Privacy Policy

1. Data controller

Asoft Oy (business ID 3107228-5), Finland

Contact: aku@asoft.fi

2. Purposes of processing

We process personal data to provide the service, manage subscriptions, offer customer support, develop the service, ensure security, and meet our legal obligations.

3. Categories of personal data

The service may process the following categories of data:

• identifying data (such as a name or username)
• usage data and logs
• device and technical data (such as IP address, browser, operating system)
• content and training data entered by the user
• activity data retrieved from a sports watch or other wearable device, if you choose to connect one (see section 4)

We do not send emails, and the service does not require an email address.

4. Activity data from sports watches and wearable devices

You may choose to connect a sports watch or other wearable device (for example a Garmin device) to Syncra. Connecting is always voluntary. This section explains what data we retrieve, how we use it, and to whom we disclose it.

4.1 What data we retrieve

We retrieve only training-related data from the device manufacturer's API:

• activity type, start time and duration
• distance, elevation gain, speed and pace
• heart rate: average heart rate, maximum heart rate and the heart rate series
• calories burned
• route location data, if the device recorded it

The connection is always established on the device manufacturer's own sign-in page. We never ask for and never see the username or password of your device manufacturer account.

4.2 How we use the data

Activity data is used only to produce your own training diary:

• An activity arriving from your device is first shown to you as a suggestion. It does not enter your training diary until you accept it yourself, and you can discard the suggestion, in which case it is not counted anywhere.
• For an activity you accept, its metrics — such as distance, average speed and average heart rate — are saved with the training session and appear in your own statistics.
• The heart rate series and the route are stored with the training session so that you can review them later.

We do not use activity data for advertising or profiling, and we do not sell it.

4.3 To whom we disclose the data

• To your coach: if you belong to a team, a training session you have accepted, including its metrics, is visible to your coach in the same way as any other session you record. The heart rate series and the route are separate from this: they are shared with your coach only if you switch sharing on yourself for that specific session. Heart rate and route are separate choices, and you can withdraw sharing afterwards as well.
• To our service providers: device connections are handled by Terra (Terra Enabling Technologies, Inc.), and the data is stored on Supabase servers in the EU region. Both process the data solely on our behalf and under our instructions.
• We disclose activity data to no one else: it is not sold, traded, or disclosed to advertisers, data brokers or other third parties. We disclose data to authorities only where the law requires it.

The coach's route view is drawn without a map background, so your location data is not sent to any third-party map service.

4.4 Artificial intelligence and activity data

Activity data received from wearable devices — heart rate, route, distance or pace — is not used to train artificial intelligence models and is not sent to any AI service. Syncra's AI features use only basic training session data and questionnaire answers, without player names.

If this ever changes, we will update this policy and obtain separate, explicit consent before any such processing begins. Consent can be withdrawn at any time, as easily as it was given.

4.5 Disconnecting and deleting data

• You can disconnect your device at any time in the app settings. After that we receive no new data from your device.
• You can delete an individual training session or its telemetry in the app, or delete your entire account and all your data as described in our account deletion instructions, or by emailing aku@asoft.fi.
• You can also revoke the permissions you granted to Syncra directly from your device manufacturer account, for example in Garmin Connect.

Activity data is retained for as long as your account exists or until you delete the data yourself. Garmin's own privacy policy is available at garmin.com/privacy/connect.

5. Legal bases for processing

Processing is based on the legal bases set out in the GDPR: performance of a contract, the controller's legitimate interest in maintaining and developing the service, and legal obligations. Consent is used where the law requires it.

6. Retention period

Personal data is retained only for as long as it is necessary for the purposes described in this policy, or for as long as legislation requires (for example accounting law).

7. Recipients and transfers of data

We use trusted service providers to deliver the service:

• hosting and database: Supabase (EU region)
• analytics: PostHog
• AI features: OpenAI (in team features, with anonymised data)
• wearable device connections: Terra (only if you connect a device yourself, see section 4)

In connection with team features, anonymised data may be sent to OpenAI's servers to produce AI features (for example training analyses). Personal data is removed before the data is sent.

Personal data may be transferred outside the EU/EEA by our service providers. In such cases we ensure an adequate level of protection (for example the Commission's standard contractual clauses).

8. Information security

We protect personal data with appropriate technical and organisational measures, such as encryption, access control and backups.

9. Your rights as a data subject

You have the right to access your data, rectify inaccurate data, request erasure, restrict processing, object to processing, and port your data from one system to another. You may also withdraw your consent at any time where processing is based on consent.

Deleting your data: you can request the deletion of all your data by emailing aku@asoft.fi. We handle requests without undue delay.

10. Cookies and similar technologies

The web service may use cookies and similar technologies to ensure the service works and to develop it. Where required, we ask for consent before using non-essential cookies.

11. Right to lodge a complaint

If you believe your personal data has been processed unlawfully, you have the right to lodge a complaint with the Finnish Data Protection Ombudsman: https://tietosuoja.fi/en/

12. Changes to this policy

We may update this privacy policy. Changes take effect when they are published in the service.