Privacy Policy

Last updated: September 8, 2026

Controller and contact

The data controller is Dragilla Łukasz Sacha, ul. Handlowa 9B, 05-120 Legionowo, Poland, NIP 5252136664 (“Dragilla” or “EnduCoach”).

Privacy contact: privacy@dragilla.com.

EnduCoach is a coaching portal operated by Dragilla for endurance sports planning and review. This policy explains what information the portal stores and how it is used.

Information we collect

Account information, including email address, password hash, login timestamps and email verification state.
Signup audit metadata, including registration route, referrer, user agent, forwarded IP address, hosting or proxy geolocation headers when present, language header and selected language.
Subscription and access status used to decide whether portal and GPT coaching features are available.
Garmin connection tokens, Garmin account email, cached activity data, profile metrics, heart-rate and power data, wellness and recovery metrics, body weight and nutrition data when you connect Garmin.
For Garmin accounts used with trial or other free access, a pseudonymous fingerprint of the Garmin account identifier and free-entitlement timestamps. The fingerprint is generated with a secret key and does not contain the Garmin password.
Coaching information entered in the portal, including athlete profile, sport goals, planned events, injuries or illnesses described by you, training plan rows, workout reviews and other free-text comments.
Visible in-app coach conversations, conversation boundaries, plan-update request and result events, coach-proposed plan-update requests, and bounded source-provenance metadata.
AI-generated progress-review comments for completed weeks, corresponding four-week periods and completed calendar years, automatic plan-update results, and the compact source facts and generation metadata used to create them.
Technical, security and AI-usage metadata, including session and device information, request status, model name, token counts, estimated cost and provider response identifiers.

Subscription and billing records apply to the web portal billing flow and supported mobile in-app purchases. Mobile apps send purchase identifiers needed to confirm account access and do not store full payment card details.

Where the information comes from

We receive information directly from you; from Garmin when you connect it; from Stripe, Apple or Google when they confirm a purchase or subscription; and automatically from the browser, mobile app and hosting infrastructure for essential operation and security.

Purposes and legal bases

We process account, subscription, Garmin-linked coaching, athlete-requested in-app coach conversations, plan updates, workout reviews and automatic weekly, four-week and annual progress reviews, as well as automatic post-Garmin plan updates when an Elite athlete enables Automatic reviews and updates, to provide the EnduCoach service and perform our contract with you (Article 6(1)(b) GDPR).

We process records required for accounting, tax and other legal obligations under Article 6(1)(c) GDPR.

We process limited security, access-control, fraud-prevention, diagnostics and service-integrity data for our legitimate interests in protecting EnduCoach and operating it reliably under Article 6(1)(f) GDPR. You may object to this processing as described below.

We send relevant health and workout data to OpenAI for in-app coach conversations, portal plan generation, automatic progress reviews and, for Elite athletes who enable Automatic reviews and updates, automatic post-Garmin plan updates, only while AI data consent is active. For this optional processing, the legal basis is Article 6(1)(a) GDPR; where the data constitutes health data, we rely on explicit consent under Article 9(2)(a) GDPR.

Training, recovery, heart-rate, injury, illness, nutrition and body-weight information may reveal health data. When information constitutes health data, an additional condition under Article 9 GDPR is required. This policy is a notice, not a consent request or consent record. Where EnduCoach relies on explicit consent under Article 9(2)(a), that consent must be requested and recorded separately and may be withdrawn at any time.

We use the information for the purposes above: to authenticate your account, connect to Garmin on your behalf, show your training context, answer in-app coach conversations, generate or update coaching plans, review completed training, generate and display progress-review comments and keep the portal working securely.

We use the pseudonymous Garmin free-entitlement record only to prevent the same Garmin account from receiving trial or other free access again during its retention period.

Garmin credentials and tokens

Garmin passwords are used only during the connection request and are not stored. Garmin access tokens are stored so EnduCoach can refresh and sync training data after you connect your account.

OpenAI processing

When you use in-app coach chat with active AI data consent, EnduCoach sends your current message, bounded recent messages from the current conversation, an optional bounded conversation summary, and only the signed-in athlete data or public app-manual sections selected as relevant for that answer. Selective athlete data may include bounded parts of your profile, goals and events, current plan or roadmap, recent activities or training history, readiness and recovery information, training zones, body weight or nutrition. The chat has no open-web access and does not preload your full manual, plan or training history.

