ownathlete is a coach. It keeps a record of your training so the coach can plan it. This page says what goes into that record, where it lives, who sees it, and how you take it back.
Who is responsible
ownathlete, Vilnius, Lithuania, KV Consult MB, Vilnius, Lithuania, trading as ownathlete, is responsible for your data. Write to hello@ownathlete.com for anything about it: to ask what is held, to have it corrected, or to have it deleted.
What is collected
- Your email address, for signing in, and the name you give yourself.
- What you tell the coach: messages, morning readings you type, screenshots you paste, events you enter, your answers on the first screen.
- Files you upload: ride files from a bike computer or watch, the figures inside them, and the exports you drop in from Strava or TrainingPeaks.
- Readings and files from a connection you make: heart rate variability, resting heart rate, sleep length and stages, breathing rate, skin temperature, blood oxygen, weight, and each session's file. The makers' own scores are not taken.
- What the coach writes: your plan, its account of each review, and its notes about you.
- Small things beside the record: the sign-in codes while they are good (10 minutes); the address you asked to start with, while it is waiting; the feedback you send from the app; the address of your phone's notification service if you switch notifications on; and the server's own log of requests, which holds the time, the path and the network address, never what was sent, and is kept for a short while for security.
There are no advertising trackers and no analytics. The site keeps one thing in your browser: the key that keeps you signed in, in the browser's memory and, for the images, workout files and export the browser fetches on its own, in a cookie the page's own code cannot read. Signing out removes both. The ride map is drawn from tiles your browser fetches from OpenFreeMap and, for satellite, Esri, which see your network address as any website does.
Health data
Most of the record is health data: your sleep, your heart, your weight, an illness you mention, a day your head is not in it. In the European Union that may be used only with your explicit consent, which you give with a tick on your first screen, before anything is read, and withdraw at any time with Delete everything. Without it the coach cannot coach you, which is why the tick is there.
The coach is a language model, from a provider we choose and may change. Each review sends your record to that provider's service and receives the plan back. Whichever provider it is, we use it only under terms under which it does not train its models on what we send, and it deletes what we send within the time those terms set. The provider may be outside the EU: your data leaves the EU only under the European Commission's standard contractual clauses or another safeguard the GDPR allows. Write to us and we tell you which provider runs the coach today, and send you a copy of the safeguard.
Where it lives
On a server in Helsinki, Finland, in the European Union, reached only over HTTPS. Connection tokens and keys for WHOOP, Oura, Polar, Suunto, Wahoo, Garmin and Intervals.icu are kept apart from your record, in files only the service can read, and are never shown in the app. A copy of everything is taken every night, encrypted before it is written with a key the server does not hold, and kept for 30 days on a Hetzner storage box in the EU; a record you delete is gone from the last copy within 30 days.
Who sees it
- You, and the coach, as above.
- A speech service, only when you talk to your coach. A voice message is turned into words by a speech service we choose and may change, under terms under which it does not train on what we send; it may be outside the EU, under the same safeguards as the coach. It is sent once, and the recording is not kept on our server; only the words you check and send reach your record.
- Resend, the service that sends the sign-in codes and the mail that your place is open, sees your address and the text of those mails, nothing else.
- Your phone's notification service (Apple, Google or Mozilla), if you switch notifications on, carries the coach's note to your phone; the text is encrypted so that the service cannot read it.
- The owner can see that your account exists, what its coaching costs to run, the addresses waiting to start, and the feedback sent from the app. He does not read your record unless you ask him to look at something.
Nobody else receives your data. It is not sold, shared or used for advertising, and a device maker's data is never passed on to anyone.
Connections
Each connection opens on the service's own page, where you sign in and allow it. Each one can be closed under More at any time; the record keeps what it already holds.
- WHOOP, Oura, Polar, Suunto and Wahoo: you sign in on their own pages and they hand the app scoped tokens. Wahoo also receives the sessions the coach plans for your week, so they appear on your ELEMNT. Polar gives only what it records after you connect.
- Intervals.icu: you sign in on its page, or paste an API key from your settings. The app reads each session's original file and the morning readings there, and writes the coach's planned sessions to your Intervals.icu calendar.
- Garmin, while Garmin's own connection is not open to the app: you sign in to your Garmin account inside the app. The sign-in goes to Garmin; your password is used once, in memory, and is never written anywhere. What is kept is the sign-in tokens Garmin returns, which reach your whole Garmin account and are guarded as such in a locked file beside your record. Disconnecting deletes them here; signing out of all devices in your Garmin account revokes them everywhere.
- Strava and TrainingPeaks: no connection; you drop in the export they give you.
- Apple Health, in the iPhone app: you switch it on in the app and choose, in Apple's own sheet, what it may read: workouts, sleep, heart rate variability, resting heart rate, breathing rate and weight; heart rate only for a workout's average and highest. The app reads it when you open it. You can turn any of it off in the iPhone's Settings.
Why we may
- Your consent, for the health data, given on your first screen.
- Running the service you asked for, for your address, your record and the connections you open.
- Keeping the service safe, for the request log and the limits on sign-in codes.
How long
Your record, until you delete it. Your waiting address, until it is approved or you ask for it to be removed. A sign-in code, 10 minutes. The request log, a short while. Feedback, until it has been read and acted on.
Your data is yours
- See and export: More, then Your data, gives you everything in the record as a file.
- Correct: your name and what you told the coach are yours to change in the app; write to us for anything else.
- Delete: More, then Delete everything, removes your record, your files and your connections from the server at once. Nothing is kept.
- Withdraw consent: the same button.
- Complain: to us first, and to the Lithuanian State Data Protection Inspectorate, vdai.lrv.lt, at any time.
Eighteen or older
ownathlete is for adults. If an account turns out to belong to someone younger, it is deleted.
Changes
If this page changes in a way that matters, we email you before the change and say what it is.