Privacy policy

This policy explains what personal data Tempo processes, why, and what you can do about it. It covers the app and the landing page.

1. Who is responsible

Alpus Labs (EURL), 54 rue Lamartine, 75009 Paris, France, RCS Paris 985 142 348, is the data controller. Contact: contact@3athlon.co.

2. What we collect

Data	When	Why
Name, email address, password (stored hashed, never readable)	You create an account	Your account, signing in
The terms version you accepted, and when	You create an account or accept new terms	Proof that you accepted the terms of use
Workouts, zone settings, plan, race results	You save them	The service itself
Session: IP address, browser, expiry date	You sign in	Keeping you signed in, security
Server logs: IP address, page requested, browser, time	Every request to the app or the landing page	Security, fixing errors
IP address and number of attempts	You sign in, sign up or join the early-access list	Limiting repeated attempts (kept a few minutes)
If you connect Garmin Connect: your Garmin user id, the permissions Garmin reports for the connection, and the access tokens Garmin issues (stored encrypted); for each workout sent, the identifier Garmin gives it and a fingerprint of what was sent; for each planned day sent, the identifier Garmin gives it	You connect Garmin Connect, then send a workout or plan sessions with « Sync my plan » on	Sending your workouts and planned sessions to your Garmin account, and knowing whether they are already up to date there
Your equipment, if you fill it in: the kinds of devices you own (watch, bike computer, heart-rate strap, power meter, smart trainer), optionally the brand and model of your watch and bike computer, and, for a day, what you left at home	You fill in « My equipment », or say you left something at home	Choosing what your watch follows (heart rate, pace or power) and advising you on your equipment; the brand and model also help us decide which devices Tempo connects to next
Early-access list: email address, page language, date	You join it on the landing page	Inviting you to the beta
Visit statistics: page visited, referring site, browser, operating system, device type, screen size, language, country; that you joined the early-access list (without your address)	You visit the landing page	Knowing how many people visit it and where they come from

Zone settings include the heart-rate values you type in (such as your threshold or maximum heart rate), your power (FTP), your threshold pace and your swim pace (CSS). They are training settings that you enter yourself to compute your zones. Tempo does not record your heart rate.

The visit statistics are made by Umami, on the landing page only, never in the app. Umami sets no cookie, does not store your IP address and does not follow you to other sites: it uses your IP address and browser only to tell one visit from another during the month and to find your country, and we only see totals. Apart from Umami’s script, we use no advertising or tracking tools and load no third-party fonts or scripts, we make no automated decisions about you and we never sell your data.

3. Why, and on what legal basis

• Running your account and the service (storing your workouts, zones, plan, results and equipment, signing you in): necessary for the contract between you and us, the terms of use.
• Security (sessions, server logs, limiting repeated attempts): our legitimate interest in protecting the service and your account.
• Connecting Garmin Connect: your consent, given when you connect it and accept on Garmin’s page. You can withdraw it at any time with Disconnect (see section 4).
• The early-access list: your consent, given when you submit the form. You can withdraw it at any time by writing to us.
• Visit statistics: our legitimate interest in knowing how the landing page is used. They are anonymous, used only to measure the audience and kept 6 months, so they need no consent (article 82 of the French Data Protection Act, as the CNIL applies it to audience measurement). You can object at any time, see section 7.

4. Garmin Connect

Garmin Connect is a recipient of your data only if you connect it (Connections page). Without that, nothing is shared with Garmin.

• What we send. The workouts you choose to send and, while Sync my plan is on (it is on once you connect, and one switch turns it off), the sessions you plan from today on: each one’s workout and its day. Each workout carries its name, its steps and their targets, which Tempo works out from your zones (pace, heart rate or power) and from your equipment (what your watch follows), and, once your equipment is filled in, a description line, « Guided by … », naming what the watch follows. When you move, skip, change or delete a planned session, Garmin’s calendar follows. Past days are never changed.
• What we keep. Your Garmin user id, the permissions Garmin reports for the connection, and the access tokens Garmin gives us, stored encrypted. We also keep, for each workout sent, the identifier Garmin gave it and a fingerprint of what was sent; for each planned day sent, the identifier Garmin gave it and its date; and when your plan was last synced.
• How we use it. Only to send your workouts and planned sessions to your Garmin account, to know whether they are already up to date there, and to keep the connection working. For nothing else.
• Who handles it. Only us and the two providers that run Tempo: Google Cloud runs the servers that use it, and Neon stores it (section 5). Nobody else receives it: Umami never sees it.
• What we do not do. We never sell your Garmin data or share it with anyone else. No artificial intelligence system processes it, and neither it nor anything derived from it is used to train, evaluate or improve AI models. In this version Tempo reads no activity and no health data from Garmin, and never your heart rate. If any of that changes, this policy will be updated with a new version before it ships, and we will ask for your consent again.
• How to stop. Press Disconnect on the Connections page, or remove Tempo in the settings of Garmin Connect. Once Garmin confirms, or if Garmin cannot be reached, we delete the tokens we hold. The workouts already in Garmin Connect stay there: delete them in Garmin Connect if you wish.

Your data is then also handled by Garmin, under Garmin’s own privacy policy, of which we are not the author.

5. Who processes your data, and where

Your data is stored in the European Union:

• Google Cloud (Google Ireland Ltd): runs the app and the landing page in Belgium (region europe-west1) and keeps the server logs.
• Neon (Neon, Inc.): hosts the database in Frankfurt, Germany.
• Umami (Umami Software, Inc.): makes the landing page’s visit statistics and stores them in its European Union region.

They work for us under data processing agreements that include the European Commission’s standard contractual clauses. We use no email provider yet; this policy will name it when we do.

Garmin is not our processor: if you connect Garmin Connect, it receives the workouts and planned sessions sent to it and handles them for itself, under its own policy and possibly outside the European Union (see section 4).

6. How long we keep it

• Your account and everything in it: as long as your account exists. When you ask us to delete it, we delete it.
• Sessions: until they expire (after 7 days without use) or until you sign out.
• Server logs: 30 days.
• Visit statistics: 6 months.
• The early-access list: until we invite you, or until you ask us to remove you.

7. Cookies and your browser’s storage

Tempo sets one cookie: the session cookie of the app, which keeps you signed in until it expires or you sign out. It is strictly necessary, so it needs no consent. The landing page sets none.

The app also keeps a few preferences in your browser (theme, the view you chose, a copied set). They stay on your device and are never sent to us.

The landing page’s visit statistics use no cookie, and Umami stores nothing in your browser. They are not made when your browser asks sites not to track you (Do Not Track). You can also stop them for this browser with the button below: only that choice is kept in your browser.

8. Your rights

You can ask to access your data, correct it, delete it, export it, restrict how we use it or object to it, and you can withdraw your consent at any time. This includes what we hold about your Garmin connection; to withdraw your consent to it, press Disconnect (section 4). You can also leave instructions on what should happen to your data after your death.

Write to contact@3athlon.co. We answer within one month. If you think we are not respecting your rights, you can complain to the CNIL (cnil.fr).

9. Changes to this policy

When this policy changes, we update its version and date at the top of this page. For a change that matters to how your data is used, we also let you know in the app.