Skip to content
FR/EN
Join the beta

Privacy policy

Last updated: 21 October 2026 · Applies to the Laptic private beta, on the web and in the mobile app.

Who we are

Laptic (laptic.io) is a cycling coaching service: you connect your training data, and an algorithm built on the method of our certified coach works out your training week every week. A language model, an artificial intelligence, writes the review of your rides and the coach's answers to your questions.

The controller of your data is LAPTIC, a French société par actions simplifiée with a share capital of €1,200, being registered with the Paris trade and companies register, with its registered office at 1 rue Marguerin, 75014 Paris, France, represented by its president, Hugo Courthias. For any question about your data: [email protected].

This policy completes our terms of use, the contract that governs the use of Laptic.

AI transparency statement

Laptic uses a language model, an artificial intelligence that writes text, for:

  • the coach's word on each of your planned sessions;
  • the review of your rides;
  • the coach's answers when you write to it;
  • reading the notes you leave after a ride, to keep what matters for what comes next (pain, an illness, heavy fatigue).

The model does not choose your sessions: Laptic's engine works out your week with rules written by our certified coach. The coach may propose a change, such as moving a session or noting a day you are unavailable, and nothing changes until you accept it. What it keeps from your notes can lighten your week; you see it, correct it or erase it in Account › AI coach.

To write a text, Laptic sends the model what it needs: your sporting profile (weight, critical power, maximum heart rate, goals), your planned sessions, your rides and their measurements (power, heart rate, cadence, duration, distance, elevation), your wellness data (sleep, resting heart rate, heart rate variability, weight), your feelings and notes, and your conversation with the coach. This includes the data received from Garmin Connect and your other connected services. Nothing comes from Strava: Laptic reads no Strava data, and none of it reaches the model.

The model is an OpenAI model. Laptic calls it through OpenRouter (OpenRouter, Inc., United States) and requires, on every request, a "zero data retention" host that does not collect the data: it processes the text to write the answer, then keeps none of it. If no host meets these conditions, the request fails instead of going elsewhere. OpenRouter does not keep the content of requests, only their metadata (date, model, size, cost). Neither OpenRouter, OpenAI, the host nor Laptic trains any model on your data. These requests leave the European Union for the United States; they are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

On its side, Laptic keeps the details of each exchange with the model for 90 days to check the quality of the answers, then erases them. The texts written (reviews, answers, the coach's words) stay in your account for as long as it exists.

Nothing about you is sent to the model without your explicit consent. You give it when you accept at the end of the sign-up questions, before you choose your plan: « I accept, let's start » gives it, « Continue without the AI coach » does not, and neither is chosen in advance. You can also give it later in Account › AI coach. You withdraw it or give it again at any time in the same place, on the web and in the app; connecting a service never gives it. Without it, Laptic sends nothing about you to the model: your week is still worked out, and the features written by AI show as turned off, with a button to turn them back on.

These texts are written automatically and can be wrong. They are not medical advice. We update this statement when the law, regulations or Garmin's rules on AI change, and the date at the top of this page shows it.

Garmin Connect data

If you connect your Garmin account, Laptic receives data from Garmin Connect through Stridee, our processor, which uses Garmin's official APIs. You sign in on Garmin's own page: Laptic never asks for your Garmin password and never sees it. We receive nothing before you authorise the connection, and only the data you agreed to share on Garmin's consent screen.

We receive your activities, with the file your device recorded (power, heart rate, cadence, speed, altitude, GPS track), and your daily, sleep, heart rate variability and body composition summaries. From these summaries, Laptic uses sleep duration, resting heart rate, heart rate variability and weight. If you authorise your history, Garmin also sends us your past activities.

This data is used to import and display your rides, review them, work out your critical power and form, adapt your week and give the coach what it needs to answer you. Laptic does not modify Garmin data: it formats it for display and uses it in its calculations.

