At a glance
- We collect only what a coach needs: your Telegram ID, an athlete profile, and training/recovery data from the wearable you connect. No name, email, phone number, or address is required.
- Health data (heart rate, HRV, sleep, workouts, readiness) is processed only with your explicit consent, which you can withdraw at any time.
- Menstrual cycle data is a separate, stricter opt-in: we store only period start dates, visible to you alone — never to administrators — and you can delete it anytime.
- We deliberately do not store GPS routes, your full date of birth, raw IP addresses, full browser user-agents, or card details.
- Your data is stored in the European Union, encrypted at rest and in transit.
- You can export everything as JSON or delete everything, directly in the bot.
- We do not sell your data and we show no advertising.
This policy explains, in full, what we collect, why, who processes it for us, and what your rights are.
1. Who we are
Sport AI Link (“Sport AI Link”, “we”, “us”) operates the Sport AI Link Telegram bot (the “Bot”) and the website sportai.link (the “Site”) — together, the “Service”: an AI-assisted personal sport coach that works with data from your wearable device.
For anything related to your personal data, contact privacy@sportai.link. For general questions: hello@sportai.link.
2. Scope
This policy covers personal data processed through the Bot and the Site. It does not cover the independent processing performed by Telegram, your wearable’s manufacturer, or other third-party services you use under their own terms (see Section 7).
3. What data we collect
3.1 Account
Your numeric Telegram ID, your interface language, and your trial/subscription status. We do not ask for your name, phone number, email, or address to use the Bot.
3.2 Athlete profile
Data you enter during onboarding or in dialogue, or that comes from your device: sex, year of birth (deliberately not the full date), height, weight, VO2max, maximum and resting heart rate, training goal, limitations, preferred units, and time zone. Some of these (sex, weight, height, heart rate values) are health data and are covered by your explicit consent (Section 5).
3.3 Health data (special category)
With your explicit consent, we receive from your connected wearable — via our aggregation provider — and compute from it: heart rate and heart rate variability (HRV), resting heart rate, sleep metrics, workout records (duration, distance, average heart rate, calories, sport type), readiness/recovery scores, and daily energy expenditure.
3.4 Menstrual cycle data (separate opt-in)
Only if you separately and explicitly enable cycle tracking, we store period start dates only. This data is technically visible to you alone: database-level access policies mean administrators cannot view it. You can delete it at any time in the Bot, independently of the rest of your account.
3.5 Messages and voice
Text messages you send to the coach (including free-form questions), and a limited rolling history of the recent dialogue. Voice messages are transcribed locally on our own infrastructure; the audio is deleted immediately after transcription and only the recognized text is kept.
3.6 Payments
Payments are made in Telegram Stars inside Telegram. We never receive or store card numbers or payment instrument details. We keep only: the amount, the Telegram payment identifier, the purchased package, and the subscription period dates.
3.7 Site analytics
On sportai.link we collect a minimal, first-party set: page path, language, device category (mobile/tablet/desktop — the full user-agent string is not stored), country (ISO code derived from hosting-level geolocation), the referrer host (without path or parameters), and an anonymous visitor identifier stored in your browser. Raw IP addresses are not stored. Separately, and only if you accept the cookie banner, we use Google Analytics 4 (Section 12).
3.8 Technical records
Synchronization queue logs, AI usage accounting (token counts and cost), an audit log of administrator actions, and product funnel events (e.g., registration → device connected → subscription).
3.9 What we deliberately do not collect
- GPS coordinates and routes — location fields are recursively stripped from workout data before anything is written to our database. We do not know where you train.
- Your full date of birth (year only), raw IP addresses, full user-agent strings, card details, your name, email, or phone number.
4. Where the data comes from
- You — onboarding inputs, dialogue, profile confirmations, opt-ins.
- Your wearable, via our aggregation provider — Garmin, Oura, Whoop, Fitbit, or Strava, connected by you through the provider’s own OAuth authorization.
- Telegram — your messages to the Bot, your Telegram ID and language setting, and payment confirmations.
- The Site — the minimal analytics described in Section 3.7.
5. Why we process your data, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the coaching service: your account, metric calculations, plans, advice | Account, profile, dialogue | Performance of a contract, Art. 6(1)(b); for health data within it — explicit consent, Art. 9(2)(a) |
| Processing health data from your wearable | Section 3.3 | Explicit consent, Art. 9(2)(a) (consent scope: sports data processing) |
| Cycle-aware coaching | Section 3.4 | Separate explicit consent, Art. 9(2)(a) (consent scope: menstrual health) |
| Subscriptions and payments | Section 3.6 | Contract, Art. 6(1)(b); legal obligations for records, Art. 6(1)(c) |
| Site analytics via Google Analytics 4 | Cookie-based analytics | Consent, Art. 6(1)(a) and ePrivacy rules |
| Our own minimal, cookie-free site beacon | Section 3.7 | Legitimate interest, Art. 6(1)(f) — understanding aggregate Site usage with minimal data |
| Security, abuse prevention, and administration | Technical records, identifiers | Legitimate interest, Art. 6(1)(f) |
| Keeping consent records after account deletion | Consent log | Legitimate interest in demonstrating compliance and defending legal claims, Art. 6(1)(f), Art. 9(2)(f) |
Where processing is based on consent, you may withdraw it at any time (Section 10); withdrawal does not affect the lawfulness of processing before withdrawal. Where we rely on legitimate interest, you may object (Section 10).
