Privacy policy.

1. Who is responsible

Peebs is a product of Elvestuen Consulting, Norway, organisation number 826 601 892. Elvestuen Consulting is the controller responsible for the personal data described here.

Contact us at elvestuen.consulting@gmail.com for privacy questions or requests. You can write in Norwegian or English.

This policy covers peebs.co and the Peebs private alpha, which currently also uses the development name Tony / Tonysgym. The alpha is intended for adults. It does not cover your independent use of Garmin, Hevy or other services, which have their own privacy policies.

2. What data we use

When you visit peebs.co

Our hosting infrastructure receives technical request data, such as your IP address, requested page, request time and browser information, to deliver and protect the website. We have not added analytics, advertising pixels, tracking cookies or third-party fonts. The public site does not ask you to sign in or upload training data.

When you contact us

We receive your email address, any name you provide and the contents of your message. Please do not email passwords, API keys or detailed health records.

When you use the private alpha

• Account data: email address, account identifier and authentication information managed by our sign-in provider.
• Training records: the files you upload and records you choose to import. Depending on the source, these include workout dates, titles, sport, duration, distance, pace, power, heart rate, calories, exercises, sets, repetitions, weights and notes.
• Original source data: we retain uploaded CSV files and imported API records for traceability and export. Extra columns or notes can contain information that is not shown in the charts, including location or health information if present in your source file. Check what you upload and avoid including unrelated personal data.
• Connection data: for Hevy, your encrypted API key, provider account identifier and connection / sync status. Sync takes place when you request it; there is no scheduled background import.
• Derived information: workout matches across sources, training totals, trends and progression comparisons calculated from your records.

Some measurements and inferences can reveal information about your health and require additional protection. A training record is not automatically an accurate medical assessment.

3. Why we use data and our legal basis

• Deliver the service you request: create your account, import and reconcile records, display history and progression, and provide data-based insights. For ordinary account and training data necessary for these functions, the basis is performance of our agreement with you (GDPR Article 6(1)(b)). Without the relevant records, we cannot provide personalised analysis.
• Optional health-data analysis: this requires your explicit, informed consent (Articles 6(1)(a) and 9(2)(a)). Consent is specific to the purpose explained when you enable a health-data feature. Reading this policy or simply visiting the site is not consent.
• Operate securely and respond to enquiries: our legitimate interests are maintaining a functioning, secure service, preventing misuse and answering messages (Article 6(1)(f)). Enquiries about entering into a service agreement can also be handled at your request under Article 6(1)(b).
• Comply with a specific legal obligation: where disclosure or retention is required by applicable law, the basis is Article 6(1)(c).

You may withdraw consent by contacting us. We will stop the processing covered by that consent and handle deletion as appropriate. Withdrawal does not affect processing lawfully carried out before it. Features that depend on that data will no longer be available.

We use your records to identify patterns in training, performance and consistency. The AI-assisted features described below will build on this analysis. Insights support your own decisions; Peebs does not make automated decisions with legal or similarly significant effects and is not a medical diagnosis service.

4. AI assistance and your choices

Planned functionality: Peebs is developing AI-assisted training guidance. The current private alpha uses calculations and comparisons and does not send training records to an external AI model provider. This section explains the intended processing for those features.

What AI will help you do

AI will turn relevant training and recovery information into understandable summaries, explanations and suggestions. This includes daily guidance, weekly progress reviews, post-workout follow-up, suggested workouts and plans that adapt to your goals, completed sessions, recovery and available time. It will also support questions you ask about your own training.

Information used for a response

The intended inputs are the relevant parts of your workout history, performance trends, available recovery measurements, goals, preferences, questions and feedback. This can include health information, such as heart-rate or sleep measurements and any limitations you choose to share. If you separately connect a calendar, relevant availability and travel context will help fit training around your commitments. Peebs will use only the context needed for the feature, rather than automatically sending your entire history or calendar.

AI providers and model training

AI providers will process the selected context to generate a response for you. The production provider has not yet been selected. The provider’s identity, the information it receives, relevant processing locations and retention arrangements will be disclosed in the service-provider information or feature notice before your data is sent. Providers will be engaged under data-processing terms appropriate to their role.

Peebs will not use, or permit its AI providers to use, your training records, health information, prompts or derived responses to train, fine-tune, benchmark or improve AI models. This includes Garmin-sourced information and outputs derived from it. Generating a personalised response is different from training a model on your data.

Your choice and the limits of the guidance

AI assistance will be optional and enabled through a separate, informed choice. The intended legal basis is consent (GDPR Article 6(1)(a)), including explicit consent for health information (Article 9(2)(a)). You will be able to withdraw AI consent through the feature’s controls or by contacting us. This will stop future AI processing covered by that consent; it will not require you to give up non-AI history and analysis features.

