Privacy Policy

Last updated: 27 September 2026

Deutsche Version English

This policy explains how personal data is processed when you use TourKit — the website at tourk.it, the associated web app, and the native TourKit app for iOS and Android (see section 21). The data controller under EU GDPR is Darren Tipton (see section 1).

1. Data controller

The data controller under Art. 4(7) GDPR is:

Darren Tipton
Parkstraße 23
85604 Zorneding
Germany
Email: contact@tourk.it

For all privacy-related enquiries and to exercise your rights as a data subject, please use privacy@tourk.it.

2. Data protection officer

No data protection officer has been appointed. The thresholds requiring one under Art. 37 GDPR / § 38 BDSG are not met: TourKit is operated as a sole proprietorship with no other persons engaged in personal-data processing. This policy will be updated if the situation changes.

3. When you visit the site

When you load a page, the server automatically receives standard HTTP request data from your browser via our hosting provider:

• IP address of the requesting device
• Date and time of the request
• Name and URL of the requested file
• Bytes transferred and HTTP status code
• Browser and operating system (User-Agent)
• Referring URL (Referer)

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in operating, stabilising, and securing the service and defending against attacks.
Retention: log files are deleted no later than 14 days after they are written, unless a specific security incident requires longer retention.

4. User account

Using TourKit requires a user account. At registration we process:

• Email address (used for sign-in, account verification, and transactional emails)
• Password (stored only as a secure hash — never in plain text)
• Display name (optional, free choice)
• Timestamps of registration and most recent sign-in

Legal basis: Art. 6(1)(b) GDPR — performance of the service contract.
Retention: for the duration of the account, plus a short grace period after deletion for backups and any tax-law retention obligations for payment-related data.

5. Training and health data

When you use TourKit for training planning, recording, or analysis, we process data relating to your physical performance — which under Art. 9(1) GDPR are special-category "health data":

• Functional Threshold Power (FTP), maximum and resting heart rate
• Training plans, individual workouts, and event goals
• Recorded activities (power, heart rate, cadence, speed, GPS trace, elevation profile, timestamps)
• Self-reported entries such as weight and year of birth (if provided)
• Calculated training metrics (Load / Norm Power / Intensity, fitness / form / fatigue values)

Legal basis: Art. 9(2)(a) GDPR — explicit consent — in conjunction with Art. 6(1)(b) GDPR (contract performance). Consent is given at registration and may be withdrawn at any time with prospective effect (see section 17).
Retention: for the lifetime of the account or until you delete the data yourself.
Recipients: these data normally stay with our hosting provider. If you enable Coach Chat (section 7) or optional third-party integrations (section 8), relevant extracts are sent to those recipients.

Insights and training recommendations (e.g. dashboard suggestions, analysis of past sessions) are calculated by rule-based logic on our servers. No transfer to external AI services takes place for these; such a transfer occurs only when Coach Chat is active (see section 7).

Riding together in Rides

In the 3D rides you can ride with others: in a group ride someone invited you to by link, or with "With others" in a road's public room — with whoever is riding that road at the same time. While you do, your device sends, four times a second, your position on the virtual road (distance covered, speed, lane), your cadence and your effort as a percentage of your FTP, and with a workout loaded the workout and its target as a percentage of FTP. The other riders in the same room see these together with your name: your first name in a private group ride, and in a public room only the public name you choose yourself — never your real name. A group ride's host can put it on the public road: then the group rides in the public room with whoever is riding that road, and everyone sees each other by public name — a rider who has not chosen one by a stand-in such as "Rider4821", never by their real name. The invite page says which kind of ride it is before you join. Your power in watts, your weight, your heart rate and any real-world location are not sent; the position is one on the virtual road, not GPS.

This passes through our room server (SwitchR, at Hetzner in Germany) and is only relayed while you are in the room; it is not stored. For "Riding now" in the Rides menu our server reads which accounts are in a public room at the moment and shows signed-in TourKit users who open Rides how many there are, their public names and which road — so while you ride "With others", your public name and your road appear there too. Private group rides never appear there. "With others" is pre-selected in Rides but only takes effect once you save there the public name others will see you by — that is your choice; until then, and whenever you choose "Alone", you ride alone. Riding alone and in no group ride, none of this leaves your device. The legal basis is Art. 6(1)(b) GDPR: the ride with others that you chose. Bots (your ghost and the domestiques) are drawn only on your own screen and are not sent anywhere.

