Privacy Policy

1. Who we are

PaceSense is a product developed and operated by AthleteConnect AI S.R.L. in Chișinău, Republic of Moldova. Radu Tataru is the accountable product and privacy owner. For privacy questions, consent withdrawal, access, or deletion requests, contact contact@athleteconnect.ai.

2. Scope and current status

This policy covers the PaceSense website, synthetic beta, Telegram and verified-email briefing delivery, settings service and authenticated AI-assistant connections. Production Garmin and TrainingPeaks connections are not yet generally available. We will review this policy before enabling real provider data and update it when approved integrations, processors or contractual conditions change.

3. Information we process

When you browse the website, our hosting and security providers may process technical information such as IP address, browser and device details, requested pages, timestamps, and diagnostic events.

If you register your interest in the private beta, we collect the email address you provide and the time of your consent. This does not create an account, connect a training platform, or subscribe you to commercial messages.

When you use the synthetic beta, or later choose to connect approved production accounts, we may process:

• account identifiers, timezone, briefing time, preferences, subscription status, and consent records;
• OAuth access and refresh tokens for connected services, stored in encrypted form;
• the athlete profile, training zones, recovery signals, planned and completed workouts, workout details, and metrics you authorize;
• subjective check-ins, questions, feedback, generated briefings, recommendation reason codes, and workout analyses;
• a Telegram account identifier or verified email address, delivery status, and notification preferences;
• support communications, security events, and operational records needed to protect and maintain the service.

We will not ask for or store your Garmin, TrainingPeaks, ChatGPT, Claude, Telegram, or email password.

4. Why and on what basis we process information

We process information to respond to private-beta interest, provide the functions you request, connect authorized accounts, generate and deliver briefings, continue an analysis in your selected AI assistant, manage a subscription, secure the service, provide support, prevent abuse, and comply with applicable law.

Depending on the context and applicable law, processing is based on your explicit consent, performance of the service you request, our legitimate interest in operating a secure service, or a legal obligation. Provider and AI processing will not begin until the required consent and authorization steps are completed.

5. Your choices and consent

Provider access, AI processing, and proactive delivery are separate choices. You can choose Telegram or email, select ChatGPT or Claude as a conversation destination, change your schedule, disable notifications, disconnect a provider, disconnect an AI destination, or withdraw consent.

Withdrawing consent or disconnecting a service stops future retrieval or processing through that connection. You can also request deletion of retained PaceSense data. Disconnecting PaceSense does not delete data held independently by Garmin, TrainingPeaks, Telegram, your email provider, OpenAI, or Anthropic.

6. Read-only provider access

The initial product is designed for read-only access. It will not create, edit, or delete workouts, calendars, zones, metrics, or other source-platform data. We use the source platform's approved authorization mechanism and request only the scopes needed for enabled features.

7. Automated analysis and training guidance

PaceSense compares permitted signals with personal reference values and applies inspectable rules to produce guidance such as proceed, adapt, reconsider, or insufficient data. The output may be incomplete, delayed, or inaccurate and is not a medical diagnosis or a guarantee that exercise is safe.

Significant decisions about your health or training should not be based solely on automated output. Concerning symptoms or pain should be discussed with an appropriate healthcare professional or qualified coach.

8. Service providers and data recipients

Depending on your choices and approved product availability, data may be processed by:

• Garmin or TrainingPeaks only after the relevant production integration is approved and you authorize it;
• OpenAI when you choose ChatGPT, or Anthropic when you choose Claude;
• Telegram when you select Telegram delivery, or Resend and the receiving mailbox provider when you select verified-email delivery;
• Auth0 for account authentication, Cloudflare for the website, and Render for the backend service and database;
• additional monitoring, payment, or customer-support providers only when introduced and disclosed for an enabled function.

No payment processor is connected to the current synthetic beta. We share only the information needed for the selected function. We do not sell personal or training data, use it for targeted advertising, or share it with unrelated parties.

9. Notifications and continuation links

Telegram or email messages may contain the briefing information required to make the notification useful. You choose the channel and can disable proactive delivery. Email messages will include a way to manage or stop non-essential notifications.

A contextual action may open the selected ChatGPT or Claude conversation. PaceSense keeps a minimal owner-scoped context envelope on the server and verifies identity, authorization, consent version and access entitlement before returning the relevant briefing or session context. Sleep, heart-rate, workout, recommendation, provider-token and other athlete values are not placed in the destination URL.

10. Retention

Private-beta interest email addresses and their consent records are retained for up to six months, or deleted earlier if you withdraw your interest. They are used only to contact you about the PaceSense beta and are not added to a newsletter or unrelated marketing list.

We minimize storage and follow the requirements of each approved source platform. Raw provider responses are not stored durably. Where a temporary retry buffer is necessary, they are deleted within 24 hours, or sooner when required by the provider. Subject to any shorter provider requirement, normalized health and activity summaries are retained for up to 90 days; generated briefings and recommendations for up to 30 days; latest AI context for up to 7 days or until replaced or invalidated; delivery logs without health content for up to 30 days; minimal consent/audit evidence for up to 24 months; and encrypted backups for up to 30 days.

Before real-provider launch, automated deletion and backup-restore deletion replay will be verified, and account controls will show the applicable periods. After a valid deletion request, active data will be deleted or de-identified unless limited retention is required for security, legal, billing, dispute, or backup purposes.

11. Security

We design the service around HTTPS, encryption for stored provider tokens, secret redaction, least-privilege permissions, user-level data isolation, access controls, rate limits, audit events, and incident response. Provider credentials and access tokens are not sent to notification channels or AI assistants.

No online service can guarantee absolute security. If we confirm a personal-data incident, we will contain and investigate it and notify affected users, partners, or authorities when required.

12. Your rights

Subject to applicable law, you may ask to access, correct, delete, restrict, or export your personal information, object to certain processing, or withdraw consent. Email contact@athleteconnect.ai. We may need to verify your identity before fulfilling a request.

13. International processing

PaceSense is operated from Moldova, and connected services or processors may handle information in other countries. Where required, we will use appropriate contractual and organizational safeguards and complete provider-specific requirements for international transfers.

14. Children

The service is not directed to children under 16, and we do not knowingly collect their personal information. Contact us if you believe a child has provided information to the service.

15. Changes

We may update this policy as the product, approved integrations, or legal requirements develop. We will identify the effective date and version and provide additional notice when a material change requires it.