Privacy notice

Controller and contact

The controller is Zero to Race s.r.o., Czech company ID (IČO) 30102413. Contact admin@zerotorace.com with questions or rights requests. This notice covers the public information website and the ZeroToRace application under development. The application is currently restricted to the invited development team; the public website does not create accounts or connect sports devices.

Data and purposes

Account data includes your email address, secured sign-in credentials, and authentication and consent records. Training data includes your selected race, experience, availability, equipment, performance references and zones, plan, completed or skipped sessions, results and perceived effort (RPE). We use it to create, display and adapt your training plan and operate and secure the service.

Health data and legal bases

Illness, injury, fatigue and associated restrictions, and performance or physiological data revealing health, are processed only with explicit consent under GDPR Article 9(2)(a) and consent under Article 6(1)(a). Necessary ordinary account data and delivery of the service you request rely on Article 6(1)(b). Necessary operation and security of the information website rely on legitimate interests under Article 6(1)(f). Withdraw consent in the application's consent settings or by email; withdrawal does not affect earlier lawful processing. Without health-data consent, the application pauses the related training functions. Public documents remain readable without consent or an account.

Recipients and processing locations

Authorized service administrators have access only as necessary, alongside infrastructure providers. The development application runs on Fly.io (Fly.io, Inc.) in Frankfurt, its Neon database in eu-central-1, and Sentry diagnostics in the German data region. Development emails are captured in Mailpit on Fly.io and accessible to authorized team members, rather than delivered to personal inboxes. A transactional email provider for the public service has not been selected.

The public website is being prepared for WEDOS/ VEDOS hosting in Czechia. The particular hosting service, contracting entity, operational logging and data processing agreement coverage must be confirmed before publication. Company transfers and company DPA coverage for Fly.io and Neon are not confirmed in project records. Sentry DPA acceptance on the existing account is recorded on 27 September 2026; company transfer remains unconfirmed. These contractual steps and the production transfer assessment must be completed before admitting real external athletes.

EU storage does not mean every transfer stays in the EU: Fly.io may terminate TLS at its global network edge outside the EU. This arrangement is currently accepted only for the invited development team. We therefore do not claim exclusively European production processing until international transfers and required safeguards have been assessed. We will update this notice before changing providers or opening the public service.

Minimization and security

We use only data necessary for these purposes. Health details must not appear in emails, logs or error reports. Inputs prepared for language services are minimized and pseudonymized, excluding names, emails and exact dates. The public information website has no analytics scripts, advertising trackers or application cookies; hosting may process technical request data such as IP addresses. The signed-in application uses necessary session cookies.

Retention, copies and deletion

We keep account and training data while the account is in use and the data is needed to provide the service. Request a copy, correction or deletion using the contact email; self-service export and account cancellation are not yet available. Deleting an account removes linked athlete data, including consent records, from the active database. Backups may remain until the configured recovery window expires and are not used for ordinary service delivery. Specific production backup and diagnostic retention periods have not yet been verified and will be set before external athletes are admitted; we do not promise an unverified deadline. Any statutory duties or legal claims are assessed individually and data is limited to what is necessary.

Garmin and other connections

The Garmin Connect integration is planned and is not active in the current application. We currently import no Garmin data and send nothing to Garmin. Before launch we will publish the exact approved scopes and implement disconnection and deletion. With your separate authorization, the connection is intended to read completed activities and necessary recovery signals and send selected planned workouts to Garmin Connect. This may include duration, distance, pace, heart rate, power and authorized recovery indicators; we will not request unrelated categories. Its purpose is to align the plan with actual training. Connecting is not required to read the website.

We do not sell Garmin data, provide it for advertising, or use it to train artificial-intelligence models. Once the connection is available, data will be accessible only to you and necessary service providers described in this notice. It will be retained only while necessary for the service you authorize; disconnection must revoke access tokens, stop further synchronization and remove imported data from active storage. Any backups follow the disclosed recovery window. Deletion in ZeroToRace does not itself delete originals held by Garmin; Garmin handles its accounts under its own terms and privacy policy.

Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, object to processing based on legitimate interests, and withdraw consent at any time. We do not use automated decisions with legal or similarly significant effects; you can decline a recommended workout. You may complain to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, https://uoou.gov.cz. You can contact the supervisory authority directly without first contacting us.