Privacy

Last updated 30 October 2026.

This policy covers the website ardofit.com, the app at app.ardofit.com and the ArdoFit Telegram bot. ArdoFit is run by Rudolf Cicko, U Pivovaru 568, 415 01 Teplice, Czech Republic ("we"), who is responsible for your data. Write to [email protected] with any question or request.

The waitlist

When you join the waitlist we store your email address, the first name you give (optional), whether you have a Garmin watch, whether you train for yourself or are a trainer, the date, your browser language and the country your connection comes from. If you join as a trainer, we also store how many clients you train and your Instagram or website, if you give them. To stop repeated sign-ups we briefly keep a one-way hash of your IP address, not the address itself.

We use this only to invite you to ArdoFit and send you news about its launch. It is kept in a Cloudflare database (D1) in Western Europe until you ask us to delete it or the waitlist closes. Every email has an unsubscribe link.

Your account

• Account: email address, name, password (stored only as a salted hash) or your Google sign-in ID, language, time zone and your plan (free or PRO).
• Training: your weekly plan, sessions, notes, and what you completed.
• Food: meals you log by text or photo, the photos themselves, calories and macros, and the foods you save.
• Body and health: data you enter or connect, such as weight, body measurements, heart rate, sleep and steps.
• Messages: what you send the coach on the web or in Telegram, and your Telegram chat ID.
• Payments: handled by Stripe. We keep your subscription status, never your card number.
• Technical: sign-in sessions and server logs (IP address, time, page) kept for a short time for security.

Training, food and body data can say something about your health. We process it only because you choose to put it in ArdoFit or connect a service that sends it, and you can remove it at any time (your explicit consent, GDPR Article 9(2)(a)). We use the rest to provide the service you signed up for (Article 6(1)(b)) and to keep it secure (Article 6(1)(f)).

Garmin

Connecting Garmin is optional and off until you connect it on Garmin's own consent screen in Account, Connections.

• What we send to Garmin: the workouts in your ArdoFit plan, so they appear in your Garmin Connect calendar and on your watch. We only change or delete workouts that ArdoFit created.
• What we receive from Garmin: summaries of your completed activities (type, time, duration, distance, calories, heart rate, pace and the device model).
• What we use it for: marking sessions as done, adjusting your plan and your daily food targets, and showing you your progress. Data from Garmin is labelled with its source, for example "Garmin Forerunner 265".
• AI coach: to answer you, the coach may read your recent Garmin activity summaries. That text is sent to our AI provider (Anthropic) only to produce your answer; it is not used to train any AI model.
• Never: we do not sell Garmin data, use it for advertising, or share it with anyone else. Only you see it, unless you turn on your public profile and choose what it shows.
• Disconnecting: disconnect in ArdoFit (Account, Connections) or remove ArdoFit in Garmin Connect. We stop receiving data at once, delete our Garmin access tokens at once and delete stored Garmin data within 30 days.

Garmin's own handling of your data is covered by Garmin's privacy policy. Garmin and Garmin Connect are trademarks of Garmin Ltd. or its subsidiaries; ArdoFit is not made or endorsed by Garmin.

Strava

If you connect Strava, we import your activities (type, time, duration, distance, heart rate) to mark sessions as done. Strava data is shown only to you and is never sent to the AI coach. Disconnecting removes our access to Strava. Activities already imported stay in your history until you delete them or your account.

Apple Health

ArdoFit has no iPhone app and does not use HealthKit directly. If you want, you can set up your own Apple Shortcut that sends us daily totals from Apple Health. It uses a personal key that works only for this.

• What we receive: your daily steps, walking and running distance, and active energy, with their source and the time they were sent. Nothing else, and only once you set up the Shortcut yourself.
• What we use it for: showing your daily activity and adjusting your plan. It may be used to calculate your daily burn and food targets, which the AI coach can see.
• Never: we do not sell this data, use it for advertising, or share it with anyone else.
• Deleting: Apple Health data is included in your data export and is deleted when you delete your account. To revoke your key or delete only this data, write to [email protected].

Because this is health data, we process it only with your explicit consent (GDPR Article 9(2)(a)). You can withdraw your consent at any time by turning off the Shortcut and asking us to revoke your key.

Who processes data for us

• Hostinger: the virtual server that runs ArdoFit and stores your account data.
• Cloudflare: secure connection, protection of the site, the waitlist database, and storage (R2) of copies of your photos and of our encrypted backups.
• Anthropic: the AI coach (meal photos, questions, plan changes). Not used to train models.
• Stripe: payments for PRO.
• Resend: account emails (confirmation, password reset).
• Telegram: the coach bot, if you connect it.
• Google: sign-in, if you choose it.
• Garmin and Strava: only if you connect them.

Some of these companies are outside the European Economic Area. Where that is the case, transfers are covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

How we protect it

All traffic is encrypted (HTTPS). Passwords are hashed and tokens for Garmin, Strava and Google are encrypted on the server. Administrator access needs two-factor sign-in and is logged. Backups are encrypted and kept for 14 days.

How long we keep it

We keep your data while your account exists. When you delete your account, we delete your data at once from the live system, and it disappears from backups within 14 days. Garmin data goes within 30 days of disconnecting Garmin, as above.

Your rights

You can download all your data (Account, Export) and delete your account and everything in it (Account, Delete) at any time. You can also ask us to see, correct, restrict or delete your data, or object to how we use it, by writing to [email protected]. We answer within 30 days. You may also complain to your data protection authority.

Age

ArdoFit is for people aged 16 and over.

Changes

If we change this policy in a way that matters, we tell you by email or in the app before the change applies.