Road toPrivacy Policy
The short version
- Your Garmin data is not kept. It lives in Road to only while your watch is connected. When you disconnect Garmin, we delete the Garmin connection and every piece of Garmin data we synced.
- Your notes are stored and processed. What you write in the "How are you feeling?" box is saved with a timestamp and read by our AI coach to adjust your plan.
- We don't sell your data and we don't show ads. No advertising or analytics trackers.
- You can sign in with just your email. A password is optional.
- You can delete your account and everything in it from Settings at any time.
1. Who we are
Road to is a training dashboard and planner for endurance athletes. It is operated by WASIT OÜ, Narva mnt 5, 10117 Tallinn, Estonia ("WASIT", "we", "us"). For the data described here, we are the "controller" (the party that decides how and why it is used). For privacy questions, write to miryam.adni@wasit.green.
2. What we collect, and why
| Data | What it is | Why we use it |
|---|---|---|
| Account | Your email address, name, and (optional) phone number. If you use "Continue with Google", the verified email address and first name Google gives us. | To create and secure your account, send you sign-in and confirmation links, and personalise the app. |
| Race & goals | Your race, race date, goal times and distances, strength sessions per week | To build your roadmap and training plan. |
| Body details (optional) | Height, weight, sex | To tune your plan, and to decide whether cycle-aware planning applies. |
| Notes you write | Free text from the feedback box (for example "tired legs", "travelling this week") with the time you wrote it | Stored and processed so the coach can adapt your plan and answer you. Please don't put anything in a note you aren't comfortable having stored. |
| Your plan | The sessions we generate or you edit, and which ones you marked done | To show and sync your training. |
| Garmin data (only if you connect) | Your most recent workouts and activities, and recovery data such as resting heart rate, HRV, sleep and stress. If you track your menstrual cycle on your watch, that cycle information too. Your Garmin profile details. | To show your training analysis and recovery, and to tailor your plan. See section 4. |
| Technical data | A sign-in cookie, and standard server logs (IP address, browser type, requested page, time) | To keep you signed in, keep the service secure and working, and fix problems. |
Some of this is health-related information (recovery and sleep metrics, injuries or illness mentioned in notes, and cycle tracking). We treat it as sensitive: we use it only to give you your own training guidance, and we ask for your explicit consent before we pull any Garmin data.
3. Our legal bases (if the GDPR or similar laws apply to you)
- Contract: to provide the service you signed up for (account, plan, dashboard).
- Consent: for health-related data, including Garmin data, notes and cycle information. You give it when you connect Garmin or write a note, and can withdraw it at any time by disconnecting Garmin or deleting your account.
- Legitimate interests: security, preventing abuse and improving reliability, balanced against your rights.
- Legal obligation: where the law requires us to keep or disclose something.
4. Garmin: how we handle it
- You connect on purpose. We ask you to sign in to Garmin and to authorise a pull of roughly your last two months of training and recovery data.
- We don't keep your Garmin password. It is used once to sign in and create a connection token. We store that token (the "session") so we can sync for you.
- Only the latest data is held, and only while connected. We keep the most recent sync so your dashboard can show it. Each new sync replaces the previous one.
- Disconnect = deletion. When you disconnect Garmin (Settings → Details → Disconnect) we immediately delete the Garmin connection token and the Garmin data we synced. Deleting your account does the same.
- What stays after you disconnect: things that are yours rather than Garmin's, your account, goals, notes and training plan. Delete your account to remove those too.
- We use Garmin data read-only. The only thing we send back to Garmin is the planned workouts you choose to push to your watch.
5. AI processing
Your plan, the coach's replies and the analysis text are produced by an AI model (via Cloudflare Workers AI). To do this we send the model the context it needs: your race, goals, plan, notes, and a summary of your recent training and recovery. We don't use your data to train our own models, and we don't send it to model providers for them to train on. AI output can be wrong; see our Terms.
6. Who we share data with
We don't sell your data. We use a small number of service providers ("processors") who handle data only to run Road to for us:
| Provider | What for |
|---|---|
| Cloudflare | Hosting, our database and AI processing |
| Resend | Delivers our emails (confirmation and sign-in links). It sees your email address and the message. |
| Render | Runs the connector that signs in to Garmin and fetches your data for us. Your data passes through it in transit and is not stored there; an unfinished Garmin sign-in is held in memory for up to 10 minutes. |
| Garmin | The source of your Garmin data, and the destination for workouts you push to your watch. Garmin has its own privacy policy. |
| If you choose "Continue with Google", Google tells us your verified email address and first name. We get nothing else from your Google account. | |
| Google Fonts | Our pages load the Bricolage Grotesque and Barlow typefaces from Google, which means your browser contacts Google when a page loads |
We may also disclose information if the law requires it, to protect people's safety or our rights, or in a business transfer (in which case we'll tell you and this policy keeps applying).
7. Where your data is processed
Cloudflare operates a global network, and our providers may process data in countries outside your own, including outside the EEA and the UK. Where required, we rely on appropriate safeguards such as the European Commission's standard contractual clauses. Our database is hosted by Cloudflare, which chooses its location automatically.
8. How long we keep it
- Garmin data and Garmin connection: until you disconnect Garmin or delete your account, then deleted immediately.
- Account, goals, plan and notes: until you delete your account.
- Sign-in links: we store only a one-way hash of each link, so it can't be reused. They expire within minutes or hours, and are deleted with your account.
- Server logs: kept by our hosting provider for a short period (days, not months).
- Backups: deleted data may remain in short-lived backups for up to 30 days before being overwritten.
9. Your choices and rights
Depending on where you live (for example under the GDPR, the UK GDPR, Morocco's Law 09-08, or California's CCPA), you may have the right to access, correct, delete, restrict or object to our use of your data, to receive a copy of it, to withdraw consent, and to complain to a data protection authority. Ours is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee); you can also contact the authority where you live, for example the CNDP in Morocco.
- Delete everything: Settings → Other settings → Delete account.
- Delete Garmin data only: Settings → Details → Disconnect.
- Edit your details and goals: Settings.
- Anything else (a copy of your data, or a question): email miryam.adni@wasit.green and we'll respond within one month.
10. Cookies
We set one cookie: a strictly necessary sign-in cookie that keeps you logged in (for up to 30 days, or until you log out). We don't use advertising, analytics or cross-site tracking cookies, so there's no cookie banner.
11. Security
Traffic is encrypted in transit. Sign-in links are single-use, short-lived and stored only as hashes; optional passwords are stored as salted hashes; the data you give us is scoped to your account. No system is perfectly secure, so please keep your inbox secure and tell us straight away if you suspect a problem. If a breach affects you we'll notify you and the authorities as the law requires.
12. Children
Road to is for people aged 16 and over. We don't knowingly collect data from younger children; if you think we have, contact us and we'll delete it.
13. Changes
We'll update this policy as the product changes. If a change is significant we'll tell you in the app or by email before it takes effect. The date at the top shows when it was last updated.
14. Contact
WASIT OÜ
Narva mnt 5, 10117 Tallinn, Estonia
miryam.adni@wasit.green