RestOrTrain
Download for iOS

Privacy Policy for RestOrTrain

Last updated: October 10, 2026

1. Introduction

Welcome to RestOrTrain. We are committed to protecting your privacy. This Privacy Policy explains how RestOrTrain Spółka z Ograniczoną Odpowiedzialnością ("we," "our," or "us"), collects, uses, and protects your information when you use our service.

RestOrTrain Spółka z Ograniczoną Odpowiedzialnością is the data controller responsible for your information under the General Data Protection Regulation (GDPR).

2. Information We Collect

We collect the following types of information to provide and improve our service:

Account Information:

  • Your email address. To sign you in, we email you a link, so you do not need a password. We also email you about your account and your subscription, for example before a free trial ends. We send you other emails only if you agree (section 4): a summary of your training each week you train; after each ride, run or swim, its stats and charts (duration, distance, elevation, speed, pace, power, your power or pace zones and the device that recorded it) and the short comments our AI writes about it in the app, such as its summary line and, when it matched a planned workout, that workout's name, its workout score and the reason for it; on a day you have a plan, at the time you choose, the words of the app's Plan for Today notification with each planned workout's steps; a note when your free questions are back; and occasional news and offers about RestOrTrain. If you are an ambassador, you also have a password for the ambassador dashboard.
  • Manually provided profile information, such as weight and gender, for analysis accuracy.

Signing in with Apple or Google:

  • If you sign in with Apple or Google, they send us your email address and an ID for your account with them. We use the ID only to sign you in, and the email address as described under Account Information. Google may also send your name and profile picture. We do not keep the name or the picture.
  • Apple also sends us a code. We use it only to disconnect RestOrTrain from your Apple account when you delete your RestOrTrain account.
  • We delete this sign-in information when you delete your account.

Health and Activity Data:

  • Cycling activity files (e.g., .fit files) you upload.
  • Data extracted from these files, including power, heart rate, speed, and GPS coordinates.
  • Rides you record in the RestOrTrain app on an indoor trainer: power, heart rate and cadence from the Bluetooth devices you connect, with no location.
  • If you connect Strava: the start time, duration, distance and sport of each new activity on your Strava account, which we use only to find the matching ride, and its current description, which we read so we can add our summary above it without storing that text. We keep a list of the Strava activity IDs that Strava tells us about, and when, until you delete your account.
  • Data synced from Apple HealthKit, if you choose to connect it, including heart rate and other relevant health metrics.
  • Processed data and performance metrics derived from your activities.

Technical Information:

  • Log data, such as your IP address, browser type, and access times, for security and service functionality.
  • Information on how you interact with our features to help us improve the application.
  • If you signed up in our Android app: the label Google Play keeps for your install. It is the label on the link you tapped to get to Google Play, or Google Play's own label if there was no link. Our web pages, our ads and the creators we work with can put labels on their links, so the label tells us which page, ad or creator sent you, for example the link under a creator's video. The label names the link, not you: it is the same for everyone who tapped that link. After you sign in, the app sends us what Google Play keeps about how you arrived, once, and we keep only the label and the Meta ad details described below, with your account, until you delete the account. We do not give our copy to anyone, including the creators. Separately, the Google Firebase and Meta tools built into the app read the same information from Google Play the first time the app opens, whether or not you sign up.
  • If you signed up in our Android app, we also find out whether one of our ads on Facebook or Instagram brought you. If you went to Google Play straight from one of our ads, Google Play's label holds a coded note from Meta that names the ad. The label can also say whether the ad was on Facebook or Instagram. After you sign in, the app also asks the Facebook, Instagram or Facebook Lite app on your phone, if you have one, about the last of our ads you saw or tapped there. If you only saw the ad, the app sends us nothing about it. If you tapped it, the app sends us what that app remembers about the tap: Meta's coded note, which Meta app it was, and the time of the tap. We use the time only to check that the tap came in the week before you installed. We decode one note: the one in Google Play's label if there is one. If there is none, and none of our own links took you to Google Play, we decode the note of your last tap from that week. From it we keep which ad it was, with its ad set and campaign, by name and number, and whether Google Play or a Meta app told us, with your account until you delete the account. This names the ad, not you: it is the same for everyone who tapped that ad. We do not keep the time of the tap or which Meta app it was. If we cannot decode a note right away, we keep only its coded part until we can decode it or you delete your account.
  • In our Android app, whether or not you sign up: if the Facebook app is on your phone, the Meta tool built into our app reads an ID the Facebook app keeps for you, from the first time the app opens. It sends that ID to Meta with the app's events, such as the app being opened or a subscription being bought. Sometimes it sends these events to Meta through the Facebook app instead.

