Privacy Policy

1. Scope

This Privacy Policy explains how Xcoach (“Xcoach”, “we”, “us”) collects, uses, shares and protects personal data when you use our website and the Xcoach service (the “Service”).

Xcoach is the controller of the personal data described in this policy. You can contact us at support@xcoach.example.

2. Data we collect

• Account data: your intervals.icu athlete ID and display name, the access token intervals.icu issues to us (stored encrypted), your time zone and country (used to set your language), your unit and notification preferences, and your plan.
• Training data read from intervals.icu: activities (such as time, distance, elevation, power, heart rate, pace, intensity zones, device and activity name), wellness data (such as resting heart rate, HRV, sleep and training load) and calendar entries.
• Content you provide: messages you send, how an activity felt, and edits you make to what the coach remembers about you, including goals, schedule, preferences and injuries you mention.
• Content we generate: the coach's reviews, replies and questions, and the notes it keeps about you (“memories”) and your long-term training profile.
• Usage and technical data: when you read messages, your settings changes, server logs (including IP address and request details), and records of each AI model request (purpose, model, number of tokens, duration and outcome).

Information you share about injuries or health may be health data. You choose whether to share it, and you can edit or remove it at any time on the About me page.

3. How we use your data

• To provide the Service: syncing your training, writing a review after each session, answering your questions and, on the Pro plan, occasionally checking in.
• To personalise the Service: remembering what you tell the coach and building a training profile from your history, so that it compares you with yourself.
• To operate, secure and improve the Service: troubleshooting, preventing abuse, monitoring reliability and measuring the quality of the coach's output.
• To communicate with you about the Service, including changes to these policies.
• To comply with legal obligations.

We do not sell your personal data, and we do not use it for advertising.

4. Legal bases

Where the EU or UK General Data Protection Regulation applies, we rely on: performance of our contract with you (to provide the Service); your explicit consent for health information you choose to share, which you may withdraw by removing it; our legitimate interests in securing and improving the Service, balanced against your rights; and compliance with legal obligations.

5. AI processing

To generate reviews and replies, we send the relevant context — your recent sessions and their summaries, your memories and profile, recent conversation and your message — to our AI model provider, currently DeepSeek (Hangzhou DeepSeek Artificial Intelligence Basic Technology Research Co., Ltd.), which processes and stores data in mainland China.

DeepSeek's own privacy policy permits it to use data it receives to improve and train its models and to retain data for as long as it considers necessary. If we change AI provider, we will update this policy.

Coach output is generated automatically and can be wrong. It does not produce decisions with legal or similarly significant effects on you.

6. Sharing

We share personal data only with:

• Our AI model provider (see section 5).
• Our hosting provider, Alibaba Cloud, which runs our servers and database in mainland China (Hangzhou).
• Our payment provider, when paid plans are available, to process payments. We do not receive or store full card details.
• Authorities or other parties where required by law or to protect rights, safety and security.

intervals.icu is the source of your training data and acts as an independent controller under its own privacy policy. We only read from it and never write to it.

7. International transfers

Your data is processed in mainland China and may be processed in other countries where our providers operate. Where the GDPR applies, we protect these transfers with the European Commission's Standard Contractual Clauses and supplementary measures where appropriate.

8. Retention

• Account, training and conversation data: for as long as your account exists.
• When you delete your account, your data is deleted from our production database immediately and our access to intervals.icu is revoked.
• Backups are overwritten within 30 days.
• Server and AI request logs, which can contain the full text of model requests and responses, are kept for 30 days for troubleshooting and then deleted.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent.

• Export: Settings → Data & privacy → Export gives you a file with all your data.
• Correct: edit or forget anything on the About me page.
• Delete: Settings → Data & privacy → Delete account removes everything.
• Anything else: write to support@xcoach.example. We respond within 30 days.

You may also lodge a complaint with your local data protection authority.

10. Cookies

We use only strictly necessary and preference cookies, and no analytics or advertising cookies. See our Cookie Policy for details.

11. Security

We use encryption in transit, encrypt intervals.icu access tokens at rest, restrict administrative access to named operators, and record every operator access to a user's conversation in an audit log. No system is completely secure; if a breach affects you, we will notify you as required by law.

12. Children

The Service is not intended for anyone under 16. We do not knowingly collect data from children under 16; if you believe we have, contact us and we will delete it.

13. Changes to this policy

We may update this policy. We will post the new version here with its effective date and, for material changes, notify you in the app before they take effect.

14. Contact

Xcoach · support@xcoach.example