Privacy Policy

FORMAI (desktop and mobile) · in force since 24 July 2026 · updated 26 September 2026 · Slovenian original

⚕️ Important: FORMAI provides coaching and nutrition guidance, not medical advice. Calorie and training-load figures are estimates. Before making significant changes to your training or diet, consult a doctor — especially if you have a health condition.

This is an English translation of the Slovenian privacy policy published at formai.si/zasebnost.html. In case of any discrepancy, the Slovenian version prevails.

What data we process

Account (if you sign in): the name, email address and photo of your Google account.
Profile: name (if you enter it), age, sex, height, weight, heart rate, FTP, goals and races.
Activities: rides and workouts (distance, duration, elevation, heart rate, power, GPS track) — entered manually, imported, or read from screenshots.
Nutrition: meal entries, photographs of food and meal descriptions (typed or dictated) that you submit for analysis.
Wellbeing: the morning check-in you fill in yourself (sleep, soreness, energy and, optionally, weight, waist and a note) and — only if you turn it on — sleep, HRV and resting heart rate from your watch via intervals.icu.
Place for the weather (optional): a place you type in, or your device location rounded to about 1 km.
Your conversation with the coach and AI output (reviews, meal plan), so you can see them later.

Legal basis

Consent (Art. 6(1)(a) GDPR); for health-related data — weight, heart rate, sleep and HRV, health notes — explicit consent (Art. 9(2)(a) GDPR). You can withdraw consent at any time (see “Your rights”); withdrawal does not affect the lawfulness of processing before it.
Performance of the service you use (Art. 6(1)(b) GDPR): storing and synchronising your data, building your training plan and nutrition targets.

Where your data is held

Locally by default: all data is stored in your browser (IndexedDB) on your own device. Until you sign in, it stays there; the services under “Other services” receive only what is listed for them.
Synchronisation when signed in: when you sign in with a Google account, your data is automatically stored in your account in Google Firebase (Firestore) as well, so it is available on all your devices. There is no separate switch — synchronisation applies for as long as you are signed in. GPS tracks, meal photos, and sleep, HRV and resting heart rate from your watch are not uploaded to the cloud. For sign-in, Firebase Authentication receives the name, email address and photo of your Google account.
AI (coach, reviews, meal analysis): works only when you are signed in and have allowed AI processing. When you use an AI feature, we send: the numbers from your profile (age, sex, height, weight, FTP, heart rate, goals and races), a summary of your training, plan and nutrition, your morning check-in (sleep, energy, soreness and your note, if you wrote one), the text of your question or conversation, and meal photos and descriptions you submit for analysis. We do not send your name, email address, exact location or GPS tracks, activities from Strava, or sleep, HRV and resting heart rate from your watch.
This data is processed by the Google Gemini API as our contractual processor. We use the paid tier, under which Google does not use the content to train its models; it is used only to produce the response returned to you (Google may keep it for a limited time solely to detect abuse). Requests run through our own server (Google Cloud Run, europe-west1); the API key is never exposed in the browser. Our server does not store the content — it records only the number of AI actions per day (for the daily limit) and a short entry per request without content (time, model, success, token counts). Google does not guarantee the region in which it processes the content for this service.
Sleep, HRV and resting heart rate from your watch stay only on the device where you turned them on: they are not uploaded to the cloud and never sent to AI. The switch applies to each device separately; when you turn it off, this data is deleted from the device immediately.
Transfers outside the EU: Google may process data outside the EU/EEA as well; such transfers are covered by Google’s data processing terms with the EU standard contractual clauses.
We do not sell your data and do not share it with third parties for advertising.

Other services

Your browser calls these services directly, so each request also reveals your IP address to them.

