1. Who we are
RYVE.coach (“RYVE”, “we”, “us”) is operated by Outnome Michał Danielewicz, a sole proprietorship (jednoosobowa działalność gospodarcza) registered in the Polish Central Register and Information on Economic Activity (CEIDG, ceidg.gov.pl):
- Registered address: ul. Zabytkowa 4A/8, 80-253 Gdańsk, Poland
- NIP: 6040215661
- REGON: 384837849
We are the data controller for the personal data described below under EU Regulation 2016/679 (GDPR).
Contact: contact@ryve.coach
2. What this policy covers
This policy explains what personal data we collect when you use the RYVE.coach product (the website, the web app, and connected services), why we collect it, who we share it with, and what rights you have.
It does not cover third-party services you connect to RYVE.coach (e.g. Strava, Garmin, Google). Those services have their own privacy policies.
3. Data we collect
We collect only what we need to run the product.
a) Account data
- Email address, name (from your Google account if you sign in with Google)
- If you were invited, the RYVE.coach administrator enters your email address to create your account and invitation link
- Authentication identifiers (managed by Supabase Auth)
b) Training and athlete data
- Goal, discipline, availability, benchmarks, training history you provide during onboarding
- Daily check-ins (subjective feedback such as fatigue, sleep, motivation)
- Workout completion status and notes
c) Imported activity data (if you connect Strava)
If you connect Strava, RYVE.coach reads activity data from your Strava account.
- What we read. Read-only activity data from your Strava account: workout type, duration, distance, pace/power/ heart-rate streams, start time, and dates.
- How we collect it.Through Strava's OAuth flow — you grant access on Strava's site, and Strava issues us OAuth tokens that we use to fetch the data you've authorised.
- What we never do. We request read-only scopes only (
read,activity:read_all). We never write to Strava on your behalf, we never modify Strava activity metadata or content when displaying it, we never access another Strava user's data, and we never display your Strava data to anyone other than you. - What we use it for. We use this data solely to provide RYVE.coach to you: estimating your fitness, building and adapting your plan, evaluating your workouts, and computing your calorie balance.
- No AI/ML training. We do not use Strava data — directly or indirectly — to train, fine-tune, or build artificial-intelligence or machine-learning models, and we do notallow our AI providers to train on it. RYVE.coach's plan generation and adaptation logic is rule-based, not AI-trained.
- No cross-user aggregation. We do notaggregate, analyse, or combine Strava data across users for analytics, customer insights, or product improvement. Strava data is combined only with your own RYVE data (your goals, profile, and check-ins) and never with another user's data.
Strava data retention — derive-then-purge
We retain raw Strava activity data only as long as we need it to compute your own training metrics. In practice:
- First 7 days after import. We hold the raw Strava data (activity name, distance, start time, calories, GPS-derived fields, heart-rate / power / pace streams, raw Strava activity IDs) so we can compute your training-load score, match the activity to a planned workout, and surface it in the activities list.
- At 7 days. A daily automated job purges every raw Strava field from our database. After the purge we keep only fields that RYVE has derived: a normalised sport classification, the activity date, the duration, our computed training-load score, and the match to a planned workout (if any).
- Geographic location data (start/end coordinates, GPS streams, route polylines, mapping data) is not retained beyond the 7-day raw purge. We never store it longer than the purge window and we never display it to anyone other than you.
- Strava OAuth tokens are kept only while you keep Strava connected. They are encrypted at rest.
Deletion when you disconnect
If you disconnect Strava in RYVE.coach orrevoke RYVE.coach's access from Strava, we delete your imported Strava data and OAuth tokens within 48 hours.
If you delete an activity on Strava, we remove it from RYVE.coach within 48 hours of being notified via Strava's webhook.
Scope changes
If we ever change the scope of data we request from Strava (for example, requesting a new permission or syncing a new data type), we will notify you and obtain your consent before applying the change.
Your rights regarding Strava-imported data
For ease of reference, here are the four things you should know about the Strava data we hold:
- What we collect: read-only activity data from your Strava account — workout type, duration, distance, heart-rate / power / pace streams, start time, and dates.
- How we collect it:via Strava's OAuth flow, after you authorise access on Strava's site.
