Privacy Policy

1. Who we are

The controller responsible for your data is TriHonu GmbH, Winkelweg 5, CH-8127 Forch, Switzerland, registered in the commercial register of the canton of Zürich under CHE-219.470.047, reachable at hello@trihonu.com. TriHonu operates at trihonu.com.

2. What we collect

• Account — your email address and, if you set one, a password (stored only as a salted hash by our authentication provider; we never see it in plain text).
• Profile — name, sex, date of birth, height, weight, home location, language, your chosen AI coach, and your goals and races.
• Health & training data — activities and their metrics (heart rate, power, pace, distance, duration), recovery and wellness signals (HRV, sleep, resting HR, body battery), daily check-ins, injuries and niggles, performance thresholds, whether you have told us that something you take affects your heart rate (a yes/no only — we never ask for or store the name of any medication), and nutrition information (dietary preferences, targets, and any food you log). Some of this is health data, treated as a special category under EU/Swiss law (see “Legal bases”).
• Connected services — if you connect Garmin, we import the activity, workout, and wellness data you authorize, and store the access tokens needed to keep syncing.
• AI coaching — your conversations with the AI coach, and the training and health context we send to the AI model so it can generate your coaching.
• Media — photos or videos you choose to upload (e.g. meals, gear, or technique clips).
• Technical — sign-in cookies and minimal usage records (including AI-usage counts we keep to manage costs). We do not use third-party advertising or cross-site tracking. Two features do load content into your browser from a third party (see “Embedded content”).

3. Legal bases (GDPR / Swiss FADP)

Where the EU GDPR or the Swiss FADP applies, we rely on:

• Performance of a contract — to provide the coaching service you signed up for.
• Your explicit consent — for health / special-category data (Art. 9(2)(a) GDPR), given when you accept the in-app disclaimer and this policy. You can withdraw consent at any time by deleting the relevant data or your account.
• Legitimate interests — to keep the service secure and within cost and fair-use limits, balanced against your rights.

4. How we use your data

• Generate your plan, morning briefings, weekly reviews, and coaching replies.
• Adapt your training to your recovery, goals, and how you’re responding.
• Sync with your connected devices and provide nutrition guidance.
• Judge whether heart rate is a meaningful signal for you. This is the only thing your answer about heart-rate medication is used for: if you tell us something you take affects it, your coach stops reading heart-rate zones and recovery scores as fitness and works from pace, power and how you feel instead. Answering is optional and you can change or clear the answer at any time in your profile.
• Keep your account secure and within fair-use limits.

We do not sell your personal data.

5. AI processing & service providers

To run the service we share data with a small set of processors, each only to the extent needed:

• Anthropic (Claude) — receives the relevant training/health context and your chat messages to generate your coaching. Anthropic does not use data sent through its API to train its models, and retains it only for a limited period for safety and abuse monitoring.
• Garmin — you connect this; data flows to and from it per your authorization and Garmin's own terms.
• Voyage AI — receives text you or your coach have saved (coach memory, uploaded documents, and your search queries) to turn it into the numerical representation that lets the coach recall the right note later.
• Supabase — hosts the database, authentication, and file storage.
• Vercel — hosts the application.
• Resend — sends sign-in and notification emails.
• Open-Meteo — receives the coordinates or place name of a planned session to return its forecast. It is not told who is asking.
• Payment provider — when paid subscriptions launch, a payment provider (acting as merchant of record) will process your payment and billing data. We will name it here before that goes live.

6. Embedded content

Two parts of the app load content into your browser directly from someone else’s server. When that happens, your browser contacts that provider itself, so it sees your IP address and browser details — the same as if you had opened the content in a new tab. We send it nothing about you: no name, no email, no account identifier, and no training data.

• Exercise demonstrations — expanding the How to panel on a strength or mobility exercise may load demonstration images from jsDelivr (a public host for open-source files) and, where one exists, a demonstration video from YouTube. Videos use YouTube’s privacy-enhanced player (youtube-nocookie.com), which sets no tracking cookies unless you actually press play; once you do, YouTube (Google) may set cookies and receives your IP address and device details as an independent controller, not as our processor, under Google’s own privacy policy. Nothing is requested until you open the panel.
• Activity route maps — opening an activity that was recorded with GPS draws its route on a map, using tiles from OpenStreetMap and styling from unpkg. A map is drawn by fetching the tiles that cover your route, so OpenStreetMap necessarily learns the approximate area you trained in. This is the one embed that reveals something about you rather than only about your device, and it currently loads automatically with the activity — there is no setting to turn it off.

Apart from these, the app embeds no third-party content: no advertising, no analytics, no social widgets, no cross-site tracking. Fonts and every other asset are served from our own domain.

7. Cookies & local storage

We use no tracking cookies, no advertising cookies and no analytics. Everything this app stores in your browser is either needed to keep you signed in or a setting you chose yourself — which is why you are not asked to accept cookies when you arrive.

• Sign-in cookies — set when you sign in, by Supabase, the service that handles our authentication. They are what keeps you signed in as you move between pages, and they are refreshed as you browse so your session does not expire while you are using the app. Without them you would have to sign in again on every page. Clearing them signs you out.
• Your own settings, kept in your browser’s local storage — the light or dark appearance, whether the side navigation is collapsed, whether weights are shown in kilograms or pounds, whether the strength timer plays a sound, and when your watch last synced. They are written only when you change something, read only by the app on your own device, and never sent to us. Clearing them resets those preferences and nothing else.

Under EU and EEA rules, consent is required only for storage that is not strictly necessary for a service you actually asked for — which is why neither of the above needs a banner. If we ever add something that does require consent, such as analytics, we will ask first, and refusing will be exactly as easy as agreeing. One thing noted above does set its own cookies: pressing play on an embedded demonstration video lets YouTube do so (see Embedded content).

8. Where your data is stored & international transfers

Your data is stored with our hosting providers (Supabase and Vercel). Some providers process data in the European Union and/or the United States — for example, our AI provider (Anthropic) processes in the United States. Where data is transferred outside Switzerland or the EEA, it is protected by appropriate safeguards such as the Standard Contractual Clauses.

9. How long we keep it

We keep your data while your account is active. When you delete your account (self-service in the app), your data is deleted, subject to short-lived rolling backups (currently up to 7 days) and any records we must retain by law.

10. Your rights

Subject to applicable law, you can request access to, correction of, deletion of, a portable copy of, restriction of, and objection to the processing of your data, and you can withdraw consent.

• Export — download your data yourself in-app under Profile → Your data.
• Delete — delete your account and its data in-app under Profile → Your data, or contact us.
• Other requests / complaints — contact hello@trihonu.com. You also have the right to lodge a complaint with a supervisory authority (in Switzerland, the FDPIC; in the EU, your local data-protection authority).

11. Security

We isolate every user’s data at the database level (row-level security keyed to your account), encrypt data in transit, store passwords only as salted hashes, and never expose your device tokens to other users. No system is perfectly secure, but we work to protect your data.

12. Children

TriHonu is intended for adults only. It is not for anyone under 18, and we do not knowingly collect data from anyone under 18.

13. Changes to this policy

We may update this policy; material changes will be surfaced in-app. The version date above shows which version you are reading.

14. Contact

Questions or requests: hello@trihonu.com.