Privacy Statement

Version 1.0 · 10 September 2026

VeloGrit is a cycling coach that reads your training and health data from intervals.icu and bases its advice on it. That requires processing data about your health. This statement describes what that data is, why it's processed, who gets to see it, and what rights you have. It applies to VeloGrit, available at velogrit.cc.

1Who processes your data

The data controller within the meaning of the General Data Protection Regulation (GDPR) is:

Wood Ice data & AI
Box C4498, Kwikstaartlaan 42, 3704 GS Zeist, Netherlands
Email:
Chamber of Commerce (KvK) number: 42159878

No data protection officer has been appointed. That isn't required for a project of this size: the processing isn't large-scale and doesn't form the core activity. Questions about this statement can be sent to the address above.

2What data is processed

Data you provide yourself

Your email address. This doubles as your sign-in method: you receive a sign-in link at it, and it ties your data to you. No password is used.
Your name, if you enter it or if it comes from your intervals.icu profile.
An access token for intervals.icu, which you obtain by granting VeloGrit permission there once. VeloGrit uses it to fetch data on your behalf. If you still use the older method with a personal API key, that's stored the same way.
Your FTP and body weight, if you correct them manually.
A profile photo, if you upload one. Optional.
What you enter in the app: daily check-ins, notes on training sessions, your race calendar, and your messages to the coach.

Data retrieved via intervals.icu

Using that access token, VeloGrit retrieves the following data from your intervals.icu account:

Health data: heart rate variability (HRV), resting heart rate, sleep duration and sleep quality, estimated VO2max, body weight.
Training data: your rides with date, duration, distance, elevation gain, power, heart rate, cadence and training load; your power curves; your interval sets.
Profile data: your name, athlete ID and FTP as stored in intervals.icu.

Heart rate variability, resting heart rate, sleep and VO2max are data concerning health. That is a special category of personal data under Article 9 GDPR, subject to stricter rules. See Chapter 4.

This data is not stored. It is fetched live from intervals.icu the moment you open a screen or ask the coach a question, used to compose your answer, and then discarded. So there is no store of your HRV, sleep or ride data on VeloGrit's servers. What is retained is what you enter yourself and what the coach replies to you.

Data generated automatically

A session token in a cookie, so you don't have to sign in again on every visit.
A temporary sign-in code when you request a sign-in link. It's valid for fifteen minutes, works once, and is deleted immediately afterwards.
Usage data: how many AI calls you've made and what they cost, to keep track of your monthly budget.
Technical logs from the hosting provider, such as IP address and the time of a request. These are kept by Cloudflare and are needed for security and troubleshooting.

3What the data is used for

Purpose	Which data
Giving you a training plan and coaching advice	Training and health data, check-ins, FTP, weight
Showing your progress in charts and the trophy case	Training data, power curves
Sending you a sign-in link and separating your account from other users	Email address, sign-in code, session token, user ID
Keeping AI costs from running out of control	Usage data
Detecting faults and securing the service	Technical logs
Improving the service based on your experience	What you report yourself; no automatic analysis of your data

Your data is not used commercially. It is not sold, not rented out, and not shared with advertisers, insurers, employers or data brokers. No advertising is shown and no profiles are built for marketing purposes. Your data is also not used to train AI models — not by VeloGrit and, under the terms of the API VeloGrit uses, not by Anthropic either.

4Legal basis

For ordinary personal data, processing rests on consent (Article 6(1)(a) GDPR). You give that consent by creating an account with your email address and connecting your intervals.icu account.

For health data, the prohibition in Article 9(1) GDPR applies. Processing rests on the exception for explicit consent (Article 9(2)(a) GDPR). By connecting your intervals.icu account while knowing it holds HRV, sleep and heart rate data, you give that explicit consent.

Consent is voluntary and always revocable. You revoke it by deleting your account through the app's settings, or by revoking VeloGrit's access in your intervals.icu settings. Withdrawing consent does not affect the lawfulness of processing before that point. Without this data VeloGrit cannot function; the service then stops.

For the hosting provider's security logs, the basis is legitimate interest (Article 6(1)(f) GDPR) in keeping the service available and secure.

5Who gets to see your data

Your data is shared with the following parties, acting either as processor or as an independent controller:

Party	Role and what they receive
Cloudflare, Inc.	Hosting and storage. All data mentioned in this statement resides on their infrastructure.
Anthropic PBC	Provides the language model behind the coach. Receives the data sent along with a coaching conversation: your question and its context, including your recent training and health data, FTP and weight.
Resend	Sends the sign-in links. Receives only your email address and the content of that email.
intervals.icu	Source of your training and health data. Your relationship with intervals.icu falls under their own privacy terms, not this statement.

No one else gets access. There are no staff members, no third-party analytics services and no trackers. VeloGrit's administrator can technically access the stored data because he manages the storage; that only happens for maintenance and troubleshooting.

Transfers outside the EEA

Cloudflare and Anthropic are based in the United States and may process data outside the European Economic Area. That transfer takes place on the basis of the European Commission's standard contractual clauses and, where applicable, the EU-US Data Privacy Framework. Both parties offer a data processing agreement as part of their terms.