6. Route planner

The route planner processes location and route information:

• Waypoints you set and routes you save (geo-coordinates, elevation profile)
• GPX files you upload
• Optionally: your current location, if you explicitly grant browser access via the Geolocation API

Map rendering, route calculation, geocoding, and elevation queries run on TourKit's own infrastructure (self-developed engines hosted at a Hetzner Online GmbH data centre in Germany — see section 13). These data are not transmitted to any external map, routing, or geocoding provider.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(a) GDPR (consent) for the Geolocation feature.

7. Coach Chat — AI training assistant

Coach Chat is an optional AI-powered training assistant. When enabled, we send the following data to our processor Anthropic PBC (United States):

• Display name
• A coarse fitness band (e.g. "intermediate") derived server-side from your FTP — the exact FTP, maximum and resting heart rate are not transmitted
• Training metrics for the last 14 days — including the ride titles you gave them — and 4-week load (intensity/load)
• Your Fitness, Fatigue and Form values and your weekly ramp — a few numbers derived server-side from your training-load history, not the history itself — and the projection calculated from them and your scheduled sessions
• The trend in your FTP, estimated FTP and VO2max — as a percentage change only; the underlying watts and ml/kg/min values are not transmitted
• Any personal records you set in the last 30 days
• If you ask about training intensity: how your training time splits across low, moderate and high intensity zones
• Training-plan structure, the past week's sessions and the next 21 days of scheduled sessions
• Your readiness score and today's recommendation — derived server-side from your wellness data; the underlying heart-rate variability, resting heart rate and sleep values are not transmitted
• Your durability trend and your current coaching insights
• If you have a route open in the planner: its title, distance, elevation gain, route type, estimated ride time, average speed and energy estimate, and the climbs on it (position along the route, length, gradient, category) — the route's path and coordinates are not transmitted
• If you ask the coach to find one of your saved routes: the titles and summary figures (distance, climb, estimated time, load) of the matching routes
• If you ask for stops or a refuelling plan along your route: the names, opening hours and contact details of the public places found (e.g. cafés, bakeries, water points), their position along the route, and your estimated arrival time — those places' exact coordinates are not transmitted
• Your messages and the existing chat history

Only these derived values are transmitted — not the underlying time series. If the scope of the transmitted data changes, we obtain your consent again before any further data is sent.

These data include health data under Art. 9 GDPR. Sending them to a provider in the US constitutes a third-country transfer (see section 14).

Legal basis for the processing: Art. 9(2)(a) GDPR (explicit consent) in conjunction with Art. 6(1)(b) GDPR. Coach Chat is off by default. You activate it only by a separate, unambiguous consent given in a dialog that first informs you about the processing.
Basis for the international transfer: transfers to Anthropic PBC rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of our data processing agreement with Anthropic. In addition, we obtain your explicit consent under Art. 49(1)(a) GDPR (see section 14).
Anthropic does not use API content to train their models (Anthropic API default setting). Anthropic retains processed content for up to 30 days for abuse-prevention purposes.
Retention in TourKit: chat history is automatically deleted after 14 days. You can delete history manually at any time, or disable Coach Chat entirely — both of which erase your full message history.

8. Connected third-party services

TourKit can optionally be connected to external platforms (e.g. Strava, Garmin Connect, Intervals.icu) to import, export, or synchronise activities. The currently available integrations are listed in the Integrations area of the TourKit app.

The respective providers act as independent controllers under GDPR and process your data on the basis of their own privacy notices and the account you hold with them — not on our instructions. The data exchanged is determined by the permissions and actions you choose.

Connections happen only on your initiative (OAuth, credentials, or API key). You can disconnect at any time in your account settings; the corresponding tokens or keys are then deleted from our servers.

Legal basis: Art. 6(1)(a) GDPR (consent to the connection) or Art. 6(1)(b) GDPR (performance of the service you requested), and Art. 9(2)(a) GDPR where health data is transferred. Each provider's own privacy notice also applies.

