Privacy Policy

1. Controller

The controller responsible for the processing described in this notice is:

Kestivo is the business designation of a German sole proprietorship that is not entered in the commercial register.

2. Scope

This notice applies to the public website at kestivo.app, the private-beta waitlist, email enquiries and support, and the Kestivo iOS application when it is used internally or made available to beta users.

It covers account data, athlete-profile and race data, training preferences, planned and completed workouts, Apple Health workout imports, Garmin-origin activity data received through Intervals.icu where enabled, selected structured-workout delivery through the same bridge, derived training-load and physiology information, AI-planning requests, data export and account deletion workflows, and technical data required to operate the service.

Payments and subscriptions are not currently part of the private-beta processing described here. If Kestivo introduces materially different processing, such as additional wellness data, advertising analytics, payments or new connected services, this notice will be updated before or when that processing begins.

3. Categories of personal data and sources

Depending on the features you use, Kestivo may process:

• Account and contact data: email address, first and last name, display name, account identifiers, verification status and support correspondence.
• Athlete profile data: date of birth, height, weight, timezone, selected sports, experience, goals, availability, preferred rest days, training preferences, equipment and facility access.
• Race and planning data: race goals and dates, target information, known holidays or dated exceptions, Training Roadmap content, weekly-plan drafts, approvals, rejections, edits and workout-calendar data.
• Training-zone and threshold data: cycling FTP, run threshold pace, swim CSS, maximum heart rate, bike and run threshold heart rate, and the training zones derived from or adjusted from those values.
• Completed-training data: sport, activity start and end time, duration, distance and, where available, heart rate, pace or speed, power, cadence, elevation, device/source information, external activity identifiers and related activity metadata.
• Athlete feedback: RPE, feeling, completion notes and other text that you deliberately enter.
• Derived coaching data: planned-versus-actual matching, training-load results, daily load evidence, fitness, fatigue and form metrics, including ATL, CTL and TSB where available, confidence, limitations and other deterministic planning evidence.
• Integration data: connected-service status, provider identifiers, encrypted OAuth credentials held server-side, approved scopes, sync coverage, external workout identifiers and non-secret connection diagnostics needed to operate optional integrations.
• AI operational metadata: request ID, feature type, prompt/context version, model identifier, lifecycle and validation status, token counts, estimated cost, safe error codes and execution timestamps.
• Technical data: IP address, request time, device and operating-system information, application version, network/security information and service logs required for delivery, security and troubleshooting.

Personal data is obtained directly from you; from Apple Health / HealthKit after you grant iOS permission; from Intervals.icu when you voluntarily connect the current Garmin bridge; from Garmin-origin activity files and connection evidence made available through that bridge; from Kestivo's deterministic calculations and AI-assisted planning processes; and from infrastructure providers when they operate Kestivo services.

4. Purposes and legal bases

5. Health and training data

Some workout, physiological and performance data can constitute data concerning health within the meaning of Article 9 GDPR. Kestivo processes such data only for athlete-facing training, planning, history, analysis and related product functions. Where Article 9 applies, Kestivo relies on explicit consent under Article 9(2)(a) GDPR.

The current Garmin private-beta bridge does not request Garmin all-day wellness data such as sleep, stress, Pulse Ox or Body Battery. Through Intervals.icu, Kestivo requests the scopes needed for completed-activity transport, structured-workout delivery and connected-service verification. Kestivo does not use the Intervals.icu settings scope to import training settings, FTP, zones or wellness data.

The current Apple Health integration is focused on completed workout data, not a general extraction of the user's complete Health database.

Kestivo does not sell health or training data, use it for advertising, or disclose it to other Kestivo users.

6. App account and athlete profile

Kestivo uses Supabase Auth and Supabase PostgreSQL to authenticate users and store app data. Supabase processes login and verification information required to establish an authenticated session. Kestivo does not store plain-text passwords in its application database.

Athlete records are associated with the authenticated user. Row Level Security and authenticated ownership rules are used so that users can access only data authorized for their account. The app may require certain profile information to generate meaningful training plans. Other fields are optional; leaving them blank can reduce the specificity of planning.

7. Apple Health / HealthKit

If you authorize Apple Health access, Kestivo may read permitted completed-workout records through Apple's HealthKit framework. The current synchronization uses a bounded initial history window and then incremental change tracking. Kestivo normalizes permitted workout facts into its own completed-activity model so they can be displayed, matched against planned sessions, used in training-load calculations and considered in future planning.

