Privacy Policy

This policy applies to the website afasteryou.com, the web platform and the “A Faster You” app for Android and iOS. It explains which data we process, for what purpose, who receives it and what rights you have.

1. Controller

Aerotune GmbH (brand: A Faster You), Kreuzkoppel 134a, 24943 Flensburg, Germany
Email: info@afasteryou.com

2. Summary

• We calculate your metabolism and a training plan from your training and body data. This includes health data such as heart rate, weight and sleep. We process it only with your explicit consent.
• We do not show third-party advertising and do not sell data. We never use your health data for advertising and do not pass it on to advertising partners. We do not use third-party analytics or advertising services such as Google Analytics or the Meta Pixel; we keep our own usage statistics (3.9).
• Your values are calculated by our own AI models on our servers. The AI coach and voice input use service providers in the USA and are only active if you agree to them. How we use AI is set out in the AI transparency statement (3.11).
• You can delete your account yourself at any time — on the web and in the app.

3. Which data we process

3.1 Account and profile

Required: email address and password (stored only as a hash), or sign-in with Google or Apple. Without these we cannot create an account. From Google or Apple we receive your email address, your name, an account identifier and, from Google, the address of your profile picture.

Optional: first and last name, phone number, profile picture, country, city and address. If you enter a place, we derive coordinates from it to determine weather and time zone. Language and time zone are taken from your settings.

Purpose: providing your account. Legal basis: contract (Art. 6(1)(b) GDPR).

3.2 Body and health data

Needed for the calculation: sex, date of birth, height, weight, heart rate from your activities and the results of your powertests — maximal oxygen uptake (VO2max), maximal lactate production rate (VLamax) and threshold power. Without these we cannot calculate metabolic values, training zones or your plan.

Optional: body fat, further body measurements, maximum heart rate, lactate values, sick days you report and — if your connected service provides them — sleep, heart rate variability, resting heart rate, stress and daily activity. Without them we use default values, or your plan adapts less precisely to your recovery.

Purpose: calculating your metabolic values, training zones and training plan, and adapting the plan daily. Legal basis: your explicit consent, which we ask for separately at registration (Art. 9(2)(a), Art. 6(1)(a) GDPR). You can withdraw it at any time. Because we cannot provide the service without this data, you withdraw by deleting your account (section 8); we then delete your health data. You can remove individual optional details from your profile at any time. Processing before withdrawal remains lawful. Disconnecting a connected service (3.4) only stops further data exchange and is not a withdrawal.

Your plan is adapted automatically according to fixed calculation rules. We do not make solely automated decisions that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

3.3 Training data

Activities with time, duration, power, speed, heart rate and — if recorded — GPS track, as well as your training plan, goals and races. The app itself does not access your device's location; tracks come from your recording devices or connected services.

Legal basis: contract (Art. 6(1)(b) GDPR); where health data is included, your consent under 3.2.

3.4 Connected services

You can connect your account to services of other providers (Zwift, Garmin, Wahoo, ROUVY, Polar, Suunto, Hammerhead).

• Import: after you authorise it with the provider, we retrieve activities and — depending on the provider — health data (e.g. sleep, heart rate variability). Legal basis: contract (Art. 6(1)(b)) and, for health data, your consent under 3.2.
• Export: we send planned workouts to the provider so they appear on your device. Legal basis: contract (Art. 6(1)(b) GDPR).

If you disconnect a service in the settings, we stop retrieving and sending data. Data already retrieved stays in your account until you delete it or your account. The provider is responsible for its own processing; its privacy policy applies.

3.5 AI coach and voice input

The AI coach is only active if you have agreed to it separately before first use. This applies to the chat on the web and in the app, to messages via WhatsApp and to messages the coach sends on its own (e.g. the weekly briefing). You can withdraw your consent in the settings; the coach is then switched off.

For each reply we send the following to our AI language model provider (named in the coach's consent notice): your message, your first name, age, sex, language, body and health values (e.g. weight, maximum heart rate, sleep, recovery values), training data and your plan. As your name we send only your first name, not your email address. Whatever you write in a message is sent as you wrote it. The AI language model provider may keep logs containing the transmitted content for up to 30 days to detect abuse; this retention does not end when you withdraw your consent.

