Privacy.

Last updated: 29 October 2026

Train/Together is a small, invite-only app for planning and logging training with friends. This page says what the app stores about you, who can see it, and which companies help run it.

Who is responsible

Bernd grosse Siemer, Netherlands. Questions and requests: privacy@traintogether.io.

What we store

Your account. Your email address and your password. The password is stored only in hashed form by our sign-in provider. If you sign in with Google or Apple, we get your email address and name from them and no password. If you sign in with Apple, we also keep the token Apple gives us, encrypted, so that deleting your account also ends Sign in with Apple for this app.
Your profile. Display name, initials, profile picture, your gyms, and a trainer bio if you add one. Your display name starts as the part of your email before the @ until you change it.
What you plan and post. Sessions (title, time, place, notes, and how to join, with booking links and a drop-in price if you add them), who you invite, your replies, comments, photos, moments, workout results, logged sets, events and race results, either/or posts and answers, and training programs between a trainer and a client.
Your connections. Friends, close friends, people you muted or blocked, the communities you belong to or asked to join, and community invites you sent or got.
Health and location data, only if you connect Apple Health or a Garmin watch. For each workout: type, the app or device it came from, start and end time, duration, distance, calories, elevation gain, average and maximum heart rate, the heart-rate curve and other samples over time, and the GPS route if you allow routes. The app reads up to the last 120 days: all of them when you connect Apple Health or press Sync, and only the most recent days when it syncs on its own. It only reads and never writes to Apple Health. If you upload a .fit file from a watch, we read the same kind of data from it, and the same if you connect a Garmin watch, through Garmin Connect or through Stridee: then we get each workout Garmin shares with us, with its file and the name of the watch that recorded it. From these workouts the app works out your maximum heart rate (the highest it has seen in the last 12 months, leaving out single spikes) and builds your heart-rate zones on it. You can type your own maximum in Settings instead.
Costs you split. The amount, who owes and who has paid, and a payment link you paste (for example a Tikkie link). We never see bank or card details.
Your devices. A push-notification token with the browser or phone description that came with it, and your notification settings.
Your Garmin connection. If you connect Garmin Connect: your Garmin user id, which data you allowed Garmin to share, and a key from Garmin that lets the app receive your workouts. The key is stored encrypted and deleted when you disconnect.
Technical records. A count of certain actions per account, to limit abuse. A scrambled (hashed) form of your IP address, kept for ten minutes, on a few pages that work without signing in. Crash reports: the error, the page, the browser type, and no account id. And the server logs of our hosting provider.

What we use it for

To run the app: show your sessions and posts to the people you chose, send the notifications you turned on, keep accounts safe, and find and fix errors. We do not sell data, show ads, or use analytics or tracking tools. Workouts we receive from Garmin are never used to train an AI model. They are sent to one only to write your own weekly plan, if you sign up for the planner.

Under EU law (GDPR) we rely on three grounds. The agreement to provide the app to you covers your account and what you post. Your consent covers health data from Apple Health or a connected watch, push notifications, the weekly planner, and the camera and photo library. Our legitimate interest in a safe, working app covers abuse limits and crash reports. You can take back a consent at any time by turning off Health access or notifications in your phone’s settings, or by disconnecting Garmin under Connections. Removing Train/Together in Garmin Connect does the same.

Who can see what

Every member can see your profile: name, picture, gyms and trainer bio.
Your profile shows your friends the gyms you posted sessions at. Nobody else sees them. You can switch this off in Settings.
A session is visible to the audience you pick when you create it (Everyone, meaning all your friends, Close friends, or Specific people), to the people you invite, and to the members of a community when you post it there.
A community can open a session to friends. Then the friends of its host and of everyone who joined can see it, who is going and its comments, and can join it, which shows it to their friends in turn. Photos, results, sets and recordings on it follow the rule below, and the community’s members and other sessions stay hidden.
An invite into a community, and your answer, can be seen by you, the friend who sent it and that community’s admins.
Photos, results, logged sets, heart rate, heart-rate zones, distance, calories and the GPS route belong to a session. What the session’s creator adds is visible to everyone who can see the session. What anyone else adds is visible only to their own friends who can see that session. A GPS route shows where you trained. The zones on a workout show the maximum heart rate they are built on.
A tracked workout set to “Only me” stays private.
Moments are visible to your friends for 24 hours.
A result you enter for a community’s monthly challenge is visible to that community’s admins, and to its members once an admin has confirmed it.
Your calendar link shows your name and your sessions (title, gym, times, note) to anyone who has the link. You can make a new link at any time, which switches the old one off.
Nobody outside the app can see any of this. A new account needs a community code.

