AthleteOS Legal center

Privacy Policy

How AthleteOS handles your data.

AthleteOS uses your account, training, recovery, sleep, calendar, and integration data to run the product, generate coaching context, protect accounts, and help you make better training decisions.

Effective June 27, 2026 Includes OAuth integrations Includes AI features
01 Connected data is opt-in.

WHOOP, Strava, Wahoo, and Oura connect only after you approve OAuth access. Planned sources are clearly labeled.

02 Tokens are protected.

Integration tokens are encrypted before storage and are not shown back to the browser.

03 You can delete your account.

Account deletion removes your active AthleteOS account data from the database.

1. Scope

This Privacy Policy applies to AthleteOS websites, app pages, accounts, dashboards, integrations, assistant features, team and coach features, exports, and related services.

This Policy does not control the privacy practices of third-party providers you connect or services that help operate AthleteOS, such as connected fitness platforms, calendar providers, hosting providers, database providers, email delivery providers, analytics providers, AI providers, or other configured providers. Their own policies apply to their services.

2. Information AthleteOS Collects

  • Account data: name, email address, password hash, session records, login status, and account settings.
  • Profile data: sport, training preferences, goals, units, role, team setup, and onboarding answers.
  • Training data: sessions, planned sessions, workouts, duration, distance, pace, load, RPE, notes, tags, and exports.
  • Recovery and health-related data: sleep, readiness, recovery, HRV, resting heart rate, strain, heart rate, steps, calories, body metrics, and wellness check-ins.
  • Calendar data: planned and completed sessions published or read through connected calendar features.
  • Team data: team membership, coach notes, athlete summaries, interventions, and coach-facing views.
  • AI interaction data: prompts, generated responses, structured context, citations, action buttons, and assistant metadata.
  • Technical and analytics data: cookies, CSRF tokens, security events, error details, request metadata, browser state, diagnostic logs, product usage events, and performance signals.

3. Connected Sources

When you connect a provider, AthleteOS receives data through that provider's API according to the scopes you approve. Current available connected sources may include WHOOP, Strava, Wahoo, and Oura. Manual logging can also be used without connecting a provider. Google Calendar, Apple Health, Garmin, and other sources may appear as coming soon, in progress, disabled, import-only, or otherwise limited until they are fully supported.

AthleteOS may store imported provider data, transformed metrics, sync metadata, and encrypted access or refresh tokens needed to keep the integration working. You can disconnect supported providers in the app.

  • WHOOP may provide recovery, sleep, strain, workout, body, profile, HRV, and heart-rate-related data.
  • Strava may provide activity, distance, pace, heart-rate, and effort data for the authorized user.
  • Wahoo may provide user profile, workouts, cycling, heart-rate, power, and training device data.
  • Oura may provide readiness, sleep, HRV, activity, workout, stress, and profile data.
  • Google Calendar, Apple Health, and Garmin may be shown as planned, coming soon, in progress, or limited features until stable access is available.

4. How AthleteOS Uses Information

  • Authenticate users and protect accounts.
  • Operate dashboards, logs, analytics, reviews, calendar tools, and coach/team views.
  • Sync connected data and merge duplicate workouts from multiple providers.
  • Generate readiness, recovery, sleep, strain, load, and trend summaries.
  • Send password reset or account-related emails through the configured email provider.
  • Generate AI-assisted answers and training decision support.
  • Measure product usage, onboarding progress, feature adoption, and performance with privacy-conscious analytics.
  • Debug, secure, monitor, and improve the service.
  • Comply with legal obligations and enforce the Terms.

5. AI Processing

Ask AthleteOS and coach copilot features may send your prompt and selected structured AthleteOS context to a configured AI provider. Context can include recent sessions, metrics, sleep, recovery, wellness, planned-session or calendar context when available, team context where applicable, and integration status needed to answer your question.

AthleteOS tries to send relevant context rather than unnecessary raw account data. Do not enter sensitive information into the assistant unless you want it processed for an answer.

6. How Information Is Shared

AthleteOS may share information with:

  • service providers that host, store, email, secure, monitor, or operate AthleteOS
  • AI providers used to generate assistant and copilot responses
  • connected providers as part of OAuth, token refresh, sync, and revocation workflows
  • authorized coaches, athletes, team owners, or team members when team features make data visible
  • legal, safety, or security recipients where required by law or needed to protect rights and service integrity

7. Hosting, Storage, and Security

AthleteOS uses cloud services to operate the production product, including app hosting, database storage, account email delivery, product analytics, error monitoring, and AI assistant processing. Provider availability can change as AthleteOS evolves.

AthleteOS uses reasonable safeguards such as HTTPS, secure cookies in production, CSRF protections, password hashing, encrypted integration tokens, and access controls. No system can guarantee perfect security.

8. Cookies and Local Storage

AthleteOS uses cookies and browser storage for login sessions, session hints, CSRF protection, preferences, onboarding state, product tour state, analytics, and app functionality. Blocking these may break login or app features.

9. Your Choices

  • Disconnect an integration to stop future sync for that provider.
  • Delete sessions, logs, or settings where the app supports it.
  • Delete your account from settings where available.
  • Revoke OAuth access from the provider's own account settings if you want to cut provider-side access too.
  • Use export tools to download certain data before deletion.

10. Retention and Deletion

AthleteOS keeps data while your account is active and as needed to operate the service. Account deletion removes active account data from the production database, including sessions, settings, integrations, team membership, and saved app data. Limited logs, backups, or records may be kept temporarily where needed for security, fraud prevention, legal compliance, or dispute handling.

11. Privacy Rights

Depending on where you live, you may have rights to access, correct, delete, restrict, object to processing, withdraw consent, or receive a portable copy of certain information. AthleteOS may need to verify your identity before completing a request.

12. Children's Privacy

AthleteOS is intended for adults 18 and older unless a separate team, school, club, guardian, or organization arrangement supports supervised use. If you believe a child provided information improperly, contact AthleteOS at support@athleteos.health.

13. International Processing

Information may be processed in countries other than where you live. Where required, AthleteOS takes steps intended to provide appropriate protection for international processing.

14. Changes to This Policy

AthleteOS may update this Privacy Policy as the service, providers, or legal requirements change. The effective date will be updated when the Policy changes.

15. Contact

For privacy questions, account deletion help, or data requests, contact support@athleteos.health. For product feedback or bug reports, contact feedback@athleteos.health.