Data controller
FredCoach is a cycling training web app with artificial intelligence, developed and operated by Alfredo (Fredscycling), based in Villaviciosa de Odón, Madrid, Spain. Contact: support@freds.cc.
FredCoach accesses your activity and recovery data through the devices and services you connect, always with your explicit permission.
Data we process
FredCoach only accesses the data needed to provide your personalised training service:
Purpose of processing
- Work out your training load, your form (CTL, ATL and TSB) and your attributes from your real training history.
- Personalise the AI coach's recommendations to your current state, history and goals.
- Remember the context between sessions so the coach does not ask you the same thing every day.
- Fit what we suggest to your schedule: the hours you usually train (from your quality sessions or from what you tell us) and the time you usually fall asleep (from your recovery source), so we never suggest a hard session too late. You can set or change it in My profile → personal details.
- Calculate and show your power and heart rate training zones.
- Let you follow how your fitness evolves over time.
Consent and access to your sources
FredCoach accesses each source (Garmin, COROS or Wahoo through Stridee; Hammerhead; WHOOP) only through its official authorisation flow: you give permission when you connect it and can revoke it at any time from that service's settings or by disconnecting it in My profile. We only ask for read permissions: FredCoach never posts or changes anything in your accounts.
FredCoach no longer connects to Strava. If you connected it before October 2026, we keep the activities imported at that time as part of your history until you delete them or your account.
The legal basis for processing is your explicit consent when you connect each source, under Article 6.1.a of the General Data Protection Regulation (GDPR).
Who we share data with
To run FredCoach we use the following trusted providers, each under its own privacy policy and data processing agreements:
- Supabase — Database where we store your profile, wellness and conversations. Infrastructure in the EU. supabase.com/privacy
- Anthropic — AI provider (Claude). Your messages, a summary of your training state and the screenshots or reports you attach (such as an effort test) are sent to its servers to generate the coach's replies. Under its commercial terms, data sent through the API is not used to train its models. anthropic.com/privacy
- Vercel — Web app hosting. vercel.com/legal/privacy-policy
- Stridee — Only if you connect Garmin, COROS or Wahoo: intermediary that delivers your activity files to us with your consent. stridee.com
- Hammerhead (SRAM) — Only if you connect your Karoo: source of your activities, through its official OAuth. sram.com/en/company/legal/global-privacy-policy
- Stripe — Only if you support the project: processes the payment of your contribution. FredCoach never sees or stores your card details; only the amount, the date and the receipt email. stripe.com/privacy
- Resend — Sends FredCoach's emails (request confirmation, invitation, sign-in links). It receives only your email address and the content of the message. resend.com/legal/privacy-policy
- WHOOP — Only if you connect it: source of your recovery, sleep and body composition data, and of your non-cycling workouts. whoop.com/privacy
Rights over your data
Under the GDPR, you have the right to:
- Access: request a copy of all the data we hold about you.
- Rectification: correct inaccurate or incomplete data.
- Erasure: ask us to delete all your data ("right to be forgotten").
- Portability: receive your data in a structured, readable format.
- Objection: object to the processing at any time.
- Withdrawal of consent: disconnect any source from My profile or from that service's settings, at any time.
To exercise any of these rights, contact us at:
We will reply within 30 working days at most.
How we protect your data
All data is stored in Supabase, encrypted at rest and in transit (HTTPS). Database access is restricted with Row Level Security (RLS) and service keys that are never exposed to the browser.
WHOOP and Hammerhead access tokens are stored in our database and only used by the server to sync your data; they are never sent to your browser. You can revoke them at any time from each service's settings.
We keep your data while you use the service. You can delete your account yourself from My profile → Delete my account and data: all your data and your user are deleted at once, and FredCoach's access to WHOOP and Hammerhead is revoked. You can also ask for it by email.
Access and support model. FredCoach is free during the beta and is funded by voluntary contributions (from €2). Your commitment to the project is shown in a bar that fills up every time you contribute and goes down with time and with the days you use the app; to work it out we store which days you open it (only the date). If the bar reaches zero and you do not support the project, your access is paused and your place may be offered to someone else; your data stays stored until you decide to delete it, and access is reactivated when you contribute. Contributions are voluntary and non-refundable except in case of a charging error or if your access request is not accepted (see below).
Access requests. Access is by invitation. When you request it from the welcome page we store your name, email, the optional details you add (type of rider, next goal, what you record your rides with) and a fingerprint of your connection to stop abuse (never the IP itself). Places are opened in batches: requests that come with a contribution go first in the queue, then the rest in order of arrival. If you contribute when requesting access, Stripe processes the payment and we link it to your account when you join; if your request is not accepted, it is refunded. We send you an email confirming your request and, when your place is ready, your invitation with your personal key. If you delete your account, your request is kept only as an anonymous record (without your email, name or messages).
FredCoach is a training support tool and its recommendations are generated by an AI: they are not medical advice. If you have health concerns, consult a professional.
Updates to this policy
We may update this privacy policy from time to time. If we make significant changes, we will let you know inside the app. The date of the last update always appears at the top of this document.
If you have any questions about this policy or about how we handle your data, please contact us:
support@freds.cc · Villaviciosa de Odón, Madrid