Voice input: the recording is sent to our speech recognition provider to convert it into text. We do not store the recording; we store the recognised text as a chat message. The provider normally does not store the recording; only in case of errors or suspected abuse may logs be kept for up to 30 days.

WhatsApp: if you have added your phone number, you can also write to the coach via WhatsApp. Messages, voice messages and images then pass through WhatsApp (Meta) and our self-hosted messaging system.

Storage: we store chat histories, summaries created from them and search indexes for conversational context as long as your consent stands and your account is active. If you withdraw consent, we switch the coach off and delete this data. Withdrawal also blocks your coach's AI-coach queries about you (6). Our technical logs contain no message content.

The coach's replies are generated automatically and may contain errors; they are not medical advice.

Legal basis: your explicit consent (Art. 6(1)(a), Art. 9(2)(a) GDPR).

3.6 Feedback and support

If you send feedback from the app, we receive your text, on request a screenshot, and your device model, operating system version and the screen you are writing from. We handle support requests by email or chat in a self-hosted ticket system.

Legal basis: contract (Art. 6(1)(b) GDPR) if your request concerns your account or subscription; otherwise our legitimate interest in answering requests (Art. 6(1)(f) GDPR). If you share health data with us on your own initiative, we process it only to answer your request, based on your consent (Art. 9(2)(a) GDPR). Retention: see 7.

3.7 Payment and subscription

On the web you pay via PayPal; we receive the payer's name, email address and address, country, amount and transaction number. In the app you subscribe via Google Play or the Apple App Store; we receive product, term and a purchase identifier, but no payment details. We create invoices with invoicing software. PayPal, Google and Apple process the payment under their own responsibility.

Legal basis: contract (Art. 6(1)(b)) and statutory retention obligations (Art. 6(1)(c) GDPR).

3.8 Emails

• Account and contract messages (confirmation, password, payment) are always sent. Legal basis: contract (Art. 6(1)(b) GDPR). They contain no open or click tracking.
• Emails about your training and our offer (e.g. getting-started tips, notes on your trial and subscription, news and offers) are sent to the address you registered with. We point this out at registration. Legal basis is our legitimate interest in informing you about using and developing our service (Art. 6(1)(f) GDPR, Section 7(3) of the German Act against Unfair Competition, UWG). You can object at any time — via the unsubscribe link in each of these emails or in your settings; you will then no longer receive such emails. We use the newsletter checkbox at registration to select content.
• Measurement: in these emails we use a tracking pixel and redirected links to measure whether they were opened and which links were clicked, in order to improve content (Art. 6(1)(f) GDPR). Unsubscribing also ends measurement.

For some of these emails we use an email service provider in the EU and send it your name, email address, country, language, sex, year of birth, and details of registration, usage, subscription, sport and connected services. We do not send it health or performance values; emails showing your personal values are sent through our own system.

3.9 Use of the website and platform

• Server log: for every request we store IP address, time, requested address, browser identifier and — if you are signed in — your user ID. We derive the country from the IP address on our own server. Purpose: securing operation, investigating errors and abuse. Deleted 90 days after the request. Legal basis: legitimate interest in a secure service (Art. 6(1)(f) GDPR).
• Own usage statistics: in our own database we record which pages and features are used and through which link you reached us (referrer, campaign parameters), with a shortened IP address and, if you are signed in, your user ID. We store your origin at registration with your account. Purpose: understanding which features and channels are used in order to improve our service. Events are deleted after 24 months, at the latest with your account; your origin with your account. No data goes to analytics or advertising services. Legal basis: legitimate interest in improving our service (Art. 6(1)(f) GDPR); you can object (section 10).
• Cookies: we only set technically necessary cookies: a session cookie and, if you choose “stay signed in”, a sign-in cookie (each for up to 30 days). There are no advertising or tracking cookies. Legal basis: Section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR.
• Error reports: if an error occurs, a report is sent to our self-hosted error tracking system; on the web it contains your user ID and email address, in the app it does not. Deleted after 90 days. Legal basis: legitimate interest in an error-free service (Art. 6(1)(f) GDPR).

