Sapere Studio — Privacy Policy

Last updated: 16 June 2026

Sapere Studio (“the app”) is a companion app for cyclists that connects to your intervals.icu account to show your training data and to create planned workouts. This policy explains what data the app accesses, how it is used, and the control you have.

Data controller

The controller for personal data processed by this website and app is Wouter Coenen, Belgium — contact [email protected]. Lawful basis under the GDPR: performance of a contract (Art. 6(1)(b)) for the data accessed through your intervals.icu authorization, and legitimate interests (Art. 6(1)(f)) for cookieless, aggregated website analytics.

Data we access

With your explicit authorization (via intervals.icu sign-in or an API key you provide), the app reads from your intervals.icu account:

• your activities and training-load metrics (fitness, fatigue, form),
• your wellness metrics (e.g. resting heart rate, weight) where present,
• your planned workouts and calendar.

With your permission, the app also writes planned workouts you create in the app back to your own intervals.icu calendar.

How we use it

The data is used solely to display your dashboards, analyse your rides, and create the workouts you build, inside the app on your device. We do not profile you, sell your data, share it with third parties, or use it for advertising.

Recovery data (Apple Health / Health Connect)

If you opt in, Studio reads recovery signals (heart-rate variability, resting heart rate, sleep) from Apple Health or Health Connect locally on your device, to work out your daily readiness. This data is processed on-device, is not sent to our servers, and its local cache is erasable at any time (your intervals.icu source is untouched). Recovery signals are a training & wellness input — Sapere is not a medical device.

Storage

Your access token (or API key) is stored only on your device, in the iOS Keychain or Android Keystore. Our sign-in broker (hosted on Cloudflare) only temporarily handles the token during the sign-in exchange and does not retain your training or wellness data on our servers. We do not operate a profile database of your intervals.icu data.

Sub-processors

• Cloudflare, Inc. — hosts this website and the edge sign-in broker. The broker handles your intervals.icu token only in memory during sign-in to complete the exchange; it does not store your training or wellness data.
• Umami (cloud.umami.is) — cookieless, privacy-first website analytics. Receives only aggregated, non-identifying signals; no personal data and no cookies.

Optional coaching layer (opt-in)

The free product is fully local. A future opt-in coaching layer can generate multi-week plans and natural-language coaching that a phone can’t compute alone. If you choose to enable it, a minimal, pseudonymous slice of your derived training numbers (never raw GPS, streams, name or email) is sent to our coaching server, kept briefly, and erasable in one tap. You are identified only by a random code generated on your device — never your name, email or intervals athlete id. Your identity and raw rides stay on your device and in intervals.icu.

For this optional layer, Cloudflare (hosting) and Anthropic (AI text — under a data-processing agreement, zero data retention, de-identified before each request) act as sub-processors. The AI only turns an already-computed result into words; it never decides your numbers.

Your control & your rights

• You can revoke the app’s access at any time in your intervals.icu settings (Connected apps), or by clearing the API key in the app.
• Deleting the app removes the locally stored token from your device.
• You have the right to access, rectify, or erase your personal data, and to lodge a complaint with your data-protection authority. To request erasure of any data we hold, contact [email protected]. Because we keep no profile database of your training data, such requests typically close with confirmation that no server-side record exists.

Website analytics

This website uses Umami, a privacy-first, cookieless analytics tool, as our processor. The tracker is self-hosted from this domain and configured with do-not-track honoured and search terms excluded. We measure only aggregated, non-identifying signals — unique visitors, referring channel, bot-vs-human, scroll depth and call-to-action clicks. We do not use session replay, heatmaps, cross-site tracking, fingerprinting or any personal identifier. Because no cookies or personal data are stored, no consent banner is required — but you can block the script and the site works exactly the same.

Contact

Questions about this policy: [email protected]

Changes

We may update this policy; the “Last updated” date above reflects the current version.