Companies that help run the app

Supabase keeps the database, the sign-in and the photo storage, in Paris, France.
Vercel hosts the app. Our server code runs in Paris, France.
Resend sends the confirmation and password-reset emails.
ImprovMX forwards mail sent to privacy@traintogether.io to our inbox.
Apple delivers push notifications to iPhones, and signs you in if you use Sign in with Apple.
Google signs you in if you use Sign in with Google. When you search for a gym or a place, Google gets what you type and a rough area taken from your IP address (rounded to about 10 km), and nothing about your account.
Your browser’s push service (Google, Mozilla or Apple), if you turn on notifications in a browser.
Anthropic. When you ask the app to read a workout from a whiteboard photo, a screenshot or PDF of a training plan, a screenshot of your lap times, or typed text, that photo or text is sent to Anthropic’s AI model to be read. It goes without your name, email or account id. We keep the result, not the image. If you sign up for the weekly planner, once a week your planner answers (the daily vibe you pick and the feedback you write on a session included), the sessions and sets you log, and your watch workouts (type, distance, time, heart rate), Garmin’s included, are sent to Anthropic’s AI model to write your plan, without your name or email. They are used only to write your plan, not to train AI models. You can stop the planner and have its data deleted at any time on Your week.
CARTO. When a map is shown, your device loads the map images from CARTO, which sees your IP address and the area of the map, not your route.
Garmin if you connect Garmin Connect: after you agree on Garmin’s page, Garmin sends us the workouts you allow it to share. Garmin handles your data there under its own Garmin Connect privacy notice (garmin.com/privacy/connect). If you send a session’s workout to your watch, we send that workout to Garmin.
Stridee a company in Switzerland, connects your Garmin watch if you choose to: after you agree on its page, it passes the workout files Garmin shares to us.

Some of these companies are based in the United States.

How long we keep it

Your account and what you posted stay until you delete them or ask us to delete your account.
A moment’s photo is deleted from storage about an hour after the moment expires.
A notification about a session is removed a day after that session. Other notifications go 7 days after you read them, or after 14 days unread.
The hashed IP address is deleted after ten minutes.
Deleting a workout in Apple Health does not remove the copy here.
Workouts from Garmin stay after you disconnect, until you delete them or your account. When you disconnect or delete your account, we also tell Garmin to stop sharing.

In Settings, “Delete my account” sends us your request, and we delete your account and its data within one month. You can also email us.

You can report a person, a comment, a photo or a moment. A report is sent to us by email with what you reported, your reason and note, and your account’s id and email address. It is not stored in the app and the person you report is not told. A message you send us from Settings (“Feedback”) reaches us by email the same way, with your name, email address and account id.

You need an email address to have an account. Everything else you add is up to you.

Your rights

You can ask for a copy of your data, as a file you can take elsewhere, have it corrected or deleted, object to how we use it, or take back a consent, by emailing privacy@traintogether.io. We answer within one month. You can also complain to your data protection authority. The app makes no automated decisions about you and builds no profile of you.

Cookies and storage on your device

One cookie keeps you signed in. A second one exists for up to 30 minutes while you create an account with Google or Apple, and a third for up to 10 minutes while you connect Garmin Connect. The app also saves a few settings on your device, such as light or dark mode, your camera choice, when you last looked at the feed, and whether Apple Health is connected. Nothing is used for tracking or ads.

Age

Train/Together is for people aged 18 and over. When you create an account you confirm that you are.

Changes

We update this page when the app changes what it stores. The date at the top shows the latest version.

What we store

Your account. Your email address and your password. The password is stored only in hashed form by our sign-in provider. If you sign in with Google or Apple, we get your email address and name from them and no password. If you sign in with Apple, we also keep the token Apple gives us, encrypted, so that deleting your account also ends Sign in with Apple for this app.

Your profile. Display name, initials, profile picture, your gyms, and a trainer bio if you add one. Your display name starts as the part of your email before the @ until you change it.

What you plan and post. Sessions (title, time, place, notes, and how to join, with booking links and a drop-in price if you add them), who you invite, your replies, comments, photos, moments, workout results, logged sets, events and race results, either/or posts and answers, and training programs between a trainer and a client.

Your connections. Friends, close friends, people you muted or blocked, the communities you belong to or asked to join, and community invites you sent or got.

Health and location data, only if you connect Apple Health or a Garmin watch. For each workout: type, the app or device it came from, start and end time, duration, distance, calories, elevation gain, average and maximum heart rate, the heart-rate curve and other samples over time, and the GPS route if you allow routes. The app reads up to the last 120 days: all of them when you connect Apple Health or press Sync, and only the most recent days when it syncs on its own. It only reads and never writes to Apple Health. If you upload a .fit file from a watch, we read the same kind of data from it, and the same if you connect a Garmin watch, through Garmin Connect or through Stridee: then we get each workout Garmin shares with us, with its file and the name of the watch that recorded it. From these workouts the app works out your maximum heart rate (the highest it has seen in the last 12 months, leaving out single spikes) and builds your heart-rate zones on it. You can type your own maximum in Settings instead.

