Privacy Policy
Last updated: 17 October 2026.
Ultrathlete is an AI coach for ultra running: an app that plans your training and talks it through with you. This policy says what data we collect, why, who handles it and what you can do about it, and it lists only what the service actually collects.
Who we are and how to reach us
Ultrathlete is run by Ultrathlete Srl, Frazione Champlan Dessous 14/A, 11020 Gressan (AO), Italy (the “controller” of your data). For anything about your data, write to privacy@ultrathlete.ai. Our full company details are in the legal notice.
What we collect
Only what the coaching needs, and nothing we don’t use. Most of it you give us yourself, in the app or in the chat with your AI coach.
- Your account: your name, email address, date of birth, sex, units and time zone. Your password is held by our sign-in service (Amazon Cognito); we never see it.
- What you tell your coach about yourself: your training background, the days and hours you can train, where you train (terrain, altitude), how you like to be coached, and, if you choose to share them, injuries and health notes, your resting and maximum heart rate, your weight, and for fuelling: what you eat and drink in training, how your gut copes, your sweat rate, allergies and intolerances.
- Your races: the races you’re training for (name, date, distance, target time) and, if you upload one, the course file with its route and elevation.
- Your recorded training: each session you record, from a connected account or a file you upload: its sport, time, duration, distance, elevation, heart rate, power, cadence, pace, temperature, the GPS track and the device that recorded it. We keep the original file and a second-by-second copy of its data to analyse it.
- How your sessions went: the effort, the feeling and the comments you give after a session, the sessions you mark done by hand, and what you ate and drank on them.
- Your conversation with your AI coach: your messages and its replies, the short notes it keeps about you (see “Your AI coach” below), and your ratings of its messages.
- What we work out from it: your training plan and sessions, your load, fitness base and freshness, your heart-rate, power and pace zones and thresholds, and the figures that compare a session with similar ones.
- Your connections: when you connect Garmin Connect or another platform, your account’s identifier there, the permissions you granted and the keys that let us fetch your recordings (stored encrypted).
- How you use the app: events such as “opened the calendar” or “sent a message”, with the screen, the app version and the size of your screen. Never the content of your messages.
- Sign-up checks: when you create an account, your email and IP address are kept for two days to stop abuse of the invitation codes, then deleted. If you arrived from a campaign link, we keep which campaign and page brought you.
- Product feedback you send from the app, with the screen you sent it from and your device type.
What we don’t collect. We don’t read your sleep, heart-rate variability, stress, body composition or daily activity from any device, your location outside the sessions you record, your contacts or your photos. We take no payments yet, so we hold no payment details.
Why we use it and on what legal basis
- To coach you: build and adapt your plan, read your sessions, answer you in the chat, send your sessions to your device and email you your coach’s notes. Basis: our contract with you (GDPR art. 6(1)(b)).
- Health data and AI coaching: your heart rate, injuries, health notes, weight, allergies and intolerances are a special category of data, and your AI coach reads them. We process them only with your explicit consent (art. 9(2)(a)), which we ask for separately when you create your account, before your coach reads anything, and again before we read data from a connected account. You can withdraw it at any time in Settings; see “Your rights”.
- To keep the service working and safe: fixing problems, preventing abuse, checking the quality of the coaching and understanding how the app is used. Basis: our legitimate interest (art. 6(1)(f)).
- To meet legal obligations, such as answering an authority. Basis: art. 6(1)(c).
We don’t use your data for advertising, we don’t sell it and we don’t share it with advertisers.
Your AI coach
Ultrathlete’s coaching is produced by artificial intelligence. A large language model writes and adapts your training plan, reads your sessions, writes your daily and weekly notes and answers you in the chat, following coaching rules written from decades of endurance racing and coaching. Every message it writes is labelled “AI coach” in the app, and the app reminds you above every conversation that its recommendations are AI-generated and can be wrong.
What it sees. To coach you, the model is given your name, age, sex, what you’ve told it about yourself (health notes included), your plan, summaries of your recent sessions and their figures, how they felt, what you ate on them, its notes about you and your conversation. It is not given your email address or your GPS tracks.
Who runs it. The model is provided by Anthropic, which processes these requests on its servers in the United States as our processor. Under its commercial terms Anthropic does not use them to train its models and keeps them only for a limited time for safety monitoring.
What it remembers. Your coach keeps short notes of what you tell it (a niggle, a preference, a constraint) so it doesn’t ask twice. You can read them in your profile and have any of them removed by asking in the chat.