- How to withdraw consent: disconnect Strava from inside RYVE.coach, or revoke RYVE.coach's access from your Strava account settings. Either way we delete your imported Strava data and OAuth tokens within 48 hours.
- How to request deletion or a copy: email contact@ryve.coach. We will provide a machine-readable export of all your personal data (including any Strava-imported activity data we still hold) or delete it on request within one month.
d) Planned workouts sent to Garmin (if you connect Garmin)
Garmin workout sync is being rolled out gradually. It applies only if the option is available in your account and you turn it on.
- What we send.Your upcoming planned workouts from your RYVE.coach plan, including plans your coach assigns or imports: workout name, sport, date, duration, an intensity target where one is set, and the workout description (which may include your coach's notes). We send them to your Garmin Connect calendar so they appear on your Garmin device.
- What we do not send. Your name, email, check-ins, pain or health notes, nutrition data, or chat messages.
- What we read. Only the identifiers Garmin assigns to the workouts we create, so we can update or remove them when your plan changes. We do not read your activities or health data from Garmin.
- How we connect.Through Garmin's OAuth flow: you approve access on Garmin's site and choose there what to share.
- How to stop. Disconnect Garmin in RYVE.coach or remove RYVE.coach in your Garmin Connect settings. We stop sending workouts and delete your Garmin tokens within 48 hours. Workouts already in Garmin Connect are held by Garmin; you can delete them there.
e) Nutrition data (if you use the calorie module)
- Food log entries and calories you enter
- Daily calorie balance figures derived from your inputs
f) Chat content
- Messages you send to the RYVE coach assistant and the assistant's replies
- If you are linked to a coach: the messages you and your coach send each other in RYVE.coach
g) Technical data
- Basic logs needed to operate the service: IP address, user-agent, error reports, page/route accessed, timestamps
- Crash and error diagnostics via Sentry
h) Health information you choose to enter
Some information you give us is health data, a special category of personal data under GDPR Art. 9:
- whether something hurts or you feel unwell, and the details you add, in daily check-ins
- injuries and health notes you add to your profile during onboarding
We use it to keep your training safe (for example, to reduce load when something hurts) and, if you are linked to a coach, to show it to your coach (see §6, “Your coach”). We process it on the basis of your explicit consent (Art. 9(2)(a)), which you give when you accept this Privacy Policy in the app. You can withdraw that consent at any time by emailing contact@ryve.coach; we then stop using your health information and delete it. Do not enter anything you do not want stored.
4. Why we use it (legal basis)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the core product (auth, plan generation, daily recommendations, chat) | Performance of contract — Art. 6(1)(b) |
| Connect and sync your Strava data | Your consent — Art. 6(1)(a), via the Strava OAuth flow |
| Send your planned workouts to Garmin Connect | Your consent — Art. 6(1)(a), via the Garmin OAuth flow |
| Use health information you enter (§3h) to adapt your training safely | Your explicit consent — Art. 9(2)(a), given when you accept this Privacy Policy in the app |
| Keep the service secure, debug errors, prevent abuse | Our legitimate interest — Art. 6(1)(f) |
| Comply with legal obligations (e.g. tax) | Legal obligation — Art. 6(1)(c) |
| Send you operational emails about your account | Performance of contract — Art. 6(1)(b) |
| Show your data to a coach you accepted (see §6, “Your coach”) | Your consent — Art. 6(1)(a), and Art. 9(2)(a) for health notes you report, given when you accept the link |
We do not run marketing email campaigns during alpha. If we add them, we will ask for separate consent.
5. AI processing
RYVE.coach uses third-party AI providers to generate plan explanations, recommendations, and chat responses. When you interact with these features:
- The content you submit (e.g. your training context, check-in answers, chat messages) is sent to the AI provider so it can generate a response.
- Injury and surgery details from your onboarding profile are sent to the AI provider, so RYVE can be careful with your training, unless you say they no longer affect your training. In that case only your coach can read them. Your other onboarding health answers (chronic conditions and medication, blood tests, and performance tests) are not sent to AI providers by default.
- We do not allow these providers to use your data to train their models.
