What TrainFurther processes, why it is needed
and which decisions remain yours.
TrainFurther · Alexander Müller
Eimsbütteler Straße 87a
22769 Hamburg
Germany
hello@trainfurther.com
This notice covers the public website and the TrainFurther app, including the connections and coach channels you use. The app is currently intended for invited testers aged 18 or over; open registration is not offered. The data involved depend on your input, connected sources and enabled features.
Data come from your input, your use of the service and providers you explicitly connect. We do not automatically import every item in an external account. Features that depend on required account or training data cannot be provided without those data.
Beta application before account creation: To apply for a closed test round we may process your name, email address, smartphone platform, watch/sports-watch manufacturer and optional model, selected sports, whether you use Intervals.icu, language and an optional testing goal. We also store the timestamps of the privacy acknowledgement and explicit 18+ confirmation plus technical mail-status values. This form does not collect training, sleep, HRV or other health measurements.
Health and recovery information may be special-category personal data under Article 9 GDPR. Processing requires both an Article 6 basis and an applicable Article 9(2) exception. Where consent is relied upon, separate, explicit consent under Article 9(2)(a) GDPR is required for the specified purposes.
Reading or acknowledging this privacy notice is not consent to health-data processing. Merely connecting a data source does not replace that consent either.
You can withdraw consent at any time for the future through the available permission settings or by contacting hello@trainfurther.com. Withdrawal does not affect the lawfulness of processing before withdrawal. Dependent analyses or coach features may then be limited. A messenger connection and permission to use coach data are separate settings.
The public website is hosted through Cloudflare Workers and Static Assets; Cloudflare provides delivery and security services. The app uses Cloudflare Workers, the primary and sport-data D1 databases, and R2 object storage. Visits involve necessary connection data. Operational and security logs may include IP addresses, browser/device information, URLs, timestamps and errors.
Fonts are hosted locally and we do not embed advertising or analytics trackers on this website. Necessary cookies or local information may support sessions, security and requested preferences. Necessary access to your device is governed by Section 25(2) TDDDG; other access requiring consent needs prior consent.
On the homepage, the language preference supplied by your browser is evaluated locally. German, English, Spanish and French are supported, with English as the fallback. This creates neither a language cookie nor a persistent user profile. Direct language-page links remain unchanged.
Intervals.icu is the current external sport data source and connected training calendar. Once connected by you, actually available profile, activity, calendar, wellness and recovery data are retrieved within the granted permissions. OAuth connection details and tokens enable synchronisation; access tokens are processed on the server.
The initial plan and direct one-off changes may be written to the connected calendar through the designated preview and confirmation flow. If the rolling training plan is enabled, TrainFurther can then continue the confirmed plan automatically within defined plan zones and adjust existing sessions without requesting a new confirmation for every follow-up adjustment. A change is treated as applied only after successful calendar readback. You can disable the rolling plan in settings, disconnect in TrainFurther and additionally revoke the app permission in Intervals.icu. Previously imported data are not automatically erased in full by disconnection; see the deletion options in section 12.
For AI replies, TrainFurther sends OpenAI only the context needed for the current task. This may include your question, relevant parts of the conversation, stored Coach memories and selected training, calendar and plan information and – where you have explicitly agreed – health and recovery data. Free text may contain personal information, so complete anonymisation is not promised. Do not include unnecessary identifying details or other people’s data.
Voice messages: If you use the voice feature, your recording is sent to OpenAI so it can be converted into text. TrainFurther does not keep the audio file permanently in this process; the resulting transcript is then handled like a normal text input. A voice message can contain the same personal or health-related information as text.
At present, it is not yet contractually and technically established that every OpenAI processing step takes place exclusively in the EU or that OpenAI keeps no data temporarily. We therefore do not promise this today. We are working to put those settings in place and will update this notice once they are confirmed.
Conversation history and stored memories support follow-up questions. Training suggestions can contain errors. They are not medical advice, diagnosis or treatment and do not replace professional assessment. The initial plan and direct one-off changes follow their respective confirmation flow. An enabled rolling training plan can then continue the confirmed plan automatically within defined zones and adjust existing sessions; a change is treated as applied only after it has been checked against the training calendar. This sports-planning function does not make solely automated decisions about you that have legal or similarly significant effects.
WhatsApp and Telegram: You can use the coach through a channel connected and authorised for your account. TrainFurther processes the account association, messages and replies, identifiers and delivery information. Message contents are also processed as described in section 7 to answer you. Messengers additionally process data under their own privacy notices. Coach processing is not equivalent to a private conversation that remains only on your device.
You can disconnect channels and withdraw coach-data permission in settings. These are different actions: withdrawal does not automatically remove the messenger connection or earlier history. Proactive messages depend on the relevant permissions and channel settings.
Web Push: Where offered for your account and activated by you, the push endpoint, cryptographic subscription keys, device association and delivery status are processed. The push provider depends on your browser or operating system. You can disable push in the app/browser settings. Notifications may be visible on your lock screen.
Apple sign-in: Where enabled, Apple’s identifier associates your account; email and verification details may be included. You can manage the connection in the available account/Apple settings. Ensure you have another available sign-in method before disconnecting.