Open-Meteo (weather forecast, only if you set a place): approximate coordinates of the place — the app rounds them to about 1 km, and a request is never more precise than about 100 m — and, if you search for the place by name, the name you typed.
Meal dictation (microphone button): speech is turned into text by your browser's or phone's speech recognition (e.g. Google in Chrome, Apple in Safari). FORMAI never receives audio — only the text you see and submit for analysis.
BRouter (brouter.de, generating new routes): the start point (where your rides usually begin, rounded to about 100 m), a few waypoints of the new route (e.g. the foot of a climb you already ride) and the road-bike settings. Your full ride tracks are never sent.
OpenStreetMap (map tiles): when you open a map, your browser downloads tiles from OpenStreetMap servers, which thereby see the area shown.
GitHub Pages (hosting of formai.si) and Google Cloud Run (our server) record the IP address and time of each request in their server logs.
Fonts are served from formai.si — your browser does not call Google Fonts or any other external font service.

Connected services (intervals.icu, Garmin, Strava)

If you connect an external service yourself, we import only what the training features need, and only for as long as the connection is enabled.

intervals.icu: when you connect (sign in with intervals.icu or a personal API key) we read your completed activities (duration, distance, elevation gain, heart rate, power, zones, device, GPS track), your FTP and zones and — only if you separately turn it on — sleep, HRV and resting heart rate. We write planned workouts from FORMAI to your intervals.icu calendar so they reach your watch. The access token or key is stored in the app data on your device and, while you are signed in, in your account (synchronisation); it is used only to read your data and write workouts. With sign-in via intervals.icu, our server exchanges the authorisation code for the token and does not store the token. You can disconnect at any time in Settings or in your intervals.icu settings.
Garmin: data from Garmin devices reaches FORMAI via intervals.icu or from files you import yourself. We use it exclusively to display your progress, compute training load, and adapt your training plan. Garmin data is never sold, never shared with third parties, and never used for advertising or profiling. You can delete imported activities at any time together with the rest of your data.
Strava: FORMAI is no longer connected to Strava directly. Activities that originate from Strava and arrive via intervals.icu are shown in the app but are never sent to AI — for those we use only computation on your device, and their GPS tracks are not stored. Any access tokens left from the former direct Strava connection are stored only on our server and are deleted when you delete your account.

Weekly question (test programme)

After your first week, the app asks at most one question per week (answer A–D). You can skip the question or turn the questions off (“don’t ask again”).
If you answer, we send our server only: the question ID, your answer, a random identifier instead of your name or email, the invite code (if you came via a link with a code), the number of days you have used the app, and the app version. No training, nutrition or wellbeing data is sent.
The random identifier is stored in your settings, which are synchronised when you sign in, so the answers are pseudonymous, not anonymous.
Only the developer sees the answers, and uses them solely to improve FORMAI.

How long we keep data

On your device: until you delete it.
In the cloud (synchronised data, AI counters and request entries, Pro status, weekly-question answers): until you delete your account.
Server logs (Google Cloud Run, GitHub Pages): for as long as Google’s or GitHub’s default rules provide.

Your rights (GDPR)

Export: Settings → “Izvozi vse” (Export all) downloads all of your data at any time (a JSON file).
Deletion: Settings → “Izbriši račun” (Delete account) deletes your account and all cloud data — synchronised data, AI counters and request entries, Pro status, weekly-question answers and any old Strava tokens; the deletion is carried out by our server. “Izbriši na napravi” (Delete on this device) clears the data on the device. You can also write to us — we delete the data within 30 days.
Access and correction: all of your data is visible and editable directly in the app.
Withdrawing consent: turn off AI processing in Settings (“AI obdelava”), and sleep, HRV and resting heart rate from your watch with the switch next to the intervals.icu connection; you can also delete your data or account.
You also have the right to restriction of processing and to object, and the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (ip-rs.si).

Terms of use (summary)

You use the application at your own responsibility; AI output is informational in nature.
FORMAI is in free early access; free use includes up to 10 AI actions per day. There is currently no paid plan.
We may update or change the service; we will notify you in the app about material changes.

Full terms: Terms of use (Slovenščina).

Contact

Data controller: Blaž Gregorc, a private individual, Slovenia.

Questions, data export or deletion: blaz.gregorc@formai.si.