Privacy policy
This explains what tryat collects, why we are allowed to, who else touches it, and how to get it back or get rid of it.
Last updated 4 September 2026
The short version. We collect your health and training data because that is the entire product. We do not sell it, we do not advertise, and we run no analytics or tracking of any kind. Three companies process it on our behalf: our host, our database provider, and Anthropic, whose model writes the coach’s reading of your numbers. You can download everything or delete everything from Settings, whenever you like, without asking us. Your completed sessions are visible to other members by default, which you can turn off in your profile at any time. Your sleep, HRV and resting heart rate are never visible to anybody, under any setting.
1. Who is responsible
Join Animation Studio AS (organisation number 824 988 692), Fjellhamarveien 52, 1472 Fjellhamar, Norway, is the data controller for tryat. That means we decide what is collected and why, and we are the ones answerable for it.
For anything in this document, including exercising any of the rights in section 8, write to privacy@joinanimation.no.
2. What we collect
What you give us
- Your name, email address and a password. The password is never stored, only a bcrypt hash of it, which cannot be turned back into your password.
- Your time zone, read from your browser at sign-up so the coach knows what “today” means for you.
- Your goals, races, training constraints and any instructions you write for the coach.
- Everything you type to the coach, and everything it replies, so the conversation has a memory.
What we fetch from Garmin
This is health data. It is treated as a special category under Article 9 of the GDPR, which is why we ask for your explicit consent separately at sign-up rather than folding it into the terms.
- Sleep: score, duration, deep, light, REM and awake time, quality, respiration rate.
- Heart rate variability, including Garmin’s seven day average, baseline and status.
- Resting heart rate.
- Body Battery high, low and change.
- Body weight, where your scales report it to Garmin.
- Steps, activities, training readiness and training status.
- Garmin’s own wellness and training overviews, including acute and chronic load, FTP, VO2 max and threshold pace.
What we fetch from TrainingPeaks, if you connect it
- Planned and completed sessions, their descriptions and their durations.
- Fitness, fatigue and form (CTL, ATL and TSB).
What we fetch from Strava, if you connect it
- Your completed activities: name, description, sport, duration, distance, elevation, heart rate, power, cadence, calories, and Strava’s Relative Effort score.
- Your athlete profile: body weight, and FTP where Strava provides it.
- Your heart rate and power zones, where Strava provides them.
Some of those fields only exist for Strava subscribers. We ask for all of them and keep whatever comes back, so a free account simply results in a shorter list rather than a failure. Strava has no planned workouts and no way to provide them, so if Strava is your training platform the plan the coach works from is the one you describe yourself in your profile. Fitness, fatigue and form are calculated by us from your Relative Effort scores rather than read from Strava, and will not match the figures shown on Strava’s own pages.
Credentials for those services
Garmin does not offer a public way for an app to be granted access without a password, so connecting Garmin means giving us your Garmin email and password. We encrypt both with AES-256-GCM before they reach the database, using a key held outside it, and we never show them again. They are used for one thing only: logging in to Garmin as you, to read your data. The same applies to TrainingPeaks. Strava uses proper OAuth and no password is ever entered or stored.
We would rather not hold these at all. If that matters to you, connect Strava instead and leave Garmin disconnected, though you will lose the sleep and HRV data that most of the coaching depends on.
Technical
Our host keeps standard server logs, which include IP addresses, for security and to diagnose faults.
3. Why, and what allows us to
| What for | Legal basis |
|---|---|
| Running your account and showing you the service you asked for | Performance of a contract, Article 6(1)(b) |
| Collecting and analysing your health data, and sending the relevant figures to Anthropic so the coach can read them | Your explicit consent, Article 9(2)(a) |
| Keeping the service secure and working, including server logs | Legitimate interests, Article 6(1)(f) |
You can withdraw the health consent at any time from Settings. Doing so stops the coach and deletes the health data we hold, because without it there is no service left to provide. Withdrawing does not undo processing that already happened lawfully.
4. Who else touches it
These companies process data on our behalf, under contract, and for nothing else:
| Who | What they do | What they see |
|---|---|---|
| Vercel Inc. | Hosts the website and runs the server code. | Everything the app handles, in transit. Technical logs including IP addresses. |
| Railway Corp. | Hosts the database. | Everything stored: your account, your health and training data, your conversations with the coach. |
| Anthropic PBC | Provides Claude, the model that writes the coach's reading of your data. | The health and training figures relevant to the question being answered, plus what you type to the coach. Not your email address, your password, or your Garmin or TrainingPeaks credentials. |
Garmin, TrainingPeaks and Strava are not on this list because the flow runs the other way: we read from them using access you granted. We do not send them anything about you beyond the login needed to read your own data. Your relationship with them is governed by their own terms.
