Skip to main content

Privacy Policy

Last updated October 19, 2026

Athlon is a fitness-coaching app that organizes your training, syncs data from the health apps, wearables and workout apps you choose to connect, and uses AI to help you plan and reflect on your training. This policy describes what we collect, how we use it, and how you can remove it.

Athlon is operated by JC Technologies LLC. Some features below are on the web only, or open only to invited accounts while we test them. Nothing is collected for a feature you don’t use.

We take the position that the data is yours. We store it to make the app work; we do not sell it, license it to third parties, or use it to train AI models.

Location

Explore uses your device’s location, with your permission, to show your position on the map, to compute distances and walking directions, and to attach a crowd report to where you are standing. Location is read only while the app is open and is not stored except as part of a crowd report you submit. Denying location leaves the map usable; you can search for a place instead.

On the web, what you type in place search goes to MapTiler to find matching places, and the route planner sends MapTiler the approximate start point of your past runs to name them.

Explore contributions

Explore’s places come from Restop, a service we also operate, and you can browse them without a Restop account. To rate, add or fix a place, or post a photo of its entrance, you link a Restop account to Athlon (you can create one when you link). The camera is used only when you choose to take that photo. What you post then belongs to that Restop account and is covered by Restop’s Privacy Policy; Athlon keeps only the link. Crowd reports stay in Athlon: they are aggregated, and deleted with your Athlon account. Deleting your Athlon account, or unlinking in Settings, ends the link and keeps your Restop account.

What we collect

From you directly:

  • Account info (email, name, password hash) via Supabase Auth, and the sign-in methods you add: Sign in with Apple, Google, or a passkey.
  • Your age range, from Apple on iPhone, or the birthday you enter instead. We keep the birthday so the range stays current and never show it to anyone.
  • Profile details you enter: age, biological sex, height, weight, goals, preferred training split, timezone, distance unit.
  • Workouts, sets, intervals, and notes you log in the app.
  • Health documents you upload (lab results, imaging) — stored in a private, per-user storage bucket.
  • AI chat messages and the responses Athlon generates.

Connected providers

You can connect third-party services. Athlon requests only the access listed below and writes to a service only where its entry says so. Each entry also says what happens to that service’s data when you disconnect.

Apple Health

On iPhone, with your permission, Athlon reads from Apple Health, including: workouts with their routes, heart rate, effort score and, for runs, running power, speed, stride length, vertical oscillation and ground contact time; steps, distance, flights climbed, exercise and stand time; active and resting energy; resting, walking and recovery heart rate, heart-rate variability, VO2 max, blood oxygen, respiratory rate and sleeping wrist temperature; sleep; weight, body fat and lean body mass; and dietary energy, protein and water. Athlon writes nothing to Apple Health. It stores what it reads on its servers, so the web app, insights and Coach can use it. Turning off access in the Health app stops new reads; what Athlon already synced stays until you delete your account or ask us to delete it.

Strava

Athlon requests the activity:read, activity:read_all, activity:write, and profile:read_all scopes. Read access to your activities, including private ones, and your profile, to import your workout history and show it to you alone. Write access to activities is used for one thing: setting an activity's gear on Strava when you pick a shoe for it in Athlon. Nothing from Strava is sent to an AI model. Disconnecting Strava here, or revoking Athlon in Strava's settings, deletes the Strava data Athlon synced within 30 days: an activity only Strava recorded is removed, a workout another source also recorded keeps only that source's data, and your gear keeps your own edits but loses its Strava link and mileage. Strava may collect information about how Athlon uses its API, under Strava’s own terms.

WHOOP

If you authorize WHOOP, Athlon requests these scopes: read:recovery, read:cycles, read:sleep, read:workout, read:profile, read:body_measurement, and offline (to keep syncing in the background). We fetch recovery scores, sleep stages, physiological cycles, workouts, profile, and body measurements to power the recovery- and strain-aware features in the app. Nothing from WHOOP is sent to an AI model or sold. Disconnecting WHOOP removes its tokens and hides the WHOOP records Athlon synced from the app. Those records, the profile fields WHOOP filled in, and insights written from WHOOP data stay on our servers until you delete your account or ask us to delete them.

Garmin

Open to invited accounts only. You sign in with your Garmin Connect email and password, which pass through Athlon’s connection service to Garmin and are never stored; Athlon keeps an encrypted Garmin session instead. It reads daily summaries (steps, stress, Body Battery), sleep, heart-rate variability, readiness and body measurements. Disconnecting stops syncing; what Athlon already synced stays until you delete your account. Garmin data can be sent to a third-party AI model when Coach, insights or plan tailoring need it, in the same way as the rest of your health data; there is no separate switch for it yet.

Hevy

With an API key you create in Hevy, Athlon reads your workouts, routines and exercises, and writes routines and custom exercises to Hevy when you send a planned session there or ask Coach to make one. Hevy data is sent to an AI model only if you allow it when you connect Hevy. Disconnecting removes the key and stops syncing; workouts already imported stay.

Runna

You paste the calendar link Runna gives you. Athlon fetches that calendar every few hours, and when you open your plan, to show your Runna sessions there. Disconnecting removes your upcoming Runna sessions from Athlon.

