Last updated: 22 October 2026
This is a translation for convenience. In case of discrepancies, the German version is legally binding. German version (Datenschutzerklärung)
Summitflow Cavalera
Pfandbrunnen 19
9493 Mauren, Liechtenstein
Email: [email protected]
This website automatically collects standard technical data, including:
This data is used exclusively for internal administrative purposes to ensure system stability and operation.
When you register for and use Summitflow Pace, we additionally collect:
Technical access data is stored for a maximum of one year. Personal account and training data is stored for as long as your account is active. You can delete your account at any time in the account settings — all your data is then deleted immediately and irrevocably from the live system. To protect against data loss, we create daily backups of our database, plus hourly backups that are kept for only 48 hours. They are encrypted before transfer and stored on our server in the EU and with a cloud storage provider (Google Drive, Google LLC, USA; participant in the EU-U.S. Data Privacy Framework) — the key is held exclusively by us, and the provider cannot read the content. In addition, our database provider Supabase keeps its own short-term backups within the EU. Backups are only used to restore data after technical failures and are automatically deleted after 30 days at the latest; deleted accounts are then no longer contained in any backup. Subscriptions already paid for are not refunded when an account is deleted. Statutory retention periods (e.g. for payment records) remain unaffected.
Summitflow Pace uses AI in the following places:
In all cases, Anthropic's Claude API processes your training and context data (details in the section "Anthropic / Claude AI" below). All of these features require your "AI data transfer" consent and are locked without it. In the chat, you are interacting with an AI, not a human being.
The AI works on the basis of Fabio Cavalera's training methodology (polarised 80/20 model, Coggan zones, block periodisation). The training logic — training phase, zones, periodisation — is calculated before the AI is called; the AI then compiles the structured plan from it.
AI output may contain errors. Training plans and Coach answers are suggestions — you always decide for yourself whether to follow a session or recommendation. No fully automated decision with legal effect within the meaning of Art. 22 GDPR takes place.
The AI does not replace medical, physiotherapeutic or nutritional medical advice. If you experience pain, injuries or health complaints, please consult a medical professional. Your data is only transferred to Anthropic with your explicit consent, which you can withdraw at any time in the settings.
If you connect Garmin Connect, summaries derived from your Garmin data (e.g. volume, intensity distribution, history of completed workouts, interval matching, recovery signals such as "resting heart rate above your personal baseline") may be used in AI-assisted plan adjustment and in the AI Coach chat. They are processed by the AI service Anthropic (Claude API). Raw data from Garmin (e.g. complete activity files) is not transferred to these services.
We use Supabase (Supabase Inc.) for database services and user authentication. The data is stored on EU servers.
Privacy policy: supabase.com/privacy
Payments are processed via Stripe (Stripe Inc.). Stripe is PCI DSS certified. We do not store any payment data on our servers.
Privacy policy: stripe.com/privacy
To generate training plans and for the integrated coaching chatbot, your profile, goal and training context data is transferred to the Claude API of Anthropic (Anthropic PBC, USA). This includes:
Directly identifying data such as your name or email address is not transferred to Anthropic. The transfer is based on the performance of a contract (Art. 6(1)(b) GDPR) and — for personal health data — on your explicit consent (Art. 9(2)(a) GDPR), which you give by voluntarily filling in these fields in the settings. You can leave these fields empty or delete them at any time without this preventing plan generation.
Anthropic is a participant in the EU-U.S. Data Privacy Framework (DPF) and thereby ensures an adequate level of data protection for transfers to the USA.
Privacy policy: anthropic.com/privacy
Summitflow Pace offers the option of registering via Google OAuth or "Sign in with Apple". In this case, your email address and name are transferred by the respective provider to our authentication service (Supabase). With Apple, you can hide your email address; we then receive a relay address generated by Apple. No other Google or Apple data is retrieved or stored. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
Privacy policies: policies.google.com/privacy · apple.com/legal/privacy
The following connections (Strava, WHOOP, Polar, Suunto, COROS, Garmin Connect) are optional and are set up by you. Heart rate, heart rate variability, sleep, resting heart rate and body metrics from these services are health data within the meaning of Art. 9 GDPR. We only process them on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give in the app before connecting — in addition to the authorisation on the respective provider's sign-in screen. We process other activity data (duration, distance, power, route) for the performance of the contract (Art. 6(1)(b) GDPR). The sole purpose is to match it against your plan, to calculate load and recovery and to adjust your training. The data is not sold, not used for advertising and — except to the processors named in this policy — not passed on. You can disconnect any connection at any time under Account & subscription → Connections or directly with the provider; this withdraws your consent with effect for the future, access is revoked with the provider and data retrieval ends. The data stored with us up to that point remains part of your training history and is removed when your account is deleted. Data held by the provider itself is not affected by any of this.
