Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

2.1 Information You Provide

We collect information you voluntarily provide when using our Service, including account information (name, email address, password, profile picture) and communications such as messages, support tickets, and feedback. We also collect fitness profile data (FTP, heart rate zones, sport preferences), weekly schedule and race calendar inputs, saved workouts and training plans, integration connection tokens when you link third-party services, and content such as workouts and training data you create. For Vo2Max Pro subscribers, payment details (such as billing address and payment method) are collected and processed by Paddle - we do not store full card numbers on our servers.

2.2 Information Collected Automatically

When you use the Service we automatically collect device information (device type, operating system, browser type), usage data (pages visited, features used, generation events, time spent, clicks), log data (IP address, access times, referring URLs), and general location based on IP address (country or region). We may use privacy-respecting analytics to understand how the product is used.

2.3 Information From Third Parties

We may receive information from analytics providers (aggregated usage statistics) and from authentication providers if you sign in with Google, Apple, or similar. When you connect Garmin Connect, Strava, Intervals.icu, Wahoo, or similar integrations, we receive activity data, health and profile metrics, and tokens needed to sync workouts and training load (see section 5.7 for Garmin). For Vo2Max Pro subscribers we receive transaction and billing information (such as subscription status, payment confirmations, and invoice details) from our payment processor, Paddle.

2.4 Android App

The Vo2Max Android app is a companion to your Vo2Max account. It includes an AI assistant that runs on your phone. This is what the app does with data:

• Account and sign-in. You sign in through your browser on vo2max.icu and are handed back to the app. The app stores the resulting access and refresh tokens in Android's encrypted secure storage on your device. Your password is never seen or stored by the app. You can also try the app in demo mode, which uses sample data and needs no account.
• Your training data. To answer your questions, the assistant requests your activities, fitness and training-load metrics, profile settings, and planned workouts from our servers over an encrypted (HTTPS) connection, and may cache recent responses on your device. If you approve a plan change the assistant proposes, the app sends that change to our servers to update your plan. The assistant does not change your plan without your confirmation.
• On-device AI. The language model and the speech-recognition model run entirely on your phone. Your messages, the assistant's replies, and your training data as processed by the model are not sent to us or to any AI provider for processing. Chat history and any notes the assistant saves are stored in the app's private storage on your device and are not uploaded. Data we receive from Garmin is never given to the assistant or to any other AI system (see section 5.7). "New chat" hides earlier messages from the conversation view; uninstalling the app or clearing its storage deletes them.
• Voice input. If you use the microphone, audio is recorded only while you are dictating, transcribed on your device, and then discarded. Audio is never uploaded to us. If you turn on spoken replies, text is read aloud using your device's built-in text-to-speech engine, which is provided by your device manufacturer or Google and is subject to their policies.
• Model downloads. The first time you use the assistant, the app downloads AI model files (several hundred megabytes to about 1.5 GB) from Hugging Face (huggingface.co). Hugging Face receives your IP address and standard request information, as with any download, but no information about your account or training data. We recommend downloading on Wi-Fi.
• Device permissions. The app requests: Internet and network state (to reach our servers and download models); Microphone (only for voice input, and only when you grant it); Notifications (to show download progress and tell you when a reply is ready); a foreground service for data sync (so a model download or a reply can finish while the app is in the background); wake lock and vibration (to keep a running reply from being interrupted and to give feedback). You can revoke the microphone and notification permissions at any time in Android settings; the app will keep working without them.
• What the app does not do. The app does not use your location, contacts, photos, camera, or files, does not use the Android advertising ID, does not show ads, and does not currently include third-party analytics or advertising SDKs. Android's backup of app data to your Google account is disabled for the app. Google Play may provide us with aggregated crash and performance reports for the app (such as stack traces and device model) through the Google Play Console.

3. How We Use Your Data

3.1 Service Delivery

We use your data to provide and maintain the Service, manage your account and preferences, and enable features and functionality.

3.2 Communication

We send transactional emails (such as account confirmations and password resets), provide customer support, send important service announcements, and with your consent may send marketing communications.

