Privacy Policy
Last updated: July 15, 2026
Who we are
Endurio provides AI powered endurance training plans and related services.
- Company name: Endurance Intelligence Ltd
- Contact: support@endurio.app
For privacy concerns contact us at support@endurio.app.
Overview
This Privacy Policy explains how Endurio ("we", "us", "our") collects, uses, discloses and safeguards your information when you use our website and services (the "Services"). By using the Services, you consent to the practices described in this Policy.
What data we collect
- Account and contact information: such as name and any details you provide when you interact with our waitlist or sign-up forms.
- Support messages and communications that you send to us.
- Payment information if applicable. Payments are processed by trusted providers.
- Usage data: information about how you use the Services, including pages viewed, links clicked and other actions within the site.
- Device and technical data: IP address, browser type, operating system, referring URLs and identifiers necessary to operate and secure the Services.
- Plan inputs: event name, event date, training level and weekly availability that you submit to generate a plan.
- Activity data from third party integrations: workout files, training metrics, schedules and related performance data that you choose to sync from services you connect to the Services, including Garmin Connect. See Garmin Connect data below for details specific to Garmin.
- Chatbot and app interactions: messages and in app actions, including messages exchanged over WhatsApp, that help us improve the Services.
How we use your data
- Provide, operate and improve the Services.
- Personalize content and measure engagement.
- Communicate with you, including service updates and support.
- Maintain safety, security and integrity of the Services.
- Comply with legal obligations and enforce our terms.
- Send updates and communications with your consent for marketing.
- Detect fraud and maintain security.
Third party integrations
You may choose to connect third party services that hold your sport activity data, such as Garmin Connect. When you connect a service, we receive the activity data that you authorize and a token that lets us sync that data.
- Scope: we only request the minimum scopes needed to import workouts, metrics and related training information.
- Use: we use imported data to generate plans, adapt recommendations and show your history in the Services.
- Control: you can disconnect an integration at any time in the connected service or in the Services where available. After disconnecting, we stop future syncs.
- Security: we store access tokens securely and do not share them with other parties.
- Deletion: you can ask us to delete imported activity data subject to applicable law. Some data may persist in backups for a limited time.
Examples of third party services include major sport platforms and device providers. Specific integrations may change over time. For details specific to Garmin, see Garmin Connect data below.
Garmin Connect data
If you choose to connect Garmin Connect, this section explains specifically what Garmin data we collect, how we use and process it, where it is stored, and whether it is shared with or processed by any third parties.
Collection
When you authorize the Garmin Connect integration through Garmin's OAuth authorization flow, Garmin grants us an access token scoped to the permissions you approve. Using that token we retrieve:
- Activity and workout data: activity type, duration, distance, pace/speed, elevation and route summaries.
- Performance and physiological metrics: heart rate, VO2 max, training load, recovery status, resting heart rate and similar fitness metrics made available by Garmin Connect.
- Device and account identifiers necessary to keep your Garmin account linked to your Endurio profile and to refresh your access token.
Use and processing
- We use your Garmin activity and performance data to build and adapt your personalized training plan, track your progress against that plan, and surface performance insights and summaries to you in chat.
- To generate coaching insights and adaptive recommendations, a summarized or derived form of your Garmin activity data (for example, a workout's type, duration and key metrics) may be sent to third party large language model ("AI") providers we use to power coaching responses. We do not send your Garmin account credentials or access tokens to these providers, only the activity data needed to generate a response.
- Coaching messages that reference your Garmin data, such as a daily digest or workout summary, are delivered to you through your connected messaging channel (for example WhatsApp, via our messaging provider Twilio). Only the message content is shared with the messaging provider, which acts solely as a delivery channel and does not otherwise process your Garmin data.
- We do not use your Garmin data for advertising and we do not sell your Garmin data.
Storage and security
- Your Garmin OAuth access and refresh tokens are encrypted at rest and stored separately from your imported activity data.
- Imported activity and performance data is stored in our database, hosted with our infrastructure providers, using encryption in transit and access controls limiting access to the systems that need it to operate the Services.
Sharing with third parties
We do not sell Garmin data. We share Garmin data only as follows:
- With third party AI/large language model providers, limited to the derived activity summaries needed to generate coaching responses and plan adjustments, as described above.
- With our hosting and database providers, who store the data on our behalf under confidentiality and data protection obligations and do not use it for their own purposes.
- With authorities or regulators where required by law, or in connection with a merger, acquisition or asset sale, subject to the same confidentiality commitments described in Who we share your data with.
Retention and deletion
We retain Garmin activity data for as long as your integration is connected and as needed to provide the Services. You can disconnect the Garmin integration at any time from Garmin Connect or from within the Services, which stops future syncs, and you can ask us to delete previously imported Garmin data at support@endurio.app. Some data may persist in backups for a limited time before it is purged.
Data security
We use industry standard encryption and security measures to protect your data. No online service is completely secure. Keep your password confidential and use unique credentials.
Sources of data
- Directly from you when you fill forms or connect services.
- Automatically from your device when you use the site.
- From third party services that you choose to connect to the Services, including Garmin Connect.
Data retention
We retain personal information for as long as needed to provide the Services, fulfill the purposes outlined in this Policy and comply with legal obligations. Retention periods vary depending on the type of data and our legal/regulatory requirements.
- Waitlist records: stored in our database until you ask us to delete them or we no longer need them.
- Plan inputs: kept in logs for a short period for troubleshooting then deleted.
- Generated PDFs: stored as public files to let you download your plan. You can ask us to remove a link if needed.
- Garmin activity data: retained while your integration is connected, as described in Garmin Connect data.
- Analytics data: retained by our analytics provider per their default schedules.
Your rights
- Opt out of non-essential cookies via your browser settings.
- Request access to, correction of or deletion of your personal information, subject to applicable law.
- Object to or restrict certain processing where applicable by law.
- Disconnect third party integrations, including Garmin Connect, at any time to stop future syncs.
- You may have additional rights under your local laws. We honor valid requests as required by law.
- Request your data in a portable format.
To exercise these rights contact us at support@endurio.app. We respond within 30 days.
International transfers
If you access the Services from outside the country where our systems are located, your information may be transferred, stored and processed in jurisdictions with different data protection laws. We take steps to ensure appropriate safeguards where required.
Children's privacy
Our Services are not directed to children under 13 and we do not knowingly collect personal information from children. If we learn that a child has provided personal information we will take steps to delete such information as required by law.
Updates to this policy
We may update this Privacy Policy from time to time. We will post the updated Policy with a new "Last updated" date. Your continued use of the Services after changes become effective constitutes your acceptance of the updated Policy.
Your legal rights
We comply with applicable privacy laws including GDPR and CCPA. You may have additional rights under your local laws. You can lodge a complaint with your local data protection authority.
Other disclosures
- AI and model providers: when you request event details or plan options, or when we generate coaching responses from your activity data (including Garmin data, see Garmin Connect data), we may send limited prompts or labels to external AI or search services to get structured results.
- CAPTCHA and bot protection: we use Cloudflare Turnstile which may process technical details needed to validate human activity.
- Security: we use reasonable technical and organizational measures to protect information, but no method is 100% secure.