PRIVACY POLICY

Effective: 2026-02-22 · Updated: 2026-10-11 (adds page-speed measurements from a sample of visits, through Vercel Speed Insights)

THE SHORT VERSION

→What we collect: your account details, what you type and attach, the workouts and plans you build, and — only if you allow it in Garmin Connect — your Garmin activities.
→Why: to build your workouts, coach you, send workouts to your Garmin device, bill you if you subscribe, and keep the service safe and working.
→Who sees it: a short list of providers that run parts of the service for us, including OpenAI for the AI — and, only if you connect them, AI apps such as ChatGPT or Claude (AI apps you connect). We never sell your data or use it for advertising.
→How long: most of it until you delete it or your account; a few things for a fixed period (see the table).
→Your choices: delete your activity data, your coach conversation or your whole account in Settings, stop emails with one click, and turn Garmin sharing on or off in Garmin Connect.

1) WHO WE ARE

Fit File Forge is run by Forge Labs LLC, a company in Washington State, USA. We decide how your personal data is used (we are its “controller”). People covered by Washington's My Health My Data Act should also read our Consumer Health Data Privacy Policy. This policy covers the website, the app and the services behind them. Questions go to privacy@fitfileforge.com.

2) GARMIN DATA

Direct link: fitfileforge.com/privacy#garmin-data · everything about Garmin data in one place

→What we receive. When you connect Garmin Connect™, your Garmin user ID and the access tokens that let us send workouts to your account. Only if you allow “Activities” on Garmin's consent screen, Garmin also sends us the activities your devices record: a summary of each, and where your device records them, detailed samples such as heart rate, pace, power, cadence, route and elevation, plus laps. When you first allow it we also ask for your previous 30 days, the most Garmin allows.
→What we never request. Garmin health or wellness data (steps, sleep, stress, Body Battery™, all-day heart rate, HRV), or anything from your Garmin profile beyond your user ID.
→How we use it. To show you your own activities and training metrics (zones, training load, fitness and form, best efforts, estimated thresholds), and to let your coach take your recent training into account (see AI). Screens that show Garmin data say which Garmin device it came from.
→Who else sees it. For our own coach, OpenAI receives short text summaries when your coach needs them — never raw samples, GPS coordinates, your Garmin user ID or tokens. If you connect an AI app such as ChatGPT or Claude, it receives the activity data you allow when you connect it, and only that (AI apps you connect). When you view a route, your browser loads the background map from CARTO, which sees the map area and your IP address but not your route. Our hosting and database providers store it. We never sell or license Garmin data, never use it for advertising, and it never goes to analytics.
→You control sharing in Garmin Connect. Turn “Activities” on or off for Fit File Forge in Garmin Connect (Settings → Connected Apps). We follow that permission, check it daily, and store nothing new while it is off.
→Your history stays until you delete it. Turning sharing off, disconnecting Garmin, or removing Fit File Forge from your Garmin account stops new activities arriving and keeps the ones you already have, so you never lose your training record by pausing the connection. Your activities, and everything we worked out from them, are deleted when you choose “Delete my activity data” in Settings → Data & Account, or delete your account — and only then.
→Workouts we send, and Tidy my watch. Workouts you send go to your Garmin Connect account through Garmin's Training API; once there, Garmin controls that copy. With “Tidy my watch” on (Settings → Garmin Connect; on unless you turn it off), we ask Garmin to remove planned workouts we sent 3 days after the day they were planned for, so your watch doesn't fill up. They stay in your Vault, where you can send them again, and your recorded activities are not affected.
→Changes. Any change to how we handle Garmin data appears here, with the date at the top of this page, before it takes effect, and we tell Garmin as our developer agreement requires.

3) AI TRANSPARENCY STATEMENT

Direct link: fitfileforge.com/privacy#ai · how Fit File Forge uses artificial intelligence

