Privacy notice

Last updated 16 October 2026

This notice explains which personal data stimulAI processes, why, and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP / revDSG).

Who is responsible

Visiting the public pages

The landing page, this notice and the legal notice set no cookies and load nothing from other websites. Our web server records your IP address, the page requested, the time and your browser's user agent to keep the service secure and running. These records stay on our own servers in Switzerland and are deleted once they are no longer needed for that purpose.

Data we process when you use stimulAI

• Account data: your name, email address and login details.
• Training data: the activity files your devices record (time, GPS position, heart rate, power, cadence, speed, altitude, temperature) and the profile values you enter (weight, thresholds, heart-rate zones).
• Health data: where you connect a source that provides them, sleep, heart-rate variability, resting heart rate, stress and body composition. The FADP treats health data as sensitive personal data; we process it only with your explicit consent, which you give when you connect the source.
• Your goal and training plan: the training goal you confirm and your availability (training days and hours a week, the day of your long ride, the days you are never available), and the plan the coach makes from them - its weeks and sessions with their targets - with every change to it, how each session was done against it, and the changes the coach proposes to it with your or your coach's decision.
• What you tell the coach: that you are ill, injured, travelling or back, with the days. A report of illness or injury is health data: we show it to you and to a coach you gave your training plan to, use it only to propose changes to your plan, and never send it to the AI coach. You can take a report back at any time, which deletes it.
• Data from connected services: when you connect an account at a device maker or platform (for example Garmin), we receive the data you allowed in that service's consent screen, along with access tokens that let us fetch it. We never ask for or store your password for those services.

Why we process it

• To compute and show your analyses: power-duration curve, critical power, W′ balance, training load, and the weather and terrain of each session.
• To write a coaching debrief of a session, only when you ask for one and only after your explicit consent (see "The AI coach" below).
• To plan your training: the coach's planner - code, not an AI - makes your plan from your goal, availability, training load and threshold; the AI coach explains it, only after your explicit consent. The coach's rules - code too - propose changes to the plan from how your sessions went, your form, readiness and threshold, and what you tell the coach; nothing changes until you, or a coach you gave the plan to, accept.
• To improve stimulAI, only if you agree: if you turn on "Help improve stimulAI" on your profile, we may analyse your training data - your sessions, training load and readiness, and the changes a coach makes to your plan - to improve the coaching, for example to learn which plan changes coaches make and when. The analysis uses your data without your name or account details (pseudonymised). Data from services whose terms forbid AI use, such as Strava and WHOOP, is left out. It is off unless you turn it on, and you can turn it off at any time; data not yet analysed is then left out. When a coach changes an athlete's plan, we keep a record of the change with the coach's login; it is analysed for this purpose without the coach's name, and only for athletes who agreed.
• To run the service securely: logins, error logs and backups.

We do not sell your data or show advertising. Other users see your training only if you invite them - a coach or a friend - and then only what you choose for each of them (workouts, routes, recordings, power profile, health data, AI debriefs, the training plan with what you tell the coach). You can change or withdraw that at any time on the Connections page, with effect at once. When you invite someone by e-mail address, we keep the address only while the invitation is open (seven days at most), use it only to show that person the invitation and send them one e-mail if they have an account, and never tell anyone whether an address has an account. Our administrators may open your data in the app to give you support or fix a problem, never your Strava data; every day this happens is listed for you under Operator access on the Connections page. Technical work on the servers themselves is not part of that list. Nobody but you ever sees data from Strava, whose terms forbid it.

Where it is stored and who else receives it

• Hosting: the service runs on Infomaniak Network SA's servers in its data centres in Geneva, Switzerland. Its test environment runs on a server we operate ourselves in Switzerland; if you use the test environment, your data is stored there.
• AI coach: Infomaniak Network SA, Geneva, through its AI Tools service in Switzerland, for the coaching debrief (see below).
• E-mail: the e-mails we send you - the invitation to create your account, password resets and login codes - go out through our mailbox at Infomaniak Network SA in Switzerland. It sees your name, your e-mail address and the message.
• Backups: encrypted on our servers before upload, then stored with pCloud AG (Baar, Switzerland) in its data centre in Luxembourg. pCloud cannot read them.
• Weather: to look up the weather of a session we send Open-Meteo (open-meteo.com, Austria) the centre of an area of about 36 km² and a date. It never receives your name, account or exact track.
• Maps: when the app shows a route, your browser loads map tiles from the OpenStreetMap Foundation (United Kingdom), which sees your IP address and the area shown. The app also loads its typeface from Google Fonts (Google LLC, USA), which sees your IP address.
• Connected services: the device makers and platforms you connect send us your data. We send them nothing beyond what is needed to fetch it and to revoke access when you disconnect.

