1. Introduction

MONS Athletics (operated by Nico Nyberg, “we,” “us,” or “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your information when you use the MONS Athletics mobile application (“App”), its Apple Watch companion app, our website at monsathletics.com (“Site”), and related services.

By using our App or Site, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Information You Provide Directly

When you use MONS Athletics, we collect information you provide to us, including:

Account Information: Name and email address (via Sign in with Apple). Apple allows you to hide your email address, in which case we receive a private relay email.
Apple User ID: A unique identifier provided by Apple to authenticate your account.
Training Profile: Your date of birth, how you want to build your endurance, which kettlebells you own, your usual rest days and long day, your timezone, and each morning's check-in (how much time you have, what you can do today, and anything you choose to write about your day).
Starting on the Site: If you sign in with Apple at the end of the challenge finder on the Site, the answers you give there (how you want to build your endurance, which kettlebells you have, and your date of birth) are saved to your account as your training profile, and the route you planned there is saved as your first challenge. It is the same account you use in the App. Signing in on the Site is optional.
Seeing Where You Stand on the Site: If you sign in with Apple on the challenges page, we read which challenges you have done, which you are ready for and when you are likely ready for your next one, and show them on that page. Your browser keeps you signed in, so the page shows them each time you come back, until you tap Sign out. Signing in with an Apple ID that has no MONS account creates the sign-in record for one, but no training profile.
AI Assistants: If you connect your MONS account to an AI assistant such as Claude or ChatGPT, you sign in with Apple and choose to allow it. The assistant can then set up your account, read your training, schedule, challenges and profile, change them when you ask, and pass messages between you and your AI coach. Once the assistant has it, that company's own privacy policy covers it (section 5.1). You can disconnect it at any time in the assistant's settings.
Subscription: Whether you have a trial or subscription in the App, as Apple reports it to us: the plan, the trial, the renewal or expiry date, auto-renewal, and any refund. We do not receive your payment details.
Challenges: The challenges you pick or add, with their date, distance and route.
Chat Messages: Conversations with your AI coach, including questions, workout feedback, pain or illness reports, and schedule change requests.
What Is Bothering You: When you tell your coach, or add it in Profile, about an injury or a niggle, such as “plantar fasciitis, left foot”, we keep a short note of it in your words, with the date. Your training works around it. When you tell the coach it has gone, your training stops working around it; the note stays on your account, marked as gone, until you delete your account.
Who You Are: A short paragraph about you that your coach keeps from your chats, so every part of your coaching knows you. You can read it in Profile and write it yourself; when you do, we also keep your words as you wrote them, so the coach keeps them when it adds to the paragraph later.
How You Train: The coach also keeps simple counts of how you train, such as which days you tend to skip, so it can plan around them. These are numbers, never guesses about why.
Training Data: Workout completions, skip reasons, rate of perceived exertion (RPE), running metrics (distance, pace, duration), the duration of sessions completed on the phone, heart rate zone data from Apple Watch sessions, and post-workout ratings.

2.2 Apple Health Data (HealthKit)

With your permission, the App reads health and fitness data from Apple HealthKit to personalise your training plan and monitor recovery. Each day the App sends us last night's average heart rate variability, your resting heart rate, how long you slept and when, and yesterday's steps. For each workout it sends distance, duration, heart rate and, for rides, power and climbing. We don't upload every single reading or your GPS track.

iPhone App (read, and write for sessions completed on the phone):

Heart Rate Variability (HRV SDNN): Overnight recovery monitoring and training load calculation. Delivered in the background at hourly frequency.
Resting Heart Rate: Detects elevated stress or fatigue. Delivered in the background at hourly frequency.
VO2 Max: Fitness baseline at onboarding.
Running Form Metrics: Stride length, vertical oscillation, ground contact time, and running speed. Used for gait analysis and adaptation targets.
Step Count: Activity context for load calculations.
Sleep Analysis: Sleep duration, bed time, wake time, and sleep stages. Used for recovery scoring.
Workout History: Once, when you sign up, the App sends the day, sport and duration of each run, ride and swim from the last twelve weeks, and the distance and day of your furthest run, ride and swim in those weeks. We use them to tell you how close you are to a challenge and which challenges you have already done. If Apple Health has no runs, rides or swims for a sport you train, the App asks you a few questions instead (your longest session, your weekly time, how often you go, and whether you did a long one recently), and we keep your answers as an estimate of those weeks for the same purpose.
Workout routes: For an outdoor run, ride, or open-water swim, the phone reads the GPS track already stored in Apple Health so the workout card can draw the route. That track stays on your device.
Heart Rate: Used for max HR detection at onboarding.
Date of Birth: Age-based heart rate zone calculation.
Writes: When you complete a kettlebell, hill-sprint, or yoga session on the phone, saves it to Apple Health as a workout with its start and end time only, without heart rate or energy. The App asks for this permission the first time.

