← Back to Fitness AI Connector

Privacy Policy

#

Last updated: October 16, 2026

(In the update of October 16, 2026, we added gear registered in Garmin Connect, such as shoes and bikes, to the data imported from Garmin data exports in Section 2.6, and added that files that cannot be read may be kept temporarily to find out why.)

(In the update of October 4, 2026, we added to Section 1 how you consent to and can withdraw from providing data to AI assistants, that we do not use your data for AI training, and how this section is kept up to date.)

(In the update of October 3, 2026, we added Section 2.6 on files you send through the import page (activity FIT files and Garmin data exports), and added related text to the plain-language summary, Section 3 and Section 4.2.)

(A further October 2, 2026 update adds Section 2.5 on workouts you ask the Service to send to Garmin Connect, replaces the “Read-only” summary, adds the related purpose to Section 3, and adds workout records to Section 4.2.)

(The October 2, 2026 update specifies in Section 6 how long account identifiers are kept after an account is deleted, and adds database backups to Section 4.2.)

(The September 30, 2026 update extends the Basic plan retention period in Section 4.2 to 10 years. Basic subscriptions still on the previous billing method keep the 5-year period until their one-time move.)

(The September 17, 2026 update adds Section 2.4 on technical and security records, adds the related purpose to Section 3, and clarifies in Section 4.2 how long Free plan data and security records are kept.)

This Privacy Policy explains how FMP (“we”, “us”, or “our”) handles personal information in connection with Fitness AI Connector (“the Service”).

Your data, in plain language

#

Before the legal text, here is how the Service handles your data in plain terms. See the sections below for details.

• What we access — Your Garmin health and activity data (sleep, heart rate, stress, activities, body composition, and similar). Only data from the moment you connect your Garmin account onward is available. Depending on your plan, you can also import earlier data by sending files you exported from Garmin (Section 2.6).
• What we never have — Your Garmin password. You sign in on Garmin’s own page (OAuth); the Service never sees or stores your password.
• Your control — You can revoke the connection at any time from your Garmin Connect™ account settings. If you delete your account, your Garmin health data is automatically and permanently deleted after a recovery grace period.
• Writing only what you ask for — The Service writes to your Garmin account only to create a workout that you asked your AI assistant to make and confirmed, and to delete a workout the Service created when you ask it to. It never changes or deletes your own workouts, your activities, or any other data in your Garmin account. This uses Garmin’s Training permission, which you can turn on or off at any time in Garmin Connect.

1. AI Transparency Statement

#

Your Garmin data is provided to AI assistants (Anthropic Claude / OpenAI ChatGPT). AI assistants analyze and summarize your data to generate responses.

Our Service only relays and provides data. Interpretation and recommendations are generated by the respective AI assistant platforms (Anthropic / OpenAI). The handling of your data by AI assistants is governed by their respective privacy policies.

• Anthropic Privacy Policy
• OpenAI Privacy Policy

AI Model Training: The Service provides data via MCP protocol (API). How data sent to an AI platform is stored, whether it is used to improve models, and how it is otherwise handled depends on the platform you use, your subscription plan, your account settings, and that platform’s current terms and policies. We do not guarantee or control this handling. Please check each platform’s terms and your account settings for the current conditions.

Consent and withdrawal: Your Garmin data is provided to an AI assistant only after you have agreed to the connection on Garmin’s page and connected the Service to your AI assistant, and only when the AI assistant calls the Service’s tools during a conversation. You can stop this at any time by removing the Service’s connection in your AI assistant’s settings or by deleting your account (Section 6). Revoking the connection in Garmin Connect also stops us from receiving new data.

Our use for AI training: We do not use your Garmin data to train, evaluate or improve any AI model.

This section will be updated to reflect changes in applicable laws, regulations or Garmin’s policies.