The app says what comes from Garmin. Under a ride's title, on its page, on the « Last ride » card, in search and on shared images, it names the device that recorded it: « Garmin Edge 1040 », or « Garmin » when the model is unknown. Under the title of a block computed in part from this data (a ride's review, records, power profile, season, coach) and in the header of the Statistics page, it writes « Derived in part from Garmin device-sourced data ». Recovery measured by Garmin reads « Garmin » and the night it covers. Lists that only lead to a ride, such as the calendar cards and the Statistics « Highlights », do not name the device: the ride's page does. In your data export, every file that comes from a Garmin device is flagged with its device.

Laptic is an independent controller of this data, separate from Garmin. Some of it is health data: we process it with your explicit consent, which you give by connecting Garmin and withdraw by disconnecting it or deleting its data.

Garmin data is stored securely in the European Union. We keep it for as long as your account exists, or until you delete it, whichever comes first. You can disconnect Garmin at any time, in Account › Integrations or in Garmin Connect. When you disconnect it in Laptic, you choose to keep the rides and data already received from Garmin, or to delete them. If you keep them, or if the connection is cut from Garmin Connect, nothing is erased automatically, and you can delete them later, at any time, in Account › Integrations. Deleting your account erases everything.

We do not sell your Garmin data, and we do not use or share it for advertising. Only our processors handle it, on our instructions and to run the service: Stridee, which sends it to us; hosting; Mapbox and OpenStreetMap, which receive the map area to show around a ride's GPS track, without the track itself; and the AI model if you accepted it (see the statement above). None of them uses it for its own purposes or to train a model.

For this data as for the rest, you have the right to access it, rectify it, export it, have it erased, restrict or object to its processing, and withdraw your consent at any time (see "Your rights").

Sending your sessions to Garmin Connect

From a planned session, you can send it to your Garmin Connect™ calendar and your watch or bike computer. Laptic then transfers the structured workout to Garmin, through Stridee: its name, its date, and its steps with their durations and power or heart rate targets. Nothing else about you. Garmin processes it under its own Privacy Policy for Garmin Connect.

A session is only sent when you ask. Before the first send to Garmin, Laptic shows you what will be transferred and asks for your express agreement; it keeps that agreement, and later sends go straight. A sent session then follows your week: if Laptic changes or removes it, it asks Garmin, through Stridee, to update it or remove it from your Garmin Connect calendar. What Garmin has already received, it may keep and use under its own terms: Laptic cannot erase it from Garmin's servers.

You are responsible for complying with the terms that govern this data, Garmin's and ours alike. Do not send a session if you are restricted from uploading data to your Garmin Connect™ account, and do not modify those terms if you are restricted from doing so.

Sending your rides to Strava

If you connect your Strava account in Account › Integrations, Laptic sends it the rides only Laptic has: those recorded by Laptic's indoor trainer and the files you upload yourself (.fit, .gpx, .tcx). Each ride goes a few minutes after it reaches Laptic, with its original file and the name of the planned session it follows. Rides received from your other services through Stridee are not sent, nor those that arrived before you connected. No text written by AI is sent.

Laptic asks Strava only for the right to upload activities. It reads nothing from your Strava account, neither your activities nor your profile, and no Strava data goes to the AI model. Laptic keeps only your Strava account's identifier, the access tokens Strava gives it, encrypted, and the list of rides sent, with the identifier of the activity created on Strava and the state of the upload. The name, photo and city Strava returns when you connect are discarded at once.

Strava, Inc., or Strava Ireland Limited in the European Economic Area, receives the rides sent and processes them as an independent controller, under its own privacy policy. Strava may also collect and use, for its own purposes, data about Laptic's use of its API ("Usage Data").

You can disconnect Strava at any time in Account › Integrations, or by removing Laptic in Strava's settings, under My Apps. Laptic then erases everything it kept from Strava, the link and the list of rides sent: immediately, and within 30 days at most. Disconnecting from Laptic shows the confirmation of the erasure on screen. Rides already sent stay on your Strava account, where you delete them yourself. Deleting your Laptic account also erases what Laptic kept from Strava.