3.3 Improvement, Analytics, and Algorithm Development

We analyze usage patterns and aggregated training data to improve the Service, develop new features, tune plan-generation algorithms, conduct research and analysis, and monitor and prevent technical issues. Where possible we use anonymized or aggregated data for product improvement. We do not sell your personal training data to third parties. Data received from Garmin is excluded from this section: it is used only to provide the Service to you and is never used for research, algorithm tuning, or to train, evaluate, or improve any AI or machine-learning model.

3.4 Security & Compliance

We use your data to protect against fraud and abuse, ensure platform security, comply with legal obligations, and enforce our Terms of Service.

4. Legal Basis for Processing

4.1 Contract Performance

We process data where necessary to fulfill our contract with you: providing access to the Service, managing your account, and delivering the features you use.

4.2 Legitimate Interests

We process data based on our legitimate interests in improving and optimizing the Service, preventing fraud and ensuring security, and marketing our services to existing customers where permitted.

4.3 Consent

Where we rely on your explicit consent we use it for marketing communications, optional analytics and personalization, and non-essential cookies.

4.4 Legal Obligations

We process data when required by law, including for tax and accounting records, responding to legal requests, and regulatory compliance.

5. Data Sharing & Third Parties

5.1 Service Providers

We may share your personal data with service providers who assist us: cloud hosting for data storage and computing, email services for transactional and marketing emails, analytics for usage analysis and reporting, and customer support tools. For Vo2Max Pro subscriptions we share relevant data (such as your email address and subscription details) with Paddle for payment processing, subscription management, and fraud prevention. Paddle's use of your data is governed by the Paddle Privacy Policy.

5.2 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity.

5.3 Legal Requirements

We may disclose your data if required by law or in response to valid legal requests from public authorities.

5.4 Google Play and Hugging Face (Android App)

The Android app is distributed through Google Play, and Google handles installation, updates, and, where a subscription is purchased through Google Play, payment processing under Google's Privacy Policy. We receive subscription status from Google so we can unlock your plan features, but not your card details. AI model files are downloaded from Hugging Face, as described in section 2.4. We do not share your training data, chat history, or voice recordings with either company.

5.5 Third-Party Integrations

When you connect Garmin Connect, Strava, Intervals.icu, Wahoo, or other supported platforms, we exchange data necessary to import activities, export planned workouts, and update training load metrics. Each integration is governed by that provider's own privacy policy. You may revoke access at any time through your Vo2Max account settings or through the third party's connected-apps settings. Revoking access stops future data exchange but does not automatically delete data already imported.

5.6 With Your Consent

We may share your data with other third parties when you have given us explicit consent to do so. This does not apply to data received from Garmin, which we never share or sell (see section 5.7).

5.7 Garmin Connect

If you choose to connect your Garmin Connect account, Garmin sends us the data you allow on Garmin's consent screen. This section explains exactly what we do with it.

• What we receive. Completed activities (type, start time, duration, distance, heart rate, power, cadence, speed, elevation, laps, GPS route, and the activity file), daily summaries (resting heart rate, steps, stress level, Body Battery), sleep (duration, stages, sleep score), heart rate variability, VO2 max and fitness age, and body composition (weight, body fat). We only turn on the data types listed here. If you turn on workout delivery, we also send the planned workouts you choose to your Garmin account so they appear on your device.
• How we use it. Only to provide the Service to you: showing your activities and health metrics in your calendar and dashboard, marking planned workouts as completed, calculating your training load, fitness, fatigue, and readiness, and adapting your training plan. We do not use Garmin data for advertising, marketing, profiling for third parties, research, or algorithm development.
• Who receives it. Garmin data is processed only by us and by the cloud hosting and database providers that store the Service's data on our behalf under data processing agreements. It is not sent to our email, analytics, or payment providers, and not to any AI provider. Garmin data is never sold, rented, or shared with any other third party.
• No AI use. Garmin data is not processed by any AI system, including the assistant in our Android app, and it is never used to train, evaluate, or improve any AI or machine-learning model, ours or anyone else's. If we ever want to offer an AI feature that uses Garmin data, we will publish an AI transparency statement and ask for your explicit opt-in consent first, and you will be able to withdraw that consent at any time.
• Your control. You can disconnect Garmin at any time in Account settings (Equipment) or in Garmin Connect. When you disconnect, we stop receiving data and remove our access with Garmin. You can view all imported Garmin data in the app, export it with the rest of your data, ask us to delete it (on its own or with your account), and correct it at the source in Garmin Connect: updated records from Garmin replace the earlier ones. Withdrawing consent means disconnecting; you can do this without losing access to the rest of the Service.
• Retention. Garmin access tokens are deleted as soon as you disconnect. Raw notifications from Garmin are deleted after they are processed. Imported activities and health data are kept until you delete them or your account, as described in section 6.

