This policy transparently explains how koatch collects, uses, shares, retains and protects personal data, including sports, health and location data, under the Swiss FADP and, where applicable, the GDPR.
1. Scope and controller
This policy applies to the koatch website, app and services. The controller is Option Web Binggeli, Chemin du Bas-du-Crêt 40, 2013 Colombier, Suisse. Privacy contact: info@koat.ch. The Swiss Federal Act on Data Protection (FADP) applies; the GDPR also applies where its territorial scope is met.
2. Data we process
Depending on the features used, koatch processes identity and account data; contact, subscription and billing data; running profile and goals; plans, workouts, activities and results; pace, distance, cadence, power, elevation and grade-adjusted pace; heart rate, VO2max, sleep, recovery, fatigue, pain, injury, nutrition and other voluntarily supplied health data; GPS, routes and altitude; shoes; coach messages and imported content; preferences, consent, export and deletion records; and technical, security and support data.
3. Data sources
Data comes from you, your device and browser, imported files, sensors and services you authorize (including Strava and, where available, Garmin, Apple Health or Health Connect), race organizers and public race sources, and technical providers. Third-party connections are optional.
4. Purposes and legal bases
We process data to administer accounts, deliver requested coaching and plans, record and analyze workouts, prepare races, synchronize chosen services, provide support and billing (contract); secure accounts, prevent abuse, diagnose errors and improve the service proportionately (legitimate interests); meet accounting, tax and legal duties (legal obligation); and, where required, process sensitive data, precise location, sports connections and non-essential audience measurement (consent, explicit for sensitive data).
5. Sensitive health and performance data
Information revealing health, injuries, physiology or highly personal characteristics is used only for coaching, sports safety and requested features. It is optional, is not sold and is not sent to Google Analytics. You may withdraw consent for future processing without affecting prior lawful processing.
6. Location, GPS and routes
A GPS track may reveal sensitive habits and places. koatch uses it only to display or analyze an activity, calculate distance, pace, grade-adjusted pace and elevation, adapt coaching or prepare a route. It is not published or used for advertising without your separate action and consent.
7. AI, personalization and profiling
koatch uses rules and AI systems to generate plans, summarize activities and suggest adaptations from your sports profile. This profiling supports coaching and may be wrong. It does not, by itself, make a decision producing legal or similarly significant effects. You can correct data, reject a recommendation and request human review. koatch is not a medical device or emergency service.
8. Cookies and necessary technologies
Local storage and essential cookies support authentication, security, sessions, language and saved choices. Audience measurement, non-essential personalization and marketing trackers stay off until accepted. You can reject as easily as accept and change your choice in the privacy center. Withdrawal does not affect essential features.
9. Google Analytics 4 (GA4)
With your audience-measurement consent, koatch uses Google Analytics 4, provided by Google Ireland Limited and, depending on processing, Google LLC, to understand site usage and improve performance. GA4 may receive viewed pages, interaction events, date and time, referrer, device type, browser, resolution, language, approximate area and pseudonymous identifiers/cookies such as _ga. koatch does not send your name, email, messages, health data, detailed workouts or GPS tracks to GA4. Google states that for users in Switzerland, the EEA and the United Kingdom, IP addresses are used only to derive approximate location and are discarded before logging. Advertising features and Google Signals are outside this stated purpose; enabling them would require additional notice and, where required, separate consent.
10. Google Search Console
koatch uses Google Search Console to monitor visibility in Google Search. It provides search queries, landing pages, clicks, impressions, click-through rate, average position, country, device and date in aggregated reports; Google omits or anonymizes some queries. Search Console itself adds no cookie or tracking tag to koatch and does not disclose a Google account holder’s identity to us. Processing relies on our legitimate interest in making the site discoverable and fixing indexing issues.
11. Recipients and processors
Data is available only to authorized people and necessary providers: Base44 for app infrastructure and hosting; Google for GA4 and Search Console; payment, messaging, support, security and AI providers used by a feature; sports services connected on your instruction; and authorities or advisers where required by law or legal claims. Each provider receives only the data needed for its role.
12. International transfers
Providers may process data in Switzerland, the EEA, the United States or other countries. Where no applicable Swiss or EU adequacy decision exists, koatch relies as appropriate on the Swiss-U.S. or EU-U.S. Data Privacy Framework for certified recipients, European Commission Standard Contractual Clauses adapted for Switzerland, or another lawful derogation, with supplementary technical and organizational measures where needed.
13. Retention
Account, plan and activity data is kept while the account is active and then deleted or anonymized, subject to legal retention, disputes and limited-rotation security backups. Accounting and contractual evidence may be kept for up to ten years. Security logs, requests and consent evidence are retained for a period proportionate to security and proof. GA4 user and event data is configured for no more than fourteen months; aggregated reports may remain longer. Criteria include purpose, sensitivity, risk and statutory limitation periods.
14. Security and data breaches
koatch applies minimization, access controls, encrypted integration secrets, separation of optional processing, security logging and filtering of sensitive exports. No system is infallible. If a breach reaches the legal risk threshold, koatch will notify the competent authority and, where required, affected individuals.
15. Your rights
You may request access, correction, delivery or portability where applicable, deletion, restriction, objection and withdrawal of consent. You may also request information about profiling and human review where a legal right applies. Use the privacy center or contact info@koat.ch. We may verify identity and may limit or refuse a request only where the law permits. Under the GDPR, the response period is generally one month.
16. Complaints
Please contact us first so we can address the issue. In Switzerland, you may contact the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you may also complain to the supervisory authority of your residence, workplace or the place of the alleged infringement.
17. Children
The service is not intended for unsupervised use by a child who lacks the age or capacity to consent under applicable law. Where guardian authorization is required, it must be obtained before health or location data is provided.
18. No sale, changes and contact
koatch does not sell personal, health, location or performance data. We may update this policy as the service, providers or law change. The date and version appear at the top; renewed consent will be requested if a consent-based purpose materially changes. Questions: info@koat.ch.
Sports connections and third-party services
Sports connections are optional. koatch should only collect data from Garmin, Apple Health, Health Connect, Strava or another service when you voluntarily enable the connection or import an activity.
Consent, scope and revocation
Each connection must present the requested data categories, the related running purpose and the way to withdraw authorization. Withdrawal stops future synchronizations without preventing export or deletion rights.
Location and route data
GPS tracks, routes, altitude and location data are used only to analyze the activity, terrain, load and plan consistency. They are not sold and must not be used for advertising tracking.
Integration security
Connection tokens must be encrypted server-side, limited to necessary scopes, renewed according to provider rules and excluded from user exports. koatch must never request or store a third-party service password.
No circumvention
koatch prioritizes official integrations and compliant authorization mechanisms. Any unofficial experiment must remain separate, explicit, revocable and must not be presented as an official integration.
AI-generated natural voice
When you voluntarily enable natural voice, the minimum instruction text to be spoken, its language and voice profile are sent through our Base44 infrastructure to OpenAI’s speech synthesis service. The service key remains server-side. GPS position, route, heart rate and other health data are not sent with the audio request. Audio may be held briefly in a per-account volatile cache, without persistent storage, and then replaced. You can disable this option at any time; the device voice then takes over, including offline.