Privacy

The controller for your data is Lloyd Thomas, trading as Cyclefit Europe - SteadySignalTraining. The postal address is in the Impressum. For anything about your data, write to lloyd@steadysignaltraining.com.

Your account email, the ride files and activity data you upload or sync (Strava, Wahoo, Garmin, .FIT), your daily check-ins (recovery, sleep, energy, mood), and any training context you add — goals, events, notes. If you connect a device or platform, we store the tokens needed to keep that connection alive. If you connect Garmin through Garmin's official connection, you sign in and approve access on Garmin's own page; we never see your Garmin password and keep only the access tokens Garmin issues. The older direct Garmin sign-in, which we are retiring, uses your Garmin password once to sign in and never stores it; it too keeps only the sign-in tokens Garmin returns. If you sign in with Google, Google confirms your email address to us. If you connect Google Calendar, we store the token needed to put your sessions into it.

If you connect Health Connect on Android, we import the categories you allow there: heart rate, resting heart rate, heart-rate variability, sleep, steps, distance, calories burned, weight, body fat, lean body mass, basal metabolic rate, VO2 max, respiratory rate and blood oxygen saturation.

If you connect Garmin, we receive the activities you record (time, duration, distance, route, power, heart rate, cadence and similar ride data) and, where you allow it in your Garmin Connect sharing settings, daily health summaries such as sleep, resting heart rate and heart-rate variability. We use them only to run SteadySignal for you: to analyse your rides, track your training load, fitness and fatigue, adapt your plan to your recovery and, if you use it, send planned workouts to your Garmin device. If you give a coach access, that coach sees this data too.

We do not sell, rent or trade Garmin data or anything derived from it, we do not use it for advertising, and we never use it to train, evaluate or improve AI models, ours or anyone else's. Apart from you and any coach you authorise, it is handled only by the service providers listed under sub-processors below, who process it on our behalf.

You can disconnect Garmin at any time under Connected apps; we then delete the stored Garmin tokens and stop importing. You can also revoke SteadySignal's access in your Garmin Connect account. Rides already imported stay in your account until you delete them or your account, and you can export or delete everything on Your data.

• Running your account and the training service you signed up for — your rides, plans, check-ins and connected apps: performance of our contract with you (Art. 6(1)(b) GDPR).
• Health-related data you choose to enter (recovery, sleep, check-in answers), the AI coach, and a coach's access to your data: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR), given when you enter that data or turn the feature on. You can withdraw it at any time.
• Keeping the service secure and working (sign-in records, error logs) and counting visits without cookies: our legitimate interest in a safe, working product (Art. 6(1)(f) GDPR).
• Invoices and payment records once paid plans are live: our legal duty to keep them (Art. 6(1)(c) GDPR together with German tax and commercial law).

Before anything reaches the AI model, your data is reduced to a minimised numeric snapshot: power and load numbers, recovery scores, session summaries. It contains no name, no email, no free-text notes. Health-adjacent signals are collapsed to coarse flags (for example "a recent low-recovery day exists: yes/no") — never symptoms or body-composition values.

The model is instructed to reason only from that snapshot and to say so when your data cannot answer a question. Numbers derived from your rides, including rides synced from Garmin, can be part of that snapshot. AI requests are processed by Anthropic (Claude) as a processor. Neither we nor Anthropic use your data, or anything derived from data from Garmin, to train, evaluate or improve AI models.

AI features run only after you explicitly turn them on in your profile. You can withdraw that consent at any time by switching them off again in your profile; from that moment no further data is sent for AI processing. Everything else in SteadySignal keeps working without it.

We count page visits and a few steps in the product — signing up, connecting an app, finishing onboarding, creating a plan, starting a subscription — with Umami, an open-source statistics tool we run on our own server. Nothing is sent to a third party.

Umami sets no cookies and stores nothing on your device. It does not record who you are: no name, no email, no account id, and your IP address is not stored. The query string and fragment of every address are removed before a visit is counted. If your browser sends Do Not Track, you are not counted at all.

A ride's route is drawn without any outside service. Only when you press “Show map” on a ride does your browser load the map background from the OpenStreetMap Foundation (United Kingdom), which receives your IP address for that request. Nothing is loaded from OpenStreetMap until you ask for it.

If you turn on browser notifications, they are delivered through your browser maker's push service: Google (Firebase Cloud Messaging) for Chrome and Android, Apple (Apple Push Notification service) for Safari, Mozilla for Firefox. The push service receives an address for your device and the message in encrypted form; it cannot read the content. You can turn notifications off at any time in your browser.

Your data lives on servers we rent from 1blu GmbH in Germany, and backups are encrypted before they leave those servers. We keep your account data for as long as you have an account.

When you delete your account, everything is erased after a 14-day grace period in which you can still change your mind. Encrypted backups roll over on their own, and deleted data drops out of them as they do. Invoices and payment records are kept for as long as German tax law requires (up to ten years).

Error records are deleted 30 days after the error is resolved, or 90 days after it was last seen. Server logs are rotated by size and overwritten as new entries arrive (at most 30 MB per service).

Under the GDPR you have the right to:

• see what we hold about you and get a copy (Art. 15)
• have wrong data corrected (Art. 16)
• have your data deleted (Art. 17)
• have processing limited while a question is settled (Art. 18)
• take your data with you in a machine-readable format (Art. 20)
• withdraw any consent at any time, without affecting what happened before (Art. 7(3))

Right to object: you can object at any time, on grounds relating to your particular situation, to processing that rests on our legitimate interest (Art. 6(1)(f) GDPR).

Most of this you can do yourself on Your data in your account: download everything as a file, or delete your account. For anything else, write to us; we answer within one month.

You can also complain to a data protection authority. Ours is the Hessian Commissioner for Data Protection and Freedom of Information (HBDI) in Wiesbaden.

1blu GmbH, Germany (hosting — the servers your data lives on), Stripe (payments — we never see your card number), Anthropic (AI processing of the minimised snapshot, with your consent), Google (Google Workspace, our email provider for sign-in codes and notifications; and, only if you use them, Google sign-in and Google Calendar). Open-Meteo receives only a place and a time to forecast the weather for a planned ride, never your name or your account. Umami runs on our own server, so it is not a third party. We do not sell your personal data or share it with anyone for their own purposes, and there are no advertising trackers.

Connected services (independent controllers): Strava, Garmin, Wahoo and Hammerhead (SRAM) — only if you connect them. At your instruction we exchange activities and workouts with them; their own processing is governed by their privacy policies, and they may process data in the USA.

Where each of them sits, and how transfers to the USA are safeguarded, is on Where your data lives.

Privacy questions or requests: lloyd@steadysignaltraining.com.