Who is responsible
GO TO AGENCY, SAS, [REGISTERED ADDRESS] (we) is the data controller for the personal data processed through TrainAlone.
For any question about your data or to exercise your rights, write to [CONTACT EMAIL]. We have not appointed a data protection officer; requests are handled directly by the team.
Data we collect
- Account
- Name, email address, password (stored only as a secure hash, never readable), your Google account identifier if you sign in with Google, your language.
- Training profile
- Your answers to the questionnaire (goal, level, days per week, equipment, session length), the injuries or limitations you choose to mention, and the measurements you enter, such as height and body weight.
- Training log
- Sessions, exercises, sets, repetitions, loads, effort ratings and notes; the text of your voice notes and of the workouts you paste.
- Program and calendar
- Generated programs, planned sessions, and the private link of your calendar subscription.
- Plan and billing
- Your plan, monthly usage counters (dictation minutes, generations), and, if you subscribe to Pro, your Stripe customer and subscription identifiers and subscription status. We never receive your card number.
- Connected services
- If you choose to connect Google Calendar or Strava, the access tokens needed to sync and the data you allow them to share.
- Technical data
- IP address, browser type and request logs kept by our server for security; your push subscription if you turn on notifications.
- Messages
- The emails you send us.
We do not ask for more than the service needs. Fields marked optional can be left empty.
Voice notes and AI
Dictation. A voice note becomes text in one of two ways, depending on your device and on what is enabled:
- On our server: the recording is sent over an encrypted connection to our transcription provider, Mistral AI (European Union), turned into text, and not kept by us once transcribed.
- In your browser: the speech recognition built into your browser is used. Its vendor (for example Google in Chrome, Apple in Safari) may process the audio under its own privacy policy; we receive only the text.
Structuring and programs. To turn a transcript into exercises and sets, or to generate a program, the text of the session or your questionnaire answers may be sent to an AI provider (Mistral AI and/or Anthropic). We send only what the task needs, never your email address or password. We use these providers under their business terms, which do not allow them to use the data we send to train their models. When no provider is configured, a local parser on our own server is used instead.
Why we use it, and on what legal basis
- Running the service
- Account, training log, program generation, calendar, progress, support. Basis: performance of the contract (GDPR art. 6.1.b).
- Health information
- Injuries, limitations and body measurements can reveal information about your health. Giving them is optional; we use them only to adapt your program, with your explicit consent (art. 9.2.a), which you can withdraw at any time by deleting them.
- Billing
- Managing the Pro subscription and keeping invoices. Basis: contract and legal obligation (art. 6.1.b and 6.1.c).
- Service emails
- Account confirmation, password reset, billing and important changes. Basis: contract. We do not send marketing emails without your consent.
- Security
- Server logs, abuse limits, fraud prevention. Basis: our legitimate interest in protecting the service and its users (art. 6.1.f).
- Audience measurement
- If enabled, aggregated, cookieless statistics on page visits with Datalenk, to improve the site. Basis: legitimate interest. No profile is built and no data is shared for advertising.
- Notifications
- Session reminders by push notification, only if you allow them in your browser. Basis: consent, withdrawn at any time in the app or the browser settings.
How long we keep it
- Account and training data
- As long as your account exists. Deleted within 30 days of your account deletion. If an account is not used for 3 years, we may delete it after warning you by email.
- Health information
- Until you delete it or your account, whichever comes first.
- Audio
- Not stored by us: browser dictation never sends it to us, and server-side transcription discards it once the text is produced.
- Invoices and billing records
- 10 years, as French accounting law requires.
- Server logs
- At most 12 months.
- Support emails
- 3 years after our last exchange.
- Backups
- Database backups are overwritten on a rolling basis within 30 days, so deleted data also disappears from them.
Who processes it
Your data is accessible only to the people at GO TO AGENCY who need it to run the service, and to the providers below, each acting on our instructions and only for the purpose stated.
- Hosting
- [HOSTING PROVIDER], [HOSTING PROVIDER ADDRESS]. Servers operated by GO TO AGENCY, located in: [SERVER LOCATION].
- Payments
- Stripe Payments Europe, Ltd. (Dublin, Ireland), once Pro opens. Stripe handles card data under its own security certification.
- [EMAIL PROVIDER], to send account and billing emails.
- Transcription and AI
- Mistral AI (Paris, France) and/or Anthropic PBC (San Francisco, United States), only when these features are turned on.
- Audience measurement
- Datalenk, cookieless and aggregated, if enabled.
If you choose to sign in with Google or to connect Google Calendar or Strava, those companies receive or share data as you authorise, under their own privacy policies.
We may disclose data to authorities when the law requires it. We never sell your data and we do not use it for advertising.
Transfers outside the European Union
Your data is stored on our servers ([SERVER LOCATION]). Some providers (for example Anthropic, or Stripe and our email provider for parts of their service) may process data outside the European Union. In that case the transfer is covered by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified companies, or by the Commission's standard contractual clauses. You can ask us for a copy of these safeguards.
Security
Connections are encrypted (HTTPS). Passwords are stored as hashes. The database runs on an isolated server, access is limited to the people who need it, and backups are made regularly. No system is risk-free: if a breach affects your data, we tell you and the CNIL as the law requires.
Your rights
You have the right to access your data, correct it, delete it, receive it in a portable format, restrict or object to its processing, and withdraw your consent at any time. Under French law you can also give instructions about what happens to your data after your death.
- Export: download all your data from your Profile, in a machine-readable format.
- Delete: delete your account and its data from your Profile.
- Anything else: write to [CONTACT EMAIL]. We answer within one month. If we have a reasonable doubt about who is asking, we may ask you to prove your identity.
If you think your rights are not respected, you can lodge a complaint with the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, cnil.fr, or with the data protection authority of your country.
Children
TrainAlone is meant for people aged 16 and over. We do not knowingly collect data about younger children; if you think a child has created an account, tell us and we will delete it.
Changes to this policy
We update this policy when the service or the law changes. The date at the top shows the latest version. For significant changes we tell you by email or in the app before they apply.