Who we are
VeloCoach AI is an AI-powered cycling coaching app for iPhone, operated by VeloCoach AI Ltd, a company registered in England & Wales. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), VeloCoach AI Ltd is the data controller of the personal data described in this policy.
This policy explains how we handle your personal data when you use the VeloCoach AI app and this website. If you have any questions, contact us at support@velocoach-ai.com.
What we collect
Your name, email address, and an encrypted password when you create an account. Passwords are hashed; we never store them in plain text.
Your FTP (functional threshold power), body weight, preferred discipline (road, gravel, MTB), training goals, and gender (Man, Woman, Other, or Prefer not to say). Gender is used to personalise coaching, specifically to determine whether to offer cycle-aware coaching recommendations.
If you give them during setup, we also store your age, height and maximum heart rate.
We also store your ride and workout history, including activity files, power, pace, distance, duration, and the Fitness, Fatigue and Form training-load metrics derived from your activities. This is retained until you delete your account.
With your explicit permission, we read health metrics from Apple Health, Google Health, Garmin and WHOOP, including heart rate, heart rate variability (HRV), resting heart rate, sleep duration and time in bed, sleep stages (deep, REM, core and awake) and bedtime, sleep score, recovery score, respiratory rate, blood oxygen (SpO2), active energy, VO2 max estimates, steps, cycling power, cadence and distance, and workout summaries. We only read this data after you grant permission, and it is never sold or shared for advertising.
We ask a short health screening questionnaire: whether you have a heart condition, chest pain, dizziness or a bone or joint problem, whether you take blood pressure or heart medication, and whether there is any other reason you should not exercise. We store your answers, that you acknowledged the screen, and when you completed it.
These answers are special category health data under UK GDPR Article 9. We process them only with your explicit consent (UK GDPR Article 9(2)(a)).
You can view and change your answers in Settings, then Health Readiness. To withdraw your consent, delete your account, or email us at support@velocoach-ai.com and we'll delete just these answers within 30 days.
When you do a morning check-in we store what you tell us: how you feel, how well you slept, your bedtime, wake time and sleep length, whether you are ill, and any notes you add about what is getting in the way of training.
Whether you are ill is special category health data under UK GDPR Article 9. We process it only with your explicit consent (UK GDPR Article 9(2)(a)). To withdraw your consent, delete your account, or email us at support@velocoach-ai.com and we'll delete just these answers within 30 days.
When you log a gym session we store the weight and reps for each set, and how many reps you had left in reserve.
Your coaching messages and any generated training plans are stored so VeloCoach can remember your history and give continuity across sessions. This is what makes coaching feel personal rather than starting from scratch every time.
If you choose to enable cycle tracking in Settings, VeloCoach collects your last period start date, average cycle length, whether cycle tracking is active, and, if you answer them, whether you use hormonal contraception and whether your cycle is irregular. This is optional: you are never asked for this data unless you actively switch it on.
This data falls under UK GDPR Article 9 (special category health data) and is collected only on the basis of your explicit consent. You can withdraw consent and delete all cycle data at any time via Settings > Cycle Tracking > Turn Off, which removes the data from our servers immediately. It is used only to tailor your coaching and is never used for advertising. If you agree to AI coaching, we send Anthropic, our AI provider, your cycle length, your estimated cycle phase, and whether your cycle is irregular or you use hormonal contraception. We send this only to shape your plan and your coach's advice. It is not shared with anyone else. If you have not been asked yet, have said no, or turn off AI coaching or cycle tracking, none of it is sent.
To deliver push notifications we process a device push token and basic device information (such as operating system version). We also collect crash and performance reports so we can fix what breaks; these are tied to your user ID so we can tell whether a crash affected one person or everyone.
We do not use any advertising features, and there is no cross-app or cross-site tracking. The Google analytics library includes an advertising-measurement component that we never switch on. We do not build an advertising profile of you, and we never sell your data. We analyse how the product is used, on our own servers, to work out whether the coaching is actually helping. The app also uses Google Firebase Analytics to count steps through signup, the paywall and your first sessions. It receives event names and their settings (for example which paywall screen or plan), whether the app came from the App Store or TestFlight, an app instance ID, a device identifier that is unique to our app (Apple's identifier for vendor), your device model, OS, app version and language, and an approximate location from your IP address, which Google does not store. We do not send it your name, email, health data or the content of your training, only that a session or check-in was completed, and we do not give it your VeloCoach user ID. That is described in How we use your data and again under Cookies and analytics on this website.
Sources & integrations
Most of your training data reaches VeloCoach through integrations you choose to connect. You control these and can disconnect them at any time.
