Gappie

Privacy statement

Last updated 27 October 2026. This page says what we collect, why, who else handles it, and how you ask for a copy or for deletion.

Who we are

Gappie runs the website and the training service at gappie.ai. We are the controller: we decide why your personal data is used and how. Email privacy@gappie.ai for any request on this page. We have not appointed a data protection officer. The supervisory authority is the Autoriteit Persoonsgegevens in the Netherlands.

Account

When you create an account we store:

first name and last name
email address
a hash of your password, not the password itself
timezone, so a morning note can use 08:00 where you are
whether a staff address at gappie.ai has been confirmed
an optional photo. It is shown large on your profile, to people on a plan with you, and on the coach marketplace once you are listed

A login lasts 14 days. The browser keeps a token in local storage under the name gappie_token. We store only a hash of that token. Logging out deletes it. We do not use it to follow you around the web.

The plan

A plan stores the goal you enter: the event, the distance, the time you are aiming for, how many days you train, and the race date when you set one. We also store the sessions we write, notes and lap choices you save, changes a coach makes, and which daily question you were shown and how you answered it.

The plan is built for you from those facts and, when you connect Garmin, from the training below. It is a suggestion on the page. It does not produce a decision with legal effect.

Garmin and health data

Heart rate, sleep, heart-rate variability, and similar readings are health data. We use them only to build and adjust your plan, and only after you choose to provide them.

Saving a Garmin Personal API key is that choice. The key lets us download activities and the wellness readings Garmin holds for you, such as sleep, heart-rate variability, resting heart rate, stress, body battery, and the effort and feeling answers recorded on a run. You can replace or remove the key in settings. Garmin keeps its own copy under Garmin's terms. We are not Garmin.

From an activity we keep the sport, the start time, and the figures the plan needs, including:

distance, time, speed, elevation, calories, and heart rate
cadence, power, and running dynamics such as stance time, vertical oscillation, vertical ratio, and step length
laps, and per-second samples of those same figures

A Garmin file can also contain a GPS track. We do not copy those coordinates into the stored samples. When an activity with a track is on screen, including one someone you follow has shared, we read the positions from the original file and draw the route in your browser. The line is colored from the running stride in that file: ground contact, bounce, cadence, and step length, on the parts that were running. A background map of that area is loaded from OpenFreeMap, which serves OpenStreetMap and is hosted in Germany. The route line stays in the browser and is not uploaded with that request. The coordinates are not written into our logs. The original file stays with your account so we can read the activity again. It is deleted when the account is erased, or sooner if you ask us to delete your Garmin data.

Disconnecting Garmin stops new downloads and deletes the key. The activities already saved stay until you ask us to delete them or you erase the account.

HYROX

Race search is optional. The first and last name you type are sent to the results service so it can look up public results. We store a result on your account only after you tick the box to link it. That box is your consent to keep those splits and use them for the plan. You can ask us to remove a linked result.

Coaches and invites

If you invite someone onto a plan, or accept an invite, we store the invited email address and send them one mail with the inviter's first name, the plan name, and the event name. A person on the plan can open it. They see the goal and the sessions. They do not receive your Garmin key.

A waitlist address, if you leave one, is stored until we send an invite or you ask us to remove it. Staff with a confirmed @gappie.ai address can see that list, product totals such as how many accounts and plans exist, and when an account signed in. Where a Garmin pull is available, they can queue a download for an account that has saved a Personal API key. That admin view does not show someone else's activities.

Following

You can ask to add another account from Gappies. They accept before you see their runs, hybrid racing sessions, and strength work, or the comparison of recent running stride: ground contact, bounce, cadence and step length, and how close those runs sit to the pros. Sharing includes the route and the running stride. It starts on, and they can turn it off. You can remove the gappy. They can decline the request. Any of those stops further viewing.

Email

We send mail the account needs: a welcome, a plan invite, a gappy request when someone asks to connect, and a confirmation link when a staff address asks for one. Those mails use your address and, where the sentence needs it, your first name. They do not contain a heart rate, a pace, a split, or a map. We do not send a newsletter. We do not sell the address.

Why we use it

To provide the account and the plan. Contract. This covers your profile, the plan, session notes, and the mail the account needs.
To use health data in the plan. Explicit consent, given when you save a Garmin key or enter those readings. You can withdraw it by disconnecting Garmin and asking us to delete the files. Withdrawal does not affect use that already happened.
To link a HYROX result. Consent, given by the tick box. You can withdraw it by asking us to remove the result.
To show your activities to a gappy you have both accepted. Sharing starts on. You withdraw it by turning sharing off, declining a request, or removing the gappy.
To keep the service secure and to fix faults. Legitimate interest. Logs are limited to fields such as an internal id, a sport, and an outcome. They are scrubbed of email addresses, coordinates, and keys.
To hold a waitlist address until an invite. Steps you asked for before an account exists.

We do not use your data for advertising, and we do not make automated decisions that have a legal effect.

Who else handles it

We use these processors. They act on our instructions and do not receive the data for their own products.

Amazon Web Services, in Frankfurt (eu-central-1). The app, the database, the activity files, and the logs.
Brevo, in the EU. Sends the account mail. A send includes the address and, when the mail needs it, the first name. Brevo does not receive activities or the plan.

Garmin and the HYROX results service are separate controllers for the data you give them directly. We send Garmin the key you created there, so it can return your files. We send the results service only the name you typed into search.

When a route is on screen, your browser asks OpenFreeMap for the background map of that area. OpenFreeMap is Hyperknot Software Kft. in Hungary, and the tiles are hosted in Germany. The request can also pass through Cloudflare. It carries the map area, not the stride line and not the activity file.

People who operate Gappie can open an account when that is necessary to keep the service working, to answer a request from you, or to investigate abuse. We do not transfer your data outside the European Economic Area for our own storage. A processor listed above stays in the EU.

How long we keep it

The account, plans, and activity files stay while the account is open.
If you do not sign in for 24 months, we email a warning. If you do not sign in during the next 30 days, we erase the account.
When you ask us to erase the account, we delete the profile, including a photo, the plans, the Garmin key, and the files.
A backup can still hold a copy for up to 35 days after that deletion. Then it expires.
Logs that can contain an internal id are kept for a limited period and are not a copy of your training.
A waitlist address stays until the invite is used or you ask us to remove it.

Cookies

We do not set analytics or advertising cookies, and we do not run a tracker on the public site. The login token lives in the browser's local storage, not in a cookie. It is there so you stay signed in. That is why this site has no cookie banner.

Your rights

You can ask us to:

show you the personal data we hold, or send you a copy
correct your name or timezone, which you can also do in settings
delete the account, or delete the Garmin data and leave the account
limit or stop a use that is based on legitimate interest
withdraw consent for Garmin health data or a linked HYROX result
take a complaint to the Autoriteit Persoonsgegevens

Email privacy@gappie.ai from the address on the account. We reply within one month. Activity figures come from the device, so we correct the account rather than rewrite a run. The complaint form is on autoriteitpersoonsgegevens.nl.

Age

You must be 16 or older. We do not knowingly create an account for a younger person. If we learn that we have, we delete it.

Changes

If this statement changes, the date at the top changes with it. A change that affects health data or a new recipient is also sent to the email on your account.