Privacy policy
Last updated: 27 October 2026
This policy explains what personal data VibeGrind processes when you use the website and app at https://vibegrind.app, why, and what rights you have. VibeGrind turns plain-language descriptions into structured cycling workouts and, if you connect Garmin, estimates your daily readiness to train.
VibeGrind is operated from Switzerland, so the Swiss Federal Act on Data Protection (FADP) applies. Where we process data of people in the European Union or the European Economic Area, the EU General Data Protection Regulation (GDPR) applies as well.
1. Who is responsible
Dominik Reuter – VibeGrind
Zaystrasse 21
6410 Goldau
Switzerland
Email: hello@vibegrind.app
For any privacy question, write to the email address above.
Representative in the EU (Art. 27 GDPR):
Dominik Reuter
Kobenbachweg 5
88090 Immenstaad
Germany
Email: hello@vibegrind.app
2. What we process, and why
| Data | Purpose | Legal basis (GDPR, for EU/EEA users) |
|---|---|---|
| Account data: email address, a securely hashed password, the invite code you used | Creating and securing your account | Art. 6(1)(b) (contract) |
| Training settings: FTP, maximum heart rate | Showing watts and tailoring workouts | Art. 6(1)(b) |
| Workouts and chat messages you write, and the workouts created from them; workout files you upload | Building, editing, storing and exporting your workouts | Art. 6(1)(b) |
| Garmin data, only if you connect Garmin: overnight heart-rate variability (HRV), resting heart rate, sleep duration, stages and score, Body Battery, stress, and activity summaries (type, date, duration, power, heart rate, training load, training effect) | Your readiness dashboard and workout suggestions that fit your readiness | Your explicit consent, Art. 9(2)(a) and Art. 6(1)(a) |
| Usage counters: number of chat messages per day and the AI cost estimate | Fair-use limits and keeping costs under control | Art. 6(1)(f) (legitimate interest in running the service sustainably) |
| Technical data: IP address, time and type of request, browser information in server logs | Operating the service securely, limiting sign-in attempts, fixing errors | Art. 6(1)(f) (legitimate interest in security) |
Data about your heart rate, HRV, sleep and similar measurements is health data, which the FADP treats as sensitive personal data and the GDPR as a special category (Art. 9 GDPR). We only process it with your explicit consent, given when you connect Garmin. You can withdraw that consent at any time (see section 7); this doesn't affect processing that happened before.
We don't use your data for advertising, we don't sell it, and we don't build profiles beyond what you see in the app. The readiness score and workout suggestions are produced automatically, but they're training suggestions you're free to ignore: they don't lead to any decision that has legal consequences for you or affects you significantly.
3. AI processing
When you send a chat message, the message, the current workout, your training settings and, if you've connected Garmin, a short summary of your readiness and recent activities are sent to Anthropic's Claude API to create or change the workout. Anthropic processes this data on our behalf. Under Anthropic's commercial terms, data sent through its API isn't used to train its models. Please don't put information in the chat that isn't needed for your training.
4. Service providers and transfers abroad
We use these providers, each bound by a data processing agreement where they act on our behalf:
| Provider | What for | Location |
|---|---|---|
| Render Services, Inc. | Hosting the app and its database | Frankfurt, Germany (EU). Render is a US company, so access from the USA (e.g. for support) can't be ruled out. |
| Anthropic, PBC | AI processing of chat messages (section 3) | USA |
| Garmin Ltd. and subsidiaries | Source of your Garmin data, when you connect it. Garmin processes your data under its own privacy policy. | Per Garmin's privacy policy |
Your account data, workouts and Garmin data are stored in the EU. Data sent to Anthropic for AI processing is processed in the USA. Transfers to the USA rely on the Swiss-U.S. and EU-U.S. Data Privacy Frameworks where the provider is certified, and otherwise on standard contractual clauses recognized by the Swiss Federal Data Protection and Information Commissioner and the European Commission.
5. How long we keep data
- Account, settings, workouts and chats: until you delete them or your account.
- Garmin data: until you disconnect Garmin or delete your account; then it's deleted from our database within 30 days.
- Usage counters: up to 13 months, for cost tracking.
- Server logs: as long as our hosting provider keeps them, at most 30 days.
6. Cookies
We use one cookie: a session cookie that keeps you signed in. It's needed for the service to work. We don't use analytics, tracking or advertising cookies.
7. Your rights
You can ask us for information about the data we hold about you, and to have it corrected, deleted or handed over in a common electronic format. You can object to processing and withdraw your consent to Garmin data processing at any time, by disconnecting Garmin or by emailing us. Under the GDPR, EU/EEA users also have the right to restrict processing (Art. 18). To exercise any of these rights, write to hello@vibegrind.app.
You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch); in the EU/EEA the authority in your country of residence.
8. Security
Connections are encrypted (HTTPS), passwords are stored only as salted scrypt hashes, sign-in attempts are rate-limited, and access to the service is invite-only during the beta.
9. Changes
We'll update this policy when the service or the law changes, and tell you about significant changes in the app or by email.