3. How We Use Your Information

Your data is used exclusively to:

  • Provide, operate, and maintain our service.
  • Analyze your performance data to generate personalized insights and training recommendations.
  • Secure your account and protect our service from fraud and misuse.
  • Email you about your account and your subscription.
  • If you agree, send you the emails described in section 2. We record when we send you each of these emails, and we may look at whether you used the app in the days after, to learn whether they help.
  • Improve our existing features and develop new ones.
  • Understand which of our pages, ads and creators bring new users, and how many of them subscribe.
  • Comply with our legal obligations.

4. Legal Basis for Processing (GDPR)

We process your personal data on the following legal bases:

  • Performance of a Contract: To fulfill our service agreement with you. This includes processing your account and activity data to provide the performance analysis you signed up for.
  • Legitimate Interests: For purposes such as improving our service, understanding which of our pages, ads and creators bring new users, and ensuring security, provided these interests do not override your fundamental rights and freedoms.
  • Explicit Consent (Article 9(2)(a) GDPR): For your health data, such as heart rate, and its analysis by AI services. You give it by ticking these two boxes when you create your account. If you connect WHOOP, you also agree to share your WHOOP data with our AI coach. You can withdraw it at any time by deleting your account or by writing to contact@restortrain.com, and for WHOOP by disconnecting it. Withdrawing does not affect what we did before.
  • Consent: For optional features you turn on yourself, such as uploading rides to Strava, and for the emails described in section 2, which we send only if you tick their box on the sign-up screen (on its own or with "Accept all") or turn them on in the app's settings (Article 6(1)(a) GDPR, and for these emails Article 398 of the Polish Electronic Communications Law). The emails after each ride, run or swim and with each day's plan come only if you turn them on in the app's settings; the sign-up box does not turn them on. You can withdraw it at any time in the app's settings, and for these emails also with the link at the bottom of any of them. Withdrawing does not affect what we did before.

5. Data Sharing and Third-Party Services

We do not sell your personal information. Inside RestOrTrain, your personal data and activity information is private to you and is not shared with other users or made available through any social features, leaderboards, or community mechanisms. What you choose to send to Strava is described below. We only share data in the following limited circumstances:

  • With Your Consent: If you give us explicit permission to share your information.
  • Strava: If you connect Strava, we add an AI-written summary of each workout (for example, "VO2 Max Intervals | 4x4min @ 400W") and the line "via restortrain.com" to the top of the description of the Strava activity for the same ride. The summary can include power, heart rate, speed or pace. Only if you agree to upload rides do we send each ride you record in the RestOrTrain app on an indoor trainer to Strava as a new activity, with its workout name, start time, duration, laps, power, heart rate and cadence, and no location. Strava is a separate company based in the United States. Your Strava privacy settings decide who can see these descriptions and rides, and Strava's own privacy policy applies to them. You can turn off either feature in the app's settings or disconnect Strava at any time. Descriptions and rides already sent stay on Strava until you change or delete them there.
  • Meta: The Meta tool built into our iPhone and Android apps sends Meta the app's events, such as the app being opened or a subscription being bought, with an ID for your RestOrTrain account and your phone's advertising ID (on iPhone only if you allow tracking), so we can measure our ads. On Android it also sends what Google Play and the Facebook app keep, as described in section 2. Meta's own privacy policy applies to what it receives.
  • For Legal Reasons: If required by law, court order, or governmental request.
  • Service Providers: With cloud hosting and infrastructure providers that process data on our behalf.
  • AI-Powered Analysis: To provide advanced insights, we send your cycling activity data to third-party AI services like OpenAI, Google, or Anthropic. This data does not include personally identifiable information (PII) such as your name or email address. We process this data exclusively via enterprise APIs that contractually prohibit the third party from using your data to train their models. We do NOT use your data to train AI models and do NOT allow third parties to use your data for training purposes.

