Privacy Policy

Data controller

The controller of your personal data is Michał Jankowski, an entrepreneur trading as Michał Jankowski Miart, ul. Wesoła 11, 82-500 Kwidzyn, Poland, tax ID (NIP) 5811841807 (“we”, “us”). We run the AthSpace app and the athspace.com website.

For any matter concerning your data, write to [email protected] or to the postal address above. We have not appointed a data protection officer.

This policy covers App users, visitors to the Website and public profile pages, and people whose data we obtain from other sources, e.g. race participants whose results we show. Terms defined in the Terms of Service have the same meaning in this policy.

Account and sign-in

We collect your first and last name, email address, phone number and password (we store only its hash), and when you sign in with Google or Apple, the account identifier and email address from the provider. We record sign-in sessions with the IP address and a description of the browser or app (user agent), and your mobile devices: installation identifier, model name, operating system and push notification token. We also record which version of the Terms of Service you accepted and when, with the IP address and a description of the device.

Purpose: creating and running your account, confirming your email and phone, signing you in and protecting your account from takeover. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in security (Art. 6(1)(f) GDPR).

Profile

We collect the data you provide in your profile: profile name and address, profile and cover photos, description, date of birth, gender, country and town, sports with level and experience, and interests. Date of birth and gender are required for personal profiles because age categories, result matching and heart rate zones depend on them.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR). What others see depends on your privacy settings — described below.

Activities and health data

From connected devices we store activities: time, distance, speed, elevation, calories, GPS route, heart rate recording, power, cadence, laps, strength sets with weights and the device name. When you add an activity manually, we store what you enter, optionally including average and maximum heart rate. We also keep the original workout file (FIT) so we can recalculate the activity. From the route we create a map and a place name, and from heart rate and date of birth — heart rate zones, training load and form in reports.

Heart rate and the indicators calculated from it may be health data. We process them based on your explicit consent (Art. 9(2)(a) GDPR), which you give by accepting the Terms of Service (section “Heart rate and calculations”), as well as by connecting a device and approving the data transfer on the device maker’s consent screen. You can hide your heart rate from other users at any time. You can withdraw consent at any time by writing to [email protected] or by disconnecting the device and deleting activities with heart rate; this does not affect the lawfulness of earlier processing. We process other activity data to perform the contract (Art. 6(1)(b) GDPR).

We do not collect all-day measurements from devices, such as sleep, stress or resting heart rate.

Your race results

When you confirm your results, we link a results profile to your profile: the name from the results list, nationality, club, category, positions, times and splits. To suggest results, we compare your name, date of birth, country, town and sports with results lists, also with the help of an AI model.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR). You can turn off suggestions in privacy settings and hide or detach confirmed results.

Community and public page

We process the Content you publish (posts, photos, videos, comments, reactions, questions and threads in Zones), follow relationships, team and group membership, invitations and roles. You can add a location to a post; the place name is then determined by your phone’s operating system.

If you have PRO, you can turn on a public page at athspace.com/your-name. It shows what you choose: description, results, activities, partners, media and a contact form. An athlete or team profile with the page and search turned on also appears in the directory on the Website (name, photo, country, sports).

Your conversation with the page Creator is processed by an external AI model to suggest changes to the page. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

The Chiron assistant

If you turn on Chiron, we process your messages and its replies, remembered facts (including about health, e.g. an injury), its summary of you and your settings. For each reply we send the AI model your first name, age, gender, sports, activities from the last 60 days, training load and form, goals and upcoming races, recent messages and remembered facts.

Legal basis: your explicit consent given in the App (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You withdraw it by turning Chiron off; you can clear its memory and conversation in the App. Health facts are deleted automatically after 30 days.

Payments

You pay for PRO and Zone subscriptions in the App Store or Google Play. The store processes your payment data as a separate controller; we do not know your card number. From the store and from RevenueCat we receive subscription information: product, store, status, periods, amounts and transaction identifiers. In RevenueCat you are identified by a random identifier, not your email address. You can also pay for a Zone subscription by card through Stripe — then Stripe processes the card details and billing address, and we receive the payment status, amount, country and VAT rate.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and tax and accounting obligations (Art. 6(1)(c) GDPR).

Subs Zone creators

If you run a paid Zone, we collect the data needed for payouts and taxes: your name or company name, email address, date of birth, address, country of tax residence, tax identification number, VAT number, bank account number with its change history, and identity documents passed on for verification. We record your acceptance of the creator agreement with the IP address and a description of the device.

The payout account and identity verification are run by Stripe, which also processes this data as a separate controller, including to prevent money laundering. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legal obligations, including tax and platform operator reporting obligations (Art. 6(1)(c) GDPR).

