Privacy Policy

This privacy policy explains how we collect, use, and protect your personal information when you use our service. By using our service, you agree to the collection and use of information in accordance with this policy.

Who We Are

FitKeep is a service by Svaletech ApS, a company based in Denmark, with CVR-number 44104504.

Information We Collect

We only collect what we need to provide our service. Some of it is required to have an account. The rest is only collected if you add it yourself or use the feature that needs it.

Required for an account:

• Your email address, to create your account and sign you in
• A display name, which you enter when you sign up, or which Google provides if you sign in with Google

Only if you add it or use the feature:

• Fitness data from the .FIT files you upload, the files you import from Google Drive, or the activities Garmin Connect™ sends us if you connect it, including the model of the device that recorded them
• Your profile picture, if you sign in with Google
• Your birth date and maximum heart rate, if you add them in your profile, to calculate your heart rate zones
• Your AI Coach conversations, if you use the optional AI Coach

Collected automatically while you use the service:

• Your preferences, such as language, time zone, and theme
• Your IP address, used only while handling a request to protect sign-in and other endpoints against abuse. We do not store it with your account or your login sessions.

How We Use Your Information

Your information is used solely to provide the services found on FitKeep, including:

• Provide access and insights to your fitness data
• Process and analyze your fitness data
• Maintain your account and preferences
• Generate AI summaries, AI Coach replies, Activity Reviews and coach check-ins when you request them or the Coach is enabled for you

Data Storage and Security

Your data is only accessible to you through your account. We do not sell your data or share it for advertising. Your data only leaves our servers in the cases described in this policy: the optional AI features, the sign-in and integration services you choose to use, and the map provider (see Third-Party Services).

Your original .FIT files and your AI Coach conversations are encrypted at rest with AES-256-GCM. Other data, such as the metrics and best efforts calculated from your activities, is stored in our database in the EU.

Optional AI Features

All AI features are optional and off by default. None of them send any of your data anywhere unless you use them or the AI Coach is enabled for you.

We never send the contents of your raw .FIT files, your GPS route or location coordinates, or your account email and display name. What is sent is a subset of your computed activity metrics, together with any free text you entered yourself, such as activity names, uploaded file names, and goal names. If you use these features, do not put sensitive personal details in those free-text fields.

AI activity summaries: When you explicitly request a summary for an activity, a subset of that activity’s metrics (such as activity type, distance, duration, pace, heart rate, and elevation), its name, and summary stats about your recent activities of the same type are sent to Google’s Gemini API to generate the summary. This happens only on demand, each time you ask for a summary.

AI Coach: The AI Coach is not active on an account unless it has been enabled for you. When it is active, each message you send, the earlier messages in that conversation, your time zone, and a relevant subset of your fitness data (such as activity metrics, best efforts, and goals) are sent to Google’s Gemini API to generate a reply. Because your own messages are sent as written, do not include anything in them you would not want processed by Gemini. Your coach conversations are stored in your account encrypted at rest, and you can delete any conversation at any time.

Activity Reviews and coach check-ins: If the AI Coach is enabled for you and you have an active Training Plan, the coach also works without you asking. It writes an Activity Review for runs during the plan, and drafts a Weekly Check-in, or a proposal for changes to your plan, when something calls for it. For an Activity Review, the run’s metrics, a digest of its pace and heart rate over the run (no GPS route), and the Planned Session it was matched to are sent to Google’s Gemini API. For check-ins and proposals, a relevant subset of your plan, goals and recent activities is sent. The coach never changes your plan by itself: you confirm every proposal.

Connecting an external AI assistant (MCP): FitKeep offers an MCP server that you can use to connect an outside AI assistant of your choice, such as Claude, to your data. No connection exists until you set one up in that assistant and approve it on a FitKeep consent screen. Once connected, the assistant has read-only access to your fitness data (your activities and their details, training statistics, best efforts, and goals) and to your account’s name and email address, scoped to your account alone. Data you request this way is sent to whichever AI provider you connected and is then handled under that provider’s own privacy policy and terms, which are outside our control. You can review and revoke connected applications at any time from the Applications page in your settings, and revocation takes effect immediately.

