Privacy policy

Peakless is a training app for triathletes: it plans sessions, syncs activities, tracks training load and uses AI to analyse your training. This policy explains what personal data Peakless handles, why, who else processes it, how long it is kept, and the rights you have under the EU General Data Protection Regulation (GDPR) and similar laws.

In short: we only use your data to run Peakless for you. It is stored in the EU, never sold, never used for advertising, and not used to train AI models. We keep no GPS routes. Website statistics are anonymous and use no cookies. You can ask for a copy or for deletion at any time.

1. Who is responsible

The data controller is Frédéric Gasse, who runs Peakless as an individual. For anything about your data or this policy, write to hello@peakless.app.

2. What we collect

• Account: your name, your email address (used to sign in, with no password) and your preferred language.
• Training data: planned and completed sessions (sport, date and start time, duration, distance, training load), power, pace, speed, heart rate, cadence and elevation, including second-by-second streams and swim laps, and the session titles, descriptions and notes you or your coach write.
• Health and body data: heart rate, thresholds (FTP, threshold heart rate and pace, CSS), maximum and resting heart rate, weight, and, if you enter them, HRV, sleep, effort ratings, injuries and how you feel. Some of this is health data, a special category under the GDPR (see section 4).
• Goals and context: races and their dates; your coach memory, meaning what you tell your coach (goals, weekly availability, health and injury history, background, kit, coaching preferences), what it learns about how you train, temporary notes with dates (for example travel or a niggle) and a history of changes to it; plans you request; and your conversations with the coach.
• Connections: if you connect Strava, your Strava athlete ID and the access tokens that let us read your activities. If you connect Claude, a token for that connection (stored only as a secure hash).
• Files you upload (.FIT, .GPX, .TCX): we read the activity from the file and keep the numbers above. The file itself is not stored, and neither are GPS coordinates: positions are used only to work out distance and then discarded.
• Usage of Peakless: which features you use (for example how many analyses or plans you request) and the AI usage they cost, so we can keep the service running and fair.
• Website statistics: anonymous visit counts (page, referring site, country, device type). See section 8.
• Technical data: a login cookie (see section 8) and the server logs our hosting provider keeps for security and troubleshooting (such as IP address and time of request).

We don't collect payment details, contacts, location tracking, or data about children.

3. How we use it

• To run your calendar, sync your activities and pair them with your plan.
• To calculate training load (TSS), fitness, fatigue and form.
• To generate, when you ask or when a session syncs, training plans, session analyses and coach answers, and to keep your coach memory up to date so they fit you. Something you say in a chat is only saved to your coach memory when you choose Save.
• To send structured sessions to your trainer app, if you enable it.
• To understand, in aggregate, how the website and the app are used, and to keep Peakless secure and fix problems.

We don't sell your data, show ads, build marketing profiles, or share your data with anyone except the providers in section 5. Your training data is only ever shown to you.

4. Legal basis

• Contract (GDPR art. 6(1)(b)): we need your account and training data to provide the service you signed up for.
• Explicit consent (art. 9(2)(a)) for health data such as heart rate, weight, injuries and how you feel, and for sending your training data to our AI provider to personalise recommendations. You give it when you create your account or connect a data source, and you can withdraw it at any time by deleting your account or that data; withdrawal doesn't affect what was done before.
• Legitimate interests (art. 6(1)(f)): anonymous website statistics, usage counts, security logs and preventing abuse.

5. Who processes your data

We use these providers (“processors”) to run Peakless. Each only processes your data to provide its service to us, under a data processing agreement.

AI processing. When Peakless asks Claude for a plan, an analysis, a coach answer or a coach memory update, it sends the training data needed for that request (your sessions, notes, thresholds, races and coach memory). Anthropic processes it to produce the answer under its commercial terms, which don't allow it to use this data to train its models. Peakless doesn't use your data to train any AI model either.

International transfers. Anthropic and Resend are in the United States, and some providers may process data outside the EU. These transfers rely on the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, as applicable.

6. Strava

• Peakless only reads your activities after you connect Strava and approve access on Strava's own page.
• Activities imported from Strava are shown only to you, and are used only to provide Peakless to you.
• You can disconnect in Peakless (Settings → Strava) or revoke access in your Strava settings at any time. Either way we stop syncing and delete our Strava access tokens. To also delete the activities already imported, ask us or delete your account.
• If you delete an activity on Strava, Peakless removes it too.

7. How long we keep it

• Account and training data: for as long as you have an account.
• When you delete your account or ask us to, we delete your data within 30 days, including from backups as they cycle out.
• Your coach memory, including items you removed and its change history (so any change can be undone): for as long as you have an account, and deleted with it. Earlier versions of the athlete profile it replaced: the latest 30.
• Website statistics and usage counts: up to 24 months, then deleted.
• Server logs: kept by our hosting providers for a short period for security, typically no more than 30 days.

8. Cookies, statistics and local storage

Peakless uses a strictly necessary cookie to keep you logged in, and one that remembers the language you chose. Your browser's local storage remembers display choices, such as which chart lines you show.

Website statistics use no cookies and no tracking across sites. For each visit we record the page, the referring website, the country (from the request, not your precise location) and the device type. To count unique visitors without identifying anyone, we combine your IP address and browser with a secret that changes every day and keep only a one-way hash; the IP address itself is never stored, and the hash can't be linked to you or across days. There are no advertising or third-party analytics cookies, so no cookie banner is needed.

9. Security

All traffic is encrypted (HTTPS). The database is encrypted at rest by our hosting provider and is only reachable by the app. Connection tokens for Claude are stored as hashes. Only you can see your data in the app; access to the database is limited to the operator for running and supporting the service.

10. Your rights

You can ask us at any time to:

• give you a copy of your data, in a common machine-readable format (access and portability);
• correct it (much of it you can edit directly in the app);
• delete it, all or part (erasure);
• restrict or object to how it is used;
• withdraw your consent.

Write to hello@peakless.app. We reply within one month. If you're unhappy with our answer, you can complain to your data protection authority (in Spain, the Agencia Española de Protección de Datos, aepd.es).

11. Children

Peakless is not intended for anyone under 16, and we don't knowingly collect their data.

12. Changes

If we change this policy, we'll update the date at the top, and tell you in the app or by email before any significant change takes effect.