- We do not send your full identity (name, email) to the AI provider beyond what is needed for the request.
- When the chat or explanation features need it, a short, recent summary of your activity history derived from connected services (such as Strava) — for example sport type, session date, and duration — may be sent to the AI provider at the moment a response is generated, solely so the assistant can reference your own recent training. This is inference-time processing only.
- We do notuse data imported from connected third-party services (such as Strava) to train, fine-tune, or build AI or machine-learning models, and we do not allow our AI providers to train on it. RYVE.coach's plan generation and adaptation logic is rule-based, not AI-trained.
Automated plan generation. RYVE.coach builds and adapts your training plan automatically from the information you give us. This is a guidance tool: the output does not produce legal or similarly significant effects, you decide what to act on, and you can contact us at any time to review or correct anything. See the Terms of Service for the full health and safety disclaimer.
If you do not want your input processed by a third-party AI provider, do not use the chat or AI-explanation features.
6. Who we share data with
We use a small set of trusted providers to run the product. They process your data on our behalf under data-processing agreements.
| Provider | What they do | Region |
|---|---|---|
| Supabase | Database, authentication | EU / US |
| Vercel | Frontend hosting | EU / US (edge) |
| Railway | Backend hosting | US |
| Sentry | Error and crash reporting | US / EU |
| Sign-in with Google (if used) | US | |
| Strava | Activity import (if connected; see below — Strava is a separate controller, not a subprocessor) | US |
| Garmin | Receives your planned workouts for your Garmin device (if connected; separate controller, see below) | US |
| Third-party AI providers | Generate AI responses (see §5) | US |
Your coach (only if you are linked to one)
Every account starts without a coach. Only we can link your account to a human coach, and the coach sees nothing about you until you accept the link in the app. Your coach is not a subprocessor: they are the person who coaches you, and RYVE.coach shows them your data so they can do that.
While the link is active:
- Conversations.Your coach can read your whole conversation in RYVE.coach: the messages you send to the RYVE assistant, RYVE's replies, and the messages you and your coach send each other. This includes conversations from before the link started. There is no separate setting to hide your RYVE conversations from your coach, and the conversation always shows that your coach can read it. Do not write anything there that you do not want your coach to see.
- Your coach's messages.Your coach can write in the conversation, and RYVE takes your coach's messages into account when it replies.
- Profile and contact details. After you complete onboarding, your coach sees your profile, including your name, email, phone number, date of birth, body measurements, residence, work situation, sport history, benchmarks, equipment, training availability, sleep, goals, and coaching preferences. Your coach also sees the health information you choose to give, including answers about injuries, conditions, medication, blood tests, and performance tests.
- Training data.Your coach also sees your goal and race history, your full active-plan calendar with workout results, your daily check-ins (including pain and health notes you report), RYVE's daily recommendations, and whether Strava is connected.
Either you or your coach can delete the whole conversation at any time. To stop sharing with your coach, email contact@ryve.coach: we end the link, and your coach loses access to your data at once.
Strava is a separate, independent data controller
Strava is not a subprocessor acting on our behalf. When you connect Strava, Strava and RYVE.coach act as separate and independent data controllers for the data Strava holds about you. RYVE.coach is responsible only for what we do with the data Strava provides to us under the access you authorised. Strava handles your Strava-side data under its own privacy policy, which takes precedence on the Strava side. If your request concerns data Strava controls (your account on Strava, activities still hosted on Strava, your Strava settings), please contact Strava directly; we will redirect you if you contact us by mistake.
Garmin is a separate, independent data controller
When you connect Garmin, the workouts we send become part of your Garmin Connect account. Garmin is not a subprocessor acting on our behalf: Garmin and RYVE.coach act as separate and independent data controllers. Garmin handles the data in your Garmin account under its own privacy policy. For requests about data held in your Garmin account, please contact Garmin directly.
Strava's monitoring of our application
Under Strava's API Agreement, Strava monitors and collects usage data about RYVE.coach's developer application — for example, the volume and pattern of our API calls and our compliance with Strava's terms. This monitoring is conducted by Strava as a separate controller and is independent of the data we process about you.