For the features that use Google’s Gemini API (activity summaries, the AI Coach, Activity Reviews and the coach’s check-ins and proposals), we use Gemini’s paid API tier, which means Google does not use your data to train or improve their models. That use is governed by the Gemini API Terms of Service.

Data Retention

We retain your data as long as your account is active. You may delete your account and all associated data at any time. AI Coach conversations can also be deleted individually from the Coach page whenever you choose.

You can download a copy of your data at any time from your settings. The ZIP holds your original .FIT files and an account.json file with your profile and settings, goals, AI Coach conversations (decrypted, the messages only) and a list of your activities with their name, type and file reference. Best efforts are not included, since they are worked out from your activity files and FitKeep can calculate them again. Garmin activities that have no .FIT file but have recorded samples come as JSON files; a summary-only activity keeps its summary in account.json. It does not hold your Training Plans or Activity Reviews. The ZIP is not encrypted once you have downloaded it, so keep it somewhere safe. If you upload an account.json to import it, FitKeep keeps it encrypted only until you confirm or cancel (at most a day). It is deleted with your account.

When you delete your account, we also disconnect your integrations: we ask Garmin to stop sending us your activities, revoke our access to your Google Drive, and delete any background jobs still holding your data.

Some data is kept for a shorter time on its own:

• Login sessions are deleted once they expire, about 7 days after you last used them.
• Background jobs that import or process your activities are deleted after they finish: about a day later for Garmin imports, and about a week later for other processing.

Data Processors

FitKeep is hosted and all data is stored in the EU. We use the following third-party data processors, which process data only on our behalf:

If you connect an external AI assistant through our MCP server, the AI provider behind that assistant also receives the fitness data you request through it, as well as your account’s name and email address. That provider is one you choose and authorize directly. We have no agreement with it, it is not a data processor we engage on your behalf, and its handling of your data, including any retention or model-training practices, is governed solely by its own terms and is outside our control.

Third-Party Services

These services are not our data processors. You choose to use them, or your browser contacts them directly, and each handles your data under its own privacy policy.

Google sign-in: If you sign in with Google, Google tells us your name, email address, and profile picture. Google’s handling of your sign-in is covered by the Google Privacy Policy.

Google Drive: If you connect Google Drive, you choose the files to import in Google’s file picker, which your browser loads from Google. We can only access the files you pick. Disconnecting Google Drive, or deleting your account, revokes our access.

Garmin Connect™: If you connect Garmin Connect, it sends us your activities as you record them. Disconnecting it, or deleting your account, deletes our access tokens and asks Garmin to stop sending us your activities. See Garmin Data for how we handle what Garmin sends us and what we send to Garmin.

Maps: Maps of your activities are made of tiles loaded from OpenStreetMap. When you view a map, your browser requests the tiles for that area directly from OpenStreetMap’s servers, so they receive your IP address and which part of the map you are viewing. Their handling of this is covered by the OpenStreetMap Foundation Privacy Policy. We also load tiles from our own servers to draw activity thumbnails; those requests do not include your IP address.

Garmin Data

This section describes how FitKeep collects, uses, processes, stores and shares data from Garmin Connect™, and the data we send to it. It applies only if you connect your Garmin account. Garmin and Garmin Connect are trademarks of Garmin Ltd. or its subsidiaries. FitKeep is not affiliated with Garmin.

What we collect from Garmin: When you connect, Garmin gives us a user ID that identifies your Garmin account to us and access and refresh tokens, which we store encrypted, and we fetch the permissions you granted us. After that, Garmin sends us your activities as you record or sync them. Depending on the permissions you grant, this is the original .FIT file, the activity’s details with recorded samples (such as heart rate, speed, cadence, elevation and GPS position), or only a summary of the activity (type, name, start time, duration and distance). Each activity includes its name, the model of the Garmin device that recorded it, and its description when Garmin includes one (kept only with the encrypted details, and not used). We do not collect your Garmin wellness data, such as sleep, steps or stress. When you connect, we also ask Garmin for your activities from the last 30 days, if you granted that permission.

