Privacy Policy

1. Data Controller

2. Data We Collect

2.1 Registration Data (Required)

Data Type	Purpose	Legal Basis	Retention
Email address	Account creation, authentication, communication	Contract performance (Art. 6(1)(b))	Account lifetime + 2 years
Username	Account identification, platform functionality	Contract performance (Art. 6(1)(b))	Account lifetime + 2 years
Year of birth	Age verification, personalized training	Contract performance (Art. 6(1)(b))	Account lifetime + 2 years
Gender	Personalized training recommendations	Contract performance (Art. 6(1)(b))	Account lifetime + 2 years

2.2 Optional Profile Data

Data Type	Purpose	Legal Basis	Retention
First and last name	Personalization, social features	Consent (Art. 6(1)(a))	Until withdrawn or account deletion
Address	Local weather, training recommendations	Consent (Art. 6(1)(a))	Until withdrawn or account deletion
Profile photo	Account personalization	Consent (Art. 6(1)(a))	Until withdrawn or account deletion

2.3 Health & Fitness Data

Data Type	Purpose	Legal Basis	Retention
Body metrics (weight, height, BMI)	Training calculations, progress tracking	Consent (Art. 6(1)(a)) + Health data (Art. 9(2)(a))	Account lifetime + 1 year
Heart rate data	Training zones, health monitoring	Explicit consent (Art. 9(2)(a))	Account lifetime + 1 year
Sleep data	Recovery analysis, training optimization	Explicit consent (Art. 9(2)(a))	Account lifetime + 1 year
Activity data (GPS, duration, intensity)	Training analysis, route tracking	Consent (Art. 6(1)(a))	Account lifetime + 3 years

2.4 Technical Data

• IP address: Security, analytics (legitimate interests) - 7 days
• Browser information: Compatibility, security - 30 days
• Device identifiers: Session management - Session duration
• Usage analytics: Service improvement - 26 months
• Log files: Security, debugging - 90 days

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

• Contract performance (Art. 6(1)(b)): Essential account data needed to provide our services
• Consent (Art. 6(1)(a)): Optional features, marketing communications, cookies
• Legitimate interests (Art. 6(1)(f)): Security, fraud prevention, service improvement
• Legal obligation (Art. 6(1)(c)): Tax records, legal compliance

4. How We Use Your Data

• Service delivery: Account management, training recommendations, progress tracking
• Communication: Service updates, support responses, security notifications
• Improvement: Analytics, bug fixes, new feature development
• Marketing: Newsletter, promotional content (with consent only)
• Legal compliance: Fraud prevention, legal obligations

5. Data Sharing

We share your data only in the following circumstances:

5.1 Service Providers

• Cloud hosting: Google Cloud (Cloud Run, region us-central1, United States) - our servers
• Database: MongoDB Atlas, hosted on Google Cloud in us-central1, United States - where your account, training and health data is stored
• App platform: Firebase (Google) - sign-in, web hosting and push notifications
• AI providers: Anthropic, OpenAI and Google - to produce the AI features, as set out in §9.6
• Payments: Paddle.com (Merchant of Record for web orders), Apple App Store and Google Play (in-app purchases) - they collect and process your payment details; we do not receive your card number
• Email services: MailChimp - Newsletter delivery
• Analytics: Google Analytics - Usage statistics
• Maps: Google Maps, OpenStreetMap, MapBox - Location services
• Weather: OpenWeatherMap, Visual Crossing - Weather data

5.2 Legal Requirements

We may disclose data when required by law, court order, or to protect our rights and users' safety.

5.3 Business Transfers

In case of merger, acquisition, or sale, your data may be transferred with proper notice and protection.

5.4 Academic Research

EnduCloud may make aggregated or pseudonymised data available to academic researchers studying topics directly relevant to endurance sports and human health — such as activity habits, sleep patterns, training load, and physiological adaptation. Any such access is subject to all of the following conditions:

• The research is conducted under a formal ethics approval issued by a recognised institution in accordance with the Declaration of Helsinki (or an equivalent national research ethics framework);
• The data provided carries no direct identifiers (name, email, account or device identifiers). Direct identifiers are replaced by a pseudonym whose key is held only by EnduCloud and is never shared with the researcher;
• The researcher is bound in writing not to attempt re-identification and not to pass the data on;
• The research is non-commercial and its findings are intended for public benefit.