Depending on the workout and source, imported facts may include workout type, time, duration, distance, heart-rate values, pace/speed, cycling power, cadence, elevation and source/device metadata where available.

Kestivo uses one automatic completed-activity source at a time. If you select Garmin through Intervals.icu as the automatic source, Kestivo stops automatic HealthKit workout ingestion while that authority is active. This does not revoke the iOS Health permission itself.

HealthKit permission is controlled by you in iOS. You can revoke Kestivo's Health permissions in Apple settings. Revoking permission stops future access but does not necessarily delete workout data that was already imported into Kestivo. You can use Kestivo's authenticated account deletion workflow or contact Kestivo as described below.

Kestivo does not write or modify your Apple Health records as part of the completed-workout ingestion described in this notice. Kestivo may separately offer Apple WorkoutKit delivery for supported structured workouts; that function is distinct from HealthKit completed-workout ingestion.

When available and permitted, Kestivo stores normalized, time-stamped Run-speed or Bike-power samples from an Apple Health workout in its Supabase database, linked to that completed activity, to support planned-versus-actual intensity comparisons. This feature does not store GPS routes or coordinates, raw HealthKit payloads, an additional heart-rate sample stream, or inferred sensor values.

8. Garmin via Intervals.icu

For the current private beta, Kestivo does not connect directly to the Garmin API. Instead, Kestivo uses Intervals.icu as a temporary transport bridge for users who voluntarily connect Garmin. The current flow is Garmin to Intervals.icu to Kestivo for supported completed activities, and Kestivo to Intervals.icu to Garmin for supported structured-workout delivery.

Kestivo requests exactly the Intervals.icu permissions required by the current bridge: activity read access, calendar write access and settings read access. Settings read access is used only to verify connected-service status. Kestivo does not use it to import Intervals.icu training settings, FTP, zones or wellness information.

• Completed activity import: Kestivo can receive FIT-backed Run, Bike and Swim activities available through the selected Intervals.icu route. Kestivo preserves provider provenance and normalizes supported activity facts into Kestivo's completed-activity model.
• Structured workout delivery: when you explicitly choose to send a supported Kestivo workout to Garmin, Kestivo may write the structured workout through Intervals.icu so that it can reach the connected Garmin account and compatible device.

Kestivo remains authoritative for Kestivo training plans, thresholds, training-load calculations, physiology and coaching. Kestivo does not treat Intervals.icu or Garmin-calculated TSS, ATL or CTL as Kestivo's authoritative values.

OAuth credentials are held only by Kestivo's backend, encrypted server-side, and are not exposed as privileged secrets to the iOS app. Kestivo also stores the connection metadata, external identifiers, provider provenance and synchronization state required to operate and troubleshoot the bridge.

Disconnecting the integration removes the usable Kestivo-side credential and stops future Kestivo synchronization through the bridge. Previously imported Kestivo data is not automatically deleted merely by disconnecting. Provider-side account or connection state remains subject to the controls and terms of Intervals.icu and Garmin. Direct Garmin API integration remains a possible future architecture and is not the active private-beta connection described here.

Intervals.icu and Garmin are independent services with their own terms and privacy notices. See Intervals.icu Privacy Policy and Garmin Connect Privacy Policy.

9. AI-assisted planning and OpenAI

Kestivo uses the OpenAI API through secure backend functions for AI-assisted planning features. Depending on the feature, Kestivo may send a minimized selection of athlete-owned context such as race goals, availability, relevant zones or thresholds, equipment/access, current Roadmap direction, recent completed training, derived physiology or limitations, and a bounded instruction that you choose to provide.

Kestivo does not automatically send the complete Athlete Profile to OpenAI. It does not intentionally send authentication credentials, access tokens, API secrets or complete raw HealthKit or Intervals.icu payloads. Context is selected for the requested planning function and is intended to be limited to what is needed for that function.

Production AI request logs are deliberately minimized. They store operational metadata such as request ID, feature type, prompt/context version, model, status, token counts, estimated cost, safe error codes and timing. They do not persist complete prompts, raw provider request bodies, complete athlete profiles, health metrics, workout history or provider response bodies in the normal ai_request_logs lifecycle.

OpenAI processes API customer data on Kestivo's behalf under contractual data-processing terms. For customers in the EEA, OpenAI's current data-processing terms identify the applicable EEA contracting entity and transfer safeguards. See the OpenAI Data Processing Addendum.