Garmin's own handling of your data is covered by the Garmin Connect privacy policy.

6. Data Retention

We retain your personal data for as long as necessary to provide the Service to you, comply with legal obligations (typically 5-7 years for financial records), resolve disputes and enforce our agreements, and maintain security and prevent fraud.

After account deletion or subscription cancellation, active data is retained for 30 days to allow recovery and backups for up to 90 days. You may request earlier deletion of your account and associated personal data through Account settings or by emailing support@vo2max.icu. Legal and financial records are retained as required by law. Anonymized analytics data may be retained indefinitely.

Android app. Data stored on your device (sign-in tokens, cached responses, chat history, notes, and downloaded AI models) stays there until you sign out, uninstall the app, or clear its storage; signing out removes the stored tokens. Deleting your Vo2Max account, as described above, deletes the account data held on our servers; it does not remove files already on your device, so uninstall the app or clear its storage as well.

7. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

7.1 Access

You have the right to request a copy of the personal data we hold about you.

7.2 Rectification

You have the right to request correction of inaccurate or incomplete personal data.

7.3 Erasure

You have the right to request deletion of your personal data in certain circumstances.

7.4 Data Portability

You have the right to receive your personal data in a structured, machine-readable format.

7.5 Restriction

You have the right to request restriction of processing of your personal data.

7.6 Objection

You have the right to object to processing based on legitimate interests or for direct marketing.

7.7 Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time.

7.8 Exercising Your Rights

To exercise any of these rights, please contact us at support@vo2max.icu. We will respond to your request within 30 days. You can request deletion of your account and data from the Account settings on vo2max.icu (also reachable from the Android app's sign-in page) or by email, without needing to reinstall the app.

7.9 Complaints

If you believe we have violated your privacy rights, you have the right to lodge a complaint with your local data protection authority.

8. Cookies & Tracking

8.1 What Are Cookies

Cookies are small text files stored on your device that help us provide and improve the Service.

8.2 Types of Cookies We Use

We use essential cookies required for the Service to function (authentication and security), functional cookies to remember your preferences and settings, analytics cookies to understand how you use the Service, and with your consent marketing cookies to deliver relevant advertisements.

8.3 Managing Cookies

You can control cookies through your browser settings. Note that disabling essential cookies may affect the functionality of the Service.

8.4 Do Not Track

We currently do not respond to "Do Not Track" browser signals. We may update this policy as industry standards evolve.

8.5 Android App

The Android app itself does not use cookies or advertising identifiers. When you sign in, the app opens vo2max.icu in your browser, where the cookies described above apply.

9. Data Security

9.1 Technical Measures

We use encryption for data in transit (TLS/SSL) and at rest, secure authentication and access controls, regular security audits and penetration testing, intrusion detection and prevention, and regular software updates and security patches. In the Android app, sign-in tokens are kept in Android's secure storage, all communication with our servers uses HTTPS, and AI processing stays on your device. Your device's own screen lock and encryption protect the data stored locally.

9.2 Organizational Measures

Access to personal data is restricted on a need-to-know basis. We maintain incident response procedures and carry out regular security reviews.

9.3 Data Breach Response

In the event of a data breach that poses a risk to your rights, we will notify you and relevant authorities as required by law, typically within 72 hours of becoming aware of the breach.

10. International Data Transfers

Your personal data may be transferred to and processed in countries outside your country of residence. When we do so we use appropriate safeguards such as Standard Contractual Clauses approved by relevant authorities, adequacy decisions where applicable, or other lawful transfer mechanisms.

11. Children's Privacy

The Service is not intended for individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately.

12. Policy Changes

We may update this Privacy Policy from time to time as the product evolves. Material changes will be posted on this page with an updated "Last updated" date. For significant changes we may also notify you by email or through an in-app notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy. We encourage you to review this policy periodically.