Longitudinal training and health data (heart rate, sleep, routes) is difficult to anonymise irreversibly, and we do not claim that it is. Pseudonymised data remains personal data, and this Policy continues to apply to it. The legal basis for this processing is our legitimate interest in contributing to scientific knowledge that underpins endurance sport and human performance research (GDPR Art. 6(1)(f)) and, for health data, the condition for processing for scientific research purposes (GDPR Art. 9(2)(j)) subject to the safeguards required by Art. 89(1), which the conditions above implement. You may object to this processing at any time by writing to privacy@enducloud.com; we will then exclude your data from future research disclosures.

6. Data Retention

Data Category	Retention Period	Reason
Account data	Account lifetime + 2 years	Legal obligations, dispute resolution
Health/fitness data	Account lifetime + 1 year	Historical analysis, export requests
Activity logs	3 years	Training history, progress tracking
Marketing data	Until consent withdrawn	Consent-based processing
Technical logs	90 days	Security, debugging

7. Your Rights

8. International Data Transfers

Your data may be processed outside the EU/EEA by our service providers:

• United States: Google (Google Cloud, where our servers run; Firebase; Analytics) - EU-US Data Privacy Framework + SCCs
• United States: MongoDB (Atlas, our database, hosted on Google Cloud in the United States) - Standard Contractual Clauses (SCCs)
• United States: Anthropic, OpenAI (AI providers, §9.6) - Standard Contractual Clauses (SCCs)
• United States: MailChimp - Standard Contractual Clauses (SCCs)
• Israel: EnduCloud, the operator, which administers the service from Israel - Adequacy decision (EU Commission)

All transfers are protected by appropriate safeguards under GDPR Chapter V.

9. Connected Services & Third Parties

9.1 Wearables & Device Integrations

With your authorization, EnduCloud connects to third-party wearable and device platforms to import your activity, workout, and health data, and to push planned workouts back to your device. You initiate these connections yourself and can revoke them at any time, both from within EnduCloud and from the provider's own account settings. Disconnecting stops further data exchange.

Service	Purpose	Data Shared	Privacy Policy
Garmin Connect™	Import of activities, heart rate, sleep, HRV, stress and body metrics; export of scheduled workouts to your watch	Activity files, health & wellness metrics, device identifiers, and the workouts we send to your device	Garmin Privacy Policy
Suunto	Import of activities and 24/7 wellness data; export of scheduled workouts to your watch	Activity files, sleep, heart rate, HRV and daily activity metrics, and the workouts we send to your device	Suunto Privacy Policy
Polar Flow	Import of activities and nightly recovery data; export of scheduled workouts	Activity files, sleep, heart rate and HRV metrics, and the workouts we send to your device	Polar Privacy Notice
COROS	Import of activities and daily metrics	Activity files, heart rate, sleep and daily activity metrics	COROS Privacy Policy
Wahoo	Import of activities; export of scheduled workouts to your head unit	Activity files and the workouts we send to your device	Wahoo Privacy Policy
Oura	Import of nightly recovery data	Sleep, HRV, resting heart rate and readiness metrics	Oura Privacy Policy
WHOOP	Import of recovery and strain data	Sleep, HRV, resting heart rate and daily strain metrics	WHOOP Privacy Policy
Google Health (Google Health API)	Import of activity and health data you have chosen to share from your Google (Fitbit) account	Activity summaries, heart rate, sleep, resting heart rate, respiration, SpO2 and step counts. Read-only: EnduCloud never writes data back to Google	Google Privacy Policy
Health Connect (Android)	Import of activity and health data that apps on your Android phone (for example Samsung Health, Google Fit, Mi Fitness, Zepp) share through Health Connect, with your permission granted on the phone	Workouts (type, times, distance, calories, route, speed, heart rate, power and cadence during the workout, and the recording device), sleep sessions and stages, resting heart rate, heart-rate variability, daily steps, calories, floors and active minutes, blood oxygen, respiratory rate, skin and body temperature, body composition (weight, height, body fat, lean, muscle and bone mass, body water), VO2max, blood pressure, blood glucose, water and meals you log, and, if you track them, menstrual flow, intermenstrual bleeding, basal body temperature and pregnancy. Blood pressure, blood glucose and reproductive health are shown to you only and never drive a training decision. Read-only: EnduCloud never writes data to Health Connect. You can revoke access at any time in Health Connect > App permissions > EnduCloud	Health Connect help
Apple Health (HealthKit)	Import of activity and health data you have chosen to share from your iPhone or Apple Watch	Workouts (type, times, distance, calories, route, speed, heart rate, power and cadence during the workout, and the recording device), sleep sessions and stages, resting heart rate, heart-rate variability, daily steps, calories and floors, blood oxygen, respiratory rate, wrist and body temperature, body composition (weight, height, body fat, lean mass, BMI), VO2max, blood pressure, blood glucose, water and meals you log, and, if you track them, menstrual flow, intermenstrual bleeding, basal body temperature and pregnancy. Blood pressure, blood glucose and reproductive health are shown to you only and never drive a training decision. Read-only: EnduCloud never writes data back to Apple Health	Apple Privacy Policy

