Privacy policy

Who is responsible

This policy explains how Échapper processes information when you visit the public website, create an account, connect Intervals.icu or use Training Companion through a compatible AI client. Andreas Svane, trading as Échapper, decides why and how this information is processed and is the data controller.

Échapper is a free, non-commercial project. It does not charge users, sell access or carry advertising.

Échapper is independent and is not operated by or endorsed by Intervals.icu, Anthropic, OpenAI or Garmin.

Information we process

• Account and authentication: account ID, email address, authentication state and the session information needed for sign-in.
• Intervals.icu connection: athlete ID and name, timezone, granted permissions, connection status, timestamps and an encrypted OAuth access token or temporary owner API key.
• Product state: IDs that point to the rider profile, goals and first assessment stored in your own Intervals.icu calendar.
• Coaching inbox: a minimal activity ID, activity name and time, source event reference, review status and any short analysis summary you explicitly approve. The inbox does not retain the complete activity payload.
• Recon, only after separate consent: activity reference, direction-specific aggregate road observations, Recon preferences, searches, candidates, selections and feedback. These can reveal places you have ridden, even though the original route file is not retained.
• Approvals and operational records: short-lived proposed actions, consent version and time, action type, outcome and limited diagnostic metadata. We do not intentionally put raw training payloads or AI conversation text in these logs.
• Public-site analytics: aggregated page views, referrer, approximate location, device, browser and operating-system information on public pages only.

Training, wellness and health-related data

Activities, wellness values, sleep, heart-rate and HRV information, athlete settings, calendar records and similar data are requested from Intervals.icu when a tool needs them. Outside the separately enabled Recon preview and the minimal coaching-inbox activity reference described above, these live payloads pass through Échapper to perform your request but are not copied into Échapper’s product database.

Some training and wellness information can reveal information about your health. Before connecting, you must explicitly consent to Échapper processing the connected training and wellness data for Training Companion. You can withdraw that consent for future processing by disconnecting Intervals.icu. Withdrawal does not affect processing that was lawful before withdrawal.

Rider context, goals and assessments that you explicitly approve are stored as calendar notes in your own Intervals.icu account. Échapper stores only the related record IDs and completion state needed to find them again.

Recon and activity-derived location

Recon is an owner-only preview that can compare cycling roads with the demands of a workout. It is off by default and requires a separate, purpose-specific consent in addition to the Intervals.icu connection consent. Opening the Recon setup page does not fetch an activity.

After Recon is explicitly enabled and an import is later started, Échapper may temporarily process outdoor cycling route files and the timing, speed and power signals needed to assess interruptions and rideability. It map-matches the ride and stores direction-specific aggregate evidence such as pass count, observed time and distance, stops, braking, average speed or power and match confidence. The raw FIT or GPX file is deleted after successful derivation and is not treated as successfully processed until that deletion succeeds.

Turning Recon off blocks future personal activity processing but retains existing derived evidence so it can be re-enabled without rebuilding it. The separate “Delete all personal Recon data” control deletes the Recon account record and its related preferences, activity references, observations, searches, candidates, selections and feedback. Source activities remain in Intervals.icu.

Purposes and legal bases

• Account access, the requested connection and delivery of Training Companion are processed as necessary to provide the service you ask for under GDPR Article 6(1)(b).
• Connected training and wellness data that may reveal health information are processed on the basis of your explicit consent under GDPR Articles 6(1)(a) and 9(2)(a).
• Recon activity-derived location and training evidence are processed only after the separate Recon consent, under GDPR Articles 6(1)(a) and, where the signals may reveal health information, 9(2)(a).
• Connection security, abuse prevention, fault diagnosis and limited, aggregated public-site analytics are processed under GDPR Article 6(1)(f) for Échapper’s legitimate interest in operating and improving a secure service. Private application and authentication routes are excluded from public-site analytics.
• Information may be retained or disclosed under GDPR Article 6(1)(c) where necessary to comply with a legal obligation, or where necessary to establish, exercise or defend legal claims.

Échapper does not use connected data for advertising, sell personal information or make solely automated decisions that produce legal or similarly significant effects.

Your chosen AI client

Échapper does not provide or store the conversation you have with Claude, ChatGPT or another AI client. It receives the MCP tool calls and arguments that client sends and returns the requested result. The result can include personal training and wellness information, so your chosen AI provider processes it under its own privacy and retention terms. Use the separate read-only address when you do not want the client to receive write tools.

Providers, recipients and international transfers

Échapper uses Vercel for hosting and public-site analytics, Clerk for authentication and Neon for the application database. Intervals.icu remains the connected training source. When you request weather context, the latitude, longitude, date and time window supplied in that request are sent to Open-Meteo; Échapper does not add your account ID or training payload to that weather request. The AI client you select receives the result required for your request.

Some providers may process information outside the European Economic Area. Where required, transfers are covered by an adequacy decision such as the EU–US Data Privacy Framework or by approved Standard Contractual Clauses and supplementary safeguards. Provider subprocessors and locations can change under their published data-processing terms.

Cookies and analytics

Clerk uses essential session and security cookies through Échapper and its authentication domain to create and protect a signed-in session. They are required for account and application features. Échapper does not use advertising cookies.

Vercel Web Analytics runs only on public pages. It provides aggregated statistics without third-party cookies and does not create a cross-site profile. Private app, account, sign-in and sign-up routes are excluded before an analytics event is sent.

Garmin-sourced data

Intervals.icu records can include data originating from Garmin devices. When Intervals.icu supplies a Garmin source or device model, Échapper returns visible Garmin attribution and instructs the AI client to preserve it in derived answers and exports. Intervals.icu does not always expose the originating device for wellness data, so wellness and readiness results state that they may include data from Garmin devices.

Retention and deletion

• The encrypted Intervals.icu credential is held until you disconnect, replace it or delete the account.
• After disconnecting, the credential and pending approvals are removed. Basic connection metadata remains until account deletion so the account can show that the source is disconnected.
• Action approvals become unusable after their short expiry and are removed during routine cleanup or account deletion.
• Coaching-inbox references and approved review summaries are retained until account deletion. Closing an item changes its status but preserves the review history.
• Operational audit metadata is normally retained for up to 180 days. Consent grant and withdrawal records are retained until account deletion or longer where required to demonstrate legal compliance.
• Recon-derived evidence is retained while the Recon account exists, including when future processing is switched off. You can delete it separately from the Recon setup page.
• Deleting your Échapper account removes the application connection, product state, approvals and related records and requests deletion of the Clerk account. Provider backups and security logs follow the providers’ own retention schedules and legal obligations.
• Notes already stored in your Intervals.icu account remain there under your control and can be deleted in Intervals.icu.

Security

Access credentials are encrypted on the server using authenticated encryption and bound to your Échapper user ID. Secrets remain server-side, OAuth requests use a short-lived one-time state value, and write-capable tools use the preview and approval controls described on the Intervals.icu integration page. No internet service can guarantee absolute security.

Your rights

Depending on the processing and where you live, you can ask for access, correction, deletion, restriction or a portable copy of your personal information, object to processing based on legitimate interests and withdraw consent at any time. You can disconnect and delete the account directly in Settings or email a request. We may need to verify that the request relates to your account.

You also have the right to complain to your local supervisory authority. In Denmark, this is Datatilsynet. Contacting Échapper first is welcome but not required.

Changes and contact

Material changes will be dated on this page and, where appropriate, shown in the product before they take effect. Questions or privacy requests can be sent to Andreas Svane at support@echapper.cc.