PEAKTRAIL.RUN — Privacy Policy
As of: October 31, 2026 · Version 1.0 · Deutsche Version
1. Controller
The controller for data processing on peaktrail.run is:
roither.dev e.U. (sole proprietorship), Owner Georg Roither
Hochfeld 3A, 4048 Puchenau, Austria
Email: office@roither.dev
The commercial register number (FN) and VAT ID will be added once officially registered.
2. Data we process
PeakTrail is a trail-running training planning and analysis platform. We only process data relevant to your training:
- Garmin data: activities (runs, distance, duration, heart rate, elevation profiles, .FIT training data), health data (HRV, sleep, resting heart rate, stress, body battery, daily summaries) and — only with your separate, explicit opt-in — women's health data (cycle data). The connection runs via the Garmin Connect APIs; you control at any time in your Garmin Connect account which data is shared.
- Watch and device data: device pairing (device token), training and strength data captured on your watch, workout reminders and fueling events (in-training nutrition).
- Training plan data: goals, races, race website links, GPX course files, training plans and versions, session outcomes (completed/missed), subjective wellbeing (e.g. RPE 1–10).
- Nutrition and fueling data: food data you enter, fueling plans, optionally photos of meals for calorie/macro estimation — only with your review approval.
- Account data: name, email, password (hashed), language setting, invitation and registration data (PeakTrail is a private beta, access by invitation only).
- Technical data: server and application logs (error diagnosis, security incidents), sync protocols (which data sources were pulled when).
- Transitional intervals.icu: while the transition integration is active, activity data is pulled from intervals.icu and stored with the provenance label
intervals-icu.
We do not process payment data on our own systems (donations run through Liberapay) and we do not run tracking, advertising, or profiling.
3. Purposes and legal bases
- Contract performance (Art. 6(1)(b) GDPR): providing training planning, KPI computation (readiness, load, training load, race projections), synchronizing your data sources, delivering training plans to your devices.
- Consent (Art. 6(1)(a) GDPR in conjunction with Art. 9(2)(a) GDPR): processing of health data (HRV, sleep, stress etc.), women's health data, AI-assisted plan generation, photo analysis, pushing workouts to your Garmin device. Each of these consents can be withdrawn at any time with effect for the future.
- Legitimate interest (Art. 6(1)(f) GDPR): operational security, error diagnosis, abuse prevention.
4. Garmin data in detail
PeakTrail is part of the Garmin Connect Developer Program and uses the Activity API, Health API, Women's Health API, and Training API:
- Retrieval (pull/push): activity and health data is pulled from Garmin or received via push notifications as soon as your device syncs.
- Purpose: computing your training KPIs (readiness score, training load, ACWR, heart rate zone analysis, race projections) and personalizing your training plans. The data is used exclusively for your training — never for cross-athlete analysis.
- Ending the connection: you can revoke the sharing at any time in your Garmin Connect account under data sharing / connected apps, and additionally delete the connection inside PeakTrail.
- Workout push to Garmin: before the first transfer of training plans to your Garmin device (Connect IQ / Training API), we show a notice linking to garmin.com/privacy/connect and obtain your explicit consent. You may withdraw it at any time.
- Women's health: cycle data is processed only after a separate opt-in and never enters readiness scores or aggregates without your explicit decision.
5. Service providers and third parties
We do not share or sell your data — to anyone. For operations we involve the following service providers (processors and transport providers):
- Hosting & databases (EU): Oracle Cloud Infrastructure (EU region, EU processing); planned additionally netcup GmbH (Austria) for static content. All personal data is hosted in the EU.
- Cloudflare (DNS, transport encryption, zero-trust access protection): processes personal data in transit (including IP address, TLS termination), not persistently.
- Mistral AI SAS (EU): AI-assisted training plan generation via the Mistral API. Contractual guarantee: no model training on API data, processing in the EU. What is transmitted is governed by section 6.
- Garmin (Garmin Ltd.): data source and recipient of the data you share; Garmin processes your data under its own privacy policy (garmin.com/privacy).
- intervals.icu (transitional source): while active, activity data is retrieved at your request; clearly labeled
intervals-icu. - Liberapay (donation link): no widget, no scripts on our side; their terms apply when you click.
- Bring Your Own AI (BYOAI): if you configure your own AI provider for plan generation, that provider is involved by your choice. Important: the provider you choose may use transmitted data to train its models — this is outside our control. Review your provider's terms. We recommend only providers with a no-training guarantee. Such providers receive minimized plan-level data only (see section 6), no raw health data.
6. AI processing & AI Transparency Statement
PeakTrail uses AI models to create and adapt training plans. We keep this transparent:
- What the model sees: the prompt to the model contains plan-level values only — weekdays, session structure, derived course numbers (e.g. distance, elevation of your race) and your notes. No heart rate, HRV, sleep, or other raw health data, no volume history, no identifying details leave the backend toward the model. This is implemented as an enforced code property (our "AI contract"), not a promise.
- Garmin data and AI models: Garmin-sourced data and anything derived from it is not used to train, test, benchmark, or improve AI models. No fine-tuning, no AI knowledge base built from your data.
- Decisions stay with the system: the model writes words; the backend computes and decides the numbers (KPIs, time targets). Readiness statements are rule-based, with no model call.
- Time series forecasts (Timestral): run locally on our EU server, offline, numbers only — no data leaves the box.
- Explicit consent: any AI-assisted processing of your data (plan generation, photo analysis for nutrition tracking) happens only after your explicit consent, which you give when using the feature and can withdraw at any time in settings — with effect for the future; running jobs are then cancelled.
- No AI processing without consent: processing involving AI models is technically coupled to your consent.
- Changes: if AI processing or providers change, we update this statement and notify you in the app.
7. Your rights
- Access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18)
- Data portability / export (Art. 20): you can request a machine-readable export of your data or export it yourself (e.g. original .FIT files from your Garmin account). An automated full export inside the app will be provided once implemented — until then we fulfil export requests manually and promptly.
- Objection (Art. 21) and withdrawal of consent — at any time, informally, with effect for the future.
- Complaint to the Austrian Data Protection Authority, Wickenburggasse 8, 1080 Vienna, dsb.gv.at.
Send any request to office@roither.dev. We respond within the statutory deadlines.
We are not Strava. Your data belongs to you.
- No sale of your data — to anyone, ever.
- No tracking, no ad networks, no profiling.
- Hosting and processing in the EU.
- AI only with your consent — and without Garmin raw data leaving the platform toward any model.
- Export and deletion of your data at any time, without hurdles.
8. Retention, backups, security
- Retention: as long as your account exists; after account deletion personal data is deleted, subject to statutory retention obligations (e.g. accounting).
- Backups: encrypted database backups on EU infrastructure, subject to the same deletion rules.
- Security: TLS encryption in transit, encryption of integration keys (AES-256-GCM), zero-trust access protection, least privilege. Secrets (API keys) live exclusively in encrypted configuration stores — never in code, never in logs.
- Logs: error and security logs with the least possible personal data; deleted after 30 days or after incident closure.
9. No tracking, no cookies
This page and the app set no tracking cookies, no analytics pixels, and no advertising scripts. There is no session or behavioral analysis by third parties.
10. Changes
We adapt this privacy policy when processing, providers, or the legal situation change. Material changes are announced in the app. Next scheduled review: October 31, 2027.