Waitlist, feedback and notifications

When you join the waitlist we collect your email address (optionally a phone number), language and request status. We send a confirmation link and later an invitation; we do not send a newsletter. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Feedback from the in-app feedback screen is stored with its text, up to 3 screenshots, the App version, operating system and language. Legal basis: our legitimate interest in developing and fixing AthSpace (Art. 6(1)(f) GDPR). Do not include other people’s data in screenshots.

We send push and email notifications according to your settings; push is on by default and email is off. Messages needed for the service to work (codes, invitations, account security) are always sent. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Security and abuse prevention

We process IP addresses and technical request data to protect AthSpace against attacks and spam, apply limits (e.g. on the number of contact form messages) and investigate failures. We also record actions taken by AthSpace staff on user accounts. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR).

Reports, moderation and blocks

When you report content, we store the report (reason, description, date) and a copy of the reported content: text and up to 4 images. We do not tell the author who reported the content, unless the law requires it. To assess a case, an AI model receives the reported content with images, all reports in the case, the history of earlier decisions concerning the author’s account and the author’s language. The decision is made by a person, and we inform the author of it with the reasons.

Legal basis: the obligations of a hosting service provider under the Digital Services Act (Art. 6(1)(c) GDPR) and our legitimate interest in protecting users from illegal content (Art. 6(1)(f) GDPR). We delete image copies 180 days after the decision. We keep case records (identifiers, the decision and its reasons, without contact details) until the limitation period for claims expires, also after account deletion, so that we can show the grounds for the decision (Art. 6(1)(f) GDPR).

We store blocks as a pair of accounts with the date and the profile the block was made from. They make sure the blocked account does not see you and you do not see it. We keep them until you unblock or delete your account. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Data of people without an account

Race results. We collect results from publicly available race results websites published by organisers and timing companies. We process name, gender, nationality, country and town, club, bib number, category, positions, times, splits and finish status. We show them in event rankings in the App and suggest matches to people who create an account. Legal basis: our legitimate interest in running a sports results service (Art. 6(1)(f) GDPR).

We do not inform each race participant individually because this would involve a disproportionate effort (Art. 14(5)(b) GDPR) — this policy is the public information about this processing. You can object at any time: write to [email protected] and identify the result concerned.

Invitations. If someone invites you to AthSpace, we process your email address or phone number to send the invitation. Legal basis: our legitimate interest and that of the person inviting you (Art. 6(1)(f) GDPR). The invitation expires after 14 days.

Contact form on a public page. We store your name, email address, subject and message to pass them to the page owner, who may reply to you. We use your IP address for anti-spam limits and do not store it with the message. Legal basis: our legitimate interest in handling contact (Art. 6(1)(f) GDPR).

People shown in other users’ Content. The author of the Content is responsible for publishing it. If something infringes your rights, write to [email protected].

What others see

An athlete profile is public by default: other users see its name, photo and basic information. You can make your profile private — then only approved followers see your Content. An observer profile is always private, and a team profile is always public.

You choose the visibility of each activity, post and report element separately: only you, Zone subscribers, followers or everyone. New activities get the visibility from your default settings, and training load, form and heart rate zones in reports are visible only to you by default. A race result appears on your profile only after you confirm it, and you can change its visibility there; in the event ranking it is visible as on the public results list.

Your public page and directory data are visible to everyone on the internet, including search engines. You can turn off search in AthSpace and your presence in the directory in privacy settings (“Appear in search”).

Who we entrust data to

We use providers who process data on our behalf under data processing agreements: OVH (application and database servers), Amazon Web Services (file storage, queues, email delivery and backups in the Frankfurt region, with files delivered through the CloudFront network), Cloudflare (content delivery, connection encryption and attack protection), Twilio (text messages with codes), Expo (push notification delivery through Google Firebase Cloud Messaging and Apple Push Notification Service), Mapbox (route maps and place names from coordinates), Stridee (intermediary for connecting device makers’ accounts), RevenueCat (store subscription handling) and Stripe (payments outside the stores).

Chiron’s replies, conversations with the page Creator, profile descriptions, goal stages, result matching and the initial assessment of reported content are generated by language models made available through OpenRouter. We route requests only to model providers that declare they do not collect the data sent, including for model training.

We pass data to, or receive it from, the following as separate controllers: Apple and Google (stores, sign-in, system notifications), Stripe (payout accounts and creator identity verification), device makers you connect your account with, and public authorities where required by law. Data may also be received by providers of accounting and legal services to us.

We do not sell personal data and do not share it with advertisers.

Transfers outside the European Economic Area

We store activities, including heart rate, only in the European Economic Area (OVH and Amazon Web Services servers in Frankfurt). If you turn on Chiron, training data, including training load and form calculated from heart rate, also goes to the AI model described above.

Some providers (including Cloudflare, Twilio, Expo, Mapbox, OpenRouter, RevenueCat, Stripe, Apple and Google) are based in or process data in the United States or other countries outside the EEA. We transfer data only on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework for certified companies) or standard contractual clauses approved by the Commission. You can get a copy of the safeguards by writing to us.

