged for a breach of Anthropic’s usage policy (then kept for up to 2 years).
- No training by us: we do not use your data to train or fine-tune any AI model.
- Your explicit consent first: nothing is sent to the AI until you have ticked a separate box in the app. You can use TindraFit without the AI.
- Withdraw at any time: Settings → Privacy or by email. The AI processing stops at once. Answers you have already received stay in your account until you delete them.
- We update this statement when the law or Garmin’s requirements change.
4. What we process, why, and our legal basis
- Account: email address, name if you give it, login data
Purpose: create and run your account
Legal basis: contract, Art. 6(1)(b) - Garmin data, after you connect Garmin and consent: activities (type, time, duration, distance, pace or speed, heart rate, power, cadence, laps, training effect and load, and the activity file, which can contain your GPS route) and daily health summaries (resting heart rate, heart rate during the day, HRV, sleep, stress, Body Battery, respiration, blood oxygen, weight). We store no Garmin data other than what is listed here
Purpose: show your training, calculate training load, fitness, fatigue, form and readiness
Legal basis: explicit consent, Art. 9(2)(a) and Art. 6(1)(a). This is health data - Data from the earlier beta (section 6): training sessions and any daily measurements (such as resting heart rate, HRV and sleep) that we collected from intervals.icu and Strava for users who connected them. We collect no more
Purpose: show them next to your other training
Legal basis: the consent you gave when you connected the service, Art. 9(2)(a) and Art. 6(1)(a) - What you enter: how you feel, notes, strength sessions, lactate tests, thresholds and heart rate zones, and the goals, level and constraints in the AI coach profile
Purpose: part of your training picture
Legal basis: consent, Art. 9(2)(a) and Art. 6(1)(a) - Calculated figures: training load, fitness, fatigue, form, readiness
Purpose: shown to you (thresholds and zones also to your coach if you have one, see below). This is an analysis (profiling) of your training status, but it leads to no automated decisions about you (Art. 22)
Legal basis: same consent as the data it is based on - The AI features (section 3): summary, chat and workout suggestions. Switched off while the app is paused
Purpose: training guidance
Legal basis: separate explicit consent, Art. 9(2)(a) and Art. 6(1)(a) - Sharing with your coach: if you send a booking request to a coach in TindraFit, you are linked to that coach. The coach then sees the booking requests, your lactate tests (with lactate and heart rate), your thresholds and zones and your sharing settings. The coach does not see your sessions or your daily health measurements
Purpose: to let the coach follow you up
Legal basis: your explicit consent when you send the request, Art. 9(2)(a) and Art. 6(1)(a). You cannot yet remove the link yourself in the app. Email us, and we will remove it within a week - Link to a lactate result: you can choose to share a lactate result through a link. Anyone with the link can see the result without signing in
Purpose: to let you show the result to anyone you choose
Legal basis: your explicit consent when you create the link, Art. 9(2)(a) and Art. 6(1)(a). Email us, and we will close the link - Planned workouts you choose to send to your Garmin device
Purpose: put the workout on your watch
Legal basis: contract, Art. 6(1)(b). Garmin then processes it under its own privacy policy - Technical logs (IP address, time, page requested) at our host
Purpose: deliver the service and protect it against attacks
Legal basis: legitimate interest, Art. 6(1)(f) - Visitor statistics on the public pages of tindrafit.no, not behind login: page views, without cookies and without any identifier that follows you from visit to visit. No training or health data
Purpose: to see whether the pages are used
Legal basis: legitimate interest, Art. 6(1)(f)
We do not sell your data, show advertising or use tracking cookies. We use no analytics tools behind the login. We do not share your data with anyone other than those listed in section 7, and a coach or a link that you have chosen yourself (see above). Otherwise we do not publish it.
5. Garmin
Garmin Connect is a separate service. When you connect it, you authorise Garmin to send us your data through Garmin’s developer programme. We receive data from the time you connect. We do not receive your history from before that.
Garmin is responsible for the data in your Garmin account under its own privacy policy (garmin.com/privacy/connect). You can disconnect TindraFit both in TindraFit and in Garmin Connect. Then we stop receiving data and delete it as described in section 8.
6. Data from the earlier beta
Before October 2026, some beta users connected intervals.icu and Strava to TindraFit. We have stopped collecting this data, and the scheduled jobs that collected it have been stopped. What was collected is still stored in our database. We will either ask you for consent under this policy or delete it. You can ask us to delete it now.
7. Who processes data for us
- Supabase, Inc.: database and login
Where: the data is stored in the EU (Stockholm). Supabase is a US company, and its support staff and some of its subprocessors may access data from outside the EEA
Transfer basis: EU standard contractual clauses (Art. 46(2)(c)), which are part of Supabase’s data processing agreement - Vercel Inc.: hosting, scheduled jobs, calculations and visitor statistics on the public pages, and receiving data from Garmin once the connection is switched on
Where: USA
Transfer basis: EU standard contractual clauses (Art. 46(2)(c)) - Anthropic (Claude API): the AI features, only with your consent (section 3)
Where: USA
Transfer basis: EU standard contractual clauses (Art. 46(2)(c)), which are part of Anthropic’s data processing agreement - Email provider for login emails: Supabase Auth sends login emails through an email provider. The provider only processes your email address and the email itself, with the login link
Where: may be outside the EEA, including the USA
Transfer basis: EU standard contractual clauses (Art. 46(2)(c))
All of them process data only on our instructions and under data processing agreements. None of them gets access to Garmin’s systems or may use your data for their own purposes. You can ask us for a copy of the transfer safeguards.
8. How long we keep data
- Garmin data and figures calculated from it: as long as Garmin is connected and your consent stands. If you disconnect Garmin or withdraw consent, or Garmin tells us that you have removed access, we stop collecting at once and delete the Garmin data within 30 days.
- AI: Anthropic deletes within 30 days (section 3). Answers you have received stay in your account until you delete them or the account.
- Your account: until you ask us by email to delete it. We delete within 30 days. In the app you can delete all your health data and download your data yourself. We do not take automatic backups of the database. If we make a manual copy, it is stored and deleted under the same rules as the database, including the 30-day deadline when you ask for deletion.
- Inactive accounts: we have no automatic deletion. We review the accounts at least once a year. If you have not logged in for 12 months, we email you and delete the account 30 days later, unless you ask us to keep it.
- Record of your consents: as long as we process data based on them, and up to 12 months afterwards, to document them.
- Technical logs: our host keeps them under its own rules (vercel.com/legal/privacy-policy).
- If we close TindraFit: we tell you and delete all data within 90 days.
9. Your rights
You can ask for access to your data, correction, erasure, restriction, and a copy in a machine-readable format (data portability). You can object to processing based on legitimate interest. You can withdraw a consent at any time by email, or in the app where it has a switch for it. This does not affect processing before the withdrawal. We reply within one month.
If you think we break the rules, you can complain to the Norwegian Data Protection Authority, Datatilsynet (datatilsynet.no).
10. Age
TindraFit is for people aged 18 and over. Sign-up is closed. Before we open it again, we will add an age confirmation. If we learn that a user is under 18, we delete the account and the data.
11. Security
We use encrypted connections and access control in the database, so that each user can only reach their own data. Only the owner of Ness Development has administrative access.
12. Changes
We will tell you in the app or by email before material changes. If we want to use your data for a new purpose, we will ask for your consent again.