Privacy Policy

Last updated: 2026-10-19

This Privacy Policy explains how Race the Water processes your personal data when you use the Race the Water swim-planning web app (the “Service”), in accordance with the EU General Data Protection Regulation (GDPR). Please read it together with our Terms of Service.

1. Data controller

The controller responsible for your personal data is Green Michał Janisz, Wolinskiego 17, 20-491 Lublin, Poland (“Race the Water”, “we”, “us”). For any privacy question or to exercise your rights, contact us at contact@racethewater.com.

2. Data we process

Account data. Your email address and an authentication identifier. You sign in with email and password or with Google. Authentication is handled by our processor Supabase; we do not store your raw password.

Profile data. Your display name and, if you add one, an avatar image.

Training data. Swim sessions and their details (date, distance, duration, pace, stroke data, SWOLF, calories, GPS track, water temperature, location, conditions), your goals, generated training plans, and personal records.

Health data (special category). Wellness metrics such as heart rate, resting and maximum heart rate, heart-rate variability (HRV), estimated VO2max, and training readiness are data concerning your health and are a special category of data under Article 9 GDPR. We process them only with your explicit consent, which you give when you create your account or connect a data source, and which you can withdraw at any time.

Integration credentials. If you connect third-party services, the credentials needed to sync your data: your intervals.icu athlete ID and API key, and Garmin Connect authentication tokens. Sensitive credentials are encrypted at rest.

Technical data. Aggregate usage and performance data from our hosting/analytics provider (Vercel) to operate and improve the Service.

Security log data. So that we can detect and investigate abuse of the Service, we keep a security log of a limited set of account events: connecting or disconnecting a third-party service, failed attempts to connect one, changing integration settings, giving consent, requesting deletion or restoration of your account, and administrative actions taken on accounts. Each entry records what happened, when, the account it relates to, and a one-way hashed form of the IP address the request came from. We do not store the IP address itself, the contents of your requests, or any credentials. The log is readable only by our administrators.

3. Why we process it and our legal basis

• To create and secure your account and provide the Service — performance of a contract (Art. 6(1)(b)).
• To process your health and wellness data so we can calculate metrics and generate plans — your explicit consent (Art. 9(2)(a)); you may withdraw it at any time.
• To sync data from intervals.icu and Garmin — your consent(Art. 6(1)(a)), given when you enable each feature.
• To keep the Service secure and prevent abuse, including by keeping the security log described above — our legitimate interests (Art. 6(1)(f)) in running a reliable service.
• To measure visits and page speed with Vercel Web Analytics and Speed Insights —your consent (Art. 6(1)(a)), given in the analytics banner; you may withdraw it at any time.
• To comply with legal obligations — legal obligation (Art. 6(1)(c)).

Withdrawing consent does not affect processing carried out before withdrawal. If you withdraw consent for health-data processing, core features of the Service may no longer be available to you.

4. Workout and plan generation

When you ask Race the Water to generate a workout or plan, it is built on our own infrastructure from your training data and a fixed library of coaching templates. No AI model provider is involved and nothing is sent to a third party for this purpose. Generation is automated, but it produces suggestions that you remain free to accept, change, or ignore; it does not constitute a decision producing legal or similarly significant effects within the meaning of Article 22 GDPR.

5. Processors and recipients

We share data only as needed with the following processors:

• Supabase — authentication, database, and file storage.
• Vercel — hosting, and, only if you consent, analytics and performance monitoring.
• intervals.icu and Garmin Connect — only if you connect them, to sync your data.

We do not sell your personal data and do not use it for advertising.

6. International transfers

Some of our processors (including Supabase and Vercel) may process data on servers located outside the European Economic Area, including in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards under Chapter V GDPR, in particular the European Commission’s Standard Contractual Clauses, or an adequacy decision where one applies. You can request a copy of the relevant safeguards by emailing contact@racethewater.com.

7. Cookies and analytics

Without asking for consent, Race the Water stores on your device only what is necessary to provide the service you use:

• Sign-in cookies (Supabase) — set when you sign in and kept so you stay signed in on that device until you sign out (up to 400 days). The sign-in form tells you this before you sign in.
• Time-zone cookie (tz_offset) — your browser’s time-zone offset, so dates such as “today” match your local day. Deleted when you close the browser.
• Local storage in your browser — choices you make, such as the light/dark theme, a dismissed reminder, your analytics choice and, before you sign in, your saved races and home settings. These stay on your device until you sign in and save them to your account.

Analytics (only with your consent). If you accept in the analytics banner, we load Vercel Web Analytics and Speed Insights. They set no cookies and do not identify you individually, but their scripts read your browser’s local storage and send page addresses, the referring page, browser, operating system, device type, connection type, page speed measurements and approximate location derived from your IP address to Vercel, which reports them to us only as aggregated statistics. If you decline, they are not loaded. You can change your choice at any time: Cookie settings.

You can also control or block cookies and local storage in your browser’s settings, and delete what is already stored there. Blocking sign-in cookies will prevent you from staying signed in.

We do not use advertising or third-party tracking cookies.

8. Retention

We keep your personal data while your account is active. If you delete your account or ask us to erase your data, we delete it within 30 days, except where we must retain specific data to comply with a legal obligation or to establish, exercise, or defend legal claims. Backups are purged on a rolling basis.

Security log entries are an exception: we keep them for 180 days from the date of the event and then delete them. If your account is erased before that period ends, we remove the account identifier from any entries that remain, which leaves a record of the event that is no longer linked to your account. We keep those entries for the remainder of the 180 days so that a security incident spanning that period can still be investigated.

9. Your rights

Under the GDPR you have the right to: access your data; have it corrected; have it erased; restrict or object to processing; data portability; and withdraw consent at any time where processing is based on consent. To exercise any of these, email contact@racethewater.com. You can also delete your account yourself at any time from Profile → Danger zone: the account is closed immediately, and all of your data is permanently erased 30 days later, apart from the security log entries described in section 8. You can restore it by signing in again at any point during those 30 days. You also have the right to lodge a complaint with a supervisory authority, in particular the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) or the authority in your country of residence.

10. Security

We use industry-standard measures including encryption in transit, encryption of sensitive credentials at rest, access controls (row-level security) so that each user can access only their own data, and the security log described in section 2. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

Race the Water is not directed to children under 16, and we do not knowingly process their data. If you believe a child has provided us data, contact us and we will delete it.

12. Changes

We may update this policy and will revise the “Last updated” date. We will notify you of material changes where appropriate.

13. Contact

Green Michał Janisz, Wolinskiego 17, 20-491 Lublin, Poland — contact@racethewater.com.