Privacy policy

ChallengeUS is a coaching app for running and triathlon. This policy explains which data we process, why and for how long, under the Swiss Federal Act on Data Protection (FADP) and, for users in the European Union, Regulation (EU) 2016/679 (GDPR).

Last updated: 2026-09-29

Data controller

ChallengeUS, Zug, Switzerland. Privacy contact: info@challengeus.com.

Data we process

Account: e-mail, name, sign-in identifier (Google, or e-mail and password through Firebase Authentication).

Athlete profile: discipline, level, races, weekly availability, weight, sex, maximum and resting heart rate, thresholds and test results, profession and training area (optional), the life and work periods you enter.

Training and health data you provide through the services you connect: activities (sport, date, duration, distance, average heart rate, power, elevation gain) and daily data (sleep duration and score, resting heart rate, HRV) from Garmin or Strava. We do not receive full GPS tracks or data you did not authorise.

Coach check-ins: the text you type or dictate about how you feel and the generated proposal, kept in your profile so that you and a coach can read them again.

Technical data: server logs needed for security (IP address, date and time), kept for 30 days.

Why, and on which legal basis

To provide the service you asked for (plan, weekly adaptation, fitness and readiness indicators): performance of the contract.

For health data (sleep, heart rate, HRV, activities): your explicit consent, given when you connect Garmin or Strava and revocable by disconnecting them or deleting your account.

For the conversational coach: your consent, given when you send a check-in. The text and a summary of your plan are processed by Anthropic (Claude) through its API to generate the proposal; Anthropic does not use this data to train its models.

For service security and abuse prevention: legitimate interest.

Where and for how long

Data is stored on Google Cloud (Firestore, region europe-west1, Belgium) and Firebase. The local Garmin connector, if you use it, runs on your own computer: passwords and codes never leave your PC and are never sent to ChallengeUS.

We keep data as long as your account exists. When you delete it, profile, activities, daily data, tokens and check-ins are removed within 30 days; backups within 90 days.

The beta waiting list keeps your e-mail until you sign up or ask for removal.

Who sees your data

You, and the ChallengeUS coaches you choose to involve. Processors acting on our behalf: Google Cloud (hosting and database), Anthropic (conversational coach: only the check-in text and a plan summary), Garmin and Strava (only when you connect them, under their terms).

Comparisons with other community athletes are computed only in aggregate and anonymously, with at least 20 athletes per group. We do not sell data and do not profile for advertising.

Your rights

You can access, correct, export and delete your data, withdraw consent and object to processing by writing to info@challengeus.com; you can disconnect Garmin and Strava and clear your data directly in the app. You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you live in the EU, with your supervisory authority.

Trademarks

Garmin and Garmin Connect are trademarks of Garmin Ltd. or its affiliates; Strava is a trademark of Strava, Inc. ChallengeUS is not affiliated with Garmin or Strava. “Powered by Strava” where required.