3.10 Embedded content and third-party queries

• Maps and podcasts: we load maps and street views (Google Maps) and podcast players (Spotify) only after you have been informed by a notice and agreed; the provider then receives your IP address. Legal basis: consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time with the button at the end of this section; we then load this content again only after you agree again.
• Videos: until you click, we only show a preview image from our own server. Only when you click the video do we load the YouTube player in privacy-enhanced mode (youtube-nocookie.com); YouTube then receives your IP address. Legal basis: your consent by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Weather and location: for weather and location details of your activities and profile location, our servers send coordinates and time to a weather service (USA) or a geocoding service (OpenStreetMap), without your name or user ID. Legal basis: contract (Art. 6(1)(b) GDPR).
• Protection against automated sign-ups: on the registration page we use Google reCAPTCHA to check that a human is filling in the form. reCAPTCHA is only loaded once you use the form; Google then receives your IP address and information about your browser and input behaviour. Legal basis: our legitimate interest in preventing abuse and spam accounts (Art. 6(1)(f) GDPR).

We serve fonts and code libraries from our own servers.

Withdraw consent for maps and podcastsConsent withdrawn.

3.11 AI transparency statement

We use artificial intelligence (AI) in the following places:

• Our own AI models for your values: models we developed ourselves, including neural networks, calculate your metabolic values, training zones and analyses of your sessions from your training and body data — above all heart rate and power. The models run on our servers in a data centre in Germany (5); we do not pass any data to providers of AI services for this. The basis is your explicit consent, which we ask for before processing begins (3.2). The results are estimates; we do not use them to make solely automated decisions within the meaning of Art. 22 GDPR.
• AI coach and voice input: the chat is based on an AI language model and voice input on AI speech recognition, both from service providers (3.5, 5). Both are only active if you have agreed to them separately beforehand; for athletes without a login of their own, the rule in section 6 applies.

No training of third-party models: under their contracts, our AI language model and speech recognition providers may not use your data to train their models (5). We do not pass our own models on to third parties.

Withdrawal: you can withdraw your consent to the AI coach at any time in the settings; the coach is then switched off. You withdraw your consent for our own models by deleting your account, because we cannot calculate your values without it. Your account is then deactivated immediately; deletion and any remaining retention follow section 8.

We update this statement when our use of AI, the law or the requirements of connected services change. If a change requires new consent, we ask for it before the changed processing begins.

4. The “A Faster You” app

• Access you allow: microphone (only during voice input in the coach), camera and photos (profile picture, screenshot in feedback), notifications. The app asks for each of these only when you first use the feature; you can revoke it in your device settings. The app does not access location, contacts or calendar.
• Notifications: if you allow notifications, we store a device identifier for delivery (push token), device name, platform and app version. Delivery runs via a delivery service and from there via Google (Firebase Cloud Messaging, with an installation identifier) or Apple; these services receive the identifier and the text of the notification; the delivery service does not store the text. Notifications may contain details about your training. We delete the identifier when you sign out, turn notifications off or delete your account. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Storage on the device: sign-in data is stored encrypted in the device's protected storage. The app caches recently loaded profile and training data locally so it starts quickly; this cache is not additionally encrypted by the app and is deleted when you sign out. Legal basis: Section 25(2) no. 2 TDDDG, Art. 6(1)(b) GDPR.
• Crash reports: are sent without a user ID to our self-hosted error tracking system (Art. 6(1)(f) GDPR).
• App updates: on start, the app checks with our update service whether an update is available; your IP address is transmitted. Legal basis: legitimate interest in a secure, up-to-date app (Art. 6(1)(f) GDPR, Section 25(2) no. 2 TDDDG).
• Purchases: see 3.7. Deleting your account: see 8.

