Privacy notice

What we hold about a coach

When you hold an account we store:

• your name and email address (from you, or from Google if you sign in with it), so the account exists and we can write to you;
• a password hash, if you set a password — never the password itself;
• your language, so the interface is in it, and when you last signed in;
• records of the emails we sent you, with their text, and whether they arrived;
• billing records, if you pay us: your plan, the amounts and the bank transfers recorded against your subscription.

What we hold about an athlete

Whatever their coach records, whatever the athlete adds, and what arrives from Strava or a watch file. In practice:

• their name and an email address, which is where the sign-in code is sent;
• the intake profile a coach may write: goal, days available, weekly distance, experience, and free-text notes on constraints such as work or family — what is written there is up to the coach;
• training: planned sessions, what was actually done, how hard it felt, notes, races, personal bests and time away from training;
• from Strava and watch files: sport, time, distance, heart rate, laps, cadence, climbing, calories and the steps of the workout the watch ran;
• health data: injuries and their severity, resting and maximum heart rate, heart-rate zones, VO2max and test results;
• sign-in details: the codes we email and the session that follows.

What we do not keep or do

We do not store GPS tracks or routes, and we do not use location. We do not keep the original watch files, only the figures read from them.

We do not sell data, we do not give it to advertisers, and we do not use it to train any artificial-intelligence or machine-learning model — Strava data in particular.

Athletes' health data

Heart rate, injuries, test results and the like are health data. Under the GDPR (Art. 9) this is a special category of personal data and needs a stronger basis than ordinary information. That basis is the athlete's explicit consent.

Splitbook asks for it when the athlete first signs in, naming their coach, and records the date and the version of this notice. It can be withdrawn at any time on the athlete's Privacy page: that signs every device out and the coach loses access. We ask again when this notice changes.

Where it comes from

From the coach, from the athlete, from Strava once an athlete connects it, and from watch files uploaded by an athlete or a coach. A coach's own details come from the coach and, when they sign in with Google, from Google.

Technical data

Our servers record details of each request, such as the IP address, the time and the page asked for, to keep the service secure and working. They are kept for 30 days.

Why we hold it, and on what basis

You do not have to give us any of it, but a coach needs an account to use Splitbook, and an athlete who does not consent to the health-data processing cannot use the athlete's pages. The bases are:

• to provide Splitbook to a coach — a contract (GDPR Art. 6(1)(b));
• athletes' health data — the athlete's explicit consent (Art. 9(2)(a)); the rest of an athlete's data we process on the coach's instructions, and the coach, as controller, answers for its basis;
• to keep the service secure and working — the check that tells a person from a script, rate limits, the password-leak check and logs — our legitimate interest (Art. 6(1)(f));
• invoices and accounts — a legal obligation (Art. 6(1)(c));
• counting visits to the public pages with Google Analytics — your consent, which you give or refuse in the banner (Art. 6(1)(a)).

Who else sees it

Only the people and suppliers needed to run the service:

• an athlete's coach and, if the athlete has approved one, a co-coach, who sees the same training and health data (the athlete can end that access);
• our own administrators, as far as support, billing and fixing email delivery need; the mail queue, which holds links and codes, can be opened only by them;
• Microsoft Azure, which hosts the site, the database and the backups in Poland (the Poland Central region);
• Webio, the Polish provider through which we send and receive email;
• Cloudflare, which serves the site and runs the check on the sign-up, password-reset and resend forms that tells a person from a script. It sets no cookies for that check;
• Google, if you sign in with it: we receive your name and email address, and Google learns that you signed in to Splitbook;
• Strava, if an athlete connects it — see below;
• Have I Been Pwned, which tells us whether a password you are choosing has appeared in a published data leak, so we can warn you. It receives only the first five characters of a hash of that password — never the password, its full hash or anything about you;
• Google Analytics, on the public pages and only if you accept it — see Analytics below;
• nobody else. There is no advertising tracking on this site.

Outside the European Economic Area

Hosting and email stay in Poland. Cloudflare, Google, Strava and Have I Been Pwned are based in or operate from the United States, so data sent to them may leave the EEA. We rely on the safeguards the GDPR provides: the EU–US Data Privacy Framework where the supplier is certified under it, and standard contractual clauses otherwise. Write to us for details.

Strava

An athlete can connect Strava on the Devices page. We then ask Strava for permission to read their activities; Splitbook never posts anything there. We store the access token encrypted and import runs and other activities — time, distance, heart rate, laps and best efforts — which the coach (and a co-coach) then see in the athlete's plan.

Disconnecting stops the sync and removes from the athlete's week and the coach's view the activities that came only from Strava. Access can also be withdrawn in Strava's own settings. We use Strava data for nothing but showing it to the athlete and their coach. What Strava itself holds is governed by Strava's privacy policy.

How long

For as long as the account exists. Archiving an athlete keeps their history and removes their access, which is deliberate — a coach who parts with an athlete should not lose the record of the work.

When an athlete withdraws consent, the coach loses access and the athlete is signed out; their history stays until they ask us to delete it.

Close your account and we delete everything within 30 days, apart from invoices, which tax law requires us to keep for longer. Backups are kept for 35 days and then age out.

A sign-in code is valid for 10 minutes. Server logs are kept for 30 days.

Your rights

You may ask for a copy of your data, correct it, delete it, restrict how it is used, take it elsewhere, or object to how we use it. Where we rely on your consent you may withdraw it at any time; that does not make what happened before unlawful. Write to hello@splitbook.run and we will answer within a month.

An athlete who wants any of this can ask their coach, since the coach decides what is recorded, or write to us directly from the Privacy page in the athlete's pages.

Splitbook calculates training load and may propose changes to a plan. A proposal does nothing until the coach approves it, and no decision with legal or similarly significant effect is taken by software alone.

You may also complain to your data protection authority. In Poland that is the President of the Personal Data Protection Office.

Cookies and similar

Splitbook sets only what the service needs to work or to remember a choice you made, which does not require consent:

• signing in: a session for a coach; for an athlete, a session (30 days) and a short-lived cookie (10 minutes) while a code is being entered;
• your language (one year);
• whether the side menu is collapsed;
• the Cloudflare check on forms sets none.

Analytics

On the public pages — never in the coach portal or on the athlete's pages — a banner asks whether we may count visits with Google Analytics. Until you press Accept nothing from Google loads and no analytics cookie is set; Decline closes the banner and nothing loads.

If you accept, Google receives your IP address, the pages you view and details of your browser and device, and sets cookies to tell visits apart. We use it only for totals, such as how many people read the pricing. Change your mind at any time with “Analytics settings” in the footer: it clears those cookies and stops the tag. Your answer is kept in your browser's local storage, on your device only.

Security

Passwords are hashed. Sign-in codes and link tokens are stored in the database only as hashes. The copies of the emails we send — which contain the link or code — are kept in the mail queue that only our administrators can open; a code lasts 10 minutes and works once, and a link is single-use or expires.

An athlete signs in with a six-digit code emailed to the address their coach entered. It is valid for 10 minutes, works once and stops working after five wrong tries. The link in an invitation reads and changes nothing and shows only a first name, a coach and a masked address, so forwarding it gives no access. A session lasts 30 days in a cookie that scripts cannot read; an athlete can sign out everywhere, a coach can sign an athlete out of every device, and archiving or withdrawing consent does it automatically.

Traffic is encrypted in transit and Strava access tokens are encrypted when stored. The data is held in Poland.

Changes

If this notice changes materially we will say so before the change takes effect, and athletes are asked to agree to the new notice. The date at the top is when it was last written.