Yama. ← Back to homepage

Privacy Policy

Last updated: July 11, 2026

Preamble

With the following privacy policy, we would like to inform you about the types of your personal data (hereinafter also referred to as „data") that we process, for what purposes and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites, in mobile applications and within external online presences, such as our social media profiles (hereinafter collectively referred to as the „online offering").

The terms used are not gender-specific.

Table of Contents

Controller

Fabio Müller
Gammelsdorfer Straße 6a
81671 Munich, Germany

Email: info@yama.coach

Imprint: yama.coach/impressum-en/

Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of Data Processed

  • Inventory data
  • Contact data
  • Content data
  • Usage data
  • Meta, communication and procedural data
  • Log data
  • Health and fitness data (training data, heart rate, performance metrics)

Categories of Data Subjects

  • Communication partners
  • Users (athletes, coaches)

Purposes of Processing

  • Provision of contractual services and fulfillment of contractual obligations
  • Communication
  • Security measures
  • Provision of our online offering and user-friendliness
  • Information technology infrastructure
  • Training analysis and individual evaluation of athletic performance

Relevant Legal Bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection regulations may apply in your or our country of residence or domicile.

  • Consent (Art. 6 (1) (a) GDPR) — The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Performance of a contract and prior requests (Art. 6 (1) (b) GDPR) — Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6 (1) (c) GDPR) — Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6 (1) (f) GDPR) — Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany, in particular the Federal Data Protection Act (BDSG) and state data protection laws.

Security Measures

We take appropriate technical and organizational measures in accordance with the statutory requirements, taking into account the state of the art, the costs of implementation, and the nature, scope, circumstances and purposes of processing, as well as the different probabilities and severities of risk to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

Securing online connections with TLS/SSL encryption (HTTPS): To protect user data transmitted via our online services from unauthorized access, we use TLS/SSL encryption technology. All data transmissions between browser and server are encrypted.

Transmission of Personal Data

In the course of processing personal data, it may be transmitted to or disclosed to other entities, companies, legally independent organizational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content integrated into a website. In such cases, we comply with the statutory requirements and, in particular, conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data. In a coach-athlete relationship, training data of a user may be visible to their assigned coach — this only happens with the athlete's consent and can be terminated at any time.

International Data Transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this occurs in the context of using third-party services, this is always done in accordance with statutory requirements.

For data transfers to the USA, we primarily rely on the Data Privacy Framework (DPF), which has been recognized as a secure legal framework by an adequacy decision of the EU Commission dated 10.07.2023. In addition, we have concluded Standard Contractual Clauses with the respective providers.

For individual service providers, we will inform you whether they are certified under the DPF and whether Standard Contractual Clauses are in place. More information on the DPF and a list of certified companies can be found at www.dataprivacyframework.gov.

General Information on Data Storage and Deletion

We delete personal data that we process in accordance with statutory provisions as soon as the underlying consent is revoked or no further legal basis for processing exists. Exceptions to this rule exist when statutory obligations or special interests require longer retention or archiving of the data.

Retention and deletion of data — German legal retention periods:

  • 10 years — Books, records, annual financial statements (§ 147 (1) No. 1 AO, § 257 HGB)
  • 8 years — Accounting vouchers such as invoices (§ 147 (1) No. 4 AO)
  • 6 years — Other business records (§ 147 AO, § 257 HGB)
  • 3 years — Data required for potential warranty and damages claims (§§ 195, 199 BGB)

Start of period with the end of the year: If a period does not begin expressly on a specific date and is at least one year, it automatically starts at the end of the calendar year in which the triggering event occurred.

Rights of Data Subjects

As data subjects, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of your personal data based on Art. 6 (1) (e) or (f) GDPR.
  • Right to withdraw consent: You have the right to withdraw consent granted at any time.
  • Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed and to receive information about such data, as well as further information and a copy of the data.
  • Right to rectification: You have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: You have the right to request that data concerning you be deleted without delay, or alternatively, in accordance with statutory provisions, to request restriction of processing.
  • Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format.
  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data violates the GDPR.

Supervisory authority responsible for us:
Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18, 91522 Ansbach, Germany
Phone: +49 (0) 981 180093-0
Email: poststelle@lda.bayern.de
Web: www.lda.bayern.de

Provision of the Online Offering and Web Hosting

We process user data to provide our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or device.

  • Types of data processed: Usage data, meta/communication/procedural data (e.g. IP addresses, timestamps), log data.
  • Data subjects: Users.
  • Purposes: Provision of our online offering, IT infrastructure, security measures.
  • Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Service provider used — Cloudflare (hosting, CDN, email routing):

Yama is provided via the Cloudflare Workers platform. Cloudflare acts as a Content Delivery Network (CDN), DNS provider and provides email routing for info@yama.coach. When the website is accessed, technical data (IP address, user agent, timestamp) is transmitted to Cloudflare servers and stored for up to 30 days for security purposes (DDoS protection). Service provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Privacy policy: cloudflare.com/privacypolicy. Basis for third-country transfers: Data Privacy Framework (DPF) and Standard Contractual Clauses. Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Database Backend (Supabase)

We use Supabase as a backend service for storing account and training data and for authentication. When creating a user account, email address, password (hashed), profile data and training data (activities, heart rate, performance metrics) are stored in a dedicated Supabase database. The database is secured with Row-Level Security such that each user can only see their own data.

  • Types of data processed: Inventory data, contact data, content data, usage data, health/fitness data.
  • Data subjects: Users.
  • Purposes: Provision of the user account and training analysis, performance of contractual services.
  • Legal bases: Performance of a contract (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).