The data we collect

  • Account: your e-mail address and first name. You sign in with a one-time code sent by e-mail, or with Apple or Google, which then share your name and e-mail address with us. There is no password. We also keep the date you accepted the terms of use and this policy, and the date of your consent for the AI coach.
  • Training data, imported with your authorisation from the services you connect (Garmin, COROS, Polar, Wahoo, Suunto and Hammerhead, through Stridee) or from the files you upload yourself (.fit, .gpx, .tcx): activities and their sensor recordings (power, heart rate, cadence, speed, altitude, GPS track), and wellness data where it exists (sleep, resting heart rate, heart rate variability, weight). For Garmin, the details are in "Garmin Connect data".
  • What you tell us: sporting profile (date of birth, sex, weight, critical power or FTP, maximum heart rate, experience), goals and events, availability, post-ride feelings, days off sick, on holiday or at a training camp, messages exchanged with the coach.
  • Subscription: the state of your subscription. Payment is handled by Stripe on the web and by the App Store or Google Play on mobile; we never see your card number.
  • Reports sent to support, with their technical context (screen, version, browser, language) and any screenshot you attach.
  • Technical data: IP address and browser of your sessions, your phone's notification token if you allow notifications, and the logs and error reports needed to run and secure the service.

Some of this data concerns your health: heart rate, sleep, illness, fatigue, and pain or injuries you mention to the coach, which remembers them to adapt your training. If a message suggests you may be in danger, the team receives an alert stating the kind of risk, never the content of the conversation.

A value your devices did not measure is never invented or estimated behind your back.

What we do with it, and on what basis

  • Run the coaching, to perform our contract with you: write your training week, review your rides, have the coach answer you, send your sessions to your calendar or bike computer when you ask, send your rides to Strava if you connected it, manage your subscription. You accept the terms of use and this policy at the end of the sign-up questions.
  • Process your health data, with your explicit consent, given by connecting your services and entering this information. You withdraw it at any time by disconnecting a service, deleting the data it sent, deleting an entry or deleting your account.
  • Entrust your data to the AI model, with your explicit consent, which you give at sign-up or in Account › AI coach and withdraw there (see the AI transparency statement).
  • Measure usage and fix errors, on the basis of our legitimate interest in improving the service.
  • Meet our legal obligations, accounting ones in particular.

Your data is never sold or used for advertising, and Laptic does not use it to train AI models.

Our processors

Only the processors the service needs receive your data, each for its sole role:

  • hosting of the service and its database on servers located in the European Union;
  • Resend, for e-mails (sign-in codes, notifications);
  • OpenRouter, and the zero data retention host of the OpenAI model it picks, for AI-written texts, if you accepted them;
  • Better Auth, for sign-in security (abuse detection from IP address and browser);
  • Stripe, for payment on the web; Apple, Google and RevenueCat, for subscriptions on mobile;
  • PostHog (servers in Frankfurt), for usage analytics; Sentry (servers in Germany), for error reports;
  • Stridee, to receive the data of the services you connect (Garmin, COROS, Polar, Wahoo, Suunto, Hammerhead) and send them the sessions you choose. Stridee holds the access to these services on our behalf;
  • Mapbox and OpenStreetMap, for the maps of your rides: they receive your IP address and the map area shown, computed from the ride's GPS track. The track itself is drawn on your device and is not sent to them;
  • Expo, to register your phone for notifications;
  • Strava, Inc., or Strava Ireland Limited in the European Economic Area, if you connect Strava: it receives the rides Laptic sends there for you and processes them as an independent controller, not as our processor (see "Sending your rides to Strava").

Some processors are based in the United States. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses.