The backup copy at pCloud and the weather lookup at Open-Meteo are in the European Union, which, like the United Kingdom, offers adequate data protection according to the Swiss Federal Council. For Google, the transfer relies on the Swiss–US Data Privacy Framework.

The AI coach

When you ask for a debrief of a session, we send a language model what our coach knows about it: the session's figures as the coach computed them from a recording of a service whose terms allow AI use (duration, power and heart rate, time in zones, intervals, best efforts and whether one is your best of the last 90 days, heart-rate recovery between efforts and your usual recovery of the last 90 days, weather and climbing), the thresholds those figures are measured against (your threshold power or Critical Power, W′, your lactate-threshold or maximum heart rate), the session's date and sport, its category or the one you set, the coach's findings with the scientific references behind them, your training load and form around the session, which count the session RPE you gave, the coach's recommendation for the next days, and your body mass. A session whose figures are not computed yet is sent as before: its sport, duration and power figures, and your baseline in that sport (age, weight, critical power, W′ and, for a ride, your FTP). Since 12 October 2026 it also receives your readiness that morning (its state, told from your heart-rate variability, sleep and resting heart rate), how the session ranks against your similar earlier sessions and the trend of your efficiency across them, and, with a training plan, your next planned session. To explain your training plan, we send it your goal and availability, the plan's weeks and sessions with their targets, durations and loads, your fitness and threshold, and how the coach classifies your training where it is confident (the sports you train, how much and how long you have trained, how regularly, how you spread your intensity, and your power profile), which it is checked never to name to you; it changes nothing of the plan. Your own reports about how a session felt are not sent. We do not send your name, e-mail address, GPS track or anything else that identifies you. The model is an open-source model running on Infomaniak's AI Tools in Geneva; Infomaniak does not store the request and does not use it to train any model. Data from services whose terms forbid AI use, such as Strava and WHOOP, is never sent.

The coach writes nothing until you have agreed: the coach card says what is sent and to whom and asks for your explicit consent, which we record with its date. You can withdraw it on the same card at any time. If the coach moves to another provider, or sends more about you than this, we ask again. A thumb up or down you give a debrief is stored with it. The debrief is advice; no automated decision about you is taken.

The stimulAI browser extension

If you install the stimulAI extension for Chrome, it sends your new workouts from Garmin Connect to stimulAI: rides, runs and swims, and your other training - strength, yoga and Pilates, breathing sessions, walks, hikes, nordic skiing, rowing, other cardio, racket, team, combat and water sports, and climbing. Golf, downhill skiing, snowboarding, horse riding and meditation are not sent. It works inside the Garmin Connect page you are signed in to: it reads your list of activities and downloads the original file of each new workout, the way the Garmin page itself does; with "Sync history" it also sends the older ones from a day you choose. It never sees or stores your Garmin password.

• Sent to stimulAI: each workout's original file (FIT, with its heart rate and, where it was recorded, its GPS track) and Garmin's summary of it, with the upload code that links them to your account. Nothing else, and nothing to anyone else.
• Sleep and recovery, only what you tick: under "Sleep and recovery" in the extension, each category has its own switch, all off at first: sleep score and phases (with breathing rate and blood oxygen during the night), overnight HRV, resting heart rate, stress, Body Battery, and steps. For each category you tick, the extension sends its daily values as Garmin Connect shows them, and nothing of the categories you leave off; our server also refuses to store any category you have not agreed to. These are health data; we keep a record of when you agreed to each category and use the values for your analysis. Untick a category to stop: its values are then deleted from your account, and from the copy in our analysis database within a day.
• Kept in your browser only: the upload code, the list of activities already sent, the time of the last sync and a short log, so the extension can show you what it did.
• Not collected: your browsing, other websites, analytics or advertising data.

"Disconnect this browser" in the extension, or removing it from Chrome, deletes what it keeps. The activities already sent are treated like any other training data below.

How long we keep it

We keep your data as long as you have an account. When you ask us to delete it, or close your account, we delete it from the live system within 30 days. Backups that still contain it expire on their own schedule, at the latest after 10 years for yearly archives; we do not restore deleted data from them except to repair the whole system, and then delete it again. Sleep, recovery and body values that are deleted from your account, one at a time or with it, are deleted from the copy in our analysis database within a day.

Your rights

You can ask what data we hold about you and receive a copy in a common format, have it corrected, have it deleted, and withdraw your consent at any time, which stops further processing. Write to info@stimulai.ch; we answer within 30 days. You can also complain to the Federal Data Protection and Information Commissioner (FDPIC), www.edoeb.admin.ch.

Cookies

Once you sign in, we set a single session cookie that keeps you logged in. We use no tracking or advertising cookies.

Changes

When this notice changes, we update the date above and tell signed-in users about significant changes.