→Where AI is used. Fit File Forge is built on large language models from OpenAI. They turn your descriptions into structured workouts, power your coach (planning, answering questions, looking things up on the web), read files you attach, and draft the weekly plan email.
→What we send to OpenAI. What you type and attach, the Athlete Profile values you entered (such as max heart rate or threshold pace), and the context your coach needs to answer — for example your goals, upcoming workouts, coach notes and plan. If Garmin is sharing your activities with us, we also send your current training status and short text summaries of your activities (Garmin data). We never send your email address, your Garmin user ID or tokens, GPS coordinates or raw activity samples.
→Web search. Your coach can search the web through OpenAI, for example for a race date or the weather. Searches are written from your conversation and never include your name, email or account details.
→What OpenAI does with it. For our own coach and workout builder, OpenAI processes each request and returns a response. OpenAI does not use data sent through its API to train its models. (AI apps you connect yourself work differently — see below.)
→In the background. If you get the weekly plan email, your coach reviews your week and drafts the next one without you asking. Turn it off in Settings → Email.
→You stay in control. Your coach keeps one conversation with you and short notes you can see, edit and delete. It checks with you before bigger changes, such as sending a whole week to Garmin. To keep your Garmin data out of it, turn off the “Activities” permission in Garmin Connect; workouts and plans still work.
→No decisions about you. AI is never used to make decisions with legal or similarly significant effects on you.
→AI can be wrong. Workouts, plans and advice are suggestions, not medical or professional advice. Check them before you train.
→AI apps you connect (ChatGPT, Claude). You can connect Fit File Forge to an AI app you use, such as ChatGPT (OpenAI) or Claude (Anthropic). Nothing is shared until you connect the app, sign in and agree to share. When you connect, you see what it may see and do, each ticked to start with and yours to untick (except your profile): your profile and plan; your activity summaries, laps, splits and the metrics we compute; detailed time series of heart rate, pace, power, cadence and elevation; your planned workouts; and building, scheduling and sending workouts. It never receives your location or routes, the original activity files, your Garmin user ID or tokens, or health data such as sleep or HRV (we don't collect it). Once data is in your chat, the AI app's own terms and your settings there apply — which may include using it to improve their models — and we can't delete those copies. Disconnect at any time in Settings → Connected Apps or in the app; that stops new sharing at once. Settings also shows what each connected app did and when.

4) WHAT WE COLLECT

→Account — your name and email; with Google sign-in, your Google account ID and profile picture; with a password, a secure hash of it (never the password itself).
→What you create — the workouts you describe and build, your Vault, your coach conversation, goals and notes, files you attach, your Athlete Profile, and feedback you send us.
→Garmin — see Garmin data.
→Plan and billing — your plan, trial dates and usage counts (such as workouts built and coach messages sent). Card details go to our payment provider, never to us.
→How you use the app — which features you use and when, the days you open the app, your time zone, cookie-free analytics events (such as “workout built”) that don't contain what you typed, and how quickly pages load for a sample of visits.
→How you found us — such as the website that sent you, the page you landed on and the links you followed to sign up, saved with your account if you sign up (see Cookies).
→Abuse prevention — we keep one-way hashes of IP addresses (never the addresses themselves) for up to 30 days, only to prevent abuse such as mass sign-ups or automated use. To rate-limit requests we also keep short-lived counters keyed by the same kind of hash, deleted within a week.
→Technical data — our hosting provider records IP addresses, device and browser details and errors to keep the service working.
→Without an account — if you build a workout before signing up, what you typed goes to OpenAI to build it and the result is kept in your browser so you can save it when you sign up.

5) HOW WE USE IT, AND WHY WE'RE ALLOWED TO

What we do	Legal basis (where the law asks for one)
Run your account and the features you ask for: build workouts, coach you, send to Garmin, store your Vault, bill your subscription	Performing our contract with you
Receive and analyse your Garmin activities	Your consent, given and withdrawn in Garmin Connect
Share your training data with an AI app you connect (ChatGPT, Claude)	Your explicit consent, given when you connect the app and withdrawn by disconnecting it
Keep the service secure, prevent abuse, fix problems, and understand which features help people	Our legitimate interests in a safe, working, improving service
Remember how you found us	Your consent in the EEA, UK and Switzerland; our legitimate interests elsewhere
Send product news, trial reminders and the weekly plan email	Our legitimate interests, or your consent where the law requires it; stop them any time
Account, security and billing emails	Performing our contract with you
Keep records the law requires and respond to lawful requests	Legal obligation

Our team can see account data when it's needed to support you or investigate a problem or abuse; that access is limited and logged.

6) WHO WE SHARE IT WITH

These providers process data for us, only to run the parts of the service listed. We don't sell personal data, share it for targeted advertising, or give it to data brokers or social networks.

Provider	What it does for us
OpenAI (US)	AI models for workouts, your coach, web search and reading attached files (see AI)
Vercel (US)	Hosts the website and app, stores attached files, operational logs, cookie-free web analytics and page-speed measurements
Neon (US)	Our database
Lemon Squeezy LLC / Link, a Stripe company (US)	Merchant of record: takes payments, sends receipts and invoices, handles sales tax and payment support
Resend (US)	Sends our emails
Google	Sign-in with Google, if you choose it
Garmin	Receives the workouts you send; sends us your activities if you allow it
CARTO	Map backgrounds your browser loads when you view a route

AI apps you connect (ChatGPT from OpenAI, Claude from Anthropic) are not our providers: they receive data only when you connect them and choose to share, and they handle it under their own terms and privacy policies (details). We may also disclose data if the law requires it, to protect people's safety or our rights, or as part of a merger or sale of the business (we'd tell you first). Workouts you choose to share are public at their link; the shared page doesn't show who you are.