Since October 2026, we no longer accept new Strava connections; existing connections continue until you disconnect them. Training data such as completed activities, distances, duration, heart rate and power values is retrieved via the Strava API in order to better adjust your training plans. For the legal bases, see "Common rules". The connection can be revoked at any time in the account settings or directly with Strava.
Privacy policy: strava.com/legal/privacy
You can optionally connect your WHOOP account to Summitflow Pace. Recovery and strain data (recovery score, resting heart rate, HRV, sleep, strain) is then retrieved via the WHOOP API in order to adapt your training plan to your current recovery. For the legal bases, see "Common rules". The connection can be revoked at any time in the account settings or directly with WHOOP.
Privacy policy: whoop.com/privacy
You can optionally connect your Polar or Suunto account to Summitflow Pace. Completed activities (duration, distance, heart rate, power values where available) are then retrieved and matched against your training plan. For the legal bases, see "Common rules". The connection can be revoked at any time in the account settings or directly with the respective provider.
Privacy policies: polar.com · suunto.com
You can optionally connect your COROS account to Summitflow Pace. Via the interface provided by COROS, completed activities (sport, time, duration, distance, heart rate, power and elevation gain where available), the model of your watch and, as recovery metrics, resting heart rate, overnight heart rate variability, sleep duration and sleep score are then retrieved. The activities are matched against your training plan; we use the recovery metrics to adjust your training. We do not pass any raw COROS data on to the AI, only summaries derived from it (such as "resting heart rate above personal baseline"). For the legal bases, see "Common rules". The connection can be revoked at any time in the account settings or directly with COROS.
Privacy policy: coros.com/privacy
You can optionally link Summitflow Pace to your Garmin Connect account via the Garmin Connect Developer Program. If you actively set up the connection (explicit consent in the app, followed by OAuth authorisation with Garmin, where you choose the data categories to be shared), Summitflow Pace uses:
Garmin only transfers data from the time of linking onwards; earlier activities are not imported.
Garmin data is used exclusively to provide your personal training plan and your training analyses. It is not sold, not used for advertising and not passed on to third parties, except to the processors named in this policy (database, hosting and the AI service Anthropic as described in the section "Anthropic / Claude AI", insofar as the data is used in plan adjustment or the Coach chat). The legal basis is your consent (Art. 6(1)(a) GDPR) or the performance of a contract (Art. 6(1)(b) GDPR); insofar as Garmin data is health data, your explicit consent (Art. 9(2)(a) GDPR), which you give in the app before connecting.
You can disconnect at any time in the account settings or in your Garmin account. Access is then revoked with Garmin and data retrieval ends. When your account is deleted, the Garmin data stored with us is also deleted; your data in Garmin Connect itself is not affected. Garmin and Garmin Connect are trademarks of Garmin Ltd. or its subsidiaries; Summitflow Pace is not a Garmin product.
Privacy policy: garmin.com/privacy
In the Summitflow Pace app for iOS, you can optionally grant access to Apple Health (HealthKit) so that your workouts, heart rate, heart rate variability (HRV), resting heart rate, sleep and distance covered can be used for training planning. We do not read step counts. The data is read locally on your device via the HealthKit API and transferred to our servers in the EU in order to adapt your training plan to your actual load and recovery.
Apple Health data is considered a special category of personal data under Art. 9 GDPR. It is processed exclusively on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you give in Apple Health's first permission dialogue. You can withdraw your consent at any time in the iOS system settings under Privacy & Security → Health → Summitflow Pace or in the Summitflow Pace app under Account & subscription → Connections.
We use HealthKit data exclusively to adjust your training plan and to display it in the app. In accordance with Apple's requirements, any transfer to advertising networks, third-party analytics or tracking providers is excluded.
The Summitflow Pace Android app currently does not access Google Health Connect. On Android, you connect your watch directly via Garmin Connect, Polar or Suunto. Should we offer Health Connect in the future, we will inform you here in advance and obtain your consent in the app.