We do not sell personal data, we do not share it for advertising, and no third party receives it for their own purposes.
5. What you choose to share with other athletes
tryat has a feed where members follow each other. New accounts start public. That means your name is listed for other members and any of them can follow you with one tap, without asking you first.
You can turn this off whenever you like. Open your profile and switch off Public profile: you disappear from the list and nobody new can follow you. Anybody already following you stays until you remove them, one by one, under Following on the Team screen.
A follower sees, of your completed sessions:
- The sport, the name of the session, its duration and its distance.
- The date it happened.
- Your first name, as written in your profile. Never your surname and never your email address.
They never see any of the following, and there is no setting that would let them:
- Sleep, HRV, resting heart rate, Body Battery, respiration, weight or readiness.
- Your training plan, your goals, your races, or the instructions you wrote for your coach.
- Anything the coach has written to you, or anything you have written to it.
- Your heart rate or calories for a session.
- Any session read from Strava. Strava allows their data to be shown only to the athlete it came from, so those are excluded even from your own followers.
Only sessions from the day you created your account onwards appear. Connecting Garmin backfills sixty days of history, and that history stays private to you.
Followers can leave a comment or a flame on a session. Those are visible to everybody else who follows that athlete. You can delete your own comments, and you can delete any comment left on your own session. Deleting your account removes both.
The legal basis for this sharing is your consent. You agree to it when you create an account, having been told here what it covers, and you withdraw it by switching your profile to private. Nothing sensitive is shared either way: this covers what you did, not what your body was doing.
6. Where it goes
Some of this processing happens outside the European Economic Area, principally in the United States. Where it does, the transfer is covered by the European Commission’s Standard Contractual Clauses together with the additional safeguards our providers commit to. You can ask us for the detail of any specific transfer.
7. How long we keep it
- While your account exists: your health and training history is kept, because a trend is the point. Nothing is deleted on a schedule.
- When you delete your account: everything is removed from the live database immediately. Encrypted backups roll off within 30 days.
- Server logs: kept by our host for a short period, typically 30 days.
8. What you can do
Under the GDPR you have the following rights, and none of them cost anything:
- See it and take it with you. Settings has a button that gives you everything we hold, as a JSON file, right away. Articles 15 and 20.
- Delete it. Settings has a button for that too. It is immediate and it is not reversible. Article 17.
- Correct it. Edit your profile, or write to us. Article 16.
- Withdraw consent. At any time, as easily as you gave it. Article 7(3).
- Object, or ask us to restrict what we do. Articles 18 and 21.
- Complain. To us first, ideally, but you are entitled to go straight to Datatilsynet, the Norway supervisory authority. Article 77.
If you write to us rather than using the buttons, we will answer within one month.
9. Cookies
tryat sets three cookies, all of them ours, none of them for tracking:
| Cookie | What it is for | How long |
|---|---|---|
| Session token | Keeps you signed in. Without it every page would ask for your password again. | Until you sign out or it expires |
| CSRF token | Stops another site submitting forms as you. | The browser session |
| Callback URL | Returns you to the page you were on after signing in. | The browser session |
All three are strictly necessary for a service you asked for, which is the exemption in Article 5(3) of the ePrivacy Directive, so there is no consent banner. There is no Google Analytics, no advertising pixel, and no third-party script of any kind. Your phone may also store small amounts of data locally, such as whether you dismissed the install prompt or the last figures shown, so the app can paint before it has finished loading. That never leaves your device.
10. Keeping it safe
- Everything travels over HTTPS.
- Your password is stored only as a bcrypt hash.
- Garmin and TrainingPeaks credentials are encrypted with AES-256-GCM, with the key held outside the database.
- Each account can only ever read its own rows.
No system is perfect. If personal data is ever breached in a way that puts you at risk, we will tell Datatilsynet within 72 hours and tell you without undue delay.
11. Children
tryat is not for anyone under 16. We do not knowingly collect health data about children. If you believe a child has an account, write to us and we will remove it.
12. Changes
If we change this policy in a way that affects what you agreed to, we will tell you in the app and ask again where the law requires it. The version you accepted is recorded against your account.