9. Payment processing

Paid TourKit plans (Pro/Premium) are billed through the payment processor Stripe Payments Europe Ltd. (Ireland) and its group companies. Card and bank data (card number, IBAN, CVC) is collected and processed directly by Stripe; TourKit never receives it.

We process:

• The status of your subscription and payments
• Invoice-related master data (name, billing address, email), as needed for accounting and invoicing
• Your Stripe customer ID and subscription ID

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (statutory record-keeping obligations under HGB/AO).
Retention: invoice and accounting records for up to 10 years (§ 147 AO). Other payment-related data until contract termination plus statutory limitation period.

10. Newsletter and product updates

You can optionally subscribe to email updates about TourKit (product news, occasional announcements). Subscription is by double opt-in: after you enter your email address, you receive a confirmation email with a link; the subscription becomes effective only when you click that link.

Every newsletter email contains an unsubscribe link. Unsubscribing removes your address from the mailing list.

Personal-record emails: You can optionally be notified when an activity beats one of your previous bests. When enabled, we email you at most once a day; the email includes the relevant training figures (e.g. 5-min/20-min power, 5K/10K run times, distance, climbing). You enable this yourself in Settings, and every such email carries a one-click unsubscribe link. These emails are sent only to your own address and are never shared with third parties.

Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw consent at any time with prospective effect.

11. Contacting us

If you email us at contact@tourk.it or privacy@tourk.it, we process the information you provide solely to handle your request.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual) or Art. 6(1)(f) GDPR (legitimate interest in responding).
Retention: until the request is resolved; thereafter subject to statutory retention obligations.

12. Cookies and local storage

TourKit uses no tracking, analytics, or advertising cookies. No data is sent to analytics services (e.g. Google Analytics). The following cookies and local storage entries are used:

All cookies and storage entries listed are strictly necessary or fulfil a function you have specifically requested (§ 25(2) No. 2 TTDSG / TDDDG). No consent banner is therefore required.

13. Recipients and processors

We engage the following service providers as processors under Art. 28 GDPR or as independent controllers:

The currently available third-party services are listed in the Integrations area of the TourKit app. These providers act as independent controllers, not as processors on our behalf — see section 8.

14. International transfers

Transfers to third countries outside the EEA occur in the following cases:

• United Kingdom (hosting at Penguin Internet Ltd): transfers rely on the European Commission's adequacy decision for the United Kingdom (Implementing Decision (EU) 2021/1772, as currently in force).
• USA — affected recipients include Anthropic (Coach Chat), Stripe group companies, and any training/activity platforms you optionally enable (see section 8 and the Integrations area of the app).
  The governing safeguard is the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of our agreements with the relevant processors — this applies in particular to Anthropic PBC (Coach Chat). Where a recipient is additionally certified under the EU-U.S. Data Privacy Framework, the transfer also relies on Adequacy Decision (EU) 2023/1795.
  For Coach Chat and similar consent-based features we additionally obtain your explicit consent under Art. 49(1)(a) GDPR. In doing so we disclose the risks of a transfer to the United States — in particular that US authorities may under certain conditions access the data, and that remedies comparable to those available in the EU may not exist.

15. Retention

Unless stated otherwise in the sections above, we keep personal data only for as long as is necessary for the relevant purpose:

• Server logs: up to 14 days
• Coach Chat history: up to 14 days (automatic deletion)
• Account data: duration of the contractual relationship
• Payment-related data: up to 10 years (§ 147 AO)
• Newsletter subscriptions: until you unsubscribe
• Email enquiries: until the request is resolved, subject to statutory retention obligations

16. Your rights

You have the following rights with respect to personal data concerning you:

• Access (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interest (Art. 21 GDPR)

An informal email to privacy@tourk.it is enough to exercise these rights. We respond within one month (Art. 12(3) GDPR).