Costs you split. The amount, who owes and who has paid, and a payment link you paste (for example a Tikkie link). We never see bank or card details.

Your devices. A push-notification token with the browser or phone description that came with it, and your notification settings.

Your Garmin connection. If you connect Garmin Connect: your Garmin user id, which data you allowed Garmin to share, and a key from Garmin that lets the app receive your workouts. The key is stored encrypted and deleted when you disconnect.

Technical records. A count of certain actions per account, to limit abuse. A scrambled (hashed) form of your IP address, kept for ten minutes, on a few pages that work without signing in. Crash reports: the error, the page, the browser type, and no account id. And the server logs of our hosting provider.

What we use it for

Who can see what

Every member can see your profile: name, picture, gyms and trainer bio.

Your profile shows your friends the gyms you posted sessions at. Nobody else sees them. You can switch this off in Settings.

A session is visible to the audience you pick when you create it (Everyone, meaning all your friends, Close friends, or Specific people), to the people you invite, and to the members of a community when you post it there.

A community can open a session to friends. Then the friends of its host and of everyone who joined can see it, who is going and its comments, and can join it, which shows it to their friends in turn. Photos, results, sets and recordings on it follow the rule below, and the community’s members and other sessions stay hidden.

An invite into a community, and your answer, can be seen by you, the friend who sent it and that community’s admins.

Photos, results, logged sets, heart rate, heart-rate zones, distance, calories and the GPS route belong to a session. What the session’s creator adds is visible to everyone who can see the session. What anyone else adds is visible only to their own friends who can see that session. A GPS route shows where you trained. The zones on a workout show the maximum heart rate they are built on.

A tracked workout set to “Only me” stays private.

Moments are visible to your friends for 24 hours.

A result you enter for a community’s monthly challenge is visible to that community’s admins, and to its members once an admin has confirmed it.

Your calendar link shows your name and your sessions (title, gym, times, note) to anyone who has the link. You can make a new link at any time, which switches the old one off.

Nobody outside the app can see any of this. A new account needs a community code.

Companies that help run the app

Supabase keeps the database, the sign-in and the photo storage, in Paris, France.

Vercel hosts the app. Our server code runs in Paris, France.

Resend sends the confirmation and password-reset emails.

ImprovMX forwards mail sent to privacy@traintogether.io to our inbox.

Apple delivers push notifications to iPhones, and signs you in if you use Sign in with Apple.

Google signs you in if you use Sign in with Google. When you search for a gym or a place, Google gets what you type and a rough area taken from your IP address (rounded to about 10 km), and nothing about your account.

Your browser’s push service (Google, Mozilla or Apple), if you turn on notifications in a browser.

Anthropic. When you ask the app to read a workout from a whiteboard photo, a screenshot or PDF of a training plan, a screenshot of your lap times, or typed text, that photo or text is sent to Anthropic’s AI model to be read. It goes without your name, email or account id. We keep the result, not the image. If you sign up for the weekly planner, once a week your planner answers (the daily vibe you pick and the feedback you write on a session included), the sessions and sets you log, and your watch workouts (type, distance, time, heart rate), Garmin’s included, are sent to Anthropic’s AI model to write your plan, without your name or email. They are used only to write your plan, not to train AI models. You can stop the planner and have its data deleted at any time on Your week.

CARTO. When a map is shown, your device loads the map images from CARTO, which sees your IP address and the area of the map, not your route.

Garmin if you connect Garmin Connect: after you agree on Garmin’s page, Garmin sends us the workouts you allow it to share. Garmin handles your data there under its own Garmin Connect privacy notice (garmin.com/privacy/connect). If you send a session’s workout to your watch, we send that workout to Garmin.

Stridee a company in Switzerland, connects your Garmin watch if you choose to: after you agree on its page, it passes the workout files Garmin shares to us.

Some of these companies are based in the United States.

How long we keep it

Your account and what you posted stay until you delete them or ask us to delete your account.

A moment’s photo is deleted from storage about an hour after the moment expires.

A notification about a session is removed a day after that session. Other notifications go 7 days after you read them, or after 14 days unread.

The hashed IP address is deleted after ten minutes.

Deleting a workout in Apple Health does not remove the copy here.

Workouts from Garmin stay after you disconnect, until you delete them or your account. When you disconnect or delete your account, we also tell Garmin to stop sharing.

In Settings, “Delete my account” sends us your request, and we delete your account and its data within one month. You can also email us.

You need an email address to have an account. Everything else you add is up to you.

Your rights

Cookies and storage on your device