Privacy Policy
Last updated: · Version 1.22
AthleWise is a free service that connects Intervals.icu with compatible AI assistants through MCP. Access is by invitation. This notice covers the connector and its account and invitation website.
1. Information we use
- Account information: when you sign in, we receive your verified sign-in identity and email from Google. We store your account identifier, email, access status and role. We do not store your Google password or Google user access or refresh tokens. Google sign-in does not give us access to your Gmail messages, contacts or Drive files.
- Invitation requests: we store the first name, last name, email, country and referral information you submit, plus request and email-delivery status. A temporary form token, browser cookie and hashed network identifier help prevent misuse. A request does not automatically create or approve an account.
- Connections and permissions: we store your Intervals.icu athlete ID, granted permissions, connection status and an encrypted OAuth access token so the connector can act within your authorization. We also keep consent records and the identifiers, permissions, expiry and revocation records needed to authorize your AI assistants. These are technical access credentials, not your Google or Intervals.icu passwords.
- Training and wellness data: the connector fetches the data needed for a tool request from Intervals.icu, processes it temporarily in memory and returns the result to the authorized AI client. Tools may filter data or calculate requested statistics. We do not store a sporting history or copies of your activities, workouts, wellness measurements, streams or exported files in our application database or a file archive. We do store the account, athlete ID and authorization records described above. Requested data can include health information and GPS location.
- Requested changes: the connector sends supported changes to Intervals.icu only within the permissions you grant. The source platform stores those changes. Granting a permission does not add tools or functionality that the connector does not support.
- Technical and contact information: website delivery and abuse prevention process network and request metadata, including IP addresses in transit. Invitation forms retain a hashed network identifier for rate limiting. Worker request logs and traces are disabled. We do keep account-administration events, such as admission, connection and permission changes, with account identifiers and dates. These records do not contain sporting records or full tool-request and response bodies. Cloudflare also processes infrastructure metrics and security information. If you email us, we process the message to handle your request.
2. Why we use your information
We use your information to manage invitations and accounts, keep your Intervals.icu connection and assistant authorizations working, relay the supported reads and changes you request, prevent misuse and handle privacy requests. Your AI assistant interprets the returned results under its own service terms; AthleWise supplies the connector tools.
We do not sell personal data, use connector data for advertising or train an AI model of our own with it. We do not use your sporting data to make decisions with legal or similarly significant effects about you.
Voluntary participation and the processing of connected data rely on consent under GDPR Article 6(1)(a). When data reveals health information, we request explicit consent under Article 9(2)(a) before connecting. You choose the categories and permissions to enable. Without a required permission, the corresponding tool cannot operate. Disconnecting Intervals.icu withdraws consent for further connected-data processing; withdrawal does not affect earlier lawful processing.
Responding to access requests, managing invitations and protecting accounts rely on our legitimate interests in operating the requested testing service and preventing unauthorized access (Article 6(1)(f)). We process statutory privacy requests and disclosures required by law under Article 6(1)(c). Providing an access email and sign-in identifier is necessary to register; invitation-request fields are needed to assess the request.
The service is free and in testing. We do not offer dedicated support or a service-level commitment. This does not limit your data-protection rights or the legal deadlines for responding to them. Do not send passwords, API keys or access tokens by email.
3. Services that receive information
- Cloudflare: runs the website and MCP connector, stores account and authorization records, processes tool data while a request runs, and provides network security and email forwarding for our domain addresses. Cloudflare’s privacy policy.
- Google: verifies your identity for sign-in. AthleWise does not send sporting records to Google as part of signing in. Google’s privacy policy.
- Intervals.icu: supplies the sporting data requested by a tool and receives the changes made with your authorization. Your original sporting history remains on that platform. Intervals.icu’s privacy policy.
- Resend: sends invitation emails and request notifications on our behalf. It processes recipient addresses, message content (including invitation links) and delivery information. Sent messages and delivery records follow its retention settings. We do not send training or wellness records to Resend. Resend privacy policy.
- Google Gmail: receives contact correspondence and request notifications forwarded from our domain addresses. Mailbox copies follow the mailbox settings. Google’s privacy policy.
