Privacy policy

This page describes what data Sleipnir Analytics collects, why, who it is shared with, and what your rights are. The product's philosophy fits in one sentence: your data stays yours.

Last updated: 28 October 2026. This is a translation; the French version is the reference text.

Data controller

Ismael MERZAQ, contact: contact@gosleipnir.com.

Data collected and purposes

• Account (email address, display name, encrypted password, profile picture if you add one): to create and secure your access.
• Physical profile (date of birth, sex, weight, maximum and resting heart rate), entered by you or provided by your watch: to compute your zones, your training load and your fitness-level estimates.
• Sports activities (GPS tracks, heart rate, power, cadence and other sensors, photos you attach), synced from your watch or imported by you: to provide the analyses that are the purpose of the service. They are never sold, and never shared without an explicit action on your part (sharing with friends or a club, a public link).
• Sleep and recovery (sleep duration and stages, overnight heart rate and heart-rate variability, breathing rate), when your watch or your import provides them: to compute your recovery score and your daily readiness. This is health data; it is used only for these calculations and is never shown to anyone else.
• Social features (friends, groups, clubs, comments, reactions, challenges): to run the features you use with other accounts.
• Mobile app (notification token, platform, device time zone and language, app version): to send you the notifications you have turned on, at the right time and in your language.
• Waiting list (email address, and what you are waiting for: sync for a Coros, Suunto or Wahoo watch — or Garmin, for a signup made before it opened —, or a beta seat when all available seats are taken): to tell you about what is new at Sleipnir, starting with what you are waiting for — a few messages a year at most. Every message carries a one-click unsubscribe link, and your address is deleted on request. No sharing. Joining the waiting list creates no account and is not linked to any existing account.
• Technical logs (application errors, response times): to detect and fix outages. They are collected by our own servers, without any third-party tool, and do not contain your training data.

What we do not do

No advertising, no data resale, no commercial profiling. None of your data is processed by an artificial-intelligence system or handed to a third-party analytics or machine-learning service, and none of it is used to train, evaluate or improve an AI model: every analysis is an explicit computation, run on our own servers.

Services you connect

When you link your Polar or Strava account, you allow Sleipnir to read your activities from that service (and, for Polar, your sleep, recovery and physical profile). We keep the access tokens this requires, and we send none of your data to these services — only the exchanges their authorization protocol requires. You can disconnect at any time from your preferences; deleting your account revokes the authorization you had given. Files you import yourself (FIT, GPX, TCX, Polar or Garmin export archives) are read once, on our servers, and involve no connection to the manufacturer.

Garmin Connect

When you link your Garmin Connect account, you allow Garmin to send us, after each sync of your watch, the data you agree to share on Garmin's consent screen:

• your activities, with the file recorded by your watch (GPS track, heart rate, power, cadence, laps, swim lengths), including those you create or edit on Garmin Connect;
• your sleep and recovery: sleep duration and stages, sleep score, overnight heart-rate variability (HRV), resting heart rate and overnight breathing rate.

This data is used only to provide Sleipnir's features to you: analysis of your activities, training load, records, segments, cols and summits, VO2max estimates, training calendar and recovery score. Your activities are visible to other people only according to the visibility you choose; your sleep and recovery never are. The other data Garmin offers (stress, Body Battery, blood oxygen, nutrition…) is not collected: if it reached us, it would be discarded without being stored.

Garmin data is never sold, never passed to a third party for its own use, never used for advertising, and never processed by an artificial-intelligence system. It is stored and processed at our host, OVH, in France (see below); no other recipient receives it, except an activity's starting point sent without any identifier to Open-Meteo for the weather, as for every activity. We send none of your data to Garmin — only the exchanges its authorization protocol requires.

You stay in control at any time: you choose what you share, and can change it, in your Garmin Connect account settings; you can disconnect Garmin from Sleipnir's preferences, which also removes our authorization at Garmin and stops any transfer. What has already been imported stays in your Sleipnir account, where you can view, export, correct or delete it (see "Your rights"); deleting your account erases it entirely.

Beta access and waiting list

Access to the beta is limited to a set number of seats. When every open seat is taken, sign-up is refused and you can leave your email address on the waiting list. That address is used to let you know when a seat opens, then to tell you about what is new at Sleipnir — a few messages a year at most, each with an unsubscribe link. It is never used for anything else and is not subject to any profiling or to any automated decision producing legal effects concerning you. Your position on the list guarantees neither a rank nor a date of access.

