ForbedrBuild my plan

Forbedr Privacy Policy

Effective date: 2026-08-08

Forbedr ("we", "us") is an endurance-coaching service operated by Martin Kotouč Šourek, a self-employed sole trader (OSVČ) registered in the Czech Republic, Gen. Peřiny 1292/4, 393 01 Hustopeče, Czech Republic. Martin Kotouč Šourek is the data controller for personal data processed through Forbedr. This policy explains what data we collect, how it's used, and how it's protected. Forbedr is a "bring your own AI" product: you connect your own AI assistant (e.g. Claude, ChatGPT, Gemini) to our server, and that assistant does the coaching conversation. Because of that, this policy also explains what your AI provider sees.

What we collect

wellness metrics (resting heart rate, HRV, sleep, weight), and your training calendar. Read access only unless you've explicitly enabled a write-back feature (e.g. pushing planned workouts), which we'll always ask before enabling.

race date, training history, preferences, injuries/limitations you tell your coach about, to-do and check-in responses.

If you connect intervals.icu via API key, that key is encrypted at rest (AES-256-GCM) and never logged or exposed in error messages.

  • Training data from intervals.icu, if you connect your account: completed activities,
  • Coaching profile, built from your onboarding conversation and ongoing check-ins: goals,
  • Account credentials: username and a hashed password (we never store plaintext passwords).

We do not collect data beyond what's needed to run the coaching workflow. No ad trackers, no data brokers, no sale of your data to third parties — ever.

How your data is used

Your coaching profile and training data are used to power the tools your connected AI assistant calls (e.g. "get today's readout," "build a training plan"). Because you bring your own AI, the relevant subset of your data is sent to whichever AI provider you've connected (Anthropic, OpenAI, Google, etc.) to generate the actual coaching conversation — that provider's own privacy policy governs what happens to data once it reaches them. We send only what's needed to answer the specific request being made, not your full history in bulk.

Legal basis and retention (GDPR)

We process your data on the basis of performing our contract with you (running the coaching service you signed up for) and, for account security and abuse prevention, our legitimate interest. We keep your data for as long as your account is active, and delete it on account closure per "Your controls" and "Your rights" below — we don't keep data around after that for any secondary use.

Cookies

Forbedr sets exactly one cookie: a session cookie, required to keep you signed in. It's strictly necessary for the service to function, carries no tracking or advertising purpose, and under GDPR/ePrivacy rules doesn't require a consent banner. We use no analytics, advertising, or third-party tracking cookies.

Your rights (GDPR)

If you're in the EU/EEA (or anywhere GDPR-equivalent protections apply), you have the right to: access the personal data we hold about you, rectify it if it's inaccurate, erase it, restrict or object to certain processing, and receive a copy of your data in a portable format. Contact us (below) to exercise any of these — see "Your controls" for the concrete deletion path. You also have the right to lodge a complaint with your local data protection authority; for Czech Republic residents, that's the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.cz).

Storage and isolation

All data lives in a database with per-user row-level isolation — one user's data is never readable by another user's session, enforced at the database layer, not just in application code. Backups are encrypted.

Your controls

You can disconnect intervals.icu, edit or delete facts your coach has recorded, and request full account deletion at any time by contacting us (below). Deletion removes your training data, coaching profile, and credentials from our systems.

Security

Passwords are hashed, not stored in plaintext. API keys/OAuth tokens are encrypted at rest. Traffic to and from Forbedr is encrypted in transit (HTTPS). We do not access your data except to operate or debug the service, and never to build ad profiles.

Changes to this policy

We'll update the effective date above and note material changes if this policy changes.

Contact

Questions or deletion requests: [email protected]