Privacy Policy

AthleteVia is an adults-only (18+) athlete-development app for soccer and volleyball. We collect the information you give us to build your training plan, store it securely with our infrastructure provider (Supabase), and share it only with the small set of service providers listed below that are needed to run the app. We do not sell your personal information, and we do not show third-party advertising. You can export or delete your data at any time from Settings.

AthleteVia ("we", "us") is the controller of the personal information described here. For any privacy question or request, contact us at legal@athletevia.com or via the in-app Report Issue form.

We use your information to calculate your readiness score, benchmark you against your target level, generate and schedule training plans, track your progress, and keep an audit trail of intake, prompts, model outputs, and final plans for safety and quality. Where the GDPR applies, our legal bases are: performance of our contract with you (running the app), your consent (for health information and AI plan generation), and our legitimate interests (security, fraud prevention, and improving the Service). You may withdraw consent at any time.

We share personal information only with service providers ("sub-processors") that process it on our behalf to operate the Service. We require each to handle data under appropriate confidentiality and data-protection terms. We do not sell your data or share it for advertising.

• Supabase — our database, authentication, and backend hosting provider. Stores essentially all of the account, profile, performance, and health information above. Privacy policy.
• AI model providers — Anthropic (Claude) and/or Google (Gemini) — when AI plan generation is enabled, a sport-scoped, de-identified summary of your profile is sent to author your guidance text. See "AI processing" below. Anthropic · Google.
• Wearable providers you connect (WHOOP, Oura, Fitbit, Polar, and similar) — when you link a device, we receive your physiological data from that provider under the access you authorize. We do not send them your AthleteVia profile beyond what the sign-in handshake requires. Your connection tokens are encrypted before storage and are never shared. Each provider's own handling of your data is governed by their privacy policy, which you accept when you connect.
• Our cloud hosting provider — serves the application and processes technical/log data (such as IP addresses) needed to deliver and secure the Service.
• Payment processor (future): we do not currently process payments. If we introduce paid features, card details will be handled directly by a PCI-DSS-compliant payment processor such as Stripe; AthleteVia will not receive or store your full card number. We will update this policy before any such processing begins.

We may also disclose information if required by law, to protect the safety of users, or in connection with a merger or acquisition (in which case we will notify you).

When AI plan generation is enabled, we send the model provider a sport-scoped summary: your position, levels, measured performance gaps, goals, self-reported strengths and weaknesses, available training times, and — if you reported an injury — a de-identified injury summary (the recognized injury type, how many days ago it happened, its current recovery phase, and what training categories are safe), so your plan is built around it. If you have connected a wearable, we may also include a de-identified recovery summary (for example, “recovery trending down, average sleep 7 hours”) so your plan and coach can adapt to how you are recovering. We do not send personal identifiers (such as your name or email), your raw biometric measurements, your free-text injury description, or your doctor's guidance. Anything you type directly to the AI coach in chat is, by its nature, sent to the model to be answered. Under our providers' API terms, content we send is used to generate your guidance and is not used to train their models; providers may retain it briefly for abuse monitoring under their own policies. Outputs are recommendations only and are not medical advice.

Connecting a wearable is entirely optional and off by default. When you connect one, you grant AthleteVia permission to read the recovery, sleep, and heart-rate data described above; we store it under your account and use it to compute your recovery score, tune your training plan and calendar, and give your AI coach awareness of your daily readiness. We access it through the provider's official, permission-based interface, and the credentials that authorize that access are encrypted at rest. You can disconnect a device at any time from the Health page, which stops further collection; you can also export or delete the imported data with the rest of your information from Settings. We treat this as special-category health data and rely on your explicit consent to process it.

Our providers, including Supabase and the AI providers, are based in or process data in the United States. If you access AthleteVia from the EU/UK or elsewhere, your information will be transferred to and processed in the United States under the data-protection terms we maintain with those providers.

Data is encrypted in transit and at rest. Database access is restricted per-user by row-level security, and admin and coach dashboards are role-restricted. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your information and will notify you and any required authority of a qualifying data breach without undue delay.

We keep your account and training data for as long as your account is active. We retain intake, plan, and audit logs for up to 12 months to support safety and incident investigation, after which they may be anonymized. Imported wearable data is kept while your account is active and while the device stays connected; disconnecting stops new collection, and deleting your account removes it. When you delete your account, we remove your profile and associated training and health data, except where we must retain limited information to comply with a legal obligation.

Depending on where you live, you may have the right to access, correct, export (portability), or delete your personal information; to object to or restrict certain processing; to withdraw consent; and to opt out of any "sale" or "sharing" of personal information (we do neither). You can export or permanently delete your data yourself from Settings, or contact us to exercise any other right. We will not discriminate against you for exercising these rights, and we aim to respond within the time required by law (generally one month under the GDPR; 45 days under California law).

We use only strictly-necessary cookies to keep you signed in and to secure your session. We do not use advertising or third-party tracking cookies, so no cookie-consent banner is required for the current Service.

The Service is for adults (18+) only during the public beta. We block sign-up by anyone under 18 and do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

We may update this policy as the Service evolves (for example, when we add payments). We will revise the "Last updated" date above and, for material changes, provide a more prominent notice. Continued use after an update constitutes acceptance.

Use the in-app Report Issue form for any privacy request or question, or email legal@athletevia.com.