What we send to Garmin: If the AI Coach is enabled for you and you grant the “Training” permission at Garmin (shown as “Data shared from the FitKeep app to Garmin” on Garmin’s consent screen), FitKeep sends your Planned Sessions to Garmin Connect as workouts scheduled in your Garmin calendar. You can turn this off with “Send Planned Sessions to Garmin” in your integration settings, or withdraw the permission at Garmin, whenever you want. Each workout holds the session’s name, description, date, distance or duration, and its pace or heart rate targets. We send the sessions for this week and next week and keep your Garmin calendar in sync: when a session changes or moves, we update its workout. We remove a workout when its session is done and its day has passed, is skipped or deleted, can no longer be done (its day has passed and a run can no longer be matched to it), or when the plan ends. We send nothing else to Garmin.

How we use it: Your Garmin activities are used like any other activity you add: they are shown in your account, analysed for best efforts and your progress, matched to your Planned Sessions, included in the data you can download, and used by the optional AI features described in Optional AI Features if you use them. The Garmin device model is shown next to the activity.

How we store and keep it: All of it is stored in the EU (see Data Processors). Original .FIT files and activity samples from Garmin are encrypted at rest with AES-256-GCM, and so are your access tokens. We keep your Garmin activities until you delete them or your account. Disconnecting Garmin deletes our access tokens, asks Garmin to stop sending us data, and stops us sending workouts to Garmin. When you disconnect in FitKeep or delete your account, we first try to delete the workouts we added to your Garmin calendar. If you disconnect from Garmin’s side instead, we can no longer reach them, and they stay in your calendar until you remove them in Garmin Connect. Activities already imported stay in your account until you delete them. Deleting your account deletes all your data with us, as described in Data Retention.

Third parties: We do not sell Garmin data or share it for advertising or marketing. Garmin data is processed by these third parties, and by no others:

• Google Gemini (third-party AI): if you use an AI activity summary, the AI Coach or an Activity Review, a subset of the metrics of your activities, including Garmin activities (with laps and the device model) and a digest of the recorded pace and heart rate, together with their names and your Planned Sessions, is sent to Google’s Gemini API to write the reply. We never send the .FIT file itself or your GPS route. We use Gemini’s paid tier, so Google does not use your data to train its models. Nothing is sent unless you use these features or they are enabled for you.
• Our data processors: Hetzner stores and processes the data on our behalf as the hosting provider. Brevo and Google Gemini are the others in the Data Processors list. Brevo only sends emails and never receives your Garmin data.
• Garmin itself, which receives the Planned Sessions described above.
• An outside AI assistant you connect through our MCP server, if you set one up, can read your activities, which include those from Garmin. That provider is one you choose and authorize, and its handling of the data is covered by its own terms.

Website Analytics

We use Umami, a self-hosted privacy-focused analytics tool, to understand how our service is used. Umami does not use cookies and does not collect personally identifiable information. It is hosted in EU on our own Hetzner servers (see Data Processors).

The following anonymous data is collected:

• Pages visited (the page’s path only, without search terms, and with IDs removed)
• The website you came from, if any (the site only, not the full address)
• Browser type and operating system
• Device type (desktop, mobile, tablet)
• Country (derived from IP address, which is not stored)

This data is used solely to improve the service and cannot be used to identify individual users.

Cookies

We only use essential cookies required for the service to function. We do not use any tracking or advertising cookies. The cookies we use are:

• Sign-in — keeps you logged in, and secures the sign-in process
• Preferences — remembers your time zone (so dates and charts are displayed correctly), language, and theme
• Connecting integrations — secures the connection when you connect Garmin or Google Drive, and expires after 10 minutes

Contact

If you have questions about this privacy policy, please contact us at hello@fitkeep.cloud.