2. Data We Collect

#

2.1 Garmin Health Data

#

We collect the following data through the Garmin Health API, the Garmin Activity API, and the Garmin Women’s Health API:

• Heart rate (resting and active)
• Sleep data (duration, score, sleep stages)
• HRV (heart rate variability)
• Stress levels
• Activity data (running, walking, and other exercise records)
• VO2max
• Body Battery
• Menstrual cycle tracking data (cycle phase, day in cycle, period start date, cycle length, and fertile window predictions) — via the Garmin Women’s Health API. This data is collected only if you track your menstrual cycle in Garmin Connect and have menstrual cycle data sharing enabled. If you use pregnancy tracking in Garmin Connect, pregnancy-related data may be included.
• Other health-related data provided by these Garmin APIs

2.2 Account Information

#

• Email address (obtained when you sign in; authentication is provided by Supabase Auth. If you sign in with email and password, a hashed form of your password is stored by Supabase Auth; if you sign in with Google, we receive your Google account identifier and email address)
• Bot-protection signals on the sign-in, sign-up and password-reset pages, processed by Cloudflare Turnstile. Turnstile runs invisibly and evaluates browser and device characteristics to tell people from automated traffic; see the Cloudflare Turnstile Privacy Addendum

2.3 Payment Information

#

• Payment processing is handled by Stripe. We do not store credit card numbers or other payment details.

2.4 Technical and Security Records

#

When anyone connects to the Service — including requests that are rejected — we record technical information about the request: IP address, country, network provider, user agent, the identifier of the connecting application, the type of request, its result, and the time. If a connection from an application other than Claude or ChatGPT succeeds with your account, we also record which account was used.

2.5 Workouts You Send to Garmin Connect

#

If you ask your AI assistant to create a workout and confirm it, the Service sends it to your Garmin Connect account through the Garmin Training API, and schedules it on the date you chose. The workout content (sport, steps, targets, name, and description) is written by the AI assistant from your request; the Service checks it and passes it to Garmin.

To let you list and delete these workouts later, we keep a record of each workout the Service created: the workout and schedule identifiers issued by Garmin, the scheduled date, the sport, the workout name, and when it was created or deleted. We do not keep a copy of the workout steps. The Service cannot see workouts that you or others created in Garmin Connect.

2.6 Data You Send Through the Import Page

#

If you send activity FIT files, or data you exported with Garmin’s “Export Your Data”, through the Service’s import page, we import the following data from them:

• Activities (the original FIT files, and summaries of activities that have no FIT file)
• Daily summaries, sleep, weight and blood pressure
• History of metrics such as VO2 max and fitness age
• Menstrual cycle records (past cycles’ start dates, cycle length, period length and predicted fertile window, and daily logs of flow, ovulation day, symptoms and moods)
• Gear you registered in Garmin Connect, such as shoes and bikes (name, make and model, type, status, start date and distance limit), and which of your activities each item is linked to. Internal Garmin profile and gear identifiers in the file are not kept

We do not import the sex-drive item in the daily menstrual logs; it is discarded when the file is read. We also do not import contraception items or the settings file (handedness, display language, coaching settings and similar). Files in formats we do not import are not stored.

Activity FIT files are stored as original files, in the same way as FIT files delivered by Garmin. Other files you send are deleted once processing is complete. If a file you send cannot be read, we may keep it for up to 14 days to find out why, and then delete it.

3. How We Use Your Data and Legal Basis

#

We use your data solely for the following purposes:

4. Data Storage

#

4.1 Storage Location and International Data Transfers

#

Your data is encrypted and stored on Supabase (AWS US East region, United States).

For users residing in the EU/EEA, your data is transferred to the United States. These transfers are conducted based on Standard Contractual Clauses (SCCs) established by the respective service providers.

4.2 Retention Period

#

Data retention periods vary by plan:

• Free plan: The Service provides your data from the most recent 2 days. To account for differences between time zones, stored data is kept for up to 4 days and then automatically deleted.
• Basic plan: up to 10 years from the date of sync (while your subscription is active). Basic subscriptions still on the previous billing method: up to 5 years, until their one-time move
• Technical and security records (Section 2.4): Kept in full for 1 year. After 1 year, IP addresses are shortened so that they no longer identify an individual device (for example, the last part of an IPv4 address is removed), and the shortened records are kept to track long-term patterns.
• Workout records (Section 2.5): Kept while your account and Garmin connection are active. They are deleted together with your other data when your account is deleted, and within about a week after you disconnect your Garmin account. Workouts already created in Garmin Connect stay there after you disconnect; you can delete them in Garmin Connect.
• Imported data (Section 2.6): the plan retention periods above apply counted from the date of the data (activity date, log date, cycle start date) rather than the sync date. Data dated earlier than the retention period is not imported.
• Database backups: Daily backups of our database are kept for 7 days and then overwritten. Data deleted from the database therefore also disappears from backups within 7 days.

Data beyond the retention period is automatically deleted.

