Privacy Policy

Who is responsible for the data

The data controller is Łukasz Szymczuk BLACK TENT DEV, Azaliowa 16, 58-370 Boguszów-Gorce (sole proprietorship). Contact: contact@lab17.app.

What this policy covers

This policy covers this website and the LAB 17 web app.

Today. The app runs on a single owner account and has no open sign-up. Read the sections below this way unless they say otherwise.

Pilot. We are preparing a free pilot for a closed group of 4 racers. The pilot has not started, its date is not set and participant accounts do not exist yet. The rules for the pilot are in the section Pilot: participants' data and who can see it.

This policy will be updated before the pilot starts, before iOS and Android apps are released, or before the way data is retrieved changes.

What data we process

Account. The email address and password used to sign in. Sign-in is handled by Firebase Authentication.

Activity summaries from Garmin Connect. Activity ID, start time, name, type, location name, duration, distance, elevation gain, calories, average and maximum heart rate, training load, average and normalized power, TSS, intensity factor, training effect (aerobic, anaerobic and its label) and time in heart rate zones. Other fields returned by Garmin are not stored.

Activity files. When an activity is opened in the app, its original file is downloaded from Garmin Connect and stored unchanged. The file contains what the device recorded, including the GPS track. Next to it the app stores a processed copy with time series (power, heart rate, speed, cadence, distance, altitude, latitude and longitude), laps and the workout that was followed.

Health data. For each day: last night's HRV, HRV status, sleep score, sleep duration and resting heart rate.

Data entered in the app. Workouts in the library, calendar entries and named activity segments with notes.

Data from Garmin Connect is retrieved through the Garmin Personal API and covers only the owner's account. On first run the app fetches activity summaries from the last 400 days, then only new days. Health data is fetched for the days being viewed.

How we use the data

Only to run LAB 17 features: the calendar, activity analysis, the health data view, workout planning and sending workouts to a Garmin device. Data is not sold or used for advertising. The app does not use analytics tools.

Where it is stored and who can access it

Data is stored in Firebase (Google Cloud). Firestore holds activity summaries, health data, workouts, the calendar and segments. Cloud Storage holds activity files, including GPS tracks. The database, the files and the function serving them run in the europe-central2 region. Firebase Authentication and Firebase Hosting are global Google services and are not tied to that region.

The browser has no direct access to the database or files. Data passes through a function that responds only after a valid sign-in to the allowed account. Keys for Garmin, intervals.icu and Anthropic are kept as server-side secrets and never reach the browser.

Who receives the data

• Google (Firebase) – hosting, sign-in, database and file storage.
• intervals.icu – the intermediary service for sending workouts. It receives the name, type and date of a planned workout and its description with notes, steps and targets. LAB 17 reads calendar workouts and maximum heart rate settings from it. intervals.icu itself passes workouts on to the Garmin device when its Garmin connection is switched on. Activity files, GPS tracks and health data are not sent to intervals.icu.
• Garmin – the source of activity and health data, and the recipient of workouts sent by intervals.icu.
• Anthropic – the provider of a service that automatically creates or improves a workout when the user asks. It receives the description or instruction, the chosen sport and, when improving, the whole workout being edited. When the user asks a question in the chat, it also receives the question, the conversation history, saved insights, statistics for the chosen workout, segment or period, and health data for the chosen days. It does not receive activity files, GPS tracks or second-by-second records.
• OpenStreetMap – when an activity map is viewed, the browser loads map tiles from OpenStreetMap servers, which see the IP address and the area viewed.
• Google Fonts and gstatic – the browser loads fonts from them, and in the app also the sign-in code, which reveals the IP address to Google.

Pilot: participants' data and who can see it

This section describes the rules for the pilot, not how things work today. They will apply once participant accounts exist.

Participants. The pilot is free and covers a closed group of 4 racers. Participation is by invitation only.

Data. For each participant LAB 17 will process the same kinds of data described in the section "What data we process": account data, activities, GPS tracks, health data, workouts, calendar entries and named activity segments.

Data source. Participants' data will not be retrieved through the Garmin Personal API, because it is meant only for the account owner's own data. How participants' data is retrieved and how their workouts are sent will be described in an update to this policy before the pilot starts.

Who can see the data. Each participant sees their own data. The group's data, including health data, can also be seen by:

• the owner of LAB 17, Łukasz Szymczuk,
• Dr Rafał Hebisz, a personal subject-matter adviser to LAB 17 from AWF Wrocław (Wroclaw University of Health and Sport Sciences).

This access requires the athlete's consent. Dr Hebisz views the data inside the app and does not receive API keys. The cooperation is personal: the university is neither a party to it nor a recipient of the data.

Legal basis. We process the data needed to run the service on the basis of a contract, namely the Terms of Service (Art. 6(1)(b) GDPR). Health data is a special category of data, so its processing and the access of the owner and Dr Hebisz to an athlete's data are based on that athlete's explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).

Withdrawing consent. An athlete can withdraw consent at any time by writing to contact@lab17.app. After consent to access is withdrawn, the owner and Dr Hebisz stop seeing that athlete's data in the group view. After consent to processing health data is withdrawn, we stop processing it. Withdrawal does not affect the lawfulness of processing before it.

Deleting an account. A participant can ask for their account and data to be deleted by writing to the address above.

How long we keep data

LAB 17 has no automatic deletion period: data stays stored until it is deleted. Deleting a workout, entry or segment in the app takes effect immediately. When refreshing a date range shows that an activity was deleted from Garmin Connect, its summary and files are deleted too.

Your rights and contact about your data

You have the right to access your data, to have it corrected or deleted, to restrict its processing and to data portability, as well as the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO).

Please send questions about your data and requests, including deletion requests, to contact@lab17.app.

Cookies

This website does not use cookies or analytics tools. The app keeps the Firebase sign-in session in the browser so that the user stays signed in.

Changes

The current version of this policy is always available at this address, with the last update date at the top of the page.