Contact form

When you write to us through the contact form, your email address, your message and, if you provide it, your name are stored and sent to our mailbox contact@gosleipnir.com. The page you are writing from is attached (for example the col you are reporting), because that is what makes a report actionable. This information is used only to answer you and to fix what you report; it is passed on to no one else, and is used neither for marketing nor for any audience measurement. No IP address or browser identifier is kept with your message.

Writing to us does not require an account. If you are signed in when you send it, the message is linked to your account so we can find the context; otherwise it is linked to none.

Support access

The team never opens your account without your consent. If you ask for help, you can grant a support access: it is read-only, you can revoke it at any time, and revocation takes effect immediately.

Privacy zones

You can define geographic zones (home, work) that are hidden in everything you share; the statistics shown are recomputed accordingly.

Retention periods

• Account, activity, sleep and recovery data: for as long as your account exists. A deletion request erases them permanently thirty days later (see Delete your account).
• Garmin Connect authorization: until you disconnect, or until you withdraw it at Garmin. An activity file received from Garmin is removed from the import queue as soon as the activity is created, and at the latest seven days after it was received if the import could not complete; the notification that announced it is emptied of its content as soon as it is processed.
• Waiting list (device support and beta seats alike): until you unsubscribe or ask for deletion. At the latest: twelve months after the last message sent, or after sign-up if no message has been sent by then.
• Messages sent through the contact form: up to three years after the last exchange, then deleted — the usual retention period for business correspondence.

Your rights

Under the GDPR, you have the rights of access, rectification, erasure, portability and objection. A full export of your account is available at any time from the app (Preferences → Data & account), and you can delete your account yourself, from the app or from that page. You can withdraw the consent given to a connected service (Polar, Strava, Garmin Connect) at any time by disconnecting it from your preferences, or from that service itself. For any request: contact@gosleipnir.com. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Hosting, recipients and transfers

Your data is hosted by OVH SAS (2 rue Kellermann, 59100 Roubaix, France) on servers located in France. The database and every computation run there; no copy of your data is stored anywhere else.

To operate, the service occasionally sends limited data to:

• Brevo (France), which delivers the emails we send you: address verification, forgotten password, deletion confirmation, and the weekly summary if you have left it on — which contains a numeric summary of your training week.
• Open-Meteo, which provides the weather for an activity: our servers send it the activity's starting point and date, with no identifier and no information about you.
• Public mapping services (OpenStreetMap / Overpass, the French national address database and government geographic API): our servers send them coordinates, with no identifier, to name a segment, a col or a municipality.
• Expo (United States), then Apple or Google depending on your phone, which deliver the mobile app's notifications. A notification contains a short text (for example an activity title or the name of the friend who reacted) and therefore passes outside the European Union. Nothing is sent if you have not installed the app or allowed notifications, and each type of notification can be turned off in your preferences.

Finally, your browser loads some content itself, which sends your IP address to the service concerned: map backgrounds (OpenStreetMap, OpenFreeMap, OpenSnowMap) and, if you search for an address while drawing a privacy zone, OpenStreetMap's address search (Nominatim), which receives the text you type.

Cookies and local storage

The home page sets no cookie and no tracker. The app uses a single cookie, which is strictly necessary: the session cookie that keeps you signed in (unreadable by JavaScript, valid for seven days). Your access token and your display preferences are kept in your browser's local storage, or in your phone's secure storage. Team accounts additionally receive a marker that removes their own visits from the counters. No advertising cookies, no third-party audience measurement: none of this requires consent.

Visit counting

We count visits to this home page, to the col pages and to the articles, with our own means and without any third-party tool. This counting is anonymous by design: it records only a total per day, never one row per visit. There is therefore no identifier, no measurement cookie, and nothing that could recognise you from one visit to the next.

To know who reads these pages without knowing who you are, each human visit also adds 1 to a daily total for four very general pieces of information:

• the country, derived from your IP address;
• the language announced by your browser ("fr", "en"…);
• the device type (mobile, tablet or computer);
• the domain of the site you came from, if any ("google.com", for example).

This information is derived on the fly and then discarded: your IP address is neither stored nor logged — it is used only, in memory, to derive a country code, and then forgotten. The same goes for your browser, of which we keep only the device type, and for the address you came from, of which we keep only the domain name — never the full address, so never the words you typed into a search engine. We also determine whether the visit comes from a search-engine crawler, in which case none of this is recorded.

The mapping from IP address to country comes from the DB-IP IP to Country Lite database, installed on our own server: no request is sent to a third party, neither at the time of your visit nor afterwards.

Nothing therefore makes it possible to recognise you from one visit to the next, or to link these counters to an account: a daily total cannot be "broken down" into individual visits. That is also why this measurement does not ask for your consent: it serves only to know whether these pages are read, and by what kind of audience in general.