Privacy Policy

This policy explains what data SweatStack handles, why, and what you can do about it. We try to keep it short and honest. If anything here is unclear, email [email protected] and we'll explain.

Who we are¶

SweatStack is operated by Sweatkraft AS, a company registered in Norway. We are the data controller for the personal data described below, except for accounts someone else manages (see Accounts managed for you). For any privacy question, contact us at [email protected].

What we collect¶

Account data. Email address, first name, last name, and password (hashed). If you sign in through a third-party provider, we receive the basic profile information they share.

Health and fitness data. This is the data SweatStack exists for. It reaches us in three ways: from a wearable platform you connect (Garmin Connect, Intervals.icu, Wahoo, and others as they come online), from you directly when you enter or upload it, or from an app you have authorized to write to your account. It falls into these categories:

• Activity data recorded by your device: power, heart rate, speed, location, and similar metrics, plus your age and gender where the platform shares them.
• Daily measures such as resting heart rate, heart rate variability, sleep, body mass, and body composition. These come from a connected platform or from you.
• Reproductive health data, specifically your menstrual cycle, if you choose to enter it. No connected platform sends it to us today; it is only in your account if you or an app you authorized put it there.

The current list of measures is in the developer documentation. We update that list as we add measures; a new measure within one of the categories above does not change this policy.

Usage data. Standard server logs (IP address, request paths, timestamps) and error reports needed to keep the service running.

Payment data. If you have a paid plan, Stripe handles your card details. We see the billing email, country, and subscription status, not the card itself.

Why we process it, and on what legal basis¶

We process your data to provide SweatStack and the features you use. Under GDPR:

• Contract (Art. 6(1)(b)): running your account, processing your data, delivering the analyses you came here for.
• Legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse, debugging errors, and improving the product based on aggregate usage.
• Legal obligation (Art. 6(1)(c)): tax records, responding to lawful requests.
• Explicit consent (Art. 9(2)(a)): health and fitness data is special category data under GDPR. You give us explicit consent to process it when you connect a wearable platform, when you enter or upload it yourself, and, for sharing it, when you authorize an app to receive the categories shown on the authorization screen. You can withdraw that consent at any time by disconnecting the platform, deleting the records, revoking the app, or deleting your account.

We don't use your data for advertising and we don't sell it.

Third-party apps you authorize¶

SweatStack has an open API. You can authorize third-party applications to access your data, for example a coaching app or a training-load tool built on SweatStack.

When you authorize an app:

• You give explicit consent for SweatStack to share the categories of data shown on the authorization screen with that app. Sharing is a separate step from collecting; you can connect a platform without authorizing any app.
• That app receives the data you grant access to, including via webhooks if it subscribes to them.
• From that moment, the app's developer becomes an independent controller of the data they hold. Their own privacy policy governs what they do with it.
• You can revoke access at any time in your SweatStack settings. Revocation stops new data flowing, but it does not pull back data the app has already received. To have that data deleted, contact the app's developer directly.

We require developers to handle your data responsibly under our Terms, but we are not responsible for what they do inside their own product.

Artificial intelligence¶

By AI models we mean large, general-purpose models like ChatGPT, Claude or Gemini. SweatStack doesn't put your data into AI models, and doesn't use it to train them. The analyses we compute, like your training zones, come from statistical models fitted to your own data.

Apps you authorize may use AI models. Our developer terms set the same rules for every app, whatever platform your data comes from:

• The app asks for your explicit consent first, and tells you what the AI does and which provider runs it.
• The app uses only AI providers that may not train on your data.
• The app never trains an AI model on your data, unless the model serves only you.

You can withdraw your consent at any time by disconnecting the app in your SweatStack settings. Each app's privacy policy describes how it uses AI.

If you arrived via a third-party app¶

You may have created your SweatStack account by clicking "Continue with SweatStack" inside another app. That account is yours. It exists independently of the app that sent you here, and you can use it, manage it, or delete it on your own at sweatstack.no, even if you stop using the app that introduced you. The exception is an account an app keeps for you, which the app's sign-in tells you about; see Accounts managed for you.

Accounts managed for you¶

Your account may be managed by someone else: a coach or a parent who created it for you in SweatStack, or an app that keeps your account for you. For such an account, whoever manages it decides what happens to your data, and SweatStack processes it on their behalf, as their processor. Their privacy policy applies, including how they use AI, and your questions and requests (access, correction, export, deletion) go to them. If you contact us instead, we'll pass your request on.

