Privacy
Every item below was checked against the schema, the handlers and the deployed configuration. A privacy page that lists something the service does not collect, or omits something it does, is worse than none.
Taken from the migrations that build the database. This is the whole of it.
Your intervals.icu account — the athlete id you linked, your display name reduced to a first name and last initial (“Plamen P.”), the two-letter country your link came from, and a currency. Nothing else from your profile.
Your intervals.icu credential — encrypted with AES-256-GCM before it is written, and never in plain text anywhere: not in a log, not in an error, not in a page. It is the access token intervals.icu issued when you signed in to link. It reads your planned workouts and settings, and nothing else.
Your Edges — for each one, the unique identifier Garmin gives it, the six-digit code and four characters this service issued it, the model, the app version, and when it was last seen. No serial number, no name you have given it.
Your licence — when your trial started, whether it is unlocked, and which Edges are linked.
Purchases — the payment provider’s reference, the amount, the currency and the e-mail address the receipt went to. Card details never reach this service; the merchant of record handles payment and we are told only that it completed.
A copy of your planned workouts for the coming days, so the Edge can still be served when intervals.icu is busy. Each fetch replaces it; it is deleted after 14 days without one.
Request logs — the IP address, the country, the page, the status and how long it took. Capped at 30 MB and rotated, so a few weeks.
Visit statistics — counted by Umami, which runs on our own server: the page viewed, the site that sent you, your country, the kind of browser, device and screen, and clicks on a few buttons (the Connect IQ Store badge, the setup guide, the language). No cookie is set and no IP address is stored: a visit is told apart from another only within a day, by a one-way code that cannot be turned back into an address. If your browser sends Do Not Track, nothing is counted. Kept for 12 months.
Your language, if you choose one — picking a language on the home page sets a cookie called lang that holds that language’s two-letter code and nothing else, for a year. Without one, a first visit is shown in the language your browser asks for, or else your country’s, as Cloudflare reports it with the request; neither is stored for this.
No ride data is kept. Not your power, heart rate, cadence, speed, position, route or any recorded activity. Nothing about a ride reaches this service: it sends planned workouts to your Edge, and your ride goes from the Edge to Garmin Connect and intervals.icu exactly as it did before.
No password, because there is no account to log into. No e-mail address unless you buy a licence, and then only for the receipt.
The credential fetches your planned workouts. The device identifier tells one Edge from another so a licence can cover up to three. The country sets the currency you are quoted. The logs are for finding faults and for spotting abuse of endpoints that are open to anyone.
Contract (GDPR Art. 6(1)(b)) — your account, credential, Edges, licence, purchase records and the copy of your planned workouts are what it takes to provide the service you asked for. Without them it cannot fetch your workouts or know your Edge is unlocked. The tax records of a purchase are kept by the merchant of record, not here.
Legitimate interests (Art. 6(1)(f)) — the request logs, to find faults and stop abuse; the visit statistics, to learn which parts of the site help riders and which do not, with nothing that identifies you; and the cookies below, which make the pages you use work.
No decision about you is made by automated means alone, and no profile of you is built.
Hetzner (Germany), our processor — the server and its backups, in the EU.
Cloudflare, our processor — DNS and the connection between you and the server.
intervals.icu, a separate controller — the source of your workouts, and where your data already is.
[MERCHANT OF RECORD], a separate controller — only if you buy a licence: it runs the checkout, the payment, the receipt, the tax and any refund.
A processor handles data only to do that job for us. A separate controller decides for itself what it does with the data it holds, under its own privacy policy.
Everything else stays on one server in the EU. Backups stay on that server and are kept for 30 days.
Outside the EU. Cloudflare, intervals.icu and [MERCHANT OF RECORD] may handle data outside the EU. Where that is a country without an EU adequacy decision, the transfer relies on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses. Ask us for the details of any transfer.
The site sets only the cookies it needs to work, and only when you use the part that needs them. No analytics cookies, no advertising, no tracking, and nothing from anyone else; the visit statistics above use none.
inl_account — keeps you signed in to your account page. 15 minutes.
inl_link — remembers the Edge you are linking while you sign in. 20 minutes.
inl_oauth — protects the sign-in with intervals.icu against forgery. 10 minutes.
inl_unlock — remembers that you hold the Edge you are unlocking, through checkout. 30 minutes.
lang — the language you chose on the home page. A year.
Your account and everything attached to it is kept until you delete it, or for 24 months after your last check-in, whichever comes first. A paid account is kept while its licence exists, until you delete it, because the licence lasts as long as the service does. An Edge that has checked in but was never linked to an account is forgotten 30 days after its last check-in. The copy of your planned workouts is deleted after 14 days without a fetch. Logs last a few weeks. Visit statistics last 12 months. Backups are kept for 30 days, so anything deleted is gone from them within 30 days.
Write to support@intervalnext.app from an address we can match to your account, or tell us your intervals.icu athlete id. Everything is deleted — account, credential, devices, licence and purchase records — and it cascades, so nothing is left behind.
Deleting a paid account deletes its licence too. [MERCHANT OF RECORD] keeps your receipt and its own payment and tax records under its own privacy policy; to get the unlock back later, send us that receipt.
You can also do it yourself: sign in with intervals.icu on your account page and choose Delete my account and all data. It asks intervals.icu to confirm it is you, then deletes the same things.
You can ask what is held, ask for it to be corrected, ask for a copy, or ask for it to be erased: support@intervalnext.app. The data controller is Plamen Petrov, Vasil Levski 29, 5000 Veliko Tarnovo, Bulgaria — see the imprint.
You can also ask us to restrict how your data is used, object at any time to a use based on our legitimate interests, receive the data you gave us in a machine-readable form to take elsewhere, and withdraw any consent you gave. We answer within a month.
If you think we have not handled your data properly, you can complain to a data protection authority: in Bulgaria, the Commission for Personal Data Protection (cpdp.bg), or the authority where you live.
IntervalNext is an independent product and is not endorsed by Garmin. Garmin®, the Garmin logo and Edge® are trademarks of Garmin Ltd. or its subsidiaries, registered in the USA and other countries. Connect IQ™ and Garmin Connect™ are trademarks of Garmin Ltd. or its subsidiaries. These trademarks may not be used without the express permission of Garmin.