When a paid (Basic) subscription ends, we retain your previously stored data for 30 days so that your history is preserved if you resubscribe. After 30 days, the Free plan’s retention rules apply and data beyond that range is deleted. This grace period does not apply to accounts that have only used the Free plan.

5. Third-Party Data Sharing

#

The Service shares data with the following third-party services:

We do not sell, share, or provide your data to any third parties other than those listed above. When we add or change a service provider (sub-processor), we will announce it by updating this Policy.

6. Data Deletion

#

You may request deletion of your account and data at any time through either of the following methods:

• Via AI assistant: Tell your AI assistant “I want to delete my account”
• Via email: Send a deletion request to contact@fmp.it.com

When we receive a deletion request, we handle it as follows:

• Garmin health data: Deleted from our database within 30 days of the request.
• Account: Deactivated so that you can no longer sign in or use the Service. Your email address and your sign-in record (your account with our authentication provider) are kept for 1 year after deletion to prevent misuse of the Service and to handle questions or claims about the account (legitimate interest), and are then deleted. After that, we keep only internal reference numbers that cannot be linked back to you; these are not personal data. If you had a paid subscription, your payment customer ID and your payment and transaction records are kept for the statutory record-keeping period (up to 7 years under Japanese law).
• Subscription: If a subscription is still billing, we will ask you to cancel it yourself. Where a deletion request is sent to us by email, we will carry out the cancellation on your behalf. In either case the cancellation takes effect at the end of the billing period and no further charges are made. Payment and transaction records are retained in accordance with statutory record-keeping obligations.

Disconnecting from Garmin Connect (stopping data from being sent) is something you do yourself in the Garmin Connect app. See the Account Management page for the steps.

7. Your Rights (Disclosure Requests / GDPR)

#

Under the Act on the Protection of Personal Information of Japan (APPI) and the GDPR, you have the following rights:

• Notification of purpose of use: Request notification of the purposes for which your retained personal data is used
• Right of access (disclosure): Request disclosure of your data and of records of provision to third parties
• Correction, addition, and deletion: Request correction, addition, or deletion of your data when its content is inaccurate
• Suspension of use, erasure, and suspension of third-party provision: Request these in the cases provided by law (see Section 6 for what is deleted and what is retained)
• Right to data portability: Receive your data in a structured format
• Restriction, objection, and withdrawal of consent: Request restriction of processing or object to processing under certain circumstances, and withdraw consent for processing based on consent

How to make a request:

• Method: Contact us at contact@fmp.it.com.
• Identity verification: We verify your identity by means such as receiving your request from your registered email address.
• Response: We will respond without undue delay.
• Fees: Free of charge (including requests for notification of purpose of use and for disclosure).

Complaints: You have the right to lodge a complaint regarding the handling of your personal information with the Personal Information Protection Commission of Japan (or, if you reside in the EU/EEA, with your local supervisory authority).

8. Cookies

#

The Service uses session cookies for authentication purposes only. We do not use advertising tracking or third-party tracking cookies.

9. Minors

#

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from anyone under 18.

10. Security

#

We implement the following security measures to protect your data:

• Data encryption (in transit and at rest)
• Access controls and authentication
• Regular security reviews

However, no method of data transmission over the Internet or electronic storage is completely secure.

11. Data Breach Response

#

In the event of a personal data breach, we will work to assess the impact and prevent further harm, and, where required by applicable law (including the Act on the Protection of Personal Information of Japan and the GDPR), we will report to the competent supervisory authority and notify affected users within the time limits and in the manner prescribed by that law.

12. Business Succession and Service Termination

#

If we transfer the business to a third party or terminate the Service, we will endeavor to ensure that your personal data continues to receive protection equivalent to this Policy, and we will announce material changes in advance. Upon termination of the Service, we will delete your personal data except where retention is required by law.

13. Changes to This Policy

#

We reserve the right to modify this Privacy Policy. We will notify you of significant changes through the Service. The latest policy will always be available on this page.

14. Governing Law

#

This policy is governed by the laws of Japan.

15. Contact

#

For questions regarding this Privacy Policy, please contact us:

• Service: Fitness AI Connector
• Operated by: FMP
• Email: contact@fmp.it.com

The name and address of the operator (a sole proprietor) with respect to retained personal data will be disclosed without undue delay upon request to contact@fmp.it.com (normally within 7 days — the same period as set out in the Commercial Disclosure page).