Privacy Policy

1. Who we are

Athlete Connect AI is an independent commercial product in development, operated by Radu Tataru from Chișinău, Moldova. For privacy questions, consent withdrawal, access, or deletion requests, contact athlete@gagy.app.

2. Scope and current status

This policy covers the Athlete Connect AI website and the planned connector, briefing, notification, and AI-assistant services. Production provider connections are not yet generally available. We will review this policy before enabling real athlete data and update it if approved integrations, processors, retention periods, or product functions change.

3. Information we process

When you browse the website, our hosting and security providers may process technical information such as IP address, browser and device details, requested pages, timestamps, and diagnostic events.

When the service becomes available and you choose to connect accounts, we expect to process:

• account identifiers, timezone, briefing time, preferences, subscription status, and consent records;
• OAuth access and refresh tokens for connected services, stored in encrypted form;
• the athlete profile, training zones, recovery signals, planned and completed workouts, workout details, and metrics you authorize;
• subjective check-ins, questions, feedback, generated briefings, recommendation reason codes, and workout analyses;
• a Telegram account identifier or verified email address, delivery status, and notification preferences;
• support communications, security events, and operational records needed to protect and maintain the service.

We will not ask for or store your Garmin, TrainingPeaks, ChatGPT, Claude, Telegram, or email password.

4. Why and on what basis we process information

We process information to provide the functions you request, connect authorized accounts, generate and deliver briefings, continue an analysis in your selected AI assistant, manage a subscription, secure the service, provide support, prevent abuse, and comply with applicable law.

Depending on the context and applicable law, processing is based on your explicit consent, performance of the service you request, our legitimate interest in operating a secure service, or a legal obligation. Provider and AI processing will not begin until the required consent and authorization steps are completed.

5. Your choices and consent

Provider access, AI processing, and proactive delivery are separate choices. You can choose Telegram or email, select ChatGPT or Claude as a conversation destination, change your schedule, disable notifications, disconnect a provider, disconnect an AI destination, or withdraw consent.

Withdrawing consent or disconnecting a service stops future retrieval or processing through that connection. You can also request deletion of retained Athlete Connect AI data. Disconnecting Athlete Connect AI does not delete data held independently by Garmin, TrainingPeaks, Telegram, your email provider, OpenAI, or Anthropic.

6. Read-only provider access

The initial product is designed for read-only access. It will not create, edit, or delete workouts, calendars, zones, metrics, or other source-platform data. We use the source platform's approved authorization mechanism and request only the scopes needed for enabled features.

7. Automated analysis and training guidance

Athlete Connect AI compares permitted signals with personal reference values and applies inspectable rules to produce guidance such as proceed, adapt, reconsider, or insufficient data. The output may be incomplete, delayed, or inaccurate and is not a medical diagnosis or a guarantee that exercise is safe.

Significant decisions about your health or training should not be based solely on automated output. Concerning symptoms or pain should be discussed with an appropriate healthcare professional or qualified coach.

8. Service providers and data recipients

Depending on your choices and approved product availability, data may be processed by:

• connected training providers such as Garmin or TrainingPeaks;
• OpenAI when you choose ChatGPT, or Anthropic when you choose Claude;
• Telegram when you select Telegram delivery, or the email delivery and mailbox providers involved when you select email;
• hosting, database, security, monitoring, payment, and customer-support providers acting for Athlete Connect AI.

We share only the information needed for the selected function. We do not sell personal or training data, use it for targeted advertising, or share it with unrelated parties.

9. Notifications and continuation links

Telegram or email messages may contain the briefing information required to make the notification useful. You choose the channel and can disable proactive delivery. Email messages will include a way to manage or stop non-essential notifications.

A link that continues a briefing in ChatGPT or Claude contains only an opaque, short-lived reference. It does not contain sleep, heart-rate, HRV, workout, recommendation, provider-token, or other athlete data in the URL. The service verifies identity, authorization, link validity, and access entitlement before returning briefing context.

10. Retention

We minimize storage and follow the requirements of each approved source platform. Raw provider responses are intended to be cached only as needed and for no more than seven days unless a shorter partner requirement applies. Normalized snapshots, briefings, athlete feedback, consent records, and security records may be retained for the period stated in the production service to provide history, personalization, accountability, and legal compliance.

Before production launch, account controls will show the applicable retention periods. After a valid deletion request, active data will be deleted or de-identified unless limited retention is required for security, legal, billing, dispute, or backup purposes.

11. Security

We design the service around HTTPS, encryption for stored provider tokens, secret redaction, least-privilege permissions, user-level data isolation, access controls, rate limits, audit events, and incident response. Provider credentials and access tokens are not sent to notification channels or AI assistants.

No online service can guarantee absolute security. If we confirm a personal-data incident, we will contain and investigate it and notify affected users, partners, or authorities when required.

12. Your rights

Subject to applicable law, you may ask to access, correct, delete, restrict, or export your personal information, object to certain processing, or withdraw consent. Email athlete@gagy.app. We may need to verify your identity before fulfilling a request.

13. International processing

Athlete Connect AI is operated from Moldova, and connected services or processors may handle information in other countries. Where required, we will use appropriate contractual and organizational safeguards and complete provider-specific requirements for international transfers.

14. Children

The service is not directed to children under 16, and we do not knowingly collect their personal information. Contact us if you believe a child has provided information to the service.

15. Changes

We may update this policy as the product, approved integrations, or legal requirements develop. We will identify the effective date and version and provide additional notice when a material change requires it.