When you request a portal AI plan update, or when an enabled Elite automatic plan update starts after Garmin synchronization, relevant coaching context sent to OpenAI may include your athlete profile, goals and events, plan and training history, recent activities, readiness and recovery information, training zones, body weight, nutrition and your comments. EnduCoach does not intentionally send passwords, another athlete's information or raw GPS coordinates.

When you use External GPT Actions, EnduCoach returns the coaching data you request to the ChatGPT service you are using. OpenAI's separate terms and privacy notice apply to your ChatGPT account and its use of that data.

For automatic progress reviews, active access means an active paid subscription or a valid trial. These reviews require active AI data consent but do not require Elite or the Automatic reviews and updates preference.

For athletes with active access and active AI data consent, EnduCoach automatically sends a compact training-data summary to OpenAI when the athlete uses the app while signed in after a week has ended. The data is used to generate coaching comments for the completed week and its corresponding four-week period. This does not require a separate request from the athlete.

On the first signed-in use on or after the athlete-local January 1, EnduCoach may queue one review for the immediately preceding calendar year. It sends compact annual aggregates to OpenAI only after full-year training-history coverage is verified and at least one executed activity is evidenced. The current year and older years opened through historical navigation do not create annual model requests.

For Elite athletes with Automatic reviews and updates enabled and active AI data consent, EnduCoach may automatically send relevant coaching context to OpenAI and start a plan review and update after Garmin synchronization downloads a new activity or detects activities that still require review. These automatic plan updates are limited to three per user per day, separately from manual plan updates. Once the limit is reached, synchronization completes without starting another automatic update.

Turning off Automatic reviews and updates pauses automatic post-Garmin plan updates. It does not pause weekly, four-week or annual progress reviews while access and AI data consent remain active, and it does not prevent manual plan updates.

A comment for a given period is generated only when that period contains at least one completed activity. If neither the completed week nor its corresponding four-week period meets this condition, no data is sent to OpenAI. For a period that does not meet the condition, the app displays “Insufficient data” instead of a comment.

An annual comment is generated only for the immediately preceding completed calendar year, after complete history coverage is verified and at least one executed activity is evidenced. Unverified full-year coverage remains retryable without an OpenAI request. A successful annual comment is immutable and is stored only in the language selected when it is generated.

The automatic summary may include sport and purpose groupings, plan and completion counts, outcomes, duration, distance, pace, average heart rate, average power, training load and personal-record counts. Annual summaries use exact calendar bounds, coverage dates, monthly and per-sport aggregates, reliable execution and recovery counts, distinct record counts and reliable prior-year comparisons. These summaries do not include raw GPS coordinates, activity names or direct account identifiers such as the athlete's name or email address.

All OpenAI Responses API calls made by EnduCoach set store=false. This opts out of the Responses API's default 30-day response application-state storage. OpenAI states that API data is not used to train its models by default. Separate abuse-monitoring logs may contain prompts and responses for up to 30 days unless longer retention is required by law or reasonably necessary to prevent harm, or stricter approved controls apply. Prompt caching is separate from response storage and abuse-monitoring logs. For GPT-5.6, EnduCoach requests a minimum cache lifetime of 30 minutes after the latest write or reuse. OpenAI’s current data-controls documentation states that encrypted prompt-cache tensors are not retained beyond the 24-hour expiration.

For customer data originating in the EEA or Switzerland, OpenAI's API terms identify OpenAI Ireland Ltd. as the processor. OpenAI may use subprocessors and make international transfers under its Data Processing Addendum, adequacy decisions or the EU Standard Contractual Clauses, as applicable.

Other recipients and international transfers

We disclose information only as needed to Microsoft Azure for hosting, databases, storage and monitoring; OpenAI for AI processing; Garmin Connect as the connected data source; the configured email provider; Stripe, Apple and Google for billing and access confirmation; and professional advisers or authorities where legally required. We do not sell personal data.