Weather: Your configured location is sent to Open-Meteo geocoding and the resulting coordinates to its weather API. The current weather-context feature makes server-side requests. Historical weather context may use an activity’s location and time. Remove your configured weather location if you no longer want to use that location-based context.
Contact and email: We process your email address, optional name and message when you contact us. Resend delivers contact-form messages; technical checks including temporary IP-based rate limiting prevent abuse. Incoming emails may be forwarded through Cloudflare Email Routing to the GMX mailbox used for contact. Please avoid unnecessary health information in the public contact form.
The following overview explains which service receives data in which context. Optional providers become relevant only through the corresponding connection or feature. Providers may independently control the operation of their own user accounts and certain security or billing purposes; an API integration does not automatically make every provider our processor.
Website and app operation and security through Workers, website files through Static Assets, app storage in D1 and R2, and technical logs. Processes stored account, sport and communication data needed to operate the app, plus IP addresses, device/browser information and timestamps. Required for the app infrastructure. Provider privacy information.
AI processing through the OpenAI API. Coach requests involve the content described in section 7. Visiting the website alone does not send training data to the AI coach. Provider privacy information.
Sport data source and training calendar connected by you. Covers authorised profile, activity, calendar, wellness and recovery data and connection identifiers. Used only with a connected source; the provider independently operates your Intervals.icu account. Provider privacy information.
Delivery of contact-form messages and, where offered for your account, invitation, account and password-reset emails. Processes recipient/sender addresses, message content and technical delivery information. Provider privacy information.
Optional coach channel through the WhatsApp Cloud API. Phone number or WhatsApp ID, account association, messages, timestamps and delivery/webhook information. Used only with a configured connection and corresponding use/permission. Provider privacy information.
Optional coach channel through the Bot API. Chat/user ID, account association, message content and technical delivery/webhook data. Used only with a configured connection and corresponding use/permission. Provider privacy information.
Optional sign-in where enabled on your sign-in screen. Processes an Apple-specific user identifier and email and verification details supplied by Apple, which may include a private relay address. TrainFurther does not receive your Apple password. Provider privacy information.
Optional weather context: a configured weather location for geocoding and the resulting coordinates for weather requests. Historical activity-weather requests may use activity coordinates and timestamps. Provider privacy information.
Web-push services receive the technical subscription information needed for delivery; the provider depends on your device. GMX processes messages in the contact mailbox. Map views may additionally load external map resources from OpenStreetMap/OpenFreeMap, transmitting the IP address and requested map areas to the relevant provider.
The international services listed above may process data outside the EU or European Economic Area, for example through US providers or their subprocessors. We do not promise exclusively European storage of all data.
Such transfers require a basis under Chapter V GDPR. This may be an applicable adequacy decision or suitable safeguards such as EU Standard Contractual Clauses and additional measures where necessary. The EU-US Data Privacy Framework applies only to an actually certified recipient and covered processing. Merely using a provider does not establish a particular contractual or regional configuration.
You can request information on recipients, transfer grounds and available safeguards applicable to your processing at hello@trainfurther.com. The linked provider information explains their international processing; it does not replace the required assessment of TrainFurther’s specific contractual configuration.
We retain personal data only while needed for the relevant purpose or where a legal obligation or specific legitimate interest requires continued retention. Factors include the duration of your account, history needed for training trends, the status of an enquiry and the need for security records. When the purpose no longer applies, data must be erased or effectively anonymised.
Account data, associated training data, coach conversations and memories are removed through account deletion. Security/error logs, technical deletion or suppression records and backups may follow separate retention processes. Immediate removal of every copy held by every provider is not promised. Where statutory retention or the establishment, exercise or defence of legal claims requires retention, processing remains limited to that purpose.
Deleting TrainFurther does not automatically delete your account or every message held by Intervals.icu, Apple, WhatsApp or Telegram. Further steps and limitations are described on the data deletion page.
Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). You can withdraw consent at any time for the future.
Objection: You may object to processing based on Article 6(1)(f) on grounds relating to your particular situation (Article 21). Contact hello@trainfurther.com to exercise this or your other rights. We may request proportionate identity verification to protect your account.
You may complain to a supervisory authority, particularly where you usually live or work or where an alleged infringement occurred. In Hamburg: Hamburg Commissioner for Data Protection and Freedom of Information.
As TrainFurther develops, we update this notice when processing changes. We will actively inform affected users of material changes, for example in the app or by email. Consent-dependent health-data processing is not expanded simply by silently changing this text; any required new consent must be obtained separately.
Privacy questions: hello@trainfurther.com. See also the imprint, terms of use and data deletion page.
The public website currently uses no non-essential advertising or analytics trackers embedded by TrainFurther. No consent banner is therefore shown at present. Before any non-essential device access or consent-dependent tracking is enabled, the required consent must be obtained in advance and remain revocable.
Explicit KI Coach consent for processing training, health and recovery data is stored separately from acknowledgement of the privacy notice. As of the technical state on 29 September 2026, the evidence includes consent version 2026-09-29.v1, the stated purpose personalized KI Coach using training, health and recovery data, and grant and revocation timestamps. A legacy or unversioned grant does not unlock sensitive processing.
TrainFurther currently sends no newsletter or marketing emails. Account, security, invitation, contact and other service-related messages are transactional. Before advertising or newsletter email is introduced, an appropriate legal basis or required consent and a simple opt-out mechanism will be implemented.