Privacy Policy

1. Controller

The controller is Tjark Gerken, Titlisstrasse 40, 8032 Zürich, Switzerland, reachable at tjark@steig.app.

2. Data we process

STEIG is an app for planning your own training, logging workouts, analysing activities and tracking recovery. Depending on the features you use, we process:

• Account data: name and email address, or the name, email address and identifier provided by Sign in with Apple, and your profile settings
• Training data you enter: planned sessions, workouts and templates, logged sets, perceived effort (RPE), exercises, events and races including routes you upload, unavailable periods and notes
• Physiological profile: heart rate zones and thresholds, power and pace thresholds
• Imported activities (if you connect Strava or Garmin Connect): activity details, laps, GPS tracks, heart rate, power, pace and cadence data, and the recording device
• Wellness data (only if you connect Garmin Connect): resting heart rate, heart rate variability, sleep, stress and similar daily metrics
• Connection data: access tokens and account identifiers for Strava or Garmin, calendar feed URLs you add and the events they contain, and calendar links you create
• Diagnostic data from the app: crash and error reports, performance traces, app logs, session replays and feedback you submit after a crash (see section 6)
• Server logs: IP address, time and requested endpoint
• Private beta requests: email address, name, the optional training profile (primary sport, target event and month, weekly training volume, planning challenges) and the time of your consent and confirmation
• Website usage and performance: pages viewed, referrer, country, browser, operating system and device type, and page load timings, collected with Vercel Web Analytics and Speed Insights. They use no cookies and do not identify you or track you across websites; visits are counted with a hash that changes daily.

3. Health data

Heart rate and heart rate variability, sleep, stress and similar physiological data are health data (sensitive personal data under the FADP, special category data under Art. 9 GDPR). We process them only with your explicit consent, which we ask for in the app before we import or analyse such data, and only to provide STEIG's training and recovery features to you.

You can withdraw this consent at any time by disconnecting Strava or Garmin in the app, deleting your account, or contacting tjark@steig.app. Withdrawal does not affect processing before it. After withdrawal we delete the affected imported data, and features that rely on it (such as heart-rate-based load and recovery insights) are no longer available.

4. Purposes and legal bases

Under the FADP we process personal data in line with its processing principles. Where the GDPR applies, for example because you are in the EU or EEA, we rely on these legal bases:

• Account, training planning, workout logging, activity analysis and recovery features

  Performance of our contract with you (Art. 6(1)(b) GDPR)

• Health data: heart rate and other physiological data from your workouts, imports and wellness features

  Performance of the contract (Art. 6(1)(b) GDPR) together with your explicit consent (Art. 9(2)(a) GDPR)

• Importing data from Strava or Garmin and sending planned workouts to Garmin

  Performance of the contract (Art. 6(1)(b) GDPR), at your request when you connect the service; for health data also your explicit consent (Art. 9(2)(a) GDPR)

• Crash reports, performance monitoring and session replays to keep the app stable

  Legitimate interest in detecting, fixing and preventing errors and misuse (Art. 6(1)(f) GDPR)

• Website analytics and performance measurement to improve the website

  Legitimate interest in understanding and improving the website (Art. 6(1)(f) GDPR)

• Server logs to operate and secure our infrastructure

  Legitimate interest in the security and availability of the service (Art. 6(1)(f) GDPR)

• Private beta request and the double opt-in confirmation

  Steps at your request before a contract (Art. 6(1)(b) GDPR)

• Follow-ups (feedback requests, surveys, interviews) and marketing emails

  Your consent (Art. 6(1)(a) GDPR)

• Records of consents and unsubscribes

  Legal obligation to demonstrate consent (Art. 6(1)(c) and Art. 7(1) GDPR) and legitimate interest in honouring your opt-out (Art. 6(1)(f) GDPR)

We do not sell, rent or trade personal data, including data imported from Garmin or Strava, and do not use it for third-party advertising.

We do not use artificial intelligence (AI) systems to process your data. Your data, including data imported from Garmin, is never used to train, evaluate or improve AI models.

5. Service providers

These providers process personal data on our behalf, under data processing agreements and only on our instructions:

• IONOS SE

  Hosting of our application servers (API and background jobs)

  Location: Germany

• Vercel Inc.

  Hosting of this website, including the private beta signup (email address, name and training profile), and cookieless website analytics and performance measurement

  Location: Germany (Frankfurt); Vercel is a US company

• Supabase, Inc.

  Database and authentication: account, training, activity and health data

  Location: Hosted in the EU; support and operations staff may access data from other countries, including the United States and Singapore

• Cloudflare, Inc.

