Privacy policy

Version of 2026-10-14

1. Who is responsible

Tri2Bi is a private, non-commercial, invite-only training app run by:

[not set yet]
[not set yet]
Email: [not set yet]

2. What is stored

Your account: name, email, a hash of your password (never the password itself), when you agreed to this policy and to the AI coach.
From Garmin Connect, which you connect yourself: your activities with their measurements (time, distance, pace, heart rate, power, cadence, and GPS positions of the routes), and daily health data: resting heart rate, heart-rate variability (HRV), sleep, stress and Body Battery. To load new data every hour, Garmin's session key is stored, encrypted; your Garmin password is not stored.
From a Strava archive, if you upload one: a summary of each activity.
What you enter: goals, training plans, heart-rate thresholds, chats with the AI coach.
For the AI coach: a log of every request sent to OpenAI (what was sent, the answer, the token count), so you can see exactly what left the app.
One cookie that keeps you logged in (30 days), and one for the chosen language. They are needed for the app to work; there is no tracking, no advertising and no analytics.

Heart rate, HRV, sleep and similar values are health data (Art. 9 GDPR). They are only processed because you explicitly agreed to it when creating your account.

Access requests (without an account): if you use "Request access", your name, email and optional message are stored so the operator can answer you (Art. 6(1)(b) GDPR, steps before a contract you asked for). The request is deleted when it is answered, and after 90 days at the latest.

3. Why, and on what legal basis

To provide the app to you (dashboard, analyses, training plans): Art. 6(1)(b) GDPR, and for health data your explicit consent, Art. 9(2)(a) GDPR.
The AI coach only runs after a separate, explicit agreement on the Coach page (Art. 9(2)(a) GDPR), which you can withdraw there at any time.
Keeping the app secure and working (backups, error logs): Art. 6(1)(f) GDPR.

Your data is never sold, shared for advertising or shown to other athletes.

4. Who else processes it

Google Cloud (Google LLC) hosts the app on a server in the USA (Iowa). Google acts as a processor. Transfers to the USA rely on the EU-US Data Privacy Framework and Google's standard contractual clauses.
OpenAI receives the summary described on the Coach page, only when you ask the coach something and only after your agreement. According to OpenAI, data sent through its API is not used to train its models and is kept for a limited time (up to 30 days) for abuse monitoring. Processing takes place in the USA.
Garmin and Strava are where your data comes from; their own privacy policies apply there. Tri2Bi only reads from Garmin and, when you ask for it, sends planned workouts to your Garmin calendar.

5. How long

As long as your account exists. When you delete your account (on My account), all your data is deleted at once. Backups of the database are kept for up to 14 days, so deleted data disappears from them within 14 days at the latest.

6. Security

The connection is encrypted (HTTPS). Passwords are stored as salted hashes, the Garmin session key and other keys encrypted. Each athlete's data is technically separated; the admin sees only how much data an account has, never the data itself.

7. Your rights

You can see and download everything stored about you (My account → Download my data), correct your name and password, delete your account with all data, withdraw your agreement to the AI coach (Coach page) and to the processing of your health data (by deleting your account). You also have the right to restriction, objection and data portability, and to complain to a data protection authority, for example the one of the German state where you live. For anything else, write to the email above.

Imprint

2. What is stored

Your account: name, email, a hash of your password (never the password itself), when you agreed to this policy and to the AI coach.

From Garmin Connect, which you connect yourself: your activities with their measurements (time, distance, pace, heart rate, power, cadence, and GPS positions of the routes), and daily health data: resting heart rate, heart-rate variability (HRV), sleep, stress and Body Battery. To load new data every hour, Garmin's session key is stored, encrypted; your Garmin password is not stored.

From a Strava archive, if you upload one: a summary of each activity.

What you enter: goals, training plans, heart-rate thresholds, chats with the AI coach.

For the AI coach: a log of every request sent to OpenAI (what was sent, the answer, the token count), so you can see exactly what left the app.

One cookie that keeps you logged in (30 days), and one for the chosen language. They are needed for the app to work; there is no tracking, no advertising and no analytics.

Heart rate, HRV, sleep and similar values are health data (Art. 9 GDPR). They are only processed because you explicitly agreed to it when creating your account.

3. Why, and on what legal basis

To provide the app to you (dashboard, analyses, training plans): Art. 6(1)(b) GDPR, and for health data your explicit consent, Art. 9(2)(a) GDPR.

The AI coach only runs after a separate, explicit agreement on the Coach page (Art. 9(2)(a) GDPR), which you can withdraw there at any time.

Keeping the app secure and working (backups, error logs): Art. 6(1)(f) GDPR.

Your data is never sold, shared for advertising or shown to other athletes.

4. Who else processes it

Google Cloud (Google LLC) hosts the app on a server in the USA (Iowa). Google acts as a processor. Transfers to the USA rely on the EU-US Data Privacy Framework and Google's standard contractual clauses.

OpenAI receives the summary described on the Coach page, only when you ask the coach something and only after your agreement. According to OpenAI, data sent through its API is not used to train its models and is kept for a limited time (up to 30 days) for abuse monitoring. Processing takes place in the USA.

Garmin and Strava are where your data comes from; their own privacy policies apply there. Tri2Bi only reads from Garmin and, when you ask for it, sends planned workouts to your Garmin calendar.

7. Your rights