Privacy policy
The short version. gpeak is an invite-only training calendar. Each athlete has their own account and sees only their own data — plans, notes, Garmin activity and overnight health figures, and their own conversations with the training assistant. We use it for one purpose: showing you your training and answering your questions about it. Nothing is sold, nothing is used for advertising, there are no analytics or tracking cookies, and your data is never used to train AI models. Withdraw your Garmin authorization and we erase the Garmin data we hold for you automatically. Ask us to delete your account and everything goes.
1. Who we are
gpeak ("gpeak", "we", "us") is an invite-only web application operated by Greg Miller in Canada. Each athlete has a separate account, and the application is built so that one athlete's data is not visible to another. For anything in this policy — access, correction, deletion, or a question — write to privacy@adze.ca.
2. What we collect
We collect only what the application needs to function. There is no public sign-up, and we do not buy or import data about anyone. Everything in the table below is stored in our database unless a row says otherwise, because the value of the application is the comparison across time — this season's block against last season's.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | A username, a password, and a session cookie that keeps you signed in. | Issued by us to invited users. |
| Activity data | Completed workouts: date, type, duration, distance, elevation gain, pace, heart rate (average, maximum, and time in heart-rate zones), training effect. | Garmin Connect, with the athlete's authorization. |
| Health and wellness data | Daily overnight measurements: sleep duration and sleep stages, heart-rate variability, resting heart rate, body battery, stress, blood-oxygen saturation where recorded. | Garmin Connect, with the athlete's authorization. |
| Activity detail traces | The second-by-second record behind a workout — heart rate, pace and altitude through the session — used to analyse pacing and cardiac drift. These are deleted automatically after 60 days; only the workout summary is kept beyond that. | Garmin Connect, with the athlete's authorization. |
| Assistant usage | A per-day count of how many questions the athlete asked the assistant and roughly how much processing that used, so the service stays within its running costs. No message content is kept in this record. | Generated automatically. |
| Training plan and notes | Imported or entered plans, sessions, per-day and per-activity notes, manual corrections (for example a corrected elevation figure), an athlete profile, and any coaching documents the athlete chooses to store. | Entered or uploaded by the athlete. |
| Coach-prescribed sessions | Sessions published by the athlete's coach: date, type, title, description, planned duration. | A FinalSurge calendar feed the athlete supplies. |
| Assistant conversations | The athlete's subjective readiness score and note, the questions they ask the assistant, and the assistant's replies — kept as a history so past assessments can be revisited and compared. | Entered by the athlete; generated by the assistant. |
| Server logs | Ordinary web-server request logs kept by our hosting provider (IP address, timestamp, URL requested, error diagnostics), used for security and troubleshooting. | Generated automatically. |
3. What we do with it
- Display the athlete's calendar: prescribed sessions beside completed ones, with weekly planned-versus-actual distance and elevation totals.
- Show overnight recovery figures against the day they belong to.
- Answer the athlete's questions through the AI training assistant, which reads their stored training and health data in order to give an answer grounded in it.
- Keep the application secure, diagnose faults, and prevent unauthorized access.
That is the complete list. We do not use this data for advertising, profiling for third parties, credit or insurance decisions, or any purpose unrelated to the athlete's own training.
4. What we never do
- We do not sell personal data, and we never have.
- We do not share it with third parties for their own purposes — only with the service providers in section 5, acting on our instructions.
- We run no advertising, analytics, or tracking. There are no third-party trackers, advertising pixels, or analytics scripts on this site.
- We do not use health or activity data to train AI models.
- Unlike most companies you entrust with your data, we strongly believe that this is YOUR DATA. You want us to delete it, just say the word.