10. Training load, physiology and profiling

Kestivo derives training and coaching information from your athlete profile and training history. This can include planned-versus-actual relationships, sport-specific training load, daily load evidence, fitness, fatigue and training-form metrics, confidence levels, limitations and training-phase or planning context.

These values are training-planning tools and are not medical diagnoses, medical-device outputs or guarantees of readiness or performance. Missing or uncertain data is retained as missing or uncertain rather than automatically converted into a healthy or zero-load state.

This processing is used to provide the requested training service under Art. 6(1)(b) GDPR and, where derived information constitutes health data, on the basis of explicit consent under Art. 9(2)(a) GDPR.

11. On-device storage and cached reads

The iOS app uses limited local storage for application operation. This can include authenticated session state managed by the Supabase client, user-scoped HealthKit synchronization state and versioned read-only snapshots used to show previously loaded Dashboard, Week, Workouts, Roadmap or Profile information during temporary connectivity problems.

These local read snapshots are presentation caches, not a separate source of truth. They are designed to exclude API keys, service-role credentials, raw HealthKit payloads, Intervals.icu access tokens and AI request bodies. Supabase remains authoritative for account identity and server-side application data.

After successful account deletion, Kestivo clears applicable local athlete snapshots, integration state and local synchronization state under the app's deletion workflow.

12. Website hosting and infrastructure

The public website is delivered using Cloudflare Workers Static Assets and related Cloudflare network services. Cloudflare may process technical request data such as IP address, date and time, requested URL, HTTP method and status, referrer, browser, operating system, device, network and security information.

Cloudflare also provides the restricted OAuth callback relay used by the current Intervals.icu bridge and private off-site object storage used for Kestivo's operator-controlled production database backups. GitHub Actions is used to execute the controlled backup workflow. Production database dumps are not retained as GitHub Actions artifacts.

This infrastructure processing is necessary for delivery, security, continuity, abuse prevention, troubleshooting and recoverability. The legal basis is Art. 6(1)(f) GDPR. Kestivo's legitimate interests are secure and efficient operation and protection and recoverability of its infrastructure.

13. Private-beta waitlist and Brevo

When you join the beta waitlist, Kestivo processes your email address, first name if provided, consent status, registration/confirmation status and technical delivery information needed to manage the waitlist.

Kestivo uses Brevo as the waitlist and email-service provider. Registration uses double opt in. The legal basis is consent under Art. 6(1)(a) GDPR. You may withdraw that consent at any time using the unsubscribe link or by contacting hello@kestivo.app.

Joining the waitlist does not itself create an app account, guarantee a beta place or create a paid subscription.

14. Email communication and email events

When you contact Kestivo by email, Kestivo processes your email address, name where supplied, message, attachments and transmission metadata to answer and manage your enquiry.

Brevo may record technical email events such as sending, delivery, bounce and unsubscribe status. If open or link tracking is enabled for a communication, such measurement is based on consent where required and can be stopped by withdrawing the relevant communication consent.

15. Cookies, local storage and website analytics

The public Kestivo website currently does not use advertising cookies, behavioural advertising, cross-site profiling or optional website analytics. The beta form sends data to Brevo only after you deliberately submit it.

If Kestivo later introduces optional analytics or other non-essential tracking, the website and this notice will be updated and consent mechanisms will be introduced where required.

16. Recipients and service providers

Kestivo discloses personal data only where necessary to provide, secure, back up or support the service, or where required by law. Relevant current providers and recipients include:

17. International data transfers

Some service providers or their subprocessors may process data outside Germany or the European Economic Area. Where Chapter V GDPR requires a transfer mechanism, Kestivo relies on applicable safeguards such as an adequacy decision, the EU-U.S. Data Privacy Framework where available, or European Commission Standard Contractual Clauses together with contractual and technical safeguards.

Kestivo uses data-processing agreements with processors where required. Provider locations and subprocessor lists can change over time; applicable safeguards are reviewed as part of vendor management.