- Your AI provider: receives the results of the tools invoked through its authorized connection. It may retain those results in conversation history or use them under its own settings and terms. Review its privacy and training settings before connecting. The connector receives tool requests and parameters, not a separate copy of your chat history.
- The service operator: manages account, invitation and authorization records and handles privacy requests. This is not a separate dashboard storing your sporting history. Disclosures to authorities are made only where legally required.
These providers may process information outside the European Economic Area. Their applicable transfer safeguards are described in Cloudflare’s data processing terms and Google’s transfer frameworks. Contact the privacy address below to request further information or a copy of the applicable safeguards.
4. Retention and account deletion
Sporting results are processed temporarily for a tool request and returned to the assistant. AthleWise does not keep a separate sporting history. The original provider and your AI client determine retention of their own copies.
Account, consent, connection, assistant-authorization and account-administration records remain while the account is open or revocation or closure is pending. Disconnecting removes the saved Intervals.icu access token once revocation completes. Closing a member account blocks access immediately, then removes its associated application records once required revocations finish. A pending closure can be retried without restoring access.
Invitation request details and invitation-email delivery records are retained for up to 30 days, then removed during later request or operator-panel activity. Form tokens expire after ten minutes. Network hashes are cleared from request records after 24 hours during that cleanup activity. Deleting an application record does not delete messages already received in a mailbox.
Website sessions last up to eight hours on the server. Sign-in and connection requests expire after ten minutes. Assistant access tokens normally last one hour, refresh grants thirty days and client registrations ninety days; activity can renew these periods. A private closure receipt lasts up to 24 hours. Short-lived security records prevent a stale login from recreating a closed account.
Closing AthleWise does not delete original Intervals.icu data, downloaded files or conversations held by an AI provider. Manage those copies with the corresponding service. Contact correspondence is kept while necessary to resolve the request or meet a legal obligation.
5. Cookies
We use cookies for the features you request, security and the language you choose. We do not use advertising cookies or website analytics scripts.
| Cookie name | Purpose | Duration |
|---|---|---|
__Host-athlewise_session | Keep you signed in to your account. | Browser session; server access expires after at most eight hours. |
__Host-athlewise_google | Protect the sign-in process with Google. | Up to ten minutes. |
__Host-access_request | Protect the invitation request form against misuse. | Up to ten minutes. |
__Host-athlewise_invitation | Keep your invitation available while you sign in to accept it. | Up to ten minutes. |
__Host-athlewise_closure | Let you check the private confirmation of an account closure you requested. | Up to 24 hours. |
__Host-athlewise_language | Remember the language you select. | Up to one year. |
The language cookie is stored only when you use the language selector. Otherwise, we use your browser language without storing a language preference.
Signing out clears your sign-in cookie. Some browsers restore sessions when reopened; always sign out on a shared device. Website sign-out does not disconnect Intervals.icu or revoke an assistant you authorized.
You can delete or block cookies in your browser settings. Blocking essential cookies may prevent sign-in, invitation requests or other requested features from working.
Google and Intervals.icu may use their own cookies when you visit their websites to sign in or authorize a connection. Cloudflare may set additional technical security cookies when a traffic check is needed; see Cloudflare cookie information.
6. Your choices and rights
The EU General Data Protection Regulation (GDPR) applies to the personal data processed by this service. Subject to its conditions, you can request access, correction, erasure, restriction or portability, object to processing based on legitimate interests, and withdraw consent.
Send your request to privacy@athlewise.com. We may ask for proportionate information to verify your identity. We respond without undue delay and normally within one month. Where the GDPR permits an extension, we tell you within that first month and explain why.
You can lodge a complaint with a supervisory authority, particularly in the EU country where you live or work or where an alleged infringement occurred. In Spain, you can contact the Agencia Española de Protección de Datos (AEPD). You do not have to contact us first.
7. Changes to this policy
We date updates on this page and request any new consent needed before materially changing the purposes or permissions of the service. An update alone does not authorize new uses of your data.
8. Data controller and contact
The data controller for AthleWise is Miguel Angel Castaneda, based in Spain. For privacy questions or requests, email privacy@athlewise.com.