- intervals.icu: ride activities, workout files, and your athlete profile, fetched using OAuth tokens you grant.
- Garmin: rides, sleep and daily health metrics; we can also write your planned session to your Garmin calendar.
- Wahoo: activities and device data; we can also push structured workouts to your Wahoo ELEMNT device.
- Zwift: we send your planned session to Zwift and read back whether you completed it.
- Apple Health: with your permission, the app reads health and fitness metrics and uploads them to your VeloCoach account so your coach can use them. From version 4.2, this includes minute-by-minute heart rate.
- Google Health: health metrics, sleep, steps and active energy (the calories you burn through activity), read with your permission, for wearables that sync to Google rather than Apple Health. We use this data to give you coaching in the app. If you use AI coaching, it is sent to Anthropic, our AI provider, with your other connected health data, on the terms set out under How we use your data and Third-party processors. VeloCoach is an iPhone app; there is no Android app. The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.
- WHOOP: sleep and recovery data, read-only. VeloCoach does not write anything to WHOOP.
You can revoke access to any integration through that platform's connected-apps settings, or from within VeloCoach: open Settings using the gear icon at the top of the Home screen, then Integrations.
How we use your data
- To generate personalised training plans and daily coaching advice using AI (Claude, made by Anthropic). From version 4.2, the app asks your permission before your data is sent to Anthropic. If you say no, or later turn it off in Settings, then AI coach, none of your data is sent to Anthropic. If you have not been asked yet, for example because you use an earlier version of the app, AI coaching works as before but your cycle data is never sent. Separately, if you post a public review of VeloCoach on the App Store, we may use AI to help draft our reply. That uses only what you posted publicly.
- To display your fitness history, recent activities, training-load metrics, and recovery status inside the app.
- To push structured workouts to your Wahoo ELEMNT device.
- To maintain coaching memory so your coach knows your history without you repeating yourself.
- To send you push notifications about your training (where you have enabled them).
- To operate, secure, and improve the service, and to provide customer support.
- To measure whether the coaching works. We analyse training data, health metrics and how you use the app, keyed to your user ID, to compare outcomes across athletes and judge whether our coaching actually improves fitness. This is what Apple's App Store privacy label calls the Analytics purpose, and it is why Fitness, Health and Identifiers are declared for Analytics on our App Store listing. It is done by us, on our own servers, and it is never used for advertising.
We never sell your data. We never use it for advertising, and we never share health data with anyone for advertising or general data mining. We share data only with the processors listed below, each of which is necessary to run the service or the website.
Legal basis for processing
- Contract: to provide the coaching service you sign up for (account, training data, plans).
- Consent: for health data from Apple Health, Google Health, Garmin and WHOOP, and for special-category cycle data. You can withdraw consent at any time.
- Consent: for sending your data to our AI provider, Anthropic, to run AI coaching, once the app has asked you. You give it in the app and can withdraw it at any time in Settings, then AI coach.
- Explicit consent (UK GDPR Article 9(2)(a)): for your health screening answers and whether you are ill in a morning check-in. You can withdraw it at any time: delete your account, or email us at support@velocoach-ai.com and we'll delete just these answers within 30 days.
- Legitimate interests: to secure the service, prevent abuse, and improve the product, including measuring whether the coaching works, balanced against your rights.
- Consent: for analytics cookies on this website. None are set unless you accept, and you can change your mind at any time from Cookies.
Third-party processors
These are the third-party services we send your data to in order to run VeloCoach and this website. We have no other data-sharing arrangements, and we sell your data to nobody.
Two further companies serve files to your browser and therefore see your IP address without us sending them anything: Google Fonts and Kit. They are described under Cookies and analytics so that this page accounts for every third party your browser contacts, not only the ones we hand data to.
