What TrainFurther processes, why it is needed
and which decisions remain yours.
The controller responsible for processing personal data in connection with TrainFurther is:
Alexander Müller
Eimsbütteler Straße 87a
22769 Hamburg
Germany
E-mail: hello@trainfurther.com
Contact form: trainfurther.com/kontakt
Privacy enquiries can be sent directly to the e-mail address above.
This notice applies to the marketing website trainfurther.com and the PersonalCoach application at app.trainfurther.com.
Public self-registration, Sign in with Apple, TOTP two-factor authentication, web push notifications, payments, newsletters, advertising and audience analytics are not active in the reviewed beta version.
During the current beta phase, TrainFurther is intended exclusively for adults aged 18 and over. Accounts for minors are not currently offered.
The marketing website is currently provided through OpenAI Sites. The app runs on Cloudflare services, particularly Workers, D1 and R2. When these services are accessed, technically necessary data may be processed, including the IP address, time, requested address, referrer, browser and device information, and error or security events.
This processing supports secure, stable and fast delivery, error diagnosis and protection against misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of the services.
App data is stored in Cloudflare D1 databases; files and raw activity data are stored in Cloudflare R2. An EU jurisdiction for the existing databases is not documented in the currently reviewed project status. Processing locations, data processing agreements and appropriate safeguards for possible international transfers will be documented conclusively before public release.
Provider information: Cloudflare Privacy Policy · OpenAI Privacy Policy
The marketing website currently uses no analytics, advertising or social-media trackers. Images, the logo and fonts are served locally. A consent banner is therefore not currently required for these purposes.
The app uses technically necessary session information to keep users signed in and prevent unauthorised access. In production, the required session cookie is intended to use the “Secure”, “HttpOnly” and “SameSite=Lax” attributes. Access to the user's device is based on Section 25(2)(2) TDDDG; subsequent processing is based on Article 6(1)(b) and (f) GDPR.
If optional analytics or advertising services are introduced later, this notice will be updated in advance and those services will only be activated after consent where required.
When the contact form is used, we process the name, e-mail address, subject and message to respond to the enquiry. An IP address is processed briefly in memory to limit abusive requests but is not stored permanently in the website database.
The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual enquiries and otherwise Article 6(1)(f) GDPR based on our interest in reliable communication and preventing misuse.
Messages are delivered using Resend / Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. In particular, sender and recipient addresses, name, subject, message content and technical delivery data are processed. Resend describes processing in the United States and provides a Data Processing Addendum that includes Standard Contractual Clauses. A final review of the contractual integration is still pending.
Incoming messages to hello@trainfurther.com are forwarded through Cloudflare Email Routing to a mailbox operated by GMX / 1&1 Mail & Media GmbH, Brauerstraße 48, 76135 Karlsruhe, Germany. For forwarding, Cloudflare processes sender and recipient information as well as technical delivery and authentication information. The e-mail and its attachments are stored in the GMX mailbox. GMX states that e-mails and files are stored in German data centres.
Messages are deleted once the enquiry has been fully resolved unless statutory retention requirements or legitimate evidentiary interests require continued storage.
Provider information: Resend Privacy Policy · Resend Data Processing Addendum · Cloudflare e-mail logs · GMX Privacy Policy
For an activated account, we process in particular the e-mail address, display name, account status and security-related metadata. Passwords are not stored in plain text but as salted cryptographic verification values. Session, verification and reset identifiers are stored as cryptographic hashes.
The data is processed to establish and provide the user relationship, enable sign-in and account administration, and secure the app. The legal bases are Article 6(1)(b) and (f) GDPR. The legitimate interest lies in preventing unauthorised access and investigating technical or security incidents.
Public self-registration and password reset by e-mail are unavailable in the current beta version. Users can export their account data and initiate account deletion in the app.
Depending on how the service is used, TrainFurther processes profile and training information such as goals, age, height, weight, maximum heart rate, training preferences, appointments, planned and completed sessions, and activity and performance data.
Additional sensitive information may be generated, including sleep, heart-rate variability, resting heart rate, training load, recovery, mood, fatigue, symptoms, pain or injuries. This information may constitute health data within the meaning of Article 9 GDPR.
General account and training data is processed to provide the agreed app functions on the basis of Article 6(1)(b) GDPR. Health data may only be used for personalised analysis, recovery guidance or the AI coach with explicit, freely given and revocable consent under Article 9(2)(a) GDPR. Without this permission, health data is not supplied to the AI coach as additional context.
