Theron Triathlon - Privacy Statement
Effective Date: 2026-07-28
Theron ("Theron," "we," "us," or "our") is committed to protecting the privacy of your personal and sensitive training data. As an EU-based company, we process all data in compliance with the General Data Protection Regulation (GDPR) and local Dutch law. This statement explains what data we collect, how we use it, and your rights concerning your information.
1. Data Controller & Contact Information
Data Controller: Theron Triathlon
Email for Privacy Enquiries: hello@theron.app
2. The Data We Collect and Why (Purpose and Legal Basis)
We collect data only as necessary to provide, maintain, and improve the Theron Triathlon Training Service.
| Data Category | Specific Data Collected | Purpose of Collection | Legal Basis (GDPR) |
|---|---|---|---|
| Identity Data | Name, Email Address, Password (encrypted) | To create and secure your user account. | Contract (Processing necessary for the performance of the service agreement) |
| Health & Fitness Data (Sensitive) | From Apple Health, Garmin Connect, and Strava: Activity data (e.g., swim, bike, run), duration, distance, pace, power, heart rate, GPS routes, resting heart rate, sleep data, FTP/threshold values, and related recovery metrics (e.g., HRV, readiness, training load). | To generate, customize, and display your personalized triathlon training plans and performance analytics, and to generate AI coaching insights (workout summaries, score explanations, Theron's Take, and personalized notifications). | Consent (Explicit consent is required for processing sensitive health data) |
| Configuration Data | Training preferences, current fitness level, goal races, app settings. | To configure the service to your specific needs. | Contract |
| AI-Generated Content | Personalized coaching text produced by our AI features (e.g., workout summaries, score explanations, Theron's Take, and related push notification copy). | To deliver personalized coaching in the app and via push notifications. | Contract (and Consent for the underlying health data used as input) |
| Technical Data | IP address, device type, operating system, app version, time zone. | To ensure the app functions correctly and for security and debugging. | Legitimate Interest (Necessary for operational security and service maintenance) |
3. How We Get Your Data (Third-Party Integrations)
Theron relies on your explicit consent to access data from the following third-party services:
- Apple Health: We request permission to read your workouts, heart rate, and other relevant health metrics.
- Garmin Connect: We connect via the Garmin API to import your completed activities and relevant physiological data.
- Strava: We connect via the Strava API to import your completed activities and related data.
You can revoke Theron's access to your data through the settings of these respective third-party platforms at any time. Revoking access may prevent the Theron app from functioning as intended.
4. How We Use and Share Your Data
4.1 Use of Data (Purpose Limitation)
We use your personal data only for the following purposes:
- Service Provision: To deliver your customized training plans and performance analysis.
- AI Coaching Features: To generate personalized workout summaries, score explanations, daily coaching (“Theron's Take”), and related push notifications using AI models.
- Communication: To send you service-related notifications, updates, and essential alerts about your account.
- Product Improvement (Future): We may use aggregated and anonymized data (data where all identifying information has been stripped) for internal research, analytics, and to develop and improve our services and features.
- Marketing: We will only send you marketing communications (e.g., email newsletters) if you have provided explicit, separate consent for that purpose. You can withdraw this consent at any time.
4.2 Sharing of Data
We do not sell, rent, or share your personal training data with any third parties for commercial or marketing purposes. Your data is not shown to any other user, as Theron does not have social features (e.g., leaderboards or public profiles).
To provide AI coaching features, we share limited personal and health-related data with AI service providers acting as processors solely to generate the coaching content described above. Our primary AI provider is Google (Gemini). We may also use OpenAI and/or Anthropic as alternative AI service providers.
The data we may send to these providers includes:
- Your first name (when available)
- Training profile, goals, and plan phase
- Planned and completed workout metrics (e.g., duration, intensity, heart rate, zone times, RPE, TSS)
- Recovery and wellness metrics (e.g., sleep, HRV, resting heart rate, readiness, training load)
We do not send passwords, payment data, raw GPS route tracks, photos, voice recordings, or free-text journals to AI providers.
These providers process the data only to return generated coaching text. Theron does not sell your data to them for their marketing. Theron does not use your personal data to train our own AI models. Any further processing by AI providers is subject to their terms and our arrangements with them as processors.
We may also disclose data if legally required to do so by law enforcement or government authorities.
5. AI Processing (International Transfers)
When AI coaching features are used, structured context is sent to the active AI provider’s API. This may involve temporary processing of data outside the European Union (EU) or the European Economic Area (EEA).
Theron continues to store your account data, training data, and generated AI coaching text on servers located within the EU or EEA. Generated AI content is retained in our database until your account is deleted, at which point it is deleted along with your other identifiable personal data.
You can request deletion of your data or exercise your other GDPR rights by contacting us at hello@theron.app. Deleting your Theron account removes stored AI-generated content associated with your account.
6. Data Security and Location
Security: We implement appropriate technical and organizational measures (e.g., encryption, access controls) to protect your data against unauthorized access, alteration, disclosure, or destruction.
Location: As an EU-based company, your personal and training data is stored on servers located within the European Union (EU) or the European Economic Area (EEA), ensuring compliance with GDPR data protection standards. AI inference may involve temporary processing by the AI providers named above outside the EEA, under appropriate safeguards and our contractual arrangements with those providers.
7. Data Retention and Deletion (Your Rights)
We do not intend to keep your data longer than is necessary.
Account Deletion: If you delete your Theron account, we will immediately initiate the deletion of all identifiable personal data, including AI-generated coaching content associated with your account.
Anonymization Policy: To support service analytics and legal auditing requirements, we will anonymize your core training data upon account deletion and retain this anonymized data for an allowed period as per our internal retention policy. Anonymized data cannot be linked back to you.
8. Your Rights Under GDPR
As a user of Theron, you have the following rights concerning your personal data:
| GDPR Right | Description |
|---|---|
| Right of Access | You have the right to request a copy of the personal data we hold about you. |
| Right to Rectification | You have the right to have inaccurate or incomplete data corrected. |
| Right to Erasure ('Right to be Forgotten') | You have the right to request the deletion of your personal data. |
| Right to Restriction of Processing | You have the right to request that we limit the way we use your data. |
| Right to Data Portability | You have the right to receive your data in a structured, commonly used, machine-readable format. |
| Right to Object | You have the right to object to the processing of your data, including processing for marketing purposes. |
To exercise any of these rights, please contact us at hello@theron.app.
9. Age Restriction (Children's Privacy)
Theron is not intended for children. We do not knowingly collect or solicit any information from anyone under the age of 16. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.
10. Changes to This Privacy Statement
We may update this Privacy Statement periodically to reflect changes in our data practices or legal requirements. We will notify you of any material changes by posting the new statement on the app or by sending an email notification.