5. Recipients

We do not sell data. Depending on the features you use, the following categories of recipients receive data:

Service providers acting on our behalf and under our instructions (processors):

• data centre, file storage, backups and email delivery (Germany)
• delivery of images and static files (EU)
• AI language model for the coach (contracting party in Ireland, processing also in the USA)
• speech recognition for voice input (contracting party in the United Kingdom, processing in the USA)
• newsletter delivery and recipient management (EU)
• delivery of app notifications and app updates (USA)
• invoicing software (Germany)
• weather data (USA; receives only coordinates and time)

Recipients processing under their own responsibility:

• payment service and app stores (PayPal, Google Play, Apple App Store), if you buy there
• sign-in services (Google, Apple), if you sign in with them
• the operators of the Android and iOS notification services (Google, Apple)
• WhatsApp (Meta), if you write to the coach there
• providers of embedded content (Google Maps, YouTube, Spotify) if you load it, and Google reCAPTCHA at registration
• connected services (Zwift, Garmin, Wahoo, ROUVY, Polar, Suunto, Hammerhead), if you connect them
• your coach or trainer, if you have linked your account to theirs

Transfers outside the European Economic Area: the AI language model, speech recognition, delivery of app notifications and weather data are processed in the USA or the United Kingdom. Transfers are based on the European Commission's adequacy decisions (United Kingdom; EU-US Data Privacy Framework for certified providers) and otherwise on Standard Contractual Clauses. Under their contracts, our AI language model and speech recognition providers may not use your data to train their models. On request at info@afasteryou.com we will tell you which providers we currently use and provide a copy of the safeguards.

6. Coaches and trainers

You can link your account to a coach, trainer or bike fitter, or have them create it for you. The purpose is coaching you. They can then see your tests, calendar, activities and profile, including the health data stored there. Legal basis: your explicit consent, given by linking (Art. 6(1)(a), Art. 9(2)(a) GDPR). You can end the link at any time in the settings; the coach then no longer has access. The coach is responsible for any records they keep about you outside the platform.

A coach can also create athletes without their own login in their account. The coach is responsible towards these athletes for their data and obtains their agreement themselves; the coach's consent to the AI coach also covers this data.

If your coach uses the AI coach to ask about you, your first name with the initial of your last name and your training and health data are sent to the AI language model — only if you yourself have agreed to the AI coach (3.5) or, if you have no login of your own, your coach has.

7. Retention

8. Deleting your account

You can delete your account yourself at any time: on the web under Settings → Account → Privacy → “Delete account” (https://afasteryou.com/user/delete/), in the app under Settings → Danger zone. To confirm, we ask for your password or, if you sign in with Google or Apple, a fresh sign-in there. Please also cancel any running subscription via Google Play or the App Store in the respective store.

Your account is deactivated immediately and blocked for newsletters. Within seven days you can reverse the deletion by writing to info@afasteryou.com. After that we delete your profile, activities, training plans, health data, chat histories with summaries, reviews, support histories, device identifiers, your usage statistics entries and stored files, as well as your data at the newsletter service provider.

What remains:

• invoices and accounting records, including at the invoicing software and payment service, for the statutory retention period (7). In our payment overview we remove name, email address and address; transaction number and amount remain.
• server log entries until 90 days have passed, because we need them to investigate abuse and attacks (7).
• data in backups until they expire (7).
• individual data where needed to establish, exercise or defend specific legal claims, with restricted access and only as long as needed for that purpose (Art. 6(1)(f), for health data Art. 9(2)(f) GDPR).
• powertest results without name, contact details or account link, which we continue to use to improve our calculation models.

If you can no longer sign in, write to info@afasteryou.com and we will delete the account for you.

9. Minimum age

Our service is intended for people aged 18 and over. We do not knowingly collect data from minors. If we learn of such an account, we delete it.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to us at info@afasteryou.com.

Withdrawal: you can withdraw consent at any time (Art. 7(3) GDPR). Processing before withdrawal remains lawful.

Objection: you can object to processing based on legitimate interest (e.g. usage statistics) on grounds relating to your particular situation (Art. 21(1) GDPR). You can object to processing of your data for direct marketing at any time without giving reasons (Art. 21(2) GDPR).

Complaint: you can lodge a complaint with a supervisory authority, for example the one responsible for us: Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein, Holstenstraße 98, 24103 Kiel, Germany.

11. Security

We transmit data encrypted (TLS), store passwords only as hashes and restrict access to the people who need it for operations and support.

12. Changes

We update this policy when our service or the law changes. The current version is always available at https://afasteryou.com/en/legal/privacy/. The German version is binding; translations are provided for convenience.