Privacy Policy

We do not collect payment information, location data, or any training data itself — your Intervals.icu data is fetched on demand and never stored in our database (except briefly in a short-lived cache to reduce API calls).

AskMyCoach connects to Intervals.icu using either OAuth (recommended) or an API key, both stored AES-GCM encrypted. With OAuth you choose which permission scopes to grant (Activities, Wellness, Calendar, Settings) during the Intervals.icu authorisation screen; AskMyCoach records exactly what you approved and only enables tools that match your granted scopes. You can reconnect at any time from the Dashboard to change your scope selection.

When an AI assistant connects — either via your personal MCP URL or by signing in through OAuth — AskMyCoach retrieves data from Intervals.icu in real time using your encrypted credentials. This data is passed directly to the AI assistant and briefly cached to reduce repeat API calls — TTLs range from 5 minutes (calendar events) to 1 hour (athlete profile). The cache is stored in our database, is associated only with your account, and expires automatically. Platform administrators can also manually clear the full cache. You can disconnect your Intervals.icu account at any time from the Dashboard, which immediately removes the stored credentials and invalidates any active OAuth tokens.

Some tools (such as Log Wellness Data and Update Athlete Profile) write data back to Intervals.icu on your behalf. AskMyCoach acts as a pass-through for these writes: the data goes directly from the AI assistant to Intervals.icu via your encrypted credentials and is not stored on our servers.

The AskMyCoach mobile app (iOS) uses the same account and Intervals.icu connection described above, plus the following mobile-specific data:

Garmin Connect bridge (optional). If you choose to connect a Garmin account from the app's Garmin screen, this is an experimental feature using an unofficial method not endorsed by Garmin. Your Garmin email and password are sent directly from your device to Garmin's own servers to sign in — they are never sent to or stored on AskMyCoach's servers. The resulting Garmin session token is also kept only on your device (in the OS's secure credential storage), never on our servers. Only the activity and wellness data your device pulls from your Garmin account is sent to AskMyCoach, which forwards it into your Intervals.icu account. You can disconnect Garmin at any time from the app, which deletes the on-device session immediately. See the in-app disclaimer for the full disclosure shown before you connect.

Local, on-device data — your Garmin session, a sync watermark, and the mobile app's UI preferences — is stored using the device's standard secure storage and local storage mechanisms. This data is not accessible to AskMyCoach and is deleted when you disconnect Garmin, log out, or delete the app.

AskMyCoach supports two coach-access flows:

• Athlete invites coach (coach without account): You enter a coach's email on your Coaches page. The coach receives a 48-hour one-time link by email. Clicking it shows their personal MCP URL. Access is granted immediately — no account required for the coach.
• Athlete invites coach (coach with account): The coach receives an invitation email and must log in to their AskMyCoach account to confirm or decline. The invitation appears on their My Athletes page. Access is only granted after explicit confirmation; declining sets the status to Declined on your Coaches page.
• Coach requests access: A coach sends you an access request. You receive an email with a one-time link. Clicking the link takes you to your Coaches page where you choose which tools to allow before accepting. The coach receives their MCP token only after you accept.
• Coach MCP recovery: A coach without an account may request a fresh MCP access link via the Support page. This is rate-limited (90 seconds between requests, maximum 3 per 2-hour window). A new 48-hour one-time link is emailed only if the coach has an existing accepted coaching relationship.
• Coach API key import: A coach may provide their own Intervals.icu API key to automatically import all athletes they coach on Intervals.icu. Before the first import, the coach must affirm that the athletes being imported are 13 years of age or older, or that the coach has the legal authority or parental consent to add them — this affirmation and its timestamp are recorded against the coach's key and are not re-requested for recurring or manual syncs of the same key, only if the key is removed and a new one is added. The key is stored AES-GCM encrypted. AskMyCoach uses it to call the Intervals.icu List Athletes endpoint, which returns only athletes the coach has a coaching relationship with. For each coached athlete who has an AskMyCoach account, access is automatically provisioned. Athletes without an AskMyCoach account receive a single notification email informing them their coach uses AI for training analysis and offering — but not requiring — them to create an account. The athlete's email address for this notification comes from Intervals.icu. The key syncs every 24 hours to pick up new coaching relationships; coaches can also trigger a manual sync. The key can be removed from the My Athletes page at any time.

Each coach email address is assigned one MCP token, shared across all athletes who have granted that coach access. One-time connect links expire after 48 hours; the underlying MCP URL remains valid until access is revoked or the token is regenerated. Revoking access immediately invalidates both the MCP URL and any outstanding one-time connect links for that coach. Coaches may assign a short nickname to each athlete for easier reference in AI tool calls. We store the coach's email address, the athlete-coach relationship, the selected permission set, and any nickname the coach has set.

Coaches with access to multiple athletes may use aggregated team wellness tools (daily summary, rankings, health alerts) that retrieve and combine wellness data from several athletes in a single query. These tools only access data for athletes who have explicitly granted the coach wellness data permission, and the data is never stored beyond the short-lived cache described above.

You can revoke coach access at any time from your Coaches page, which immediately invalidates the coach's ability to access your data via that token.

• To operate and secure your account.
• To provide the MCP integration with AI assistants.
• To send transactional emails (account creation, password reset, coach invitations) via Resend.
• We do not sell your data to third parties.
• We do not use your data to train AI models.
• We do not send marketing emails without your consent.

• Cloudflare — hosting, DDoS protection, bot mitigation (Turnstile). Your requests pass through Cloudflare's network.
• Resend — transactional email delivery. Your email address is shared with Resend only to send messages you trigger.
• Intervals.icu — your training data source. Subject to their own Privacy Policy.
• Garmin — if you connect Garmin from the mobile app, your device communicates directly with Garmin's servers to sign in and retrieve your activity and wellness data, subject to Garmin's own Privacy Policy and Terms of Service. AskMyCoach never receives your Garmin credentials.
• AI providers (Anthropic, OpenAI, Google, xAI, etc.) — when you or your coach connects an AI assistant, whether via an MCP URL or by signing in through OAuth, data is sent to the AI provider you choose. AskMyCoach does not control how those providers handle that data.

• Account data is retained until you delete your account.
• Cached training data expires automatically — within 5 minutes to 1 hour depending on data type.
• Deleting your account permanently removes all stored data, including tokens, coach relationships, and cached data.

Sensitive values (Intervals.icu OAuth tokens, API keys, MCP tokens) are encrypted with AES-GCM before being written to the database. Passwords are hashed using a strong algorithm and never stored in plain text. All traffic is served over HTTPS. Access tokens are scoped and can be regenerated or revoked at any time. OAuth tokens are automatically refreshed before expiry and only the currently-granted scope is stored. Garmin credentials and session tokens never reach our servers — see Section 3.

• Access: You can view your profile and connections from the Dashboard at any time.
• Deletion: Settings → Delete Account removes all your data immediately and permanently. In the mobile app, disconnecting Garmin removes the on-device session immediately.
• Correction: You can update your name and email from Settings → Profile.
• Portability: Contact us to request a copy of the data we hold about you.

AskMyCoach is not directed at children under 13 and does not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account or been added by a coach without appropriate consent, contact us at sayhello@askmycoach.app and we will delete the associated data.

AskMyCoach sets a single cookie:

This is a strictly necessary cookie under GDPR and the ePrivacy Directive — it is required for authentication and cannot be disabled while using the Service. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies.

We will update the "Last updated" date at the top of this page when changes are made. Continued use of the Service after changes constitutes acceptance of the updated policy.

Questions or requests about your data? Email us at sayhello@askmycoach.app.