Privacy Policy

1. Data we collect

We collect the following categories of data:

• Account data — your email address, name, sign-in data (we use passwordless magic-link authentication), and your account settings and preferences.
• Profile and fitness data you provide — such as weight, functional threshold power (FTP), power and heart-rate zones, and training goals.
• Training and activity data — when you connect Strava or Garmin, or upload activity files (FIT, TCX, GPX), we import your activities, including GPS location and routes, power, speed, cadence, elevation, timestamps, and device information.
• Health-related data — heart rate, heart-rate variability (HRV), sleep, and resting heart rate. See "Health data" below.
• Payment data — subscriptions are processed by Paddle as merchant of record. We receive your subscription status, plan, country, and transaction amounts. We never receive or store your full card details.
• Usage data — pages and screens viewed, feature interactions, browser and device type, approximate location derived from your IP address, and how you found us (for example a referring site or advertising campaign).
• Communications — messages you send us, and your conversations with the AI Coach, which we process to provide the coaching feature.

2. Health data

Some of the data FormBeat processes — heart rate, heart-rate variability, sleep, and resting heart rate — is health-related data, which is a special category of personal data under Article 9 of the GDPR. We process it for one purpose only: to provide you with the training analytics, readiness insights, and coaching feedback you signed up for. We never sell it, never use it for advertising, and never share it except with the service providers listed below to the extent needed to operate the Services.

Our legal basis for processing health-related data is your explicit consent (Article 9(2)(a) GDPR), which you give when you connect Strava or Garmin, upload activity files, or enable health-metric syncing. You can withdraw consent at any time by disconnecting the integration in Settings and deleting the imported data or your account. Withdrawal does not affect the lawfulness of processing before withdrawal.

3. How we use your data

We use your data for the following purposes, on the following legal bases:

• Providing the Services (performance of our contract with you) — analyzing your activities, computing fitness, fatigue, readiness, records, zones, and trends, and showing them to you in the dashboard, emails, and mobile app.
• AI-generated insights (performance of our contract with you) — we send relevant activity, training, and profile context to the AI providers listed below (Microsoft Azure OpenAI, OpenAI, Anthropic) to generate ride analysis, weekly summaries, workout suggestions, and AI Coach responses. These providers process the data on our behalf under data-processing agreements and do not use your data to train their models.
• Service communications (performance of our contract / legitimate interest) — transactional emails such as your weekly training summary, and push notifications you enable. You can adjust these in your notification settings, and every non-essential email includes an unsubscribe link.
• Product analytics and improvement (legitimate interest, and consent where required) — understanding how the Services are used so we can improve them, using the analytics providers listed below.
• Error monitoring and security (legitimate interest) — detecting and fixing errors, abuse, and security incidents.
• Advertising measurement (consent) — see "Advertising and conversion measurement" below.
• Legal compliance (legal obligation) — for example keeping billing records for tax and accounting law.

4. Strava and Garmin data

FormBeat only accesses your Strava or Garmin data after you explicitly authorize the connection through their OAuth consent screens. Once connected, new activities (and, if you enable it, daily health metrics from Garmin) sync automatically, and we may import your activity history so your analytics start with meaningful data. Strava and Garmin are independent controllers of the data held in their own services, under their own privacy policies.

You can disconnect either integration at any time in Settings, which stops all syncing and revokes our access. You can delete individual imported activities, or delete your account, which removes the imported data from FormBeat. We use Strava and Garmin data only to provide the Services to you, in accordance with the Strava API Agreement and the Garmin Connect Developer Program terms, and we do not share it with third parties other than the service providers listed below to the extent needed to operate the Services.

5. Service providers (subprocessors)

We share personal data with the following providers, who process it on our behalf, under data-processing agreements, and only to the extent needed for the purpose listed:

• Fly.io, Inc. — application hosting
• Amazon Web Services, Inc. — file and data storage (S3)
• Cloudflare, Inc. — content delivery and security
• Paddle.com Market Ltd — payment processing (merchant of record)
• Postmark (ActiveCampaign, LLC) — transactional email delivery
• PostHog, Inc. — product analytics (EU-hosted)
• Functional Software, Inc. (Sentry) — error monitoring
• Microsoft Corporation — AI processing (Azure OpenAI)
• OpenAI, L.L.C. — AI processing
• Anthropic, PBC — AI processing (Claude)
• Google LLC / Google Ireland Ltd — advertising and conversion measurement
• Stridee (Switzerland) — sending your planned training sessions to your head unit or watch. Used only if you connect a device (Garmin, Wahoo or COROS) to your training plan; their processing takes place in the European Economic Area.