Apple Watch App (read and write):

Reads: Heart rate (live HR zone feedback during all workout types), distance for runs, rides and swims, active energy, swim strokes, running form and power, and cycling power.
Writes: Saves runs, rides, swims, strength and mobility workouts to Apple Health, with their route, running form and power, so they appear in your Activity rings and Health app history.

2.3 Automatically Collected Information

When you use the App, we automatically collect:

Device Information: Device type, operating system version, the screen you were on and recent app errors. Sent with support messages only.
App Version: Sent with API requests to ensure compatibility.
Crash Data: Crash reports, stack traces, and screenshots at the time of a crash. Collected by Sentry and not linked to your identity.
Performance Data: Performance traces sampled from 20% of app sessions. Collected by Sentry and not linked to your identity.

2.4 Location and weather

Outdoor sessions record a completed GPS route into Apple Health on the Watch. The phone reads that route on your device to draw the map on the workout card. That completed workout track is never uploaded to our servers.

When you open the Adventure route builder, the iPhone asks for location permission so it can place the start at your current location. You can deny permission and choose a start on the map instead. While you build a route, the map on screen comes from Mapbox, which receives the area it shows. Our own server plans the route. For that it asks OpenStreetMap's public map database (Overpass) for the roads in the area; that request names the area, not you. When you save an Adventure, we store its selected start and destination, planned route geometry including any turning points, distance, and activity type with your account.

To show the weather on a completed workout card, the phone sends the starting point of the Apple Health route and the session time to Apple Weather. Apple Weather returns the temperature and the sky. We do not store that weather-lookup coordinate or attach it to your account. Indoor sessions send nothing.

2.5 Information We Do NOT Collect

We do not store completed workout GPS tracks on our servers. A saved Adventure stores its planned route geometry as described above.
We do not collect advertising identifiers (IDFA or IDFV)
We do not access your contacts, photos, camera, or microphone
We do not collect payment information directly (handled by Apple)
We do not track you across other apps or websites

3. This Website

Sections 1 and 2 describe the App. This section describes monsathletics.com, which anyone can read without an account.

3.1 Analytics and Cookies

We use Google Analytics to count visits and see which pages people read. It sets cookies in your browser to do that.

Google Analytics does not load until you allow it. The first time you visit, a bar at the bottom of the page asks. Nothing is loaded and no cookie is set until you choose “Allow”. If you choose “No thanks”, the script is never fetched, and any analytics cookie already stored from a previous visit is deleted.

Your choice is remembered in your browser’s local storage, undermons-analytics-consent-v1. That is not a cookie and is never sent to us or to anyone else — it exists so we do not ask you again.

You can change your mind at any time, from this page. If you switch from allow to decline, Google Analytics stops sending for you and we delete the cookies it set. If the script had already loaded in the page you are on it stays loaded, switched off, until you next load a page — after which it is not fetched at all.

Google Analytics is operated by Google Ireland Limited. What it collects, when allowed, is described in Google’s privacy policy.

Separately, our own server counts page views without any cookie. It keeps only a daily total for each page and where visitors came from (for example Instagram or Google), and how many sign-ins and signed-in page views each page had that day. Nothing it keeps identifies you, your device or your IP address, and it stores nothing on your device.

We also use Sentry on the Site to catch errors. When a page breaks, it sends us a technical report and a replay of the page with all text and typing hidden. It sets no advertising cookies and is not used to track you.

3.2 The Contact Form

The form on our support page sends us the email address and message you type, and your name if you give one. We store it so we can reply, and we email ourselves a copy. We do not use it for anything else and we do not add you to a mailing list.

3.3 Routes by Email

If the challenge finder cannot draw your route because of a problem on our side, you can leave your email address. We keep it only until we send you one email about that route: the route, or a note that we could not draw it. That is within a day, and never more than two. Then we delete it. We do not use it for anything else.

3.4 Server Logs

The Site and the server the App talks to run on our own server at Hetzner in Helsinki, Finland. Requests to monsathletics.com pass through Cloudflare first, which protects the Site from attacks and abuse. Both see your IP address on every request.

Our server keeps a log of each request to the Site: the time, your IP address, the page or address asked for, your browser type and the response. We use it for security and to spot errors. The log has a fixed size, so the oldest entries are deleted as new ones arrive. The server also keeps its own error log, which can include your MONS account ID, and deletes it as it ages. Cloudflare keeps its own logs under its own policy. We do not use any of these logs to build a profile of you.