Our backend runs on servers of Hetzner Online GmbH (Gunzenhausen, Germany); the server location is in Finland (EU). Hetzner processes the data on our behalf on the basis of a data processing agreement (Art. 28 GDPR).
Privacy policy: hetzner.com/legal/privacy-policy
To detect and fix technical errors, we use Sentry (Functional Software, Inc.). When errors occur, technical information (error message, time, browser/device information, IP address) may be transferred. This may involve processing outside the EU/EEA (in particular in the USA); it takes place on the basis of appropriate safeguards (standard contractual clauses or the Data Privacy Framework). The legal basis is our legitimate interest in the stable operation of the service (Art. 6(1)(f) GDPR).
Privacy policy: sentry.io/privacy
For subscriptions in the iOS app, we use Apple's In-App Purchase; subscription entitlements are managed via RevenueCat, Inc. A pseudonymous user ID and purchase information are processed in this context — no payment data.
Privacy policy: revenuecat.com/privacy
For automatic training adjustment — such as recommending an indoor alternative in heavy rain, storms or heat — Summitflow Pace retrieves local weather forecasts via the Open-Meteo service. For this purpose, an approximate location (rounded geographic coordinates of your training area, derived from your profile or from the centre point of your recent activities from connected services such as Garmin, Strava, Polar or Suunto) is transferred to Open-Meteo — no exact address, no name, no account data. According to its own information, Open-Meteo does not store any personal data from requests. The legal basis is the performance of a contract (Art. 6(1)(b) GDPR).
Privacy policy: open-meteo.com/en/terms
For operational monitoring of the service (e.g. when a new user registers or a subscription changes), Summitflow Pace sends internal notifications to a private, access-restricted Telegram channel of the operator. Only a pseudonymous user ID, the selected sports, the weekly training volume and the selected subscription plan are transferred via Telegram's servers (Telegram FZ-LLC, United Arab Emirates). Name, email address, health data or detailed training data are not transferred in this way; the user ID can only be linked to a person with access to our database. The legal basis is our legitimate interest in the secure and reliable operation of the service (Art. 6(1)(f) GDPR).
Privacy policy: telegram.org/privacy
With your consent, Summitflow Pace sends push notifications to your device — e.g. when a new training plan has been generated, a trial is about to expire or an upcoming workout is due.
In the web browser, we use Web Push (VAPID standard); for the iOS app, the Apple Push Notification service (APNs); for the Android app, Google's Firebase Cloud Messaging service (FCM). An anonymous device token is transferred to our servers — the token allows us to send messages to your device but does not reveal any personal data. You can revoke the permission at any time in your browser or system settings.
For route maps in workout details and on race pages, we load map tiles from the servers of the OpenStreetMap Foundation (Cambridge, United Kingdom; EU adequacy decision). Your IP address and the map section displayed are transferred to OpenStreetMap; your route data itself remains on our servers. The legal basis is our legitimate interest in presenting your activities clearly (Art. 6(1)(f) GDPR).
Privacy policy: osmfoundation.org/wiki/Privacy_Policy
The website, app and API are delivered via the network of Cloudflare, Inc. (USA) and protected against attacks. Cloudflare processes technical connection data (IP address, request metadata) and may set a technically necessary security cookie. Cloudflare is a participant in the EU-U.S. Data Privacy Framework and acts as a processor. The legal basis is our legitimate interest in secure and fast operation (Art. 6(1)(f) GDPR).
Privacy policy: cloudflare.com/privacypolicy
This website uses Google Fonts to display fonts. In doing so, your IP address is transferred to Google servers.
Privacy policy: policies.google.com/privacy
With your consent, we use Google Analytics 4 (Google Ireland Limited) to statistically evaluate the use of this website. Data such as page views, time spent on the site and device information is collected in anonymised form. The data is stored on Google servers. Google Analytics is only loaded after you have actively given your consent via the cookie banner. You can withdraw your consent at any time by clearing your browser storage (localStorage).
Privacy policy: policies.google.com/privacy
Summitflow Pace uses two categories of cookies:
The website uses SSL encryption and implements technical and organisational security measures in line with the current state of the art.
You can exercise the following rights at any time:
Complaints can be lodged with the competent data protection authority; for us, this is the Data Protection Authority of the Principality of Liechtenstein (Datenschutzstelle, datenschutzstelle.li); you may also contact the supervisory authority in your country of residence. Please send enquiries to: [email protected]