PRIVACY POLICY

Effective: 2026-02-22

Fit File Forge helps you design structured workouts and training plans, then send them to your Garmin devices. Our AI Coach can build personalized multi-week training programs through conversation, while the Generator creates individual workouts on demand. This Privacy Policy explains in plain language how we collect, use, and protect your information when you sign in, connect Garmin, and use our workout generation tools. We never sell your personal data or use it for advertising; we only process what is needed to provide the features you ask for.

1) SCOPE

This policy applies to the Fit File Forge website, APIs, and background services that power sign-in, Garmin connections, workout generation, and delivery of workouts to your Garmin Connect account.

2) DATA WE COLLECT & STORE

→Account profile — When you sign in with Google, we receive your name, email address, Google account identifier, and optional profile image. When you sign up with email and password, we store your name, email, and a securely hashed password (we never store plaintext passwords).
→Authentication details — We store encrypted session tokens and short-lived verification codes so the site can recognize your device, prevent fraud, and complete sign-in flows.
→Garmin connection information — After you connect Garmin, we securely store your Garmin user ID along with the access and refresh tokens Garmin issues, plus their expiration times. This lets us send and update workouts until you disconnect.
→Workout prompts and generated workouts — We receive the text you enter, send it to OpenAI to structure the workout, and store the generated workout JSON in your Workout Vault so you can resend or edit later. We keep associated metadata (name, sport, schedule date, sync status, device IDs) until you delete the workout or your account.
→AI Coach plans and conversations — When you use the AI Coach, we store your conversation history, the training plan structure, and all associated workouts. This allows the Coach to maintain context across sessions and lets you continue building or editing your plan over time.
→Athlete Profile data — You may optionally provide training metrics (heart rate zones, threshold pace, FTP, etc.) in your Athlete Profile. This data is used to personalize workout targets and is stored until you update or delete it.
→Garmin webhook notifications — Garmin may notify us about permission changes or deregistration events. These notices include your Garmin ID and the updated permission status so we know when to stop syncing.
→Operational and support data — Our hosting provider captures IP addresses, device information, timestamps, and error traces to keep the service reliable. Emails you send to privacy@fitfileforge.com contain whatever you choose to include.
→No Garmin activity download — We never request or store your Garmin activity history, health metrics, or broader profile data beyond what is needed to deliver workouts.

3) HOW WE USE INFORMATION

→Sign you in with Google or email/password and maintain secure sessions so only you can access your workouts.
→Turn your prompts into structured workouts by sending the necessary text to OpenAI, validating the response, storing the workout in your Vault, and formatting it before it is sent to Garmin.
→Power the AI Coach by maintaining conversation history, generating multi-week training plans, and allowing you to edit or refine workouts through natural language.
→Personalize workout targets using your Athlete Profile data (when provided) to create more accurate heart rate, pace, and power zones.
→Store and refresh Garmin credentials so we can deliver workouts, honor permission changes, and let you disconnect at any time.
→Monitor reliability and security through aggregated logs and webhook alerts to keep the service running smoothly.
→Respond to support requests and comply with legal or regulatory obligations when they apply.

4) STORAGE & INFRASTRUCTURE

Fit File Forge runs on Vercel's managed infrastructure. Account information, Garmin credentials, and session data are stored in Vercel-hosted databases located in the United States. Sensitive secrets (like Garmin client IDs or encryption keys) live in encrypted environment variables. We only store the cookies described below on your device; everything else stays on our servers behind HTTPS.

