Privacy Policy

This Privacy Policy explains how Sweat Prompt (the "Service") collects, uses, and protects your personal data when you connect your Strava account and chat with the assistant. We process personal data in accordance with the EU General Data Protection Regulation (GDPR).

1. Data controller

The data controller is the operator of Sweat Prompt. For any privacy request, contact info@relli.it.

2. Data we process

• Strava profile: your Strava athlete ID, first and last name, username, city, country, and profile image.
• Authorization tokens: the OAuth access and refresh tokens Strava issues so we can access your data on your behalf.
• Activity data: activities and statistics retrieved from Strava on demand to answer your questions (e.g. distance, duration, pace, dates).
• Email address: the address you give us after connecting (Strava does not share one), whether you have confirmed it, and your choice about product-update emails.
• Consent records: each time you accept these terms or change your email preferences, we record what you chose, when, which version of the text you were shown, your language, and the IP address and browser (user agent) of that request.
• Chat content: the questions you type and the answers generated for you.
• Technical data: essential cookies (session and cookie choice) and standard server logs.

3. How and why we use it

• to authenticate you and keep you signed in;
• to retrieve your Strava data and answer your questions;
• to contact you about your account and the Service (for example, to confirm your email address or tell you about important changes);
• only if you opt in, to send you occasional product updates and training tips;
• to keep proof of the consents you have given and withdrawn;
• to operate, secure, and maintain the Service.

4. AI processing (Google Gemini)

To generate answers, your questions and the relevant Strava data are sent to Google's Gemini API. This processing is necessary to provide the Service. Google processes this data as described in its own privacy documentation (Gemini API terms). Please avoid entering information you do not want processed by the AI provider.

5. Legal basis

• Performance of the service you request: your Strava data, chats, and the use of your email address to contact you about your account.
• Consent for product-update emails. It is optional, never pre-selected, and can be withdrawn at any time from "Email & preferences" in the app.
• Legal obligation and legitimate interest for consent records: we must be able to demonstrate what you agreed to (GDPR, Article 7(1)).

6. Storage and security

Your Strava access and refresh tokens and your email address are encrypted at rest. We apply reasonable technical and organizational measures to protect your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Sharing

We do not sell your personal data. Data is shared only with the providers that make the Service work — Strava (source of your data) and Google (AI processing) — and only as needed to operate the Service or where required by law.

8. Retention

We keep your account data, email address, and tokens until you disconnect in the app or ask us to delete them. When you disconnect or request deletion, your account, tokens, and chats are removed.

Consent records are the exception: they are kept after your account is deleted, including the email address each one applied to, because we must be able to prove what you agreed to and when you withdrew it (for example, that you had stopped receiving product-update emails). They are used for no other purpose. You can ask us about them at the contact address below.

9. Your rights

Under the GDPR you have the right to:

• access, rectify, or erase your personal data;
• restrict or object to processing;
• data portability;
• withdraw consent at any time;
• lodge a complaint with your supervisory authority (in Italy, the Garante per la protezione dei dati personali).

10. Revoking access

You can disconnect Strava inside the app at any time, and revoke Sweat Prompt's access from strava.com/settings/apps. Revoking from Strava stops our access to your Strava data, but doesn't delete what we hold (your account, email address and chats): use Disconnect in the app for that.

11. Cookies

We only use first-party cookies. No advertising or third-party tracking cookies are used.

• Strictly necessary (always active, no consent needed): _sweat_prompt_session keeps you signed in and remembers your language, until you close the browser; cc_cookie stores your cookie choice, for 6 months.
• Analytics (optional, off by default): no analytics tool is in use today. If we add one, it will only run after you enable this category.

A banner asks for your choice on your first visit. You can change it at any time: Cookie preferences.

12. Children

The Service is not intended for individuals under the age of 16.

13. Changes

We may update this policy; material changes are reflected by updating the date above.

14. Contact

Privacy requests: info@relli.it.