AI can make mistakes or miss relevant context. Generated advice will be identified as such and is intended to support your judgement, not replace professional medical advice. You will remain in control of acting on suggestions and sending a planned workout to a connected service.

The planned service will retain saved guidance and relevant conversation context to provide continuity until you remove it or request deletion. Any temporary provider-side retention needed to process requests or protect the service will be disclosed before activation. Withdrawing AI consent and deleting saved history are separate choices.

5. Who processes data and where

• Render: hosts the public website and application backend. The backend is configured in Frankfurt, Germany; the public site uses global content delivery infrastructure.
• Supabase: provides account authentication and database storage. Our database is configured in the EU region eu-west-1 (Ireland).
• Google / Gmail: handles messages sent to our contact email address. Training history is not routinely sent to this mailbox.
• Hevy: provides your selected workout records when you connect and manually sync your own account. Our connector reads data; it does not write workouts back to Hevy.

Authorised people operating Peebs may access data when needed to provide support, investigate faults or fulfil a privacy request. We do not sell personal data or share it with advertisers. We may disclose limited data to authorities where legally required.

EU hosting does not mean every supporting operation stays in the EU/EEA. These providers and their subprocessors operate internationally, including in the United States. Their published data-processing terms describe safeguards for relevant transfers, including EU Standard Contractual Clauses. You can contact us for information about the arrangements applicable to your data and copies of applicable safeguards.

Provider information: Render data-processing terms, Supabase data-processing terms and Google privacy policy.

6. Garmin and connected training services

Peebs brings together information from services you choose to connect or files you choose to upload. The current alpha supports Garmin activity CSV imports; the Garmin API connection is planned.

The planned Garmin connection will use the official APIs to combine completed activities with available health and recovery measurements, such as sleep, heart rate and stress. A later feature will let you send selected workouts and plans to Garmin Connect. Available data and actions depend on the enabled integration and the permissions you grant. Connection notices will explain what is read or sent and how to disconnect. Publishing this policy does not grant access to your accounts or authorise transfers on your behalf.

7. How long data stays and how to remove it

Imported history and source records are kept to provide your ongoing training history until you remove them, request deletion or the alpha service ends. They do not currently expire on an automatic schedule. Account information is kept while your account remains active and is removed when an account-deletion request is completed, except for any limited information we are legally required to retain.

• Export: the app can export your imported records and reconciliation information. Credentials are excluded.
• Remove history: you can remove imports or clear imported history. Records supplied by other remaining sources may still appear. Clearing history does not delete your account.
• Disconnect Hevy: this removes the stored connection credential. Previously imported history remains until you remove it separately. Revoke the original API key in Hevy if you also want to invalidate it there.
• Delete your account: email us from the account address. Account deletion is currently handled manually, not through a self-service button.

We keep correspondence for as long as needed to handle your enquiry and necessary follow-up. Technical logs and any backup copies follow the relevant provider’s retention processes; deletion from active records does not imply immediate erasure of every backup. We will explain any remaining retention and its reason when handling your request. Deleting data from Peebs does not remove the original from Garmin, Hevy or your own files.

8. Security and browser storage

The service uses HTTPS, authenticated access and database access controls that separate users’ records. Stored provider API keys are encrypted server-side. These safeguards reduce risk; no service can promise absolute security.

The signed-in alpha stores authentication session information in your browser’s sessionStorage to keep you signed in within the tab. This is functional storage, not advertising tracking. It is separate from the public landing page, which adds no browser storage of its own.

9. Your rights

Depending on the applicable conditions, you can request access, correction, deletion, restriction of processing and a portable copy of your data. You can object to processing based on legitimate interests and withdraw consent where we rely on it.

Send requests to elvestuen.consulting@gmail.com. We may need to confirm your identity without collecting more information than necessary. We normally respond within one month. If a lawful extension is needed, we will tell you within that month and explain why.

You can complain to Datatilsynet, the Norwegian Data Protection Authority, or the supervisory authority where you live or work in the EU/EEA. You do not have to contact us first.

10. Changes to this policy

This policy describes the purposes and types of processing behind Peebs, rather than every screen, calculation or technical implementation. Routine improvements within those descriptions do not, by themselves, require a new consent request. We will keep the information accurate and show the revision date above. Where a change affects how your personal data is used, we will explain the relevant change before it takes effect, using this policy and, where appropriate, an in-app or email notice. New consent will be requested when legally required, including where a consent-based purpose changes. Feature-specific notices can provide more detail; they do not replace your rights under this policy.