6How long data is kept

Data	Retention period
Your account, training data, check-ins and coaching conversations	Until you delete your account, and up to one month afterwards
Your access token for intervals.icu	Encrypted, until you delete your account or revoke the connection
Coaching conversations	One year; they expire automatically after that
HRV, sleep, rides, power curves	Not stored
Sign-in codes	15 minutes, or until used
Session token	30 days, or until you sign out
Usage data	Per calendar month; deleted when the account is deleted
Data held by Anthropic	Automatically deleted within 30 days of receipt, under their API usage policy
Technical logs at Cloudflare	Per Cloudflare's retention policy

An inactive account is deleted after six months of no use. You'll be notified of this beforehand at the email address you sign in with, so you can sign in if you want to keep it.

7How your data is secured

All connections are encrypted via HTTPS.
Signing in works through a one-time link to your own email address; there are no passwords that can be stolen or reused. The session cookie is HttpOnly, Secure and SameSite, so it can't be read by scripts or from other websites.
Each user's storage is separated by a unique prefix per account, so a software error can't expose another user's data.
No shared key for the data source exists in the system: each user brings their own intervals.icu token.

Your intervals.icu token is stored encrypted (AES-256-GCM). The decryption key isn't in the storage but in the server environment, so access to storage alone isn't enough to read your token. You can also revoke that token at any time via intervals.icu's own settings. VeloGrit doesn't process passwords and has no access to your intervals.icu account itself.

Should a data breach be discovered despite these measures, posing a risk to your rights and freedoms, you will be informed and the breach will be reported to the Dutch Data Protection Authority, in line with Articles 33 and 34 GDPR.

8Your rights

Under the GDPR you have the following rights:

Access (Art. 15) — request which data is being processed.
Rectification (Art. 16) — have inaccurate data corrected.
Erasure (Art. 17) — have your data deleted. You can do this yourself via the app's settings; everything is then irreversibly removed.
Restriction (Art. 18) — have processing temporarily suspended.
Portability (Art. 20) — receive your data in a readable file. You can do this yourself with the "Request my data" button.
Objection (Art. 21) — object to processing based on legitimate interest.
Withdrawing consent (Art. 7(3)) — at any time, without giving a reason.

Send a request to the address in Chapter 1. You'll receive a response within one month. To prevent data from ending up with the wrong person, additional information may be requested to link your request to your account.

If you disagree with how a request was handled, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens), Postbus 93374, 2509 AJ The Hague — autoriteitpersoonsgegevens.nl.

9Automated decision-making

VeloGrit uses a language model to generate training advice based on your data. This is not automated decision-making with legal effect within the meaning of Article 22 GDPR: the advice has no legal consequences and doesn't affect you in any significant way. You are always free to disregard the advice.

10Not medical advice

VeloGrit is not a medical device and doesn't give medical advice. The advice is based on sports-physiology rules of thumb and on the data you provide. It is no substitute for a doctor, sports physician, physiotherapist or dietitian.

Consult a doctor before starting a training programme, especially with existing complaints, cardiovascular conditions, injuries, pregnancy or medication use. If you experience chest pain, dizziness, shortness of breath or other worrying symptoms during or after exercise, stop immediately and seek medical help.

A language model can make mistakes and give inaccurate or unwise advice. Judge every piece of advice with common sense, and listen to your body.

11Liability

VeloGrit is a paid service with a free trial period. The advice is generated with the help of a language model; the service is under continuous development and may change. What you can expect from us, and where the limits lie, is set out in the terms of service; those take precedence over what's stated here.

To the extent permitted by law, no liability is accepted for:

damage from following advice given in the app, including injuries, overtraining, health complaints or disappointing athletic performance;
inaccuracies in calculations, advice, training plans or displayed data;
loss or inaccessibility of data;
outages or unavailability of VeloGrit, intervals.icu, Cloudflare or Anthropic;
consequential damage, lost income or missed performance.

This exclusion does not apply in cases of intent or deliberate recklessness, and not to the extent that mandatory law prohibits it. If you are a consumer, your statutory rights remain fully in force; a liability exclusion cannot override them.

The obligations arising from the GDPR are not limited by this chapter. Your rights under Chapter 8 remain fully in effect.

12Cookies

VeloGrit sets one cookie: a session token that keeps you signed in. This is a strictly necessary functional cookie; no consent is required for it, so no cookie banner appears. No analytics cookies, tracking cookies or third-party cookies are set.

The app also keeps a copy of your data in your browser's local storage, so screens load faster. That copy is cleared when you sign out.

A full overview of what's stored in your browser is in the cookie policy.

13Children

VeloGrit is not directed at people under the age of 16. If you are under 16, only use the service with the consent of a parent or guardian.

14Changes

This statement may be updated, for instance if the app changes or a new party becomes involved in the processing. The current version is always available on this page, with the date and version number at the top. In case of significant changes, users are actively notified via the email address or channel through which they were invited.

Questions about this statement:
Back to VeloGrit · About VeloGrit · Terms of Service · Cookie Policy