Privacy Policy

This policy explains what personal data we collect when you use Custom Gains at customgains.fit and our app, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).

Data we collect

• Account data — your name and email address, and an encrypted (hashed) password if you sign up with one. If you sign in with Google, we receive your basic profile (name, email).
• Garmin Connect data — when you choose to connect Garmin, we access your training and activity data (for example workouts, distance, duration, heart rate, pace and cadence) so the coach can build and adapt your plan and push structured workouts to your device. Your Garmin connection credentials and session tokens are encrypted at rest and used only to provide this service.
• Coaching content — your goals, the chat messages you exchange with the AI coach, the workouts and plans created for you, and any weight entries you log.
• Billing data — if you subscribe, our payment processor handles your card details; we receive your subscription status and billing metadata (we never see or store full card numbers).
• Usage and diagnostic data — basic analytics (pages viewed, key actions) and error/crash diagnostics, used to operate and improve the product.
• Support data — messages, screenshots or recordings you voluntarily send us through the in-app feedback tool.

Why we use it & legal bases

• To provide the service — run your account, generate and sync workouts, adapt your training (legal basis: performance of our contract with you).
• To connect Garmin — only after you explicitly link your account (legal basis: your consent, which you can withdraw at any time by disconnecting Garmin).
• To take payment — manage subscriptions and invoices (legal basis: contract).
• To secure and improve the product — analytics, error monitoring, fraud and abuse prevention (legal basis: our legitimate interests in a reliable, secure service).

AI processing

Your coaching conversations and relevant training data are processed by a third-party large-language-model provider (Anthropic) to generate coaching responses and workout plans. This data is sent solely to produce your coaching and is not used by us to train AI models.

Service providers we share data with

We share the minimum data necessary with vetted processors who act on our instructions:

• Anthropic — AI coaching responses.
• Garmin — to read your activities and publish workouts to your devices, at your request.
• Stripe — payment processing.
• Hosting & infrastructure — our servers are hosted in the EU.
• PostHog (analytics) and Sentry (error monitoring) — operated in EU data regions.
• Resend — transactional email (e.g. password resets, reminders).

We do not sell your personal data.

International transfers

We aim to keep data within the EU/EEA. Where a provider processes data outside the EEA, it is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Data retention

We keep your personal data for as long as your account is active and as needed to provide the service. When you delete your account we delete or anonymise your personal data within a reasonable period, except where we must retain certain records (for example billing records) to meet legal obligations.

Security

We protect your data with encryption in transit and at rest, access controls, and reputable infrastructure providers. Sensitive items such as Garmin credentials and tokens are encrypted at rest. No system is perfectly secure, but we work to safeguard your information and to limit who can access it.

Your rights

Under the GDPR you have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent at any time. You can disconnect Garmin or request account deletion from within the app, or email us at taavi@customgains.fit. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or your local supervisory authority.

Children

Custom Gains is not intended for children under 16, and we do not knowingly collect their data.

Changes to this policy

We may update this policy from time to time. We will post the revised version here and update the "Last updated" date above; significant changes will be communicated to you where appropriate.

Contact

TaaviTaavi OÜ, Estonia
Email: taavi@customgains.fit