In addition, Strava, Inc. and Garmin Ltd (and its affiliates) act as independent data sources you choose to connect, as described above. We will update this list when providers change; your continued use of the Services after an update constitutes acceptance of the revised list.

6. International transfers

We are an EU company and keep data in the European Union where practical. Some of the providers above process data in the United States or other countries outside the European Economic Area. Where they do, we rely on the European Commission's Standard Contractual Clauses and, where the provider is certified, the EU-U.S. Data Privacy Framework, to protect your data to the standard required by the GDPR.

7. Data retention

We keep your personal data for as long as your account is active, because the Services are built on your long-term training history. If you delete your account, or ask us to, we delete or anonymize your personal data without undue delay, except where we must keep records to comply with legal obligations (for example billing records under tax and accounting law) or to establish or defend legal claims. Data in encrypted backups is removed as backups expire on a rolling basis.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data deleted ("right to be forgotten");
• restrict or object to processing based on our legitimate interests;
• receive the data you provided in a portable, machine-readable format;
• withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email us at [email protected] . We will respond within one month. You also have the right to lodge a complaint with a supervisory authority — in our case the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz ) — or with the authority in your country of residence.

9. Cookies

We use cookies and similar technologies in three groups:

• Essential — signing you in, security and abuse prevention, remembering your settings and your cookie choice, and first-party measurement of how our own pages perform. These are required for the Services to work and are always active.
• Analytics (consent) — PostHog and Google Analytics, so we can see which features are used and where the Services fail.
• Advertising (consent) — Google Ads conversion measurement, so we can tell which advertising brings riders to FormBeat. See "Advertising and conversion measurement" below.

In the EEA, the UK and Switzerland, analytics and advertising cookies are only set — and their scripts only loaded — after you accept them in our cookie banner; elsewhere they may be active by default. You can change or withdraw your choice at any time via "Cookie settings" in the footer; withdrawing removes those cookies and stops the scripts from loading again. We keep a record of your choice so we can show that consent was given. You can also configure your browser to refuse cookies, though parts of the Services may not work without the essential ones. Cookie lifetimes range from your current browser session to at most two years, and the consent cookie itself remembers your choice for six months.

We also use your browser's local storage (localStorage and IndexedDB) to cache your dashboard data on your device so the app loads faster. This data stays on your device, is not a tracking technology, and is removed when you sign out or clear your browser data.

10. Advertising and conversion measurement

We work with advertising partners, including Google, to measure the effectiveness of our advertising and to reach people who may be interested in FormBeat. To do this, we may share limited information with these partners — including a securely hashed (pseudonymized) version of your email address and online identifiers such as cookies or ad click identifiers — so they can match actions you take, such as signing up or subscribing, to an advertisement you interacted with. These partners process this information on our behalf under their data-processing terms, and we do not sell your personal information. We never share your training or health data with advertising partners.

Where required by law (for example, for users in the European Economic Area, the UK, and Switzerland), we share this information only with your consent. You can withdraw consent or opt out of personalized advertising at any time through your cookie settings and via Google's Ads Settings at https://adssettings.google.com .

11. Security

We protect your data with technical and organizational measures appropriate to the risk, including encryption in transit and at rest, access controls, and monitoring. No online service can guarantee absolute security, but we take the protection of your training and health data seriously and review our measures regularly. If a personal data breach affects you, we will notify you and the competent supervisory authority as required by law.

12. Children

The Services are not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child under 16 has created an account, contact us at [email protected] and we will delete it.

13. Business transfers

If Initial Condition s.r.o., or substantially all of its assets, were acquired, or in the unlikely event that we go out of business or enter bankruptcy, user information would be one of the assets that is transferred or acquired by a third party. You acknowledge that such transfers may occur, and that any acquirer may continue to use your personal information as set forth in this policy.

14. Changes to this policy

We may update this Privacy Policy from time to time. We will post any changes on this page with an updated effective date. If a change materially affects how we process your personal data, we will take reasonable steps to notify you, for example by email or in the app.

15. Contact

Initial Condition s.r.o., Urxova 436, Prague 8, Czech Republic — [email protected]