3.5 The Challenge Finder

The challenge finder works without an account. If you type a town, our server sends what you typed to Photon, run by Komoot, to find it on the map, and to Nominatim, run by the OpenStreetMap Foundation, if Photon cannot. They see the text, not you. We keep a rough start point (to about 300 m), the route and a scrambled form of your IP address that changes every day, for 30 days. The picture of your route is drawn by our own server from OpenStreetMap data. The map you can move around on the page loads its images from OpenStreetMap's tile servers, which see your IP address.

3.6 MONS by Email

At the end of a chapter you can ask for the MONS method by email, in a few short emails, then a short note when a new chapter of the book is published. We store the address you type, the page you asked from, what the form said and when you agreed. We send one email to confirm, and nothing else goes to an address until you tap its link. An address that is never confirmed is deleted within a week. We record which of the emails we have sent you, so none is sent twice. Every email has a link to leave, and leaving deletes your address and that record. We only count that someone left, with the time and nothing that names you. We use the address for nothing else and never share it, except with Resend, which delivers the emails.

4. How We Use Your Information

We use your information for the following purposes:

Provide Training Services: Generate personalised endurance training plans using AI based on your profile, health data, and progress.
Adapt Your Training: Use HealthKit recovery data (HRV, resting heart rate, sleep), workout completions, and your chat conversations to adjust future training in real time.
Plan Adventures: Use your selected start, destination, route geometry including any turning points, distance, and activity type to calculate, display, and save a planned outdoor route.
AI Coaching: Process your chat messages, training context, and health state to provide personalised coaching responses.
Account Management: Create and maintain your account and authenticate your identity.
Improve Services: Analyse aggregated, anonymised data to improve our training algorithms and App features.
Diagnose Issues: Use crash and performance data to identify and fix bugs.
Security: Detect and prevent fraud, abuse, and security issues.
Legal Compliance: Comply with applicable laws, regulations, and legal processes.

5. How We Share Your Information

5.1 Third-Party Service Providers

We share your information with the following third-party services that help us operate:

Hetzner: Hosts our server in Helsinki, Finland, which runs the Site and the App's server and plans Adventure routes. Everything the App and the Site send us passes through it. To plan a route and draw its picture, our server may download the roads for that area from OpenStreetMap; that request names the area, not you. Hetzner Privacy Policy
Cloudflare: Sits in front of monsathletics.com to protect it from attacks and abuse. It sees each request to the Site, including your IP address. Cloudflare Privacy Policy
Supabase: Database and authentication infrastructure. Stores your account data, training plans, workout history, chat messages, and health readings. Data is stored in secure, encrypted databases with row-level security policies. Supabase Privacy Policy
Anthropic (Claude AI): AI service that generates your personalised training plans, daily workout prescriptions, and coaching chat responses. Your training profile, progress data, health state, and chat messages are sent to Anthropic's API to generate responses. Anthropic does not use your data to train its models. Anthropic Privacy Policy
Sentry: Error tracking and performance monitoring. Collects crash reports and performance traces to help us identify and fix bugs. This data is not linked to your identity. Sentry Privacy Policy
Resend: Email delivery for support messages, the route emails and the MONS emails you ask for, and our own internal alerts, which never include your name or email. Resend Privacy Policy
Apple: Sign in with Apple for authentication, In-App Purchases for subscription payments, and Apple Weather (WeatherKit) for the temperature and sky on an outdoor workout card. The weather lookup receives the start of that session's route and the session time; it does not receive your account. Apple Privacy Policy
Mapbox: The map in the App only. Mapbox receives the area the map shows, not your MONS account identity. Its map may also send Mapbox anonymous usage data, including your location while a map is on screen. Our server sends Mapbox nothing. Mapbox Privacy Policy
OpenStreetMap services (Overpass, Photon, Nominatim): Public map services our server asks, through our own route service. Overpass receives only whole map squares, roughly 10 to 20 km across, around a route or where you train, so our server can keep its own copy of the roads there; that copy is what plans your route. Photon (run by Komoot) and Nominatim (run by the OpenStreetMap Foundation) receive a town or address typed into the challenge finder. What our server sends them carries neither your MONS account identity nor your IP address. The map on a challenge finder page is different: your browser loads its images straight from OpenStreetMap's tile servers, which see your IP address. Komoot Privacy Policy · OSMF Privacy Policy
AI support assistant (Anthropic Claude): Helps us answer your support requests. It can read the MONS database, including your account, training history, chat messages and health readings. We do not use it to change your data, and Anthropic does not use it to train its models. Anthropic Privacy Policy
AI assistants you connect (Claude, ChatGPT): Only when you connect your MONS account to one and allow it. It receives what you ask it for: your training, schedule, challenges and profile (including your date of birth), and your AI coach's replies, which can mention your sleep, heart rate and recent training. Its provider's own privacy policy covers it from there. Anthropic Privacy Policy · OpenAI Privacy Policy

5.2 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We will never sell your training data or health information.