  Network proxy and DNS for steig.app (sees your IP address and requests) and storage of detailed activity files in R2 (GPS tracks, heart rate, power and pace streams)

  Location: Activity files stored in Western Europe; website traffic handled at the data centre nearest to you; Cloudflare is a US company

• Functional Software, Inc. (Sentry)

  Error reports, performance monitoring, app logs and session replays

  Location: Event data in Sentry's EU region (Germany); some account and organisation metadata in the United States

• Amazon Web Services EMEA SARL (AWS SES)

  Sending private beta emails

  Location: Germany (Frankfurt); AWS is part of a US group

• Inngest, Inc.

  Background job orchestration: queues and runs import, sync and processing jobs, including the activity and wellness data passed to those jobs

  Location: United States

If you use Sign in with Apple, Apple processes your sign-in under its own privacy policy.

6. Connected services and diagnostics

Strava

If you connect Strava, we import your activities and their detailed data. Strava, Inc. (United States) is an independent controller; its privacy policy applies to your Strava account. If you disconnect Strava or revoke access in Strava, we delete your access tokens, all activities imported from Strava with their laps and detailed files, and metrics derived from them. Your plan and workouts you recorded in STEIG stay.

Garmin Connect

If you connect your Garmin Connect account, we receive your activities and wellness data through the Garmin Connect Developer Program APIs, and at your request send planned workouts to Garmin Connect so they are available on your Garmin device. Garmin is an independent controller; its privacy policy applies to your Garmin account. We use Garmin data only to provide STEIG's features to you. We never sell Garmin data or share it with third parties for their own purposes; only the service providers in section 5 process it on our behalf. Garmin data is not processed by AI systems and is never used to train AI models. If you disconnect Garmin in the app or in Garmin Connect, we delete your access tokens, all data imported from Garmin and metrics derived from it.

Calendars

If you add a calendar feed URL, our servers regularly fetch that feed and store its events so STEIG can plan around them. Calendar links you create let other apps read your STEIG plan until you revoke them.

Diagnostics with Sentry

The app and our servers send crash and error reports, performance traces and logs to Sentry. The app also records session replays: a reconstruction of the screens and interactions around a session or error, with all text and images masked. After a crash you can send us a description of what happened. We configure Sentry not to send your name, email address, IP address, cookies or HTTP headers, and we do not use this data for tracking or advertising. Details are in the Sentry documentation.

7. Disclosure abroad

We disclose personal data to the countries named in sections 5 and 6: Germany and other EU/EEA states, the United States and Singapore. Switzerland recognises the EU/EEA as providing adequate data protection. For the United States we rely on the recipient's certification under the Swiss-U.S. and EU-U.S. Data Privacy Framework where available, and otherwise, as for Singapore, on the standard contractual clauses of the European Commission as recognised by the FDPIC. You can request a copy of these safeguards at tjark@steig.app.

Data you choose to share with Strava, Garmin or Apple is governed by those companies, which may process it in the United States and other countries.

8. Retention

• Account, training and health data: until you delete it or your account. Deleting your account in the app removes all of it immediately and revokes the Strava and Sign in with Apple connections. Copies in database backups are overwritten within 30 days.
• Imported Strava or Garmin data: until you disconnect the service or withdraw your consent, then deleted as described in section 6.
• Diagnostic data in Sentry: up to 90 days.
• Server logs: up to 14 days, unless needed to investigate a security incident.
• Unconfirmed private beta requests: 48 hours.
• Confirmed private beta entries: until you withdraw your consent or the beta ends. After you unsubscribe we keep your email address on a suppression list so we do not contact you again, and we keep records of your consent for as long as we need to demonstrate it.

9. Your rights

Subject to the conditions of applicable law, you have the right to:

• Access the data stored about you (Art. 25 FADP, Art. 15 GDPR)
• Rectification of inaccurate data (Art. 32 FADP, Art. 16 GDPR)
• Erasure of your data (Art. 32 FADP, Art. 17 GDPR)
• Restriction of processing (Art. 32 FADP, Art. 18 GDPR)
• Data portability (Art. 28 FADP, Art. 20 GDPR)
• Object to processing based on legitimate interest (Art. 30 FADP, Art. 21 GDPR)
• Withdraw your consent at any time with effect for the future, including consent to process health data and to receive marketing emails (Art. 7(3) GDPR)

Withdrawing consent is as easy as giving it: use the unsubscribe link in any email, disconnect a service in the app, or contact tjark@steig.app.

10. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you are in the EU or EEA, you can also contact the supervisory authority in your country of residence.