9.1.1 How we use data from connected health platforms

The commitments below apply to every platform listed above, without exception. Where a platform imposes its own additional rules, we meet those too; the stricter rule always governs.

• Purpose limitation. Health and fitness data imported from a connected platform is used only to provide and improve the coaching features you asked for: analysing your training, computing your load, recovery and readiness, generating and adapting your training plans, and showing you your own history.
• No advertising, ever. We do not use data from any connected health platform for advertising, marketing, remarketing, or to build advertising profiles or audiences.
• Never sold. We do not sell, rent, or trade this data, and we do not transfer it to data brokers, information resellers, insurers or employers.
• No credit or underwriting use. We never use it for eligibility, insurance, lending or employment decisions.
• Humans do not read it. No EnduCloud employee reads your imported health data, except with your explicit consent for a support request you raised, where required by law, or on aggregated or de-identified data.
• No model training. Your health data is never used to train machine-learning models, ours or anyone else's. Our AI providers are contractually prohibited from training on data we send them (see §9.5).
• You can end it. Disconnecting a platform in EnduCloud, or revoking access in that platform's own settings, stops further synchronization immediately. You may delete previously imported data at any time (§7).

9.1.2 Google API Services — Limited Use

9.1.3 Apple HealthKit

9.2 Mapping & Location Services

Service	Purpose	Data Shared	Privacy Policy
Google Maps	Route visualization, topography	GPS coordinates, search queries	Google Privacy Policy
OpenStreetMap	Alternative mapping, route display	GPS coordinates, map requests	OSM Privacy Policy
MapBox	Custom map styling, satellite imagery	Location data, usage analytics	MapBox Privacy Policy

9.3 Weather Services

Service	Purpose	Data Shared	Privacy Policy
OpenWeatherMap	Real-time weather, forecasts	Location coordinates, API requests	OpenWeather Privacy
Visual Crossing	Historical weather data	Location data, date ranges	Visual Crossing Privacy

9.4 Communication Services

Service	Purpose	Data Shared	Privacy Policy
MailChimp (Intuit)	Newsletter delivery, email campaigns	Email addresses, engagement metrics	Intuit Privacy Policy
Firebase Cloud Messaging	Push notifications	Device tokens, message content	Google Privacy Policy

9.5 Analytics & Infrastructure

Service	Purpose	Data Shared	Privacy Policy
Google Analytics	Usage analytics, performance monitoring	Anonymized usage data, demographics	Google Privacy Policy
Firebase (Google Cloud)	App infrastructure, authentication	Account data, app usage	Google Privacy Policy

9.6 AI Services

The AI features (Coach Endy, the morning briefing, activity feedback, weekly summaries, training plan generation and adaptation, nutrition and event parsing) are produced by third-party AI models. To produce them, we send the provider the information the feature needs about you. Depending on the feature, that can include:

• your first name, so the text can address you;
• profile details such as age, sex, weight and sports;
• health and recovery data: heart-rate variability, resting heart rate, sleep, readiness and training load;
• your activities and your training plan;
• menstrual-cycle context, if you record it;
• your city, for the weather in your briefing;
• what you write to Coach Endy, and, for voice notes, the recording.

We do not send your email address, phone number or account credentials to any AI provider.