How long we keep data

Account and profile data — until you delete your account. What happens to data after account deletion is described in the next section.

Activities and Content — until you delete them or your account. Public page versions — 30 days, except the version shown on the page. Notifications — 90 days. Chiron conversation and memory — until you clear them or delete your account; health facts — 30 days.

Payment and settlement data, including creator data needed for taxes and proof of acceptance of the creator agreement — 5 years from the end of the financial year they relate to (Polish Accounting Act, Tax Ordinance), and longer if required by platform operator reporting rules.

Records of accepting the terms and agreements (version, date, IP address and device description) — until the limitation period for claims expires, and for creator agreements for the period stated above for settlement data. They are kept after account deletion as well.

Waitlist entries — until you create an account, at the latest until the end of the closed beta, or sooner if you ask for deletion. Invitations — up to 12 months from sending. Contact form messages — up to 12 months or until the page owner’s account is deleted. In-app feedback — up to 24 months.

Race results of people without an account — as long as the event is in AthSpace or until an objection is upheld. Security data (sessions, IP addresses, staff action log) — up to 12 months, and longer only when needed to investigate abuse or pursue claims, until the claims expire.

We do not clean backups and technical logs selectively: data disappears from them as they rotate — from backups after 30 days, from logs when newer entries overwrite them.

Account deletion

Once you confirm deletion, your account is blocked and your profiles and public page disappear for others immediately. We keep the data for another 30 days so that the account can be restored after a mistake or if it was deleted by someone who gained access — this is our legitimate interest in account security (Art. 6(1)(f) and Art. 32 GDPR). During this time we send no notifications from or to the account, and workouts from connected devices are still saved to it. After 30 days we delete the remaining data, including Subs Zone content, with the exceptions described in this section. Copies of pages in external search engines disappear according to those search engines’ rules.

Contributions and reactions in other people’s conversations (comments, Sup! reactions, likes, and threads and replies in other creators’ Zones) stay under the label “Deleted account”, without your name, photo or a link to your profile. Legal basis: the legitimate interest of the other participants in keeping conversations continuous (Art. 6(1)(f) GDPR). The cover of an event you created also stays with the event. At your request we will remove such contributions or the cover; as we no longer have a link to your account, please send links to the specific contributions or describe them, together with a statement that you are their author.

For 12 months we keep a cryptographic hash of the email address and phone number of a deleted account — not the address or number itself, and with no link to a profile or contributions. It is used solely to limit abuse through repeatedly creating and deleting accounts. Legal basis: our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

Settlement data (payments, ledgers, settlements and payouts), and for creators also verification data needed for taxes and proof of acceptance of the creator agreement (IP address and device description), stay linked to the profile identifier, without contact details, for the period stated above. Legal basis: legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR); for these reasons we do not erase them on request (Art. 17(3)(b) and (e) GDPR) and restrict their processing to these purposes.

We inform the recipients we passed your data to (including Stridee, Stripe and RevenueCat) about the deletion; Stripe keeps some creator data as a separate controller.

The log of completed deletion requests contains identifiers, for 30 days after permanent deletion also a masked email address and phone number (e.g. j•••@gmail.com) so that we can answer questions about the deletion, and, when we delete an account at your request, the reason for it. We keep it as proof that the request was carried out (Art. 6(1)(c) in conjunction with Art. 5(2) GDPR) until the limitation period for claims expires.

Your rights

You have the right to access your data and receive a copy, to rectification, erasure, restriction of processing and portability of data processed under a contract or consent, and to withdraw consent at any time.

You also have the right to object at any time to the processing of your data based on our legitimate interest (Art. 21 GDPR) — write to [email protected].

You can do much of this yourself in the App: correct your profile, change visibility, delete activities and Content, disconnect a device, turn off Chiron or delete your account. For anything else, such as a copy of your data, write to [email protected]. We will reply within one month; in complex cases we may extend this by two months and will let you know. We may ask you to confirm your identity.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in your country.

Children and teenagers

AthSpace is for people aged 13 and over. If you are under 16, a parent or guardian gives or approves consent to data processing, including health data from workouts. Chiron is available from age 16. If we learn that an account was created by someone under 13, we will delete it.

Automated processing and AI

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. AI models help suggest result matches, descriptions and replies, but you decide what appears on your profile. An AI model also pre-assesses reported content, but the decision is always made by a person. Training load, form and heart rate zones in reports are calculated automatically for your information only.

Data security

We encrypt connections (HTTPS) and store passwords as hashes. We make regular backups and limit access to our systems to people who need it.

Changes to this policy

We update this policy when the way we process data changes, e.g. when we add a provider or a feature. We announce significant changes in the App or by email. The current version is always on this page with its effective date.