| Provider | Purpose | Data shared | Notes |
|---|---|---|---|
| Supabase | Database & authentication | All stored account and training data | EU-region hosting |
| Railway | Backend / API hosting | Data passes through the backend in transit | No separate persistent data store |
| Anthropic (Claude) | AI coaching & plan generation | For AI coaching, unless you have said no: your profile (name, age, gender, height, weight, FTP), rides and training history, connected health data, check-ins, coaching messages, your schedule, and cycle details only if you have agreed and track your cycle. Also the text of public App Store reviews, to help draft our replies | Not used to train Anthropic's models under our API agreement |
| Apple (APNs) | Push notifications & App Store billing | Device push token; subscription status | iOS devices |
| Google (FCM) | Push notifications | Device push token | Android-connected delivery |
| Google (Firebase Crashlytics) | Crash and performance reporting | Crash reports, device model and OS, linked to your user ID | App only. No training or health data |
| Google (Firebase Analytics) | App usage measurement | In-app events and their settings (for example signup completed, paywall viewed), app instance ID, identifier for vendor, device model, OS, app version and language, approximate location | App only. No name, email, health data or training content. Not linked to your VeloCoach user ID |
| Resend | Sending app and account emails | Your name and email address, and the content of each email | Processed in the United States. Transfers from the UK are covered by the EU Standard Contractual Clauses as amended by the UK Addendum, under Resend's data processing addendum |
| Google Analytics | Website audience measurement | Pages viewed on velocoach-ai.com, approximate location, device type | Website only, and only if you accept. Sets a cookie. Never linked to your VeloCoach account. See Cookies |
| Kit (formerly ConvertKit) | Early-access email list | The first name and email address you type into the signup form | Website only. Used to email you about VeloCoach. Unsubscribe in any email |
| Cloudflare | Website hosting | Standard web server logs, including IP address | Website only |
Cookies and analytics on this website
This section is about velocoach-ai.com, not the app. The app sets no cookies.
We set no cookies until you say yes. When you first arrive we ask whether you are happy for us to use Google Analytics. If you decline, or simply ignore the question, no analytics script is loaded and no analytics cookie is created. If you accept, Google Analytics sets its standard cookies (_ga and one per property) so we can count visits and see which pages help people find us.
Your choice is stored in your browser only. It is not sent to us, and it is not linked to your VeloCoach account.
Separately from analytics, two third parties serve files to your browser when a page loads. None of them is used to track you, and none of them sets a cookie here. We should be straight about what they do see: because your browser fetches a file from them, each one receives your IP address, the page you were on and your browser's user agent. That is unavoidable for anything loaded from another server, and it happens before you answer the analytics question.
- Google Fonts serves the typefaces the site is set in.
- Kit loads the early-access signup form. It receives your name and email address only when you actually submit the form.
If you would rather we did not use analytics at all, decline and we will not. If you have declined or not yet answered, we also clear any Google Analytics cookie left on your browser from before we started asking, which was 14 August 2026.
International transfers
We host your core data in the EU region. Some of our processors (for example, Anthropic and Apple/Google push services) may process data in the United States or other countries outside the UK/EEA. Where data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement / Addendum and the EU Standard Contractual Clauses, or an adequacy decision, to protect your data.
Data retention
- Your data is kept for as long as your account is active.
- If you delete your account, all stored data is permanently removed within 30 days.
- Backups containing your data are purged on the same rolling 30-day schedule.
How to delete your data
You can delete your account and all associated data directly in the app: open Settings using the gear icon at the top of the Home screen, then Account, then Delete Account. This permanently removes your data within 30 days.
You can also request deletion by emailing support@velocoach-ai.com with the subject "Delete my account". Disconnecting a platform (intervals.icu, Garmin, Wahoo, Zwift, Apple Health, Google Health or WHOOP) removes the stored credential, stops any further access, and revokes VeloCoach's access on their side, where the platform offers a way to do so. It does not delete data already collected from that platform: readings and activities already stored remain part of your training history until your account is deleted, at which point all stored data is permanently removed within 30 days, as described in Data retention above.
Your rights
If you are in the UK or EU, you have the following rights. To exercise any of them, email support@velocoach-ai.com and we will respond within 30 days.
Right to access
Request a copy of all data we hold about you. Email with subject "Data access request".
Right to deletion
Ask us to permanently delete your account and all associated data. Email with subject "Delete my account".
Right to portability
Request an export of your data in a machine-readable format. Email with subject "Data export request".
You also have the right to rectification, to restrict or object to processing, and to withdraw consent at any time where we rely on it.
Children
VeloCoach AI is not directed at children. The service is intended for users aged 16 and over, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
Security
- All data is transmitted over HTTPS/TLS.
- Passwords are hashed using industry-standard algorithms; we cannot recover them.
- OAuth tokens for intervals.icu and Wahoo are stored encrypted.
- We do not log or store raw API tokens in application logs.
Changes to this policy
We may update this page from time to time. The "last updated" date at the top always reflects the most recent version. Where changes are material, we will take reasonable steps to notify you. Continued use of the app after changes are posted constitutes acceptance of the updated policy.
Contact
Data controller: VeloCoach AI Ltd (England & Wales)
For any privacy questions, data requests, or concerns, email support@velocoach-ai.com. We aim to respond to all requests within 5 business days and to complete them within 30 days.
If you believe we have not addressed your concern adequately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) in the UK, or your local data protection authority.