Privacy Policy

This privacy policy explains how we collect, use, and protect your personal information when you use our service. By using our service, you agree to the collection and use of information in accordance with this policy.

Who We Are

FitKeep is a service by Svaletech ApS, a company based in Denmark, with CVR-number 44104504.

Information We Collect

We collect information necessary to provide our service, such as:

• Email address for account creation and authentication
• Display name, and your profile picture if you sign in with Google
• Birth date and maximum heart rate, if you add them, to calculate your heart rate zones
• Fitness data from uploaded .FIT files, files you import from Google Drive, or connected third-party apps like Garmin Connect™ and Coros, including the model of the device that recorded it
• AI Coach conversation history, if you choose to use the optional AI Coach feature
• Your preferences, such as language, time zone, and theme

We use your IP address only while handling a request, to protect sign-in and other endpoints against abuse. We do not store it with your account or your login sessions.

How We Use Your Information

Your information is used solely to provide the services found on FitKeep, including:

• Provide access and insights to your fitness data
• Process and analyze your fitness data
• Maintain your account and preferences
• Generate AI summaries and AI Coach replies when you request them

Data Storage and Security

Your data is only accessible to you through your account. We do not sell your data or share it for advertising. Your data only leaves our servers in the cases described in this policy: the optional AI features, the sign-in and integration services you choose to use, and the map provider (see Third-Party Services).

Your original .FIT files and your AI Coach conversations are encrypted at rest with AES-256-GCM. Other data, such as the metrics and best efforts calculated from your activities, is stored in our database in the EU.

Optional AI Features

All AI features are optional and off by default. None of them send any of your data anywhere unless you use it.

We never send the contents of your raw .FIT files, your GPS route or location coordinates, or your account email and display name. What is sent is a subset of your computed activity metrics, together with any free text you entered yourself, such as activity names, uploaded file names, and goal names. If you use these features, do not put sensitive personal details in those free-text fields.

AI activity summaries: When you explicitly request a summary for an activity, a subset of that activity’s metrics (such as activity type, distance, duration, pace, heart rate, and elevation), its name, and summary stats about your recent activities of the same type are sent to Google’s Gemini API to generate the summary. This happens only on demand, each time you ask for a summary.

AI Coach: The AI Coach is not active on an account unless it has been enabled for you. When it is active, each message you send, the earlier messages in that conversation, your time zone, and a relevant subset of your fitness data (such as activity metrics, best efforts, and goals) are sent to Google’s Gemini API to generate a reply. Because your own messages are sent as written, do not include anything in them you would not want processed by Gemini. Your coach conversations are stored in your account encrypted at rest, and you can delete any conversation at any time.

Connecting an external AI assistant (MCP): FitKeep offers an MCP server that you can use to connect an outside AI assistant of your choice, such as Claude, to your data. No connection exists until you set one up in that assistant and approve it on a FitKeep consent screen. Once connected, the assistant has read-only access to your fitness data (your activities and their details, training statistics, best efforts, and goals) and to your account’s name and email address, scoped to your account alone. Data you request this way is sent to whichever AI provider you connected and is then handled under that provider’s own privacy policy and terms, which are outside our control. You can review and revoke connected applications at any time from the Applications page in your settings, and revocation takes effect immediately.

For the features that use Google’s Gemini API (activity summaries and the AI Coach), we use Gemini’s paid API tier, which means Google does not use your data to train or improve their models. That use is governed by the Gemini API Terms of Service.

Data Retention

We retain your data as long as your account is active. You may delete your account and all associated data at any time. AI Coach conversations can also be deleted individually from the Coach page whenever you choose.

When you delete your account, we also disconnect your integrations: we ask Garmin to stop sending us your activities, revoke our access to your Google Drive, and delete any background jobs still holding your data.

Some data is kept for a shorter time on its own:

• Login sessions are deleted once they expire, about 7 days after you last used them.
• Background jobs that import or process your activities are deleted after they finish: about a day later for Garmin imports, and about a week later for other processing.

Data Subprocessors

FitKeep is hosted and all data is stored in the EU. We use the following third-party subprocessors:

If you connect an external AI assistant through our MCP server, the AI provider behind that assistant also receives the fitness data you request through it, as well as your account’s name and email address. That provider is one you choose and authorize directly. We have no agreement with it, it is not a subprocessor we engage on your behalf, and its handling of your data, including any retention or model-training practices, is governed solely by its own terms and is outside our control.

Third-Party Services

These services are not our subprocessors. You choose to use them, or your browser contacts them directly, and each handles your data under its own privacy policy.

Google sign-in: If you sign in with Google, Google tells us your name, email address, and profile picture. Google’s handling of your sign-in is covered by the Google Privacy Policy.

Google Drive: If you connect Google Drive, you choose the files to import in Google’s file picker, which your browser loads from Google. We can only access the files you pick. Disconnecting Google Drive, or deleting your account, revokes our access.

Garmin Connect™ and Coros: If you connect one of these apps, it sends us your activities as you record them. Disconnecting it, or deleting your account, deletes our access tokens for it, and for Garmin we also ask Garmin to stop sending us your activities.

Maps: Maps of your activities are made of tiles loaded from OpenStreetMap. When you view a map, your browser requests the tiles for that area directly from OpenStreetMap’s servers, so they receive your IP address and which part of the map you are viewing. Their handling of this is covered by the OpenStreetMap Foundation Privacy Policy. We also load tiles from our own servers to draw activity thumbnails; those requests do not include your IP address.

Website Analytics

We use Umami, a self-hosted privacy-focused analytics tool, to understand how our service is used. Umami does not use cookies and does not collect personally identifiable information. It is hosted in EU on our own Hetzner servers (see Subprocessors section).

The following anonymous data is collected:

• Pages visited (the page’s path only, without search terms, and with IDs removed)
• The website you came from, if any (the site only, not the full address)
• Browser type and operating system
• Device type (desktop, mobile, tablet)
• Country (derived from IP address, which is not stored)

This data is used solely to improve the service and cannot be used to identify individual users.

Cookies

We only use essential cookies required for the service to function. We do not use any tracking or advertising cookies. The cookies we use are:

• Sign-in — keeps you logged in, and secures the sign-in process
• Preferences — remembers your time zone (so dates and charts are displayed correctly), language, and theme
• Connecting integrations — secures the connection when you connect Garmin or Google Drive, and expires after 10 minutes

Contact

If you have questions about this privacy policy, please contact us at [email protected].