5. Service providers
gpeak relies on three providers. Each processes data only to deliver its service to us.
| Provider | Role | What it handles |
|---|---|---|
| Microsoft Azure | Hosting, database, file storage | All stored data. Hosted in Microsoft's Canada Central region; encrypted in transit and at rest. |
| Anthropic | AI assistant | When the athlete asks the assistant a question, the relevant training and health context is sent to Anthropic's Claude API to generate the reply. Under Anthropic's commercial API terms, that content is not used to train their models. |
| Garmin | Data source | We retrieve activity and wellness data from Garmin Connect with the athlete's authorization. We do not send personal data back to Garmin, and Garmin's own handling of the athlete's data is governed by Garmin's privacy policy, not this one. |
6. Garmin Connect: authorization and disconnection
gpeak reads Garmin Connect data only after the athlete authorizes it, and only for the athlete's own account. The athlete can withdraw that authorization at any time from their Garmin Connect account settings. Once authorization is withdrawn, gpeak stops receiving new data.
Withdrawing authorization also erases the Garmin data we already hold for that athlete. When Garmin tells us the athlete has disconnected, gpeak automatically deletes their stored Garmin activity and health records and discards the access it was granted. This happens without anyone having to ask.
What survives is the athlete's own work — their training plan, their notes, their athlete profile, their coaching documents and their past conversations with the assistant. Disconnecting Garmin means "stop using my watch data", not "delete my training log". To have those deleted as well, see section 8.
7. How long we keep it
Training and health history is kept for as long as the athlete's account is active, because the value of the application is the comparison across seasons — this year's block against last year's. Assistant conversations are likewise retained as a history.
Two exceptions, both automatic. Activity detail traces — the second-by-second heart-rate and pace record behind a workout — are deleted after 60 days; the workout summary is kept. Garmin activity and health records are erased as soon as the athlete withdraws their Garmin authorization, as described in section 6.
When an account is closed, or when deletion is requested, the associated data is deleted from the live database and file storage. Backups roll off on the hosting provider's own schedule, normally within 35 days. Server logs are retained for a short period for security and troubleshooting.
8. Your rights
Users may ask us to give them a copy of their data, correct it, or delete it. Canadian privacy law (PIPEDA) gives these rights to individuals in Canada; we extend the same treatment to anyone who asks, including the access, correction, erasure, portability and objection rights available under the GDPR to individuals in the UK and EEA.
Write to privacy@adze.ca. We will respond within 30 days. There is no charge. Deletion removes the account and every record attached to it — plans, sessions, notes, elevation corrections, athlete profile, coaching documents, assistant conversations, usage counts, and all stored Garmin activity and health data — in a single operation. We do not retain a shadow copy. Backups roll off the hosting provider's own schedule as described in section 7.
9. Security
- All traffic is served over HTTPS; the site instructs browsers to refuse insecure connections.
- Every page except this policy and the landing page requires a signed-in session.
- Data is stored in Microsoft Azure, which encrypts it at rest; the database is not reachable from the public internet.
- Credentials and API keys are held in the hosting platform's configuration store, never in the application's source code.
No system is perfectly secure. If we become aware of a breach affecting personal data, we will notify affected users and the relevant regulator as required by law.
10. Cookies
gpeak sets one cookie: an authentication cookie that keeps a signed-in user signed in for up to 60 days. It is strictly necessary for the application to work, it holds no tracking identifier, and it is not shared with anyone. There are no analytics, advertising, or third-party cookies, which is why this site shows no cookie banner. Signing out clears the cookie.
11. Children
gpeak is not directed at children and is not offered to anyone under 16. We do not knowingly collect data from children.
12. Where data is processed
Data is stored in Canada (Microsoft Azure, Canada Central region). Requests to the AI assistant are processed by Anthropic, which may process them in the United States. Garmin processes data under its own policy and in its own locations.
13. Changes to this policy
If this policy changes, the "last updated" date above changes with it. Material changes affecting how existing data is used will be communicated to users directly before they take effect.
14. Contact
Email: privacy@adze.ca
Privacy questions, data access requests, and deletion requests all go to the same address.
Individuals in Canada who are not satisfied with our response may contact the Office of the Privacy Commissioner of Canada.