The main production application and database are configured in Microsoft's Poland Central Azure region, but provider support and subprocessors may operate elsewhere. When required for transfers outside the EEA, we rely on an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism.

Garmin, Stripe, Apple, Google and the ChatGPT service may also act as separate controllers for their own accounts and services under their privacy notices.

Garmin data is fetched from Garmin Connect through the connected account. Email verification and password reset messages may be sent through the configured email provider.

Visit and registration measurement

With your permission, we use a browser identifier to count website visits and registrations. When Meta measurement is enabled, we also send Meta visit and registration events, an advertising click identifier (if present), your IP address and browser information. We do not send your email or training and health data. You can withdraw consent in Cookie settings.

We remember your choice for 90 days. Measurement records are deleted during daily cleanup after 90 days. Withdrawing consent stops new measurement but does not delete events already received by Meta. Meta

Cookies

EnduCoach uses essential session cookies to keep you logged in and to complete OAuth connections. These cookies are required for the portal to function.

Retention and deletion

Verified EnduCoach accounts that have not been used for more than three months may be scheduled for deletion. We send a 30-day notice and a final reminder seven days before deletion. Signing in cancels the scheduled deletion. Administrators and users with active subscriptions are excluded. Former paid accounts may be included after their subscriptions are confirmed inactive.

Unverified accounts are deleted 7 days after registration. An account may be deleted earlier if our email provider confirms a permanent delivery failure indicating that the address does not exist or cannot receive mail. After deletion, limited email-delivery information—including the recipient address, delivery status and bounded diagnostic information—may be retained without an account link for up to 90 days for security, abuse prevention and delivery reliability. Pseudonymous registration-attempt fingerprints are retained for up to 24 hours.

Visible in-app coach-chat history is kept until you clear it or delete your account. Plan updates send the full latest in-app conversation to AI. Ordinary chat replies still use a limited set of recent messages. Withdrawing AI data consent stops new model requests but does not erase stored visible history. Clearing history removes the visible conversation and plan-update timeline, but it does not reset coach-reply or plan-update quotas.

Plan updates, workout reviews, AI progress comments and their supporting account data are kept with your account until they are replaced or your account is deleted. Successful annual progress comments remain immutable with their source fingerprint and generated timestamp. Disconnecting Garmin stops future sync and removes the connection credentials, but already cached Garmin and training data remains until account deletion or another applicable deletion process.

Your account page includes a delete-account option. Deleting your account removes your account data, Garmin login and access tokens, synced Garmin data, External GPT connection data, athlete profile, goals, events, training plan rows, visible coach conversations and plan-update timeline, stored weekly, four-week and annual progress-review comments, compact source facts, source fingerprints and generation metadata.

After account deletion, limited de-linked service, security and AI-usage records may remain where needed for operational accounting, fraud prevention or legal obligations. They no longer retain the EnduCoach user ID. OpenAI's separate retention is described in the OpenAI processing section above.

If a Garmin account was used with trial or other free access, EnduCoach retains only its secret-key pseudonymous fingerprint for two years from the account deletion date. During that period, using the same Garmin account with any EnduCoach account requires a paid subscription. After two years, the fingerprint is deleted and the Garmin account may qualify for free access again.

Deleting an EnduCoach account does not delete records held independently by payment providers, app stores, or accounting and tax systems. They may retain transaction records under their own legal obligations.

Your rights

Subject to the conditions in the GDPR, you may request access, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interests. If processing is based on consent, you may withdraw consent at any time without affecting processing that was lawful before withdrawal.

Send privacy-rights requests using the contact address stated above. You may also lodge a complaint with the President of the Personal Data Protection Office in Poland.

Polish Personal Data Protection Office (UODO)

Automated decisions and coaching advice

EnduCoach does not make decisions based solely on automated processing that produce legal effects or similarly significant effects for you. AI plans and comments are training guidance, not medical diagnosis or treatment. You remain responsible for deciding whether a session is appropriate and should seek qualified medical advice when needed.

Security

We use technical and organisational safeguards including password hashing, encrypted network connections, restricted credentials and access controls. No internet service can eliminate every security risk.

Changes to this policy

We may update this policy when the service or legal requirements change. We will publish the updated date here and provide additional notice when required.