TrainFurther is not a medical device and is not a substitute for medical diagnosis or treatment. Information about pain, injuries or medical conditions should only be provided where necessary for the requested function.
When a user connects their Intervals.icu account, TrainFurther processes the access key they provide and profile, calendar, activity, performance, wellness and recovery data retrieved from that service. The connection is initiated by the user and can be disconnected.
The processing supports importing and displaying existing sports data, training planning and — after separate permission — use by the AI coach. The legal basis is Article 6(1)(b) GDPR; Article 9(2)(a) GDPR additionally applies to any health data included.
Cached Intervals data is generally retained on a rolling basis for up to 400 days in the current system. Independently of this, data may be transferred into the training calendar, coaching history or app profile and remain there for the periods described for those functions.
Provider information: Intervals.icu Privacy Policy
When the AI coach is used, messages entered by the user and conversation content required to generate a response are transmitted to the OpenAI API. The coach receives additional profile, training, recovery or calendar data only where the user has explicitly enabled data sharing in the app. This permission can be withdrawn for future processing.
OpenAI receives this information as the technical provider of the language model. According to the provider, API inputs and outputs are not used to train OpenAI models by default. Content and metadata may generally be retained in abuse-monitoring logs for up to 30 days unless different data controls have been agreed.
The coach generates recommendations and drafts. Changes to the training plan or calendar still require user confirmation. No solely automated decision producing legal or similarly significant effects within the meaning of Article 22 GDPR takes place.
The legal basis for a coach function requested by the user is Article 6(1)(b) GDPR. Where health data is included, explicit and freely given consent that can be withdrawn at any time for the future is additionally required under Article 9(2)(a) GDPR.
Coach histories and coach memory are generally stored until the account is deleted unless the user deletes content earlier or a legal obligation requires longer retention. Successful account deletion removes the coach, profile, training, activity, recovery and connection data associated with the account, including stored activity files.
Complete anonymisation of content sent to OpenAI has not yet been implemented in the current beta version. Future development is intended to minimise data further before transmission and remove direct identifiers where possible. Until then, users should not enter names, contact details or other information in coach conversations unless it is required for training.
Provider information: OpenAI Enterprise Privacy · OpenAI API Data Controls
For weather-related training guidance, a place saved by the user is converted into geographical coordinates and sent directly from the browser to Open-Meteo together with the IP address of the device. TrainFurther receives geocoding and forecast data in return.
The processing provides contextual weather information and is based on Article 6(1)(b) GDPR. Open-Meteo is operated by OpenMeteo GmbH in Switzerland. The provider states that technical logs, which may include geographical coordinates, are deleted after 90 days.
Provider information: Open-Meteo Terms & Privacy
Personal data is stored only for as long as necessary for its purpose or while statutory obligations apply. The current technical implementation includes the following periods:
Account, profile, calendar, activity and coach data, including coach memory, is generally stored until account deletion unless individual data is deleted sooner or a shorter period applies. Legally required records or specifically justified security logs may be retained beyond this period to the necessary extent.
Data is disclosed only to parties that require it for the purposes described. These currently include the technical providers Cloudflare, OpenAI, Resend, Intervals.icu and Open-Meteo, as well as GMX / 1&1 Mail & Media for the e-mail mailbox.
Providers in the United States or other countries outside the European Economic Area may also process data there. Before public release, the applicable adequacy decisions, certifications, Standard Contractual Clauses and data processing agreements will be reviewed conclusively and identified specifically in this section.
Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw that consent at any time with future effect. This does not affect the lawfulness of processing carried out before withdrawal.
Requests can be sent to hello@trainfurther.com. Appropriate proof of identity may be requested to prevent unauthorised disclosure or deletion.
Data subjects may lodge a complaint with a data protection supervisory authority. For the controller's place of establishment, the following authority is particularly competent:
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
(Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Straße 22, 7th floor
20459 Hamburg
Germany
E-mail: mailbox@datenschutz.hamburg.de
datenschutz-hamburg.de
This notice is updated when functions, providers or legal requirements change. During the beta phase, the version stated on this page applies.
This English translation makes the information accessible to English-speaking users and reflects the same processing described in the German privacy notice. The original wording of the cited German and European legal provisions remains decisive for their interpretation.
Last updated: 10 September 2026. This version describes the currently reviewed beta status of TrainFurther. The technical and legal documentation will be updated continuously as the service develops.