Privacy.

What we collect, why, how long we keep it, and what you can do about it.

Last updated · 27 October 2026

Who is responsible?

The data controller is the operator listed in the imprint. For any data-related question: contact@kimbia.app.

What data do we collect?

Four families of data:

Account: Your atproto handle (your public identifier as a domain, e.g. alice.bsky.social) and DID (the protocol's stable identifier). We never store passwords: authentication is handled entirely by the protocol. If you give us one, your email address is used to verify your account and send you service messages.
Training data: Activities, plans, sessions, metrics (heart rate, pace, distance, duration, sleep, HRV, etc.) that you import via Garmin, Suunto, Polar, Wahoo, Strava and similar services, or enter manually. This includes activity files (FIT/GPX/TCX) and their metadata.
Messages: Your conversations with your coaches, your athletes or Kimbia Support, and the feedback you send. In the app, only the members of a conversation read it; the Kimbia team reads support threads, never your other conversations. Each piece of feedback is also filed in our private issue tracker on GitHub and emailed to the team, with your handle, DID, name and the page you were on; those copies are deleted on request. Messages are stored on our EU servers and are not end-to-end encrypted. Deleting your account deletes the conversations you started and your locker rooms, for everyone in them, and every message you wrote elsewhere.
Technical data: Minimal server logs (IP address, user-agent, request timestamps) retained for security and abuse prevention. If you accept analytics, PostHog also records product-usage events (pages viewed, features used) and error diagnostics - see the Cookies section below.

Why?

To deliver the service you use: showing your activities, computing your zones, comparing planned vs. actual, letting you export your data. Legal basis: performance of the contract (GDPR art. 6.1.b) and legitimate interest for security (art. 6.1.f). Heart rate, HRV, sleep and pace are special-category data under art. 9 GDPR; we process them on your explicit consent (art. 9.2.a), which you give by connecting a service or importing a file, and withdraw by disconnecting that service or deleting the data.

Where is data stored?

On Hetzner servers located in Germany (European Union): that is where your account and your training data live. The few peripheral tools not hosted in the EU are covered by the European Commission's Standard Contractual Clauses (GDPR art. 46).

Sources and processors

We never sell your data and we share it with no ad network. Two roles to tell apart. Sources - Garmin, Suunto, Polar, Wahoo, Strava and similar services - do not work for us: you trigger the import, each stays a controller on its own side under its own terms, and once the data arrives Kimbia is a separate controller for it. Processors, on the other hand, handle data on our behalf:

Hetzner Online GmbH (Germany) - data hosting
Service emails and push notifications - only what it takes to reach you
PostHog (EU region) for product analytics and error monitoring - only if you accept analytics in the consent banner, and revocable at any time
GitHub (United States) - our private issue tracker, which receives the feedback you send
Open-Meteo - weather lookup: receives only an activity's start point and time, with no identity, and stores nothing
atproto - decentralised identity protocol for your account

The current, named list of these providers is available on request at contact@kimbia.app.

AI assistants

Opt-in only. You can connect an AI assistant of your choice (Claude or another MCP client) to your journal: you grant access on a consent screen, it reads your data on your behalf, and you revoke it at any time in Settings → AI. Kimbia never uses your data, including what comes from Garmin or any other source, to train, evaluate or improve AI models.

How long do we keep your data?

As long as your account exists. You can export all of your data at any time in open formats. When you delete your account, your data is removed within 30 days, except for security logs (90 days maximum), the GitHub and email copies of your feedback (deleted on request), and any retention required by law.

Your rights (GDPR)

You can access your data, rectify it, delete it, export it (portability), restrict or object to processing, and withdraw your consent at any time. A full export is self-service in your settings. You can also lodge a complaint with a data-protection authority: the one in your country of residence, or ours in Austria (Datenschutzbehörde, dsb.gv.at).

Cookies and local storage

No advertising cookies, no third-party pixels. Only what's strictly needed, with no consent required: the signed cookies of your atproto session (did and scope, 180 days), your language preference (cleared when you close the browser), a few ten-minute technical cookies during an OAuth flow or a coach invitation, and, when a link brought you here, who sent you (kimbia_via, 30 days, cleared at sign-in).

On your device, in local storage and never sent to our servers: your analytics choice and its date, plus display preferences (collapsed panels, app-install and notification reminders).

Usage measurement runs in anonymous mode by default: PostHog (hosted in the EU, and called through our own domain - no request leaves for a third-party domain) records pages viewed and features used, with a first-party cookie lasting one year to recognise your session. Nothing is tied to your handle, DID or name. Legal basis: legitimate interest, within the limits of audience measurement. The banner offers to accept linking to your account on top of that (basis: your consent, art. 6.1.a); that is the only case where PostHog session recording starts. Your choice is remembered on this device and, once you sign in, on your account - changeable at any time.

PostHog also reports the errors the app runs into: stack trace and the page it happened on, under the same rules - tied to your account only if you accepted, never replayed without your yes.

Security

Everything travels over HTTPS, data is encrypted at rest, and database access is restricted and logged. If a breach ever poses a high risk to you, we notify the Austrian authority (DSB) within 72 hours and inform you without undue delay (GDPR art. 33 and 34).

Contact

For any data-related request: contact@kimbia.app.