Privacy Policy

The controller identity, registered address, privacy contact, and lead supervisory authority are not configured yet. Public signup must remain closed until those operator details are supplied and reviewed.

When you sign up we ask for an email address, password, name, and role. In the app you can add physiological test results, training plans, race goals, body-composition details, nutrition targets, sleep and HRV data, breathing and ventilation data from compatible sensors, an optional menstrual-cycle phase, an optional profile photo, coach-athlete messages, and saved courses. If you connect Intervals.icu, we read the data you authorize through that connection.

We do not collect tracking cookies, advertising pixels, ad-network beacons, or device fingerprints. The app uses one required session cookie, vlamax_sid, to keep you signed in.

• Contract, GDPR Article 6(1)(b): to create your account, run the coaching features, save your plans, and provide settings such as data export and account deletion.
• Legitimate interest, GDPR Article 6(1)(f): to keep the service secure through session records, login timestamps, failed login counters, IP address, and user-agent records.
• Explicit consent for health and performance data, GDPR Article 9(2)(a): physiological, metabolic, nutrition, and recovery data is health-related. We process it only after you give explicit consent at signup, and you can withdraw it at any time by deleting your account or disconnecting a data source.

Production data is stored in Postgres on a Contabo GmbH server in Germany. Encrypted backups are replicated to a Hetzner Online GmbH server, also in Germany, which also runs our self-hosted error logging. Your stored data stays in the EU, with two exceptions listed below: Resend delivers our transactional email from the United States, and some features load third-party services directly in your browser. If you live outside the EU, your data is transferred to and stored in Germany. If the hosting region or a processor changes, this page is updated before the change applies.

• Account and coaching data: kept while your account exists, then deleted when you delete the account.
• Wellness time series: capped at the most recent 90 days per athlete, with older rows removed automatically. Where you have connected Intervals.icu, the progress view can show your daily sleep, heart-rate variability and resting heart rate further back, up to 12 months: we read those older days from your Intervals.icu account each time you or your coach open the view, show them, and do not store them.
• Weekly training-load summary: once a training week is complete we keep a summary of it — the load you planned and the load you did, how that time split across the three intensity bands, and your fitness, fatigue and form at the end of that week — so the progress view can look back over months without us keeping months of daily sleep, HRV and resting-heart-rate rows. Those daily rows are still removed on the 90-day schedule above. The weekly summary is kept for 12 months. Where you have connected Intervals.icu, we may also compose these weekly summaries from the training history you already share with us there, so the view is complete from the start rather than only from the day you joined. The split of each week across the three intensity bands may likewise be worked out from the power or speed recordings of your Intervals.icu activities over those same 12 months: each recording is read and measured against the thresholds that applied on that activity's date, and we keep only the resulting time in each band — in this weekly summary, and per activity with the thresholds used, alongside your account data — never the recording itself.
• Change history of your own numbers: we record who changed a value, when, and what it changed from, so your metric history is traceable. It is kept while your account exists and is deleted with it.
• Records of a coach or operator opening your health data: from the point this record is switched on, we log only who looked, when, and which area they opened — never the values themselves, and never your own visits to your own data. Those records are kept for 12 months and then deleted.
• Proof that a deletion was carried out: when an account is deleted we keep a minimal receipt — identifiers, a one-way hash of the email address and the number of rows removed, never any health data — so we can show the deletion happened. How long we keep that receipt is under legal review and is published here once it is settled.
• Session and security records: active rows stay for the session lifetime; revoked records may be retained for up to 12 months for security review.

We do not sell your data. We do not run ad-network tracking. We use a small number of processors to operate the service:

• Contabo GmbH: production server hosting in Germany.
• Hetzner Online GmbH: encrypted off-site backups and self-hosted error logging, in Germany.
• Resend: transactional email such as password resets, account notices and the notification emails you keep switched on, delivered from the United States under the EU Standard Contractual Clauses. Resend receives recipient addresses and email content, not your training files or physiological test history.
• Cloudflare: Turnstile bot protection on the waitlist form of our public homepage. Your browser connects to Cloudflare, which sees your IP address and browser signals to tell people from bots.
• Course-preview maps: when you open a course preview, your browser loads map tiles, elevation data and street-level imagery directly from OpenStreetMap, MapTiler, Amazon Web Services, Mapillary (Meta) and Google Maps. These services see your IP address and the area being viewed. We send them no account or training data.

Intervals.icu is your own third-party account. We access it only through the credentials or authorization you provide, and revoking that authorization cuts off access.

Linking a coach is the one case where another person sees your data. From the moment you accept the link until you end it, your coach can see:

• your name, email address, date of birth, sex and height
• your weight, body composition and every physiological test result, including the raw measurements
• your sleep, heart-rate variability, resting heart rate, and how you rated your own soreness, fatigue, stress, mood and motivation
• your training history, training load, availability and the plans built for you
• your nutrition targets, dietary preference, allergies and caffeine sensitivity
• periods you marked yourself as ill or injured, including any note you added, and your menstrual-cycle phase if you record one
• your races, race plans, saved courses and profile photo
• the messages you exchange with that coach

Your coach can also change these values and prescribe, edit or remove sessions on your behalf — including in your connected Intervals.icu calendar. They keep a private note about you that you cannot see; you can ask us for a copy of it.

Your coach can set up or update your Intervals.icu connection for you — for example on a test day — but can never read your API key back, and cannot see messages between you and any other coach.

You can end the link at any time from Settings, without your coach agreeing. Their access stops immediately. For seven days afterwards you can undo it, and your coach sees only that you have left; after that the link is gone and their private note goes with it.

• Access and portability: download a JSON copy from Settings.
• Erasure: delete your account from Settings. Deletion is immediate and irreversible.
• Correction: edit profile fields in Settings, or contact us if a field is not editable in-app.
• Restriction or objection: contact us to pause or object to a specific processing activity.
• Complaint: the lead supervisory authority must be confirmed before public launch.

The required cookie is vlamax_sid. It is HttpOnly, Secure, SameSite=Lax, and scoped to the app. It stores a random session token; the server stores only a hash. Deleting it logs you out. There are no analytics or marketing cookies today.

A second functional cookie, vlamax_locale, stores your language choice (en, nl, or fr) so pages and emails render in your language. It contains only that locale code.

The service is not directed at children under 16. If you believe a minor has signed up, contact us and we will delete the account.

We update the date at the top when this policy changes. For material changes, such as new categories of data, new processors, or changed retention periods, we aim to email active accounts at least 30 days before the change takes effect.