Privacy Policy

This service is operated by Breakout Training, registered at Gent, Belgium. For privacy or data-subject requests, email privacy@breakout.training. We aim to respond within 30 days as required by GDPR Article 12.

When you sign up we ask for an email address, password, name, and role. In the app you can add physiological test results, training plans, race goals, body-composition details, nutrition targets, sleep and HRV data, breathing and ventilation data from compatible sensors, an optional menstrual-cycle phase, an optional profile photo, coach-athlete messages, and saved courses. If you connect Intervals.icu, we read the data you authorize through that connection.

We do not collect tracking cookies, advertising pixels, ad-network beacons, or device fingerprints. The app uses one required session cookie, vlamax_sid, to keep you signed in.

• Contract, GDPR Article 6(1)(b): to create your account, run the coaching features, save your plans, and provide settings such as data export and account deletion.
• Legitimate interest, GDPR Article 6(1)(f): to keep the service secure through session records, login timestamps, failed login counters, IP address, and user-agent records.
• Explicit consent for health and performance data, GDPR Article 9(2)(a): physiological, metabolic, nutrition, and recovery data is health-related. We process it only after you give explicit consent at signup, and you can withdraw it at any time by deleting your account or disconnecting a data source.

Production data is stored in Postgres on a Contabo GmbH server in Germany. Encrypted backups are replicated to a Hetzner Online GmbH server, also in Germany, which also runs our self-hosted error logging. Everything stays in the EU. If the hosting region or a processor changes, this page is updated before the change applies.

• Account and coaching data: kept while your account exists, then deleted when you delete the account.
• Wellness time series: capped at the most recent 90 days per athlete, with older rows removed automatically.
• Session and security records: active rows stay for the session lifetime; revoked records may be retained for up to 12 months for security review.

We do not sell your data. We do not run ad-network tracking. We use a small number of processors to operate the service:

• Contabo GmbH: production server hosting in Germany.
• Hetzner Online GmbH: encrypted off-site backups and self-hosted error logging, in Germany.
• Resend: transactional email such as password resets and account notices. Resend receives recipient addresses and email content, not your training files or physiological test history.

Intervals.icu is your own third-party account. We access it only through the credentials or authorization you provide, and revoking that authorization cuts off access.

Linking a coach is the one case where another person sees your data. From the moment you accept the link until you end it, your coach can see:

• your name, email address, date of birth, sex and height
• your weight, body composition and every physiological test result, including the raw measurements
• your sleep, heart-rate variability, resting heart rate, and how you rated your own soreness, fatigue, stress, mood and motivation
• your training history, training load, availability and the plans built for you
• your nutrition targets, dietary preference, allergies and caffeine sensitivity
• periods you marked yourself as ill or injured, including any note you added, and your menstrual-cycle phase if you record one
• your races, race plans, saved courses and profile photo
• the messages you exchange with that coach

Your coach can also change these values and prescribe, edit or remove sessions on your behalf — including in your connected Intervals.icu calendar. They keep a private note about you that you cannot see; you can ask us for a copy of it.

Your coach can set up or update your Intervals.icu connection for you — for example on a test day — but can never read your API key back, and cannot see messages between you and any other coach.

You can end the link at any time from Settings, without your coach agreeing. Their access stops immediately. For seven days afterwards you can undo it, and your coach sees only that you have left; after that the link is gone and their private note goes with it.

• Access and portability: download a JSON copy from Settings.
• Erasure: delete your account from Settings. Deletion is immediate and irreversible.
• Correction: edit profile fields in Settings, or contact us if a field is not editable in-app.
• Restriction or objection: contact us to pause or object to a specific processing activity.
• Complaint: you can contact Gegevensbeschermingsautoriteit (GBA/APD).

The required cookie is vlamax_sid. It is HttpOnly, Secure, SameSite=Lax, and scoped to the app. It stores a random session token; the server stores only a hash. Deleting it logs you out. There are no analytics or marketing cookies today.

A second functional cookie, vlamax_locale, stores your language choice (en, nl, or fr) so pages and emails render in your language. It contains only that locale code.

The service is not directed at children under 16. If you believe a minor has signed up, contact us and we will delete the account.

We update the date at the top when this policy changes. For material changes, such as new categories of data, new processors, or changed retention periods, we aim to email active accounts at least 30 days before the change takes effect.