7) HOW LONG WE KEEP IT

Data	Kept
Your account and Athlete Profile	Until you delete your account (or change your profile)
Workouts in your Vault	Until you delete them or your account
Coach conversation, goals, notes and weekly plan notes	Until you clear them (Settings → Data & Account) or delete your account; you can delete single notes in the app
Files you attach	90 days after you attach them, from our storage and from OpenAI, or sooner if you clear your coach conversation or delete your account; files never sent are deleted within a day. A one-line summary of each stays in your conversation until you clear it
Garmin connection (tokens)	Until you disconnect, Garmin tells us access ended, or the connection expires
AI app connections (ChatGPT, Claude) and the access we issue to them	Until you disconnect the app or delete your account; an app's access lasts an hour at a time and its sign-in up to 90 days unused
Record of what each connected AI app did (which tool, when, whether it worked — never what was asked or returned)	90 days
Garmin activities and metrics from them	Until you delete them (Settings → Data & Account) or your account — not when sharing stops
Records of our requests to Garmin and of Garmin's notifications	30 days
Plan, trial and usage records	Until you delete your account; Link keeps its own payment records as tax law requires
How you found us	30 days in the cookie; with your account until you delete it
Hashed IP addresses / rate-limit counters	Up to 30 days / within a week
Feedback you send, and records of builds that failed or were refused (which can include an excerpt of what you typed)	Kept to improve the service; no longer linked to you once you delete your account
Technical logs	A short period, under our hosting provider's retention settings

Deleting your account removes your account and the data linked to it, apart from the unlinked records above.

8) SECURITY

Everything travels over HTTPS. Data is stored encrypted at rest, Garmin tokens are additionally encrypted by us, passwords are hashed, and attached files are stored privately so only our servers can open them. Access is limited to what each part of the service needs. No system is perfectly secure; if a breach affects you, we'll tell you and the authorities as the law requires.

9) COOKIES AND LOCAL STORAGE

→Essential — keep you signed in, and secure the few minutes it takes to connect Garmin.
→Functional — remember your time zone, your cookie choice and a few display settings, such as which version of Forge to open. Your browser also keeps a workout you built before signing up, so it can be saved to your new account.
→How you found us — one first-party cookie, kept 30 days, notes how you found us, such as the website that sent you and the links you followed. If you visit from the EEA, the UK or Switzerland (or we can't tell where you are), we set it only after you choose Accept on the cookie bar, never if you choose Decline. You can at any time.
→No advertising or tracking cookies — we set no advertising, social media or third-party analytics cookies. Our analytics (Vercel Web Analytics and Speed Insights) is cookie-free.

10) YOUR CHOICES AND RIGHTS

→In Settings → Data & Account: delete your activity data, clear your coach conversation (with its goals, notes and attached files), or delete your account.
→Emails: product news is on unless you untick it at sign-up; turn it, trial reminders or the weekly plan email off in Settings → Email or with the one-click link in each email. Account, security and billing emails still arrive.
→Garmin: turn activity sharing on or off in Garmin Connect, disconnect Garmin in Settings, and turn Tidy my watch on or off in Settings → Garmin Connect.
→AI apps: see and disconnect each connected app (ChatGPT, Claude) in Settings → Connected Apps, or disconnect it in the app. To change what an app may do, disconnect and connect it again.
→Your rights: depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict how we use it, and withdraw consent at any time. Email privacy@fitfileforge.com; we'll verify it's you and reply within a month. If you're in the EEA, UK or Switzerland you can also complain to your data protection authority.
→US state privacy rights: we don't sell personal data or share it for targeted advertising, and we won't treat you differently for using your rights.

11) WHERE YOUR DATA IS PROCESSED

We and most of our providers are in the United States, so if you use Fit File Forge from elsewhere your data is processed in the US, and requests may pass through other regions on the way. Wherever it is processed, the same protections described here apply.

12) CHILDREN

Fit File Forge is for people aged 16 and over. If we learn that someone younger has an account, we'll delete it and its data.

13) CHANGES TO THIS POLICY

When this policy changes, we update it here with a new date. If a change matters to how your data is used, we'll tell you by email or in the app before it takes effect.

14) CONTACT

Forge Labs LLC, Washington State, USA · privacy@fitfileforge.com