Security

Every connection between your device, Laptic and our processors is encrypted (HTTPS). The data Stridee sends us arrives signed and encrypted, and Laptic checks the signature before reading it. Laptic keeps no credential or access token for your Garmin account or your other services: Stridee holds them. Only Strava's tokens, which allow nothing but uploading rides, are kept by Laptic, encrypted. Our servers and database are in the European Union, and only the Laptic team can access them, each with their own account. Every change made from our admin console is recorded before it is attempted. If a data breach puts you at risk, we report it to the CNIL within 72 hours and tell you without delay. When data received from Garmin is involved, we also tell Garmin within 24 hours.

Analytics and errors

We measure how Laptic is used with PostHog: pages and screens viewed, and a few key steps (sign-up, connecting a service, messaging the coach, subscribing). These measurements are tied to an internal identifier, never to your e-mail address, contain no health data and are not stored in a cookie. On laptic.io, an analytics cookie recognises you from one visit to the next, without your name or e-mail address: the pages viewed, the site or link you came from, your country and city (worked out from your IP address, which is not kept), and the beta sign-up. Error reports sent to Sentry are stripped of your identity, e-mail addresses and content before they leave. You can object to this measurement by writing to us.

Cookies

laptic.io, the site you are reading, sets a single cookie, PostHog's, for analytics (one year), and remembers your language in your browser. The web app sets a session cookie to keep you signed in (180 days, extended on each visit) and preference cookies (theme, language, layout). No advertising cookies.

The beta waitlist

On laptic.io you can leave your e-mail address to request a spot in the private beta. That address serves one purpose: writing to you when a spot opens. It is not subscribed to any newsletter, never shared, and kept until Laptic launches publicly, or deleted earlier on a simple request by e-mail. The page's language at the time of sending is stored with it, so we can write to you in yours.

The contact form

The "Write to us" form sends your message, your e-mail address, your name if you give it and the chosen topic to the [email protected] inbox, so we can answer you. Nothing is stored in our database. To keep robots out, your browser solves a small computation before sending: no cookie, no third-party service.

The WhatsApp community

On laptic.io you can also ask to join the Laptic community on WhatsApp. Your e-mail address and the page's language are then used to send you the invitation link, and deleted on a simple request by e-mail or with your account. The community itself is hosted by WhatsApp (Meta): by joining it, you accept its terms, and other members may see your phone number.

Retention

Your data is kept for as long as your account exists, except what you delete earlier: an entry you erase, or the data received from a service that you choose to delete. When you disconnect Garmin, you choose to keep or delete the data received from it, and you can delete what you kept at any time afterwards. What Laptic keeps from Strava is retained for as long as Strava stays connected. The details of exchanges with the AI model are erased after 90 days. Deleting your account erases all your data, including what Garmin sent: we keep only a record of the deletion (your e-mail address and its date) to prove it took place, and accounting records for ten years, as the law requires.

Delete, export, disconnect

From your account, at any time, you can:

  • disconnect a linked service, Garmin included, and choose at that moment: keep the rides already received, or delete everything that service sent (the rides and their recordings, your notes on these rides and their reviews, the wellness data). A ride you also imported another way keeps that other copy;
  • delete later the data received from a service that is no longer connected, whether you kept it when disconnecting or the connection was cut on its side (from Garmin Connect, for example);
  • disconnect Strava: we erase the link and the list of rides sent, and confirm it on screen;
  • export your data from the web: an archive with your data and the original files of your rides, where those that come from a Garmin device are flagged;
  • delete your account, on the web or in the app: deletion is immediate and final, erases all your data, including what Garmin sent, and extends to your data held by our processors (Stripe, RevenueCat, Stridee, PostHog).

Your rights

Under the GDPR you have the rights of access, rectification, erasure, portability (exporting your data), restriction and objection, and the right to withdraw your consent at any time, as easily as you gave it. These rights cover all your data, including the data received from Garmin. Write to [email protected]; we answer within one month. You may also lodge a complaint with the French supervisory authority, the CNIL (cnil.fr).

Changes to this policy

This policy will evolve with the product (new connected services, the end of the beta). Any substantial change will be announced in the app, and the update date appears at the top of this page.