Strava's audit rights
Strava may audit RYVE.coach's compliance with the Strava API Agreement, including reviewing systems, logs, and records related to our handling of Strava Data. By connecting Strava to RYVE.coach you acknowledge that audit right, which exists to protect your data.
Change of control
If RYVE.coach is acquired, merged with another entity, or substantially all of its assets are transferred, your data — including any Strava-imported data — will continue to be protected by the commitments in this Privacy Policy and by the Strava API Agreement. We will notify Strava in writing of the change of control as required by the Agreement, and we will notify you and offer you the right to delete your data before any transfer if the acquirer does not agree to honour these commitments.
We do not sell your personal data and we do not share it for third-party advertising. We may also disclose data where required by law.
7. International transfers
Some of our subprocessors are based outside the European Economic Area (mainly in the United States). Where this happens, transfers are protected by Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism.
8. How long we keep your data
- Active account: for as long as your account exists.
- Imported Strava data — raw fields: at most 7 days after each activity is imported. A daily job purges raw Strava data on the 7-day mark, keeping only RYVE-derived metrics (sport, date, duration, training-load score, planned-workout match).
- Imported Strava data — derived metrics: kept while Strava stays connected, deleted within 48 hours of you disconnecting Strava, revoking access from Strava, deleting an activity on Strava, or deleting your account.
- Strava OAuth tokens: kept while Strava stays connected; deleted within 48 hours of disconnection.
- Garmin OAuth tokens and Garmin workout identifiers: kept while Garmin stays connected; deleted within 48 hours of you disconnecting Garmin, removing RYVE.coach in Garmin Connect, or deleting your account.
- After you delete your account: your data is erased immediately when you delete your account in-product, and in any case within 30 days of a deletion request — except the minimum we must keep to comply with law (e.g. tax records) or to resolve disputes.
- Error logs and security logs: up to 90 days.
9. Your rights (GDPR)
You have the right to:
- access your personal data;
- correct inaccurate data;
- delete your data (“right to be forgotten”);
- restrict or object to processing;
- receive your data in a portable format;
- withdraw any consent you gave (without affecting prior lawful processing);
- lodge a complaint with the Polish supervisory authority (UODO — Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).
To exercise any of these rights, email contact@ryve.coach. We will respond within one month.
Deleting your account
You can delete your account at any time from Settings → Delete account in the app. This permanently erases your athlete profile, goals, training plans, workouts, check-ins, recommendations, nutrition data, chat history, imported Strava data, Strava and Garmin tokens, and removes your sign-in credentials.
If you cannot access the app, you can also request deletion by emailing contact@ryve.coach from the email address associated with your account. We verify the request and erase your data within 30 days.
10. Cookies and analytics
During alpha, we use only the cookies needed to run the product:
- Authentication cookies (Supabase) — to keep you logged in.
- Session cookies — strictly necessary for the app to work.
We do not use third-party advertising or cross-site tracking cookies. If we add product analytics later, we will update this policy and ask for consent where required.
11. Children
RYVE.coach is not intended for users under 18. Please do not use the product if you are under 18.
12. Security and breach notification
We use industry-standard measures to protect your data:
- TLS in transit and encryption at rest with our hosting providers.
- OAuth tokens for connected services (e.g. Strava, Garmin) are encrypted at rest with an application-level key.
- Access controls, audit logging, and regular dependency updates.
No system is perfectly secure; we cannot guarantee absolute security.
If we discover a personal data breach, we will:
- notify the Polish supervisory authority (UODO) within 72 hours where required by Art. 33 GDPR;
- notify affected users without undue delay, with the information required by Art. 34 GDPR;
- notify Strava within 24 hours where the breach involves Strava Data, in line with Strava's API Agreement.
13. Changes to this policy
We may update this policy. The Last updated date at the top reflects the most recent change. For material changes affecting how we use your data, we will notify active users in the app.
If we change the scope of data we collect from a connected service such as Strava, we will notify you and obtain your consent before applying the change.
14. Contact
Questions or requests: contact@ryve.coach
Legal entity: Outnome Michał Danielewicz, sole proprietorship registered in Poland (CEIDG), ul. Zabytkowa 4A/8, 80-253 Gdańsk, NIP 6040215661, REGON 384837849.