6. International Data Transfers

To provide our service, your information may be transferred to and processed in countries outside of the European Economic Area (EEA), including the United States, where our AI processors (OpenAI, Google, and Anthropic) and cloud infrastructure providers are located, and where Meta may process what its tool in our apps sends it.

When we transfer your data internationally, we ensure it is protected by appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to ensure a level of data protection comparable to that within the EEA.

7. Data Security

We implement appropriate technical and organizational measures to protect your data, including data encryption in transit and at rest, secure hosting infrastructure, and access controls. We rely on established cloud providers and industry-standard security practices to safeguard your information.

8. Data Retention

We retain your personal data for as long as your account is active. If you delete your account, we will permanently delete your personal information and activity data from our production systems within a reasonable timeframe, unless we are required by law to retain it for a longer period. Descriptions and rides already sent to Strava are not deleted with your account; you can delete them in Strava. We keep a record of your consent answers: what you accepted when you created your account (our Terms of Service and this Privacy Policy, health data processing and AI analysis), your answers about the emails described in section 2, and each time you agree to share WHOOP data with our AI coach or WHOOP is disconnected. We keep when each answer was given and, for most answers, which app and version. We keep this record until you delete your account.

9. Your Rights Under GDPR

As a user, you have the following rights regarding your personal data:

  • Right of Access: To request a copy of the information we hold about you.
  • Right to Rectification: To correct any inaccurate or incomplete data.
  • Right to Erasure ('Right to be Forgotten'): To request the deletion of your data.
  • Right to Data Portability: To receive your data in a machine-readable format and transfer it.
  • Right to Object: To object to our processing of your data based on legitimate interests.
  • Right to Object to Direct Marketing: To object at any time to our use of your data for direct marketing, after which we stop. For the emails described in section 2, turn off their switches in the app's settings or use the link at the bottom of any of them; for anything else, write to contact@restortrain.com.

To exercise these rights, please contact us at contact@restortrain.com. You also have the right to lodge a complaint with a supervisory authority, such as the Polish Data Protection Office, the Prezes Urzędu Ochrony Danych Osobowych (UODO).

10. Cookies and Tracking Technologies

On our website, we use only essential first-party cookies necessary for the basic functionality of our service, such as keeping you logged in. We do not use cookies for advertising, marketing, or third-party tracking.

Our apps are different. In our Android app, the app and the Google Firebase and Meta tools built into it read what Google Play keeps about how you arrived at the app, and the two tools read your phone's advertising ID. The app also asks the Facebook, Instagram or Facebook Lite app on your phone about our ads, and the Meta tool reads an ID the Facebook app keeps for you. Section 2 describes these. In our iPhone app, the Meta tool reads the advertising ID only if you allow tracking.

11. Withdrawal of Consent

You have the right to withdraw your consent for the processing of your health and activity data at any time. You can do this by deleting your account within the application settings or by contacting us at contact@restortrain.com. You can also withdraw consent for a single feature, such as uploading rides to Strava, by turning it off in the app's settings or disconnecting Strava, and stop the emails described in section 2 in the app's settings or with the link at the bottom of any of them. Withdrawing your consent will not affect the lawfulness of processing based on consent before its withdrawal.

12. Children's Privacy

Our service is not intended for individuals under the age of 16. We do not knowingly collect personal information from children under 16. If we become aware that we have, we will take steps to delete that information promptly.

13. Changes to This Privacy Policy

We may update this policy from time to time. We will notify you of any significant changes by posting the new policy on this page and updating the "Last updated" date.

14. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Data Controller: RestOrTrain Spółka z Ograniczoną Odpowiedzialnością
Email: contact@restortrain.com
Address: Piotra Borowego 35/11, 30-215 Kraków, Poland
Registered with: District Court for Kraków-Śródmieście in Kraków, XI Commercial Division of the National Court Register, KRS 0001217781
NIP: 6772536123
Share capital: PLN 15,000