→Garmin — We send workout details and scheduling requests to Garmin's Training API and receive notifications if your permissions change. Once the workout lands in your Garmin Connect account, Garmin controls that copy of the data.
→OpenAI — We send your workout prompt (and only the context required to craft the workout) to OpenAI's API to produce the structured plan. We do not share your email, Garmin tokens, or other identifiers with OpenAI.
→Google / NextAuth — Google confirms your identity when you sign in, and NextAuth keeps the resulting identity data and session state in our database so you stay logged in.
→Vercel — Hosts the website, serves static assets, runs our API routes, and stores data in their managed databases. Their systems also handle operational monitoring logs.
→Stripe — Processes subscription payments. Stripe receives your email, name, and payment details to handle billing. We do not store your card information—Stripe handles that securely. See Stripe's Privacy Policy.
→Resend — Delivers transactional emails (verification, welcome, billing notifications, password resets). Resend receives your email address and name to deliver these messages. See Resend's Privacy Policy.
→Vercel Web Analytics & Custom Events — We use Vercel Web Analytics, a privacy-friendly, cookie-free analytics tool that collects page views, routes, referrers, countries, browsers, and device types without using cookies or collecting personal data. In addition, we track custom product events (such as workout generation success/failure, feature usage, and billing actions) to understand how people use the app and improve the experience. These events contain aggregate interaction data (e.g., sport type, step count, button clicked) — never personal information like names, emails, or workout content. No data is sold to third parties or used for advertising. See Vercel's Analytics Privacy Policy.

We do not share data with advertisers, data brokers, or social networks, and we require every vendor above to process data only on our behalf.

6) RETENTION & DELETION

→Account and session records stay on file until you ask us to remove them. Session tokens expire automatically based on our security settings or when you sign out.
→Garmin tokens remain only while your account is connected. We delete them when you disconnect, when Garmin notifies us that access was revoked, or if repeated refresh attempts fail.
→Workout prompts, generated workouts in your Vault, and Coach training plans (including conversation history) remain until you delete them or delete your account. PKCE state cookies are temporary and cleared shortly after the related request completes.
→Athlete Profile data persists until you update or clear it, or until you delete your account.
→Subscription and billing records (plan type, billing period, usage counts) are deleted when you delete your account. Payment card details are stored by Stripe, not by us—Stripe may retain its own records per their data-retention policies.
→Operational logs are retained by Vercel according to their platform defaults before being deleted or aggregated.

You can delete your account and all associated data at any time from the Settings page. If you need assistance, contact us and we will confirm once the removal is complete.

7) SECURITY

→Encryption in transit (HTTPS) for every request and webhook.
→Strict access controls for Garmin and Google secrets; only the backend service can read encrypted tokens.
→Minimal browser storage—only the authentication cookies needed to keep you signed in are stored locally.
→Tokens are refreshed and revoked automatically, reducing the impact of credential leaks.
→We monitor for unusual activity and investigate incidents quickly.

8) COOKIES & LOCAL STORAGE

→Authentication cookies — Essential cookies that keep you signed in. These are set with httpOnly and same-site protections so they cannot be read by client-side scripts or sent to third-party domains.
→Garmin OAuth cookies — Short-lived cookies (a few minutes) used solely to secure the Garmin authorization flow. They are deleted automatically after the flow completes.
→No advertising or tracking cookies — We do not set analytics cookies, advertising cookies, or social media cookies. Our analytics tool (Vercel Web Analytics) is cookie-free and does not track individual users across sessions.
→Local storage — We use your browser's localStorage only to remember your display theme preference (dark/light mode). No personal data or tracking identifiers are stored locally.
→Your control — You can adjust cookie preferences in your browser settings at any time. Blocking essential cookies may prevent sign-in from working. Clearing localStorage will reset your theme preference to the default.

9) YOUR CHOICES & RIGHTS

You control when to sign in, when to connect Garmin, and when to send a workout. Use the in-app settings to revoke Garmin access at any time, or disconnect directly inside Garmin Connect. You can delete your account and all associated data from the Settings page. You may also email us to access or correct stored account data—once we verify the request, we will process it and confirm completion.

10) CHILDREN

Our service is not directed to children under 16. If we learn a child has used the service, we will delete any related transient data.

11) INTERNATIONAL TRANSFERS

We process data on Vercel infrastructure located in the United States and may route requests through other regions. Regardless of location, we apply the same minimal-data approach and security controls described here.

12) CHANGES TO THIS POLICY

We may update this Privacy Policy to reflect product changes or legal requirements. We will post updates on this page with a new effective date.

13) CONTACT

Questions or privacy requests? Email privacy@fitfileforge.com.