Privacy policy
This explains what tryat collects, why we are allowed to, who else touches it, and how to get it back or get rid of it.
Last updated 26 October 2026
The short version. We collect your health and training data because that is the entire product. We do not sell it, we do not advertise, and we run no analytics or tracking of any kind. A handful of companies process it on our behalf: our host, our database provider, Anthropic, whose model writes the coach’s reading of your numbers, and two small services that send your sign-up code and check that a visitor is a person. You can download everything or delete everything from Settings, whenever you like, without asking us. Nothing about you is visible to other members.
1. Who is responsible
Join Animation Studio AS (organisation number 824 988 692), Fjellhamarveien 52, 1472 Fjellhamar, Norway, is the data controller for tryat. That means we decide what is collected and why, and we are the ones answerable for it.
For anything in this document, including exercising any of the rights in section 8, write to privacy@joinanimation.no.
2. What we collect
What you give us
- Your name, email address and a password. The password is never stored, only a bcrypt hash of it, which cannot be turned back into your password.
- Your time zone, read from your browser at sign-up so the coach knows what “today” means for you.
- Your goals, races, training constraints and any instructions you write for the coach.
- Everything you type to the coach, and everything it replies, so the conversation has a memory.
- Your email address is confirmed with a one-time code we send to it before the account is created.
What we fetch from Garmin
This is health data. It is treated as a special category under Article 9 of the GDPR, which is why we ask for your explicit consent separately at sign-up rather than folding it into the terms.
- Sleep: score, duration, deep, light, REM and awake time, quality, respiration rate.
- Heart rate variability, including Garmin’s seven day average, baseline and status.
- Resting heart rate.
- Body Battery high, low and change.
- Body weight, where your scales report it to Garmin.
- Steps, your recorded activities, and Garmin’s training load for each of them.
Your Garmin API key
Connecting Garmin means pasting a personal API key that you create yourself in Garmin Connect. We encrypt it with AES-256-GCM before it reaches the database, using a key held outside it, and we never show it again. It is used for one thing only: reading your own data from Garmin. We never hold your Garmin password. You can delete the key in Garmin Connect whenever you like.
Technical
Our host keeps standard server logs, which include IP addresses, for security and to diagnose faults. When you sign up, ask for a code or reset a password, your IP address is also used for the Turnstile check (see section 4) and, as a one-way hash that cannot be turned back into the address, to limit how often one visitor can try. If you turn on two-factor sign-in, we store the secret behind your authenticator codes encrypted with AES-256-GCM, and your backup codes only as hashes.
3. Why, and what allows us to
| What for | Legal basis |
|---|---|
| Running your account and showing you the service you asked for | Performance of a contract, Article 6(1)(b) |
| Collecting and analysing your health data, and sending the relevant figures to Anthropic so the coach can read them | Your explicit consent, Article 9(2)(a) |
| Keeping the service secure and working, including server logs, confirming your email address, and keeping bots and abuse out | Legitimate interests, Article 6(1)(f) |
You can withdraw the health consent at any time from Settings. Doing so stops the coach and deletes the health data we hold, because without it there is no service left to provide. Withdrawing does not undo processing that already happened lawfully.
4. Who else touches it
These companies process data on our behalf, under contract, and for nothing else:
| Who | What they do | What they see |
|---|---|---|
| Vercel Inc. | Hosts the website and runs the server code. | Everything the app handles, in transit. Technical logs including IP addresses. |
| Railway Corp. | Hosts the database. | Everything stored: your account, your health and training data, your conversations with the coach. |
| Anthropic PBC | Provides Claude, the model that writes the coach's reading of your data. | The health and training figures relevant to the question being answered, plus what you type to the coach. Not your email address, your password, or your Garmin API key. |
| Resend (Resend Inc.) | Sends the one-time codes by email when you sign up or reset your password. | Your email address and the code. The sending domain is set up in Resend's EU region. |
| Cloudflare, Inc. | Runs the Turnstile check on the sign-up and password pages, which tells people from scripts. | Your IP address and technical signals from your browser, on those pages only. |
Garmin is not on this list because the flow runs the other way: we read from it using access you granted. We do not send it anything about you beyond the key needed to read your own data. Your relationship with Garmin is governed by its own terms. What you connect to tryat is your choice and your responsibility. If tryat later lets you connect other sources of your own, each one will be named here before it can be used.
We do not sell personal data, we do not share it for advertising, and no third party receives it for their own purposes.
5. Sharing with other members
tryat has no feed, no public profiles and no way for one member to see anything about another. Nothing about you, and no figure from your watch, is visible to anybody but you.
Our admin screen shows the list of accounts, whether Garmin is connected, and what the service costs. It never shows your health data. Like any operator, we can technically reach the database in order to run and repair the service, and we only do so for that purpose.
6. Where it goes
Some of this processing happens outside the European Economic Area, principally in the United States. Where it does, the transfer is covered by the European Commission’s Standard Contractual Clauses together with the additional safeguards our providers commit to. You can ask us for the detail of any specific transfer.
7. How long we keep it
- While your account exists: your health and training history is kept, because a trend is the point. Nothing is deleted on a schedule.
- When you delete your account: everything is removed from the live database immediately. Database backups, where they exist, roll off within 30 days and are not used to bring a deleted account back.
- Server logs: kept by our host for a short period, typically 30 days.
8. What you can do
Under the GDPR you have the following rights, and none of them cost anything:
- See it and take it with you. Settings has a button that gives you everything we hold, as a JSON file, right away. Articles 15 and 20.
- Delete it. Settings has a button for that too. It is immediate and it is not reversible. Article 17.
- Correct it. Edit your profile, or write to us. Article 16.
- Withdraw consent. At any time, as easily as you gave it. Article 7(3).
- Object, or ask us to restrict what we do. Articles 18 and 21.
- Complain. To us first, ideally, but you are entitled to go straight to Datatilsynet, the Norway supervisory authority. Article 77.
If you write to us rather than using the buttons, we will answer within one month.
9. Cookies
tryat sets three cookies, all of them ours, none of them for tracking:
| Cookie | What it is for | How long |
|---|---|---|
| Session token | Keeps you signed in. Without it every page would ask for your password again. | Until you sign out or it expires |
| CSRF token | Stops another site submitting forms as you. | The browser session |
| Callback URL | Returns you to the page you were on after signing in. | The browser session |
All three are strictly necessary for a service you asked for, which is the exemption in Article 5(3) of the ePrivacy Directive, so there is no consent banner. There is no Google Analytics and no advertising pixel. The one third-party script is Cloudflare Turnstile, which loads only on the sign-up and password pages to tell people from scripts, and is not used for tracking. Your phone may also store small amounts of data locally, such as whether you dismissed the install prompt or the last figures shown, so the app can paint before it has finished loading. That never leaves your device.
10. Keeping it safe
- Everything travels over HTTPS.
- Your password is stored only as a bcrypt hash.
- Your Garmin API key is encrypted with AES-256-GCM, with the key held outside the database.
- Each account can only ever read its own rows.
- Signing up needs a code sent to your email address, and sign-up and sign-in attempts are rate limited.
- You can add two-factor sign-in with an authenticator app in Settings.
No system is perfect. If personal data is ever breached in a way that puts you at risk, we will tell Datatilsynet within 72 hours and tell you without undue delay.
11. Children
tryat is not for anyone under 16. We do not knowingly collect health data about children. If you believe a child has an account, write to us and we will remove it.
12. Changes
If we change this policy in a way that affects what you agreed to, we will tell you in the app and ask again where the law requires it. The version you accepted is recorded against your account.