What it decides. It recommends training. It is not a medical device and nothing it says is medical advice. It asks you before changing your plan on its own initiative, and whether you follow a session is always your decision. No decision with legal or similarly significant effects on you is made by automated means alone (GDPR art. 22).
Your data is never used to train an AI model, ours or anyone else’s.
Garmin
- Connecting. We receive Garmin data only after you connect your Garmin Connect account through Garmin’s own consent screen, and only for the permissions you grant there. Before the first activity is read, we ask for your explicit consent to your AI coach processing your Garmin data, and record when you gave it.
- What we receive. The activities you record: the activity file (the session’s figures and GPS track, as listed above) and the name of the device that recorded it. We don’t ask for Garmin’s health data (sleep, stress, heart-rate variability, body composition or daily summaries).
- What we send to Garmin. Only if you choose it: the sessions your coach plans, so they appear on your watch. Before anything is sent we show you what will be written to your Garmin Connect account, with a link to Garmin’s privacy notice, and ask for your consent once.
- How it is used. Only to coach you: your AI coach reads your Garmin activities as described in “Your AI coach”, and every screen or insight that draws on them says so. Garmin data is processed by Amazon Web Services (hosting and storage), Anthropic (the AI model) and Fastmail (our team’s email: an alert to us about one of your coach’s messages may quote it, and so may your reply to one of our emails), and by no one else.
- Never for AI training. Your Garmin data, and anything derived from it, including your coach’s messages about it, is never used to train, test, evaluate, benchmark or improve any AI model, and is not stored in a way that would allow it.
- Withdrawing and disconnecting. You can withdraw your consent at any time by disconnecting, in the app or in Garmin Connect: we stop receiving data from that moment and delete our access keys. When you disconnect in the app you choose whether the Garmin activities we already hold stay in your training history or are deleted; they are deleted with your account in any case.
- Garmin’s own handling of your data is governed by the Garmin Connect privacy notice.
Other platforms and file uploads
Other watches and training platforms (such as COROS, Suunto, Polar or TrainingPeaks) connect through Terra, a data integration provider: when you connect one, Terra passes us the activity files you record, the same data as above, and, if you choose it, sends your planned sessions to that platform. You can also upload activity files yourself. Disconnecting stops new data the same way.
International transfers
Your data is stored in the European Union (AWS Frankfurt). The AI model runs in the United States, where the transfer relies on the European Commission’s Standard Contractual Clauses (or the EU–US Data Privacy Framework where the provider is certified). Terra is in the United Kingdom, which the European Commission recognises as protecting personal data adequately. Emails you send us are kept in Amsterdam, with a copy and backups in the United States under the same clauses.
Emails we send
Your coach’s notes (after a recorded session, on Sunday for the week ahead and, if you choose it, every morning), messages about your account and membership, and, if you joined the waitlist, its confirmation and your invitation. You choose which notes arrive by email in Settings.
The waitlist and the contact form
- Joining the waitlist: we keep your email, whether you are an athlete or a coach, which page you joined from and, if you came from a campaign link, which one, until you leave the list (every email we send has the link) or we have invited you.
- The contact form: your message, name and email are emailed to us so we can reply, and not stored anywhere else.
How long we keep it
- Your account, profile, training, plans and conversation: for as long as you have an account. When you delete it, everything is erased within 30 days, and leaves our backups within a further 60 days.
- Server logs, which record requests to the service and errors: 90 days.
- Usage events contain no message content and are kept for 24 months; when you delete your account they are no longer linked to you.
- Sign-up checks: 2 days. Notices from Garmin about new activities: 30 days.
Security
Data is encrypted in transit and at rest, the keys to your connected accounts are encrypted separately, and access is limited to the people who run the service. No system is perfectly secure; if a breach affects you, we’ll tell you and the authority as the law requires.
Your rights
Under the GDPR you can access your data, correct it, delete it, get a copy in a portable format, restrict or object to its processing, and withdraw your consent at any time (which does not affect what was done before). Most of it you can do yourself in the app: download a copy of your data or delete your account in Settings, withdraw your consent there, correct what your coach knows by telling it, remove its notes by asking in the chat, disconnect a device in Connected apps. For anything else, write to us and we’ll reply within one month.
You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live.
Age
Ultrathlete is for adults aged 18 or over, and you confirm your age when you create your account. We don’t knowingly hold data about anyone younger; if we find we do, we delete it.
Changes
We’ll update this policy as the product changes. For a material change we’ll tell you in the app or by email before it takes effect.