Connected platforms (Garmin and others)¶

When you connect a wearable or training platform such as Garmin, Intervals.icu, or others as they come online, that platform shares your data with SweatStack under the authorization you grant them. From that point, SweatStack is a data controller for that data under GDPR; the platforms remain controllers for the data on their side. For Garmin Connect specifically, see the Garmin Connect privacy notice.

What we collect. Only the data you authorize the connected platform to send. When you connect Garmin to SweatStack, the scopes you grant determine which data we receive through the Garmin Connect APIs; we do not receive data beyond those scopes.

How we use it. To provide the SweatStack service to you: storing your training history, computing derived metrics (training zones, longitudinal aggregates, and similar), and making the data available through the SweatStack app, SDK, and API.

How we process it. Data is normalized into SweatStack's data model so it can be analyzed consistently alongside data from other sources. Derived metrics are computed from the inputs. We do not modify the underlying source data beyond what is necessary to display and analyze it.

Where it is stored. On servers in Finland (EU), operated by Hetzner. See Where your data lives for international-transfer details.

Who else can access it.

• Sub-processors we use to run the service. A small set of providers (hosting, transactional email, edge networking) with stated purpose and region. The current list is at our sub-processor list.
• Third-party apps you have authorized. SweatStack has an open API. When you authorize a third-party app, that app receives the data you grant access to and becomes an independent controller of the data it holds under GDPR. Its own privacy policy governs what it does. See Third-party apps you authorize for the full description and how to revoke.
• No one else. We do not sell connected-platform data, share it with advertisers or data brokers, or make it available outside the two categories above.

Artificial intelligence. See Artificial intelligence. It covers data from Garmin and other connected platforms.

Workouts sent to Garmin. If an app you authorize sends workouts to your Garmin device through SweatStack, Garmin receives and stores them under the Garmin Connect privacy notice. When you delete such a workout in SweatStack, we also remove it from Garmin Connect, but Garmin may keep its own copies.

When you disconnect. Disconnecting a connected platform in your SweatStack settings stops new data flowing from that platform immediately. The data already in your SweatStack account remains under your control as the data subject under GDPR. You can exercise your rights of erasure, rectification, or export at any time; see Your rights. Deletion timelines are described under How long we keep it. Disconnecting at SweatStack does not affect your account on the connected platform; for Garmin, manage that under the Garmin Connect privacy notice linked above.

Who else handles your data¶

We use a small number of trusted sub-processors to run the service. The current list, with purpose and region, lives at our sub-processor list. We update that page when it changes.

Where your data lives, and international transfers¶

Your primary data is stored on servers in Finland (EU), operated by Hetzner.

Some sub-processors operate globally or from outside the EEA. For example, Cloudflare runs a global edge and email network through which traffic transits. Where data leaves the EEA, we rely on the European Commission's Standard Contractual Clauses (SCCs) and the providers' own transfer safeguards. See the sub-processor list for which providers this applies to.

How long we keep it¶

• Account and fitness data: until you delete your account, plus up to 30 days while it clears from backups.
• Server logs and error reports: up to 90 days.
• Billing records: as long as Norwegian tax law requires (currently 5 years).

Security¶

We use TLS for data in transit, access controls, and continuous error monitoring. No system is perfect; if we ever discover a breach affecting your data, we'll tell you and the relevant authority within the timeframes GDPR requires.

Your rights¶

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Correct anything that's wrong.
• Delete your account and the data attached to it.
• Export your data in a portable format (Art. 20). Most of this is available directly in the app.
• Withdraw consent for processing your health data, at any time, by disconnecting wearables, deleting the records you entered, revoking an app, or deleting your account.
• Object or restrict processing based on legitimate interests.
• Lodge a complaint with Datatilsynet (the Norwegian Data Protection Authority, datatilsynet.no) or your local supervisory authority if you think we're handling your data wrongly. We'd rather you tell us first so we can fix it, but the right is yours.

To exercise any of these, email [email protected].

Cookies¶

We use authentication cookies to keep you signed in. We don't use tracking or advertising cookies. If that ever changes, we'll update this section and ask for consent where required.

Children¶

SweatStack is for users 16 and older. We don't knowingly let anyone younger create an account of their own; if you believe a child under 16 has, email us and we'll remove it. A parent or guardian, or a coach with their permission, may manage an account for a younger athlete; see Accounts managed for you.

Changes to this policy¶

We'll update this policy when we need to. For a change that expands what we collect or how we use it, we'll notify account holders by email or in-app before it takes effect. Other changes, such as a new feature, clearer wording or a correction, take effect when we publish them. Every version stays available at its own address, with the date it took effect. The "Last updated" date at the top reflects the most recent change.

Contact¶

Sweatkraft AS Email: [email protected] Address: Laukelandsvegen 247, 6977 Bygstad, Norway