6. How AI is used with your data
Sport metrics (load, readiness, heart rate zones) are computed by deterministic code, not by AI. The AI language model is used only to phrase coaching advice, and it receives:
- a prepared briefing — aggregated numbers and facts produced by our code, never direct access to our database; and
- the free-text messages you yourself write to the coach.
Our AI provider is contractually prohibited from using this content to train its models. We do not make automated decisions about you that produce legal or similarly significant effects (GDPR Art. 22): the Service provides informational coaching suggestions, and you always decide how to train.
7. Who processes data for us
We use a small number of service providers (“processors”) acting under our instructions:
| Provider | Role | Data involved | Location |
|---|---|---|---|
| Supabase | Database, storage, background jobs | Account and health data (encrypted at rest) | EU region |
| Vital (tryvital.io) | Wearable data aggregation | Health data from your device | EU endpoint |
| Anthropic | AI generation of coaching text | The briefing (aggregated numbers/facts) and your free-text messages | USA (see Section 8) |
| Vercel | Site and admin hosting | Site analytics, static content | USA (see Section 8) |
| Google (Analytics 4) | Site analytics, only with your consent | Cookie-based analytics data | USA (see Section 8) |
| Our own server | Bot runtime and local voice transcription | Voice audio (processed locally, deleted immediately) | Our infrastructure |
The following parties are independent services, not our processors — their own privacy policies apply to what they process:
- Telegram — the platform through which you use the Bot and pay with Stars;
- Wearable providers (Garmin, Oura, Whoop, Fitbit, Strava) — you authorize the connection directly with them via OAuth and can revoke it there.
8. International transfers
Your data is stored in the European Union (EU-region database and EU endpoint of our wearable aggregator). Some providers process limited data in the United States:
- Anthropic (AI text generation): receives only the prepared briefing and your own free-text messages. Transfers are safeguarded by a data processing agreement incorporating the EU Standard Contractual Clauses (SCCs).
- Vercel (site hosting): certified under the EU-U.S. Data Privacy Framework.
- Google (Analytics 4, only with your consent): certified under the EU-U.S. Data Privacy Framework; IP anonymization is enabled.
As an additional safeguard by design, the AI provider never receives raw database contents — only aggregated briefings and text you wrote yourself.
9. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, health and cycle data | While your account exists; deleted immediately on your request (Section 10) |
| Inactive accounts | Deleted after 24 months of inactivity, with prior notice |
| Dialogue history | Rolling window of recent messages; older messages are discarded |
| Voice audio | Not stored — deleted immediately after local transcription |
| Site analytics (our own beacon) and technical logs | 12 months |
| Payment and subscription records | As required by applicable accounting and tax law |
| Consent records | Kept after account deletion, up to 5 years, solely to demonstrate that processing was lawful |
10. Your rights
You have the right to:
- Access and portability — export all your data as JSON, directly in the Bot;
- Erasure — delete your account and all associated data in the Bot; this cascades across all our tables and triggers deletion of your data at our wearable aggregator and disconnection of your device;
- Rectification — correct your profile data in the Bot at any time;
- Withdraw consent — at any time, including disabling cycle tracking separately; the related features stop working, and prior processing remains lawful;
- Object — to processing based on legitimate interest (including our site beacon);
- Restriction — request that we restrict processing while a dispute is resolved;
- Complain — to your local data protection supervisory authority.
To exercise any right, use the Bot’s built-in functions or write to privacy@sportai.link. We respond within 30 days.
11. Age
The Service is intended for people aged 16 or older. We do not knowingly process data of anyone under 16. If you believe a person under 16 is using the Service, contact privacy@sportai.link and we will delete the account and its data.
12. Cookies and site analytics
- Our own beacon on the Site is cookie-free and does not store your IP address.
- Google Analytics 4 runs under Google Consent Mode v2: analytics storage is denied by default, and GA sets no cookies and sends no identifying hits until you press “Accept” on the banner. You can decline, and your choice is remembered in your browser. IP anonymization is enabled.
13. Security
Data is encrypted in transit (TLS) and at rest. Every database table is protected by row-level security, so one user can never read another’s data even in case of an application bug. Cycle data is additionally shielded from administrator access at the database-policy level. Administrator access requires two-factor authentication, and the admin panel shows only aggregates — never raw health records. Incoming webhooks are signature-verified. A detailed, plain-language description is on our Data & Security page.
14. Changes to this policy
We may update this policy as the Service evolves. The version and effective date are shown at the top. For material changes, we will notify you in the Bot and, where the law requires, ask for renewed consent. Consents you grant are recorded together with the policy version in force at that time.
15. Contact
Privacy requests: privacy@sportai.link General: hello@sportai.link
This policy is drawn up in English; translations are provided for convenience, and the English version prevails in case of discrepancy.