Privacy

Last updated: [date]

This page explains what personal data we process when you visit withwibe.com and when you use the train app at train.withwibe.com, why, and what rights you have under the GDPR.

Who is responsible

Bernhard Schlegel, Logauweg 83, 89075 Ulm, Germany. Email: hello@withwibe.com. See also the imprint.

This website

Server logs

When you open a page, our host [hosting provider, address] processes your IP address, the time, the page requested, the referrer and your browser's user agent so it can deliver the page and keep it secure. Legal basis: Art. 6 (1) (f) GDPR (running a secure website). Logs are deleted after [number] days.

Fonts

The pages load fonts from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Your browser sends your IP address to Google for this. Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6 (1) (f) GDPR (a consistent look of the site).

No cookies, no tracking

The website sets no cookies and uses no analytics or advertising tools.

The train app

What we process

• Account: email address and password (stored only as a hash).
• Profile and goal: name, birth year, units, coach tone, your goal, race date, training days, course files you upload (GPX) and answers you give the coach.
• Training: your plan, chat messages with the coach, and workouts you record: time, distance, pace, power, heart rate, elevation, laps and how hard it felt.
• Health information: heart rate, and any injuries or pain you mention. This is health data under Art. 9 GDPR.
• Garmin connection: if you connect Garmin Connect, we store encrypted session tokens, never your Garmin password. We upload planned workouts to your Garmin calendar and read your finished activities and fitness values (such as race predictions, FTP and threshold pace).
• Usage: which features you use (for example that a plan change was accepted), stored in our own database to improve the app. No third-party analytics.

We do not store GPS positions of your activities.

Why and on which legal basis

• To provide the app you signed up for: Art. 6 (1) (b) GDPR.
• Health data: your explicit consent, Art. 9 (2) (a) GDPR. You can withdraw it at any time; the coach then can't take heart rate or injuries into account.
• Usage statistics and security: Art. 6 (1) (f) GDPR.

Cookies

The app sets one cookie that keeps you signed in. It is strictly necessary and needs no consent (§ 25 (2) TDDDG).

AI processing

The coach's replies, plans and workout analyses are generated with language models from Anthropic (Anthropic PBC, USA). To do this we send Anthropic the training context needed for the request, such as your goal, plan, recent workouts and chat messages. Anthropic processes this on our behalf under a data processing agreement and does not use it to train its models. The transfer to the USA is based on the EU-US Data Privacy Framework / standard contractual clauses.

Garmin

Data you exchange with Garmin Connect is also subject to Garmin's own privacy policy. You can disconnect Garmin in the app at any time; we then delete the stored tokens.

Hosting

The app and its database run at [hosting provider, location], who processes the data on our behalf under a data processing agreement.

How long we keep it

As long as you have an account. When you ask us to delete your account, we delete your data within [number] days, unless the law requires us to keep it longer.

Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. To use these rights, email hello@withwibe.com.

You can also complain to a data protection supervisory authority, for example the one in your state or [competent authority].