5.3 Legal Requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities.

6. Data Security

We take data security seriously and implement industry-standard measures to protect your information:

Encryption in Transit: All data transmitted between the App and our servers uses HTTPS/TLS encryption.
Encryption at Rest: Your data is stored in encrypted databases.
Authentication: We use secure JWT (JSON Web Token) authentication verified on every API request.
Row-Level Security: Database policies ensure you can only access your own data.
Access Controls: Access to user data is limited to the founder and the AI support assistants named in section 5.1, only when necessary for support.

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

7. Data Retention and Deletion

7.1 How Long We Keep Your Data

Active Accounts: We retain your data for as long as your account is active.
Deleted Accounts: When you delete your account, we delete your training, plans, chats, health readings and profile straight away. Your sign-in record and a few records linked to it are deleted within 30 days. We keep a record of your App Store subscription, because Apple keeps billing it until you cancel it in your Apple settings.
Sign-Ins Without an Account: If you sign in with Apple on our website or through an AI assistant and never set up a MONS account, we delete that sign-in record once it has gone unused for a week.
Backup Data: We back up the database every night to our own server in Finland. Backups are encrypted and kept for up to a year, then deleted. If we ever restore one, we delete again any account that had been deleted.
Legal Retention: We may retain certain information if required by law.

7.2 How to Delete Your Account

You can delete your account at any time directly in the App:

Open the MONS Athletics app
Go to Settings
Tap “Delete Account”
Confirm deletion

This action is permanent and cannot be undone. Your data is deleted as described in section 7.1.

8. Your Privacy Rights

8.1 European Users (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, you have the following rights:

Right to Access: Request a copy of your personal data.
Right to Rectification: Request correction of inaccurate data.
Right to Erasure: Request deletion of your data (via Delete Account feature).
Right to Data Portability: Request your data in a portable format.
Right to Object: Object to processing of your data.
Right to Restrict Processing: Request restriction of processing.
Right to Withdraw Consent: Withdraw consent at any time.

To exercise these rights, contact us through our support page or email hello@monsathletics.com.

8.2 Legal Basis for Processing (GDPR)

We process your personal data based on:

Contract Performance: Processing necessary to provide the training services you requested.
Legitimate Interests: Improving our services, preventing fraud, and ensuring security.
Consent: Where you have given explicit consent (e.g., HealthKit access, email communications).

We use your health data (Apple Health readings, injuries, illnesses and what you tell the coach about your body) only with your explicit consent. You give it when you allow Apple Health access and when you tell the coach. You can withdraw it at any time by turning off Health access or deleting your account.

9. Children's Privacy

MONS is for people aged 16 and older. We do not knowingly collect data from anyone under 16. If you believe a child under 16 has an account, contact us and we will delete it.

10. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States and European Union. Our server is in Finland and our database is in Sweden, both in the European Union. Some of the providers in section 5, such as Anthropic, process data in the United States. We ensure that appropriate safeguards are in place to protect your data in accordance with this Privacy Policy and applicable law, including GDPR requirements for EU users.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will update the date at the top, and tell you in the App or by email when a change is significant.

Your continued use of the App after changes are posted constitutes your acceptance of the revised policy.

12. Health and Medical Disclaimer

Important: MONS Athletics provides fitness training recommendations and is not a substitute for professional medical advice. Our AI-generated training plans and coaching responses are for informational and educational purposes only.

Always consult your physician before beginning any exercise program, especially if you:

Have any pre-existing health conditions
Are taking medication
Have a history of heart problems
Experience chest pain, dizziness, or shortness of breath during exercise
Are pregnant or recently gave birth
Have not exercised regularly in the past year

If you experience pain, discomfort, or any unusual symptoms during training, stop immediately and seek medical attention.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Nico Nyberg
Operating as: MONS Athletics
Contact: Support Page
Address: Koukkuniementie 6 L, 02230 Espoo, Uusimaa, Finland

14. Supervisory Authority

If you are located in the EEA or UK and have concerns about our data practices, you have the right to lodge a complaint with your local data protection authority:

Finland: Office of the Data Protection Ombudsman (tietosuoja.fi)

Book

Workouts

Privacy Policy