The following rights can be exercised directly from within your signed-in TourKit account — no email required:

• Rectification of your profile, training, and contact data in account settings
• Data export (Art. 20 GDPR) — download your data in a structured, machine-readable format
• Full account deletion (Art. 17 GDPR) — via the "Delete account" button in account settings; on confirmation, your personal data is removed from active databases immediately (backups age out within our host's retention window of up to two months)
• Disable Coach Chat, including deletion of the entire chat history
• Disconnect third-party services (Strava, Garmin, Intervals.icu, etc.) including deletion of stored tokens
• Unsubscribe from the newsletter

17. Withdrawing consent

Where processing is based on consent (in particular training / health data, Coach Chat, and the newsletter), you can withdraw consent at any time with prospective effect — no reason needed, no penalty. The lawfulness of processing carried out before withdrawal is unaffected.

You can withdraw consent directly in your account settings (disable Coach Chat, unsubscribe from the newsletter, delete your account) or by emailing privacy@tourk.it.

18. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority, independent of any judicial remedy (Art. 77 GDPR). The authority competent for TourKit is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Phone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Web: www.lda.bayern.de

19. Minimum age

TourKit is intended for users aged 16 or older. Use by persons under 16 is not permitted. If we become aware that we have processed personal data of a person under 16, we will delete it without undue delay.

20. Data security

We apply technical and organisational measures (TOM) to protect your data, including:

• TLS encryption of all connections
• Application-level encryption of sensitive fields with AES-256-GCM — in particular health data (FTP, resting and maximum HR, weight, year of birth), contact data (email, display name), Coach Chat history, and credentials for connected third-party services; separate key management per data category
• Also stored encrypted (and additionally compressed): recorded activity files together with their GPS traces and sensor streams, the derived heat-map track data, and the geometry of the routes you save (track, elevation profile, and waypoints)
• Passwords stored only as a secure hash
• Session tokens as HttpOnly, Secure, and SameSite cookies
• In the mobile app: the session token is held in the operating system's secure key store (iOS Keychain / Android Keystore)
• CSRF protection for state-changing requests
• Role- and IP-based access controls on servers and databases
• Operation in a physically secured data centre (access control and CCTV; sub-processor: Vantage Data Centres, Newport, Wales)
• Routine software and security-patch updates

21. TourKit mobile app (iOS and Android)

The sections above apply to the native TourKit app as well: account, training, health, and route data are processed on the same servers and on the same legal bases as in the web app (see sections 4 to 6). The following applies in addition.

Location data and background recording

To display the map and to record rides, the app processes your location data (GPS position, timestamp, elevation, speed). At your request, recording can continue while the app is in the background or the screen is off, so that the recorded track remains complete. We also evaluate the device's motion sensors in order to detect stops automatically and reduce battery consumption.

All permissions are requested solely through your device's own permission prompts and can be withdrawn at any time in your system settings. Without location access, map centring and ride recording are unavailable; the remaining features of the app continue to work.

Legal basis: Art. 6(1)(a) GDPR (consent, given via the operating system's permission prompt) and Art. 6(1)(b) GDPR for the recording you have requested. Where the recorded data constitute health data, Art. 9(2)(a) GDPR applies in addition (see section 5).

Data stored on your device

• The session token and cached account details are held in the operating system's secure key store (iOS Keychain / Android Keystore).
• In-progress and not-yet-uploaded ride recordings (GPS points, timestamps, pauses) are stored locally on the device until you upload or discard them.
• Signing out removes the token and cached account details from the device. Uninstalling the app deletes all locally stored data.

Spoken navigation prompts are generated on the device. The app does not access the microphone, and no voice data is transmitted.

No tracking, no analytics services

The app contains no analytics, advertising, or crash-reporting libraries and no advertising or tracking identifiers. No tracking of your behaviour across apps or devices takes place. As in the web app, map tiles, route calculation, geocoding, and elevation data are obtained exclusively from TourKit's own engines (see sections 6 and 13); no data is sent to external map providers.

The app is distributed via the Apple App Store and Google Play. We receive no personal usage data from these stores. Apple and Google are independently responsible for the data they collect in connection with the download and your store account; their own privacy notices apply.

22. Changes to this policy

We may update this policy to reflect changes in technical or legal circumstances or new features that require additional disclosure. The current version is always available on this page. Material changes will be notified to account holders by email in advance.

← Back to home  ·  Legal Notice  ·  Terms  ·  Withdrawal notice