18. Retention

Kestivo keeps personal data only as long as required for the purposes described above, legal obligations, security or the establishment, exercise or defence of legal claims. Because the service is still in private-beta development, exact periods can depend on the type of record and service configuration. The following criteria apply:

• Account, athlete profile, planning, workout and imported activity data: generally retained while the account is active and the data is needed for Kestivo functionality; deleted or anonymised after account deletion unless retention is legally required.
• Intervals.icu connection credentials and connection metadata: retained only while required to operate the connection. The usable Kestivo credential is removed as part of disconnect or account deletion according to the implemented workflow.
• AI operational request logs: retained only as long as reasonably necessary for usage control, cost monitoring, security, reliability and audit needs. Normal request logs exclude raw athlete context and raw provider bodies.
• Account-deletion recovery metadata: minimal server-side deletion-request state may be retained temporarily to make deletion idempotent and to recover truthfully from response loss or partial delivery of the deletion result.
• Local app caches and synchronization state: kept on the device only as needed for operation and cleared according to app, session and account-deletion lifecycle. Deleting the app removes app-local storage subject to normal iOS behaviour.
• Waitlist data: retained until consent is withdrawn, the waitlist purpose ends or continued storage is no longer necessary. Limited suppression or consent evidence may be retained to respect opt-outs and demonstrate compliance.
• Website, security and delivery logs: retained according to the configured infrastructure services and only for as long as necessary for security and operational purposes.
• Email correspondence: retained until the enquiry is resolved and no legal or legitimate business reason requires further storage.
• Backups: Kestivo maintains restricted off-site backups with bounded rotation. Deleted data may remain temporarily in backup generations until normal retention and rotation remove those generations, unless longer retention is legally required.
• Provider-managed platform metadata: limited authentication, transaction, security or service metadata controlled by an infrastructure provider may remain outside Kestivo's application-owned deletion boundary where Kestivo cannot safely delete it directly. Such data remains subject to the provider's own retention obligations and Kestivo's contractual controls where applicable.

19. Your rights, data export and account deletion

Subject to the requirements of applicable law, you may have the rights to access, rectification, erasure, restriction of processing, data portability and objection under Articles 15 to 21 GDPR. Where processing is based on consent, you may withdraw consent at any time with effect for the future.

Kestivo provides an authenticated in-app data export for the defined Kestivo-owned and Kestivo-derived export scope. The export is generated for the authenticated account and is designed to exclude provider secrets and unrelated server-only security data.

Kestivo also provides an authenticated in-app account deletion workflow with destructive confirmation. The workflow removes applicable Kestivo-owned and derived application data, integration connections and credentials, the Supabase Auth user, and applicable local Kestivo state. It does not delete data held independently by Garmin, Intervals.icu, Apple or another external provider.

Deletion may not immediately remove data from restricted rotating backups or provider-managed metadata outside Kestivo's application-owned deletion boundary, as described above.

You can also contact hello@kestivo.app to exercise applicable rights. Kestivo may need to verify your identity before fulfilling a request.

20. Consent, Apple Health permissions and disconnecting integrations

Apple Health and the Garmin-through-Intervals.icu bridge are optional. Declining or revoking access does not prevent basic account use where the relevant feature can operate without the integration, but it may limit automatic workout import, execution sync, training-load evidence or AI-planning specificity.

Where Kestivo relies on consent, withdrawal does not affect the lawfulness of processing carried out before withdrawal. Disconnecting a provider normally prevents future Kestivo synchronization; already imported information is not necessarily deleted automatically and can be removed through the account/data deletion process where it falls within Kestivo's deletion boundary.

21. Automated decision-making

Kestivo uses deterministic calculations and AI-assisted generation to support training planning. It does not use the described system to make solely automated decisions that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR.

AI-generated Roadmaps and workouts are proposals. Kestivo validates defined constraints and the athlete reviews, edits, rejects or approves training before it becomes the operative plan. Kestivo does not provide medical diagnoses or automated medical decisions.

22. Security

Kestivo applies technical and organisational measures appropriate to the nature of the service. Current measures include encrypted HTTPS communication, authenticated backend access, Supabase Row Level Security for user-owned data, least-privilege architecture, backend-only storage of privileged integration and AI secrets, server-side encryption of Intervals.icu access credentials, one-time OAuth state protection, privacy-safe logging, deterministic ownership validation and restricted off-site backups with integrity verification.

No internet service or storage system can guarantee absolute security. If Kestivo becomes aware of a personal-data breach, it will assess and handle notification obligations in accordance with applicable law.

23. Right to complain

You may lodge a complaint with a competent data-protection supervisory authority, particularly in the Member State of your habitual residence, workplace or the alleged infringement.

Authority responsible for North Rhine-Westphalia:

24. Changes to this Privacy Policy

This notice may be updated when Kestivo changes its app, website, integrations, service providers, data categories, AI functions or legal requirements. Material changes affecting consent-based processing will be handled in accordance with applicable law. The current version and date are published on this page.