Google Calendar

If you connect Google Calendar, Athlon requests the https://www.googleapis.com/auth/calendar.app.created scope. It uses that access to create a calendar named “Athlon” in your Google account, to create, update and delete workout events inside that calendar, and to read changes you make to those events so both sides stay in sync. Athlon does not read, modify or share events in any other calendar. The workouts in that calendar, including changes you make in Google, are part of your training schedule in Athlon, which Coach can read. Google Calendar data is never sold, used for advertising, or used to train AI models. Athlon’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Disconnecting Google Calendar in Settings revokes the grant and removes the stored tokens.

File import

If you import a FIT, GPX or TCX file, Athlon stores the file privately in your account and reads the workout from it, its route, heart rate and other recordings included. It keeps the file so the workout can be read again if Athlon improves how it reads files. Deleting the workout, using Delete imported data in Settings, or deleting your account deletes the file. Nothing from an imported file is sent to an AI model.

Spotify

If you connect Spotify, Athlon requests the user-read-recently-played scope, and playlist-modify-private only if you turn on saving playlists. With that scope, Athlon creates a private playlist in your Spotify account when you save one, and adds its songs. Every hour it reads the songs you played recently and matches them to your workouts, so a run shows what you listened to. It stores those recently played songs, including ones played outside a workout. Disconnecting stops syncing; songs already on your workouts stay. Nothing from Spotify is sent to an AI model.

How your data is stored

  • Databases and file storage are hosted on Supabase with row-level security: your rows are readable only by your authenticated session.
  • OAuth access and refresh tokens and third-party API keys are encrypted at rest with AES-256-GCM before being written to the database.
  • Backend services run on Vercel; traffic is TLS-encrypted in transit.
  • Tokens are never sent to your browser. All provider API calls happen server-side.

How we use your data

  • To display your workouts, recovery, sleep, and body metrics in the app.
  • To answer you in Coach and to write insights about your training. These send your messages, and the workout, health and training data the answer needs, to a third-party AI model through the Vercel AI Gateway. Data from Strava, WHOOP and Spotify is never sent, and Hevy data only if you allowed it.
  • To tailor a training plan, only when you allow it at the end of setup. Your notes and your setup answers, as categories without your measurements, are shared with a third-party AI model provider through the Vercel AI Gateway. Nothing from Strava, WHOOP or Spotify is included.
  • To sync newly imported workouts to connected calendars.
  • To send transactional email (account actions, errors).

We do not sell or license your data. We do not share it with third parties for advertising. Requests Athlon pays for are sent to the AI model with training on them disallowed. If you add your own AI provider key, requests made with it follow that provider’s terms for your account.

Service providers

These services process data for us to run Athlon:

  • Supabase: database, sign-in and file storage.
  • Vercel: hosting, and Web Analytics and Speed Insights for page views and page performance.
  • The Vercel AI Gateway and the AI model providers it sends requests to.
  • Sentry: error reports.
  • Resend: account email.
  • Maps: Apple Maps on iOS, including Look Around; CARTO, OpenFreeMap, MapTiler and Esri for map tiles and imagery on the web, and MapTiler for place search. These services receive your device’s map requests. Place data comes from OpenStreetMap and from Restop.
  • Google Street View, on a place’s card on the web, under the Google Maps Terms and Google’s Privacy Policy.
  • Sign in with Apple and Google receive only what you authorize at sign-in; if you hide your email with Apple, we hold the relay address Apple provides.

None of them uses your data for advertising.

Retention and deletion

  • Disconnecting a provider stops syncing and removes its tokens. What happens to the data already synced is stated in that provider’s entry above.
  • Deleting your account removes what we hold about you — workouts, health data, health documents, chat history, provider connections, your crowd reports and the link to your Restop account — via a cascade delete from your user record. Your Restop account stays; delete it in Restop.
  • Error reports in Sentry and server logs in Vercel can include your user id and details of a request. They are not removed when you delete your account, and expire on those services’ schedules.
  • Requests already sent to a third-party AI model are not recalled when you delete your account. The model provider keeps them for as long as its own terms allow; requests Athlon pays for are sent with training on them disallowed.
  • A deletion audit log records when a provider disconnect happened for compliance; it contains no user-identifying data beyond the user id for the time window needed.

Your rights

  • Access & export: email us to request a copy of your data (workouts, provider data, health documents, chat history, contributions) in JSON or CSV.
  • Correction: edit profile fields and workouts directly in the app.
  • Deletion: disconnect individual providers from Settings, delete your account, or email us to delete particular data.
  • Portability: exports are in open formats so you can move your data to another service.

Not a medical service

Athlon is not a medical or healthcare service. We are not a HIPAA Covered Entity or Business Associate, and nothing shown in the app is medical advice. Do not rely on Athlon to diagnose, treat, or manage a health condition. Talk to a qualified clinician for medical questions.

Children

You must be 13 or older to use Athlon. A new account gives its age range or a birthday first, and an account under 13 is deleted. If you believe a child has provided data to us, email the address below and we will delete it.

Changes to this policy

We may update this policy as Athlon evolves. Material changes will be announced in-app. Continued use after a change means you accept the updated policy.

Contact

Questions, requests, or data concerns:

JC Technologies LLC. john@athlon.dev.