Provider	Used for	Data it can receive	Privacy Policy
Anthropic (Claude models)	Coach Endy, briefings, activity feedback, training plans and their adaptation, workout design	The categories listed above, except voice recordings	Anthropic Privacy Policy
OpenAI (GPT models)	The same features, when routed to OpenAI; transcription of voice notes; search over our help content	The categories listed above, including voice recordings	OpenAI Privacy Policy
Google (Gemini models)	The same features, when routed to Google	The categories listed above, except voice recordings	Google Privacy Policy

10. Cookies & Tracking

10.1 What Are Cookies

Cookies are small text files stored on your device to enhance your experience and provide functionality.

10.2 Cookie Categories

Category	Purpose	Duration	Consent Required
Essential	Authentication, security, basic functionality	Session / 1 year	No (legitimate interest)
Functional	User preferences, language settings	1 year	Yes
Analytics	Usage statistics, performance monitoring	26 months	Yes
Marketing	Newsletter tracking, campaign analytics	13 months	Yes

10.3 Managing Cookies

You can manage cookie preferences through:

• Our cookie consent banner (first visit)
• Account settings (logged-in users)
• Browser settings (all users)
• Third-party opt-out links provided above

11. Data Security

11.1 Technical Measures

• Encryption: TLS 1.3 for data in transit, AES-256 for data at rest
• Authentication: Multi-factor authentication available
• Access controls: Role-based access, principle of least privilege
• Infrastructure: SOC 2 Type II certified cloud providers
• Monitoring: 24/7 security monitoring and incident response

11.2 Organizational Measures

• Regular security training for employees
• Data Protection Impact Assessments (DPIAs)
• Incident response procedures
• Regular security audits and penetration testing

11.3 Data Breach Notification

In case of a data breach affecting your personal data:

• We will notify relevant authorities within 72 hours
• We will notify affected users without undue delay
• We will provide clear information about the incident and remedial actions

12. Children's Privacy

Age Requirement: EnduCloud is not intended for children under 16 years old. We do not knowingly collect personal data from children under 16.

If we discover that we have collected personal data from a child under 16:

• We will delete the data immediately
• We will notify the child's guardian if possible
• We will implement additional safeguards to prevent recurrence

Parents/guardians can contact us at privacy@enducloud.com regarding children's data.

13. Contact & Complaints

Filing Complaints

You have the right to lodge a complaint with a supervisory authority:

• EU residents: Contact your national data protection authority
• Israeli residents: Privacy Protection Authority
• Other jurisdictions: Contact your local privacy regulator

14. Policy Changes

14.1 Notification of Changes

We will notify you of material changes to this privacy policy:

• Email notification: For significant changes affecting your rights
• In-app notification: For all policy updates
• Website banner: For 30 days after changes

14.2 Change History

Version	Date	Changes
2.7	October 8, 2026	Corrects where your data is stored: our servers and database run on Google Cloud in the United States (us-central1), not in Israel as the earlier text said. §5.1 now names the database (MongoDB Atlas), the AI providers and the payment providers, and §8 lists the United States transfers that follow from them
2.6	September 28, 2026	Names the operator correctly (Tomer Geminder, a sole proprietor trading as EnduCloud; earlier versions said "EnduCloud Ltd.", which was never incorporated); rewrote §9.6 to list exactly what each AI provider can receive, including your first name, which the earlier text wrongly said was never shared
2.5	September 2, 2026	Wearables section extended from Garmin alone to every platform we support (Suunto, Polar, COROS, Wahoo, Oura, WHOOP, Google Health, Apple Health); added the cross-platform use commitments (§9.1.1), the Google API Services Limited Use disclosure (§9.1.2) and the Apple HealthKit disclosure (§9.1.3)
2.3	June 15, 2026	Added Wearables & Device Integrations section (Garmin Connect™) documenting import of activity and health data and export of scheduled workouts; renumbered Connected Services subsections
2.2	March 3, 2026	Updated AI Services section: accurate per-provider descriptions; added explicit statement that no PII is shared with AI providers and that providers are prohibited from model training on user data
2.1	December 20, 2025	Added AI Services section (OpenAI, Anthropic, Google AI) for Coach Endy feature
2.0	September 20, 2025	Complete GDPR compliance update, enhanced cookie management, detailed third-party services
1.0	June 1, 2025	Initial privacy policy

---