Service provider: Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992. Server region for our instance: EU (Frankfurt). Privacy policy: supabase.com/privacy. Data Processing Agreement (DPA): supabase.com/legal/dpa. Basis for third-country transfers: Standard Contractual Clauses.

Processing of Health Data

Yama is a training application. The data we process therefore also includes health data within the meaning of Art. 9(1) GDPR, in particular heart rate and heart rate variability (HRV) values, sleep and recovery data, body weight and athletic performance metrics. We process this data exclusively to provide the core functions (training analysis, load management, training planning) and only on the basis of your explicit consent (Art. 9(2)(a), Art. 6(1)(a) GDPR), which we obtain during registration. The data is stored in our database at Supabase in the Frankfurt am Main data centre (EU). You may withdraw your consent at any time with effect for the future, for example by deleting your account; in that case the health data will be deleted unless statutory retention obligations apply. Yama cannot be used without this consent, as processing this data is necessary for the core functions.

Strava Integration

Users can voluntarily connect their Strava account with Yama to automatically import training activities. The connection is made via OAuth 2.0 — Yama receives an access token from Strava, which can be used to retrieve activity data (route, duration, heart rate, power, GPS data etc.). Yama stores Strava activity IDs and the imported training data in the Supabase database. The Strava connection can be disconnected at any time via the profile settings — Yama then revokes the authorization at Strava and deletes the stored tokens.

  • Types of data processed: Strava account identifier, training data (activities, GPS routes, heart rate, power), health/fitness data.
  • Data subjects: Users (athletes).
  • Purposes: Training analysis, individual evaluation of athletic performance.
  • Legal bases: Consent (Art. 6 (1) (a) GDPR) — granted by clicking the „Connect with Strava" button; performance of a contract (Art. 6 (1) (b) GDPR).

Service provider: Strava, Inc., 208 Utah Street, Suite 400, San Francisco, CA 94103, USA. Privacy policy: strava.com/legal/privacy. Basis for third-country transfers: Standard Contractual Clauses.

Wahoo Integration

If you connect your Wahoo account, we import your training activities stored there (including time, distance, heart rate, power, GPS route) into your Yama account via the Wahoo interface. The connection uses OAuth; we never receive your Wahoo credentials. Legal bases: performance of contract (Art. 6(1)(b) GDPR) and, with regard to health data, your consent (Art. 9(2)(a) GDPR). Provider: Wahoo Fitness L.L.C., Atlanta (USA); privacy policy: wahoofitness.com/privacy. You can disconnect at any time in the settings.

Suunto Integration

If you connect your Suunto account, we import your training activities stored there (including time, distance, heart rate, GPS route) into your Yama account via the Suunto interface. The connection uses OAuth; we never receive your Suunto credentials. Legal bases: performance of contract (Art. 6(1)(b) GDPR) and, with regard to health data, your consent (Art. 9(2)(a) GDPR). Provider: Suunto Oy, Vantaa (Finland); privacy policy: suunto.com/Privacy-Policy. You can disconnect at any time in the settings.

Polar Integration

If you connect your Polar account, we import your training activities stored there (including time, distance, heart rate, GPS route) into your Yama account via the Polar AccessLink interface. The connection uses OAuth; we never receive your Polar credentials. Legal bases: performance of contract (Art. 6(1)(b) GDPR) and, with regard to health data, your consent (Art. 9(2)(a) GDPR). Provider: Polar Electro Oy, Kempele (Finland); privacy policy: polar.com/en/legal/privacy-notice. You can disconnect at any time in the settings.

Map Service (Geoapify)

For displaying static maps of imported routes (e.g. running or cycling routes), we use the Static Maps API service from Geoapify. When rendering a map, the GPS coordinates of the route are transmitted to Geoapify, which returns a map image. The map images are cached server-side in a Cloudflare R2 cache to avoid repeated API calls and data transmissions. The interactive map tile layers come from OpenStreetMap (see corresponding section).

  • Types of data processed: GPS coordinates (route data from training activities).
  • Data subjects: Users.
  • Purposes: Visualization of training routes.
  • Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Service provider: Geoapify GmbH, Lyoner Straße 14, 60528 Frankfurt am Main, Germany. Privacy policy: geoapify.com/privacy-policy. Data processing within the EU.

Weather Data (Open-Meteo)

To analyse heat stress and provide weather information for training locations, the application retrieves weather data directly from your browser via Open-Meteo. Your IP address and the coordinates of the respective location (e.g. of an activity) are transmitted to Open-Meteo. Provider: Open-Meteo (open-meteo.com). Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in providing weather-related analysis features. Further information: open-meteo.com/en/terms.

Own API Services (Cloudflare Workers)

For certain features we operate our own server-side services on Cloudflare infrastructure ("Cloudflare Workers"). These are used in particular to generate map previews of activities (transmission of the route coordinates of the respective activity) and to relay requests to AI services (see the following section). Cloudflare processes technical connection data (including IP address) as a processor. Provider: Cloudflare, Inc. (USA); transfers based on the EU-US Data Privacy Framework or standard contractual clauses. Legal bases: performance of contract (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR). When an activity or your account is deleted, cached map images and route data in our cache are removed as well; any remaining technical caches are automatically deleted after 90 days at the latest.

AI-Powered Features

Certain features — such as the training assistant chat and automatic plan generation — use large language models from external providers. For this purpose, the content required for the respective request, for example your question and relevant training metrics, which may include health data, is transmitted via our API service to the respective provider and processed there solely to generate the response. Under the providers' API terms, this content is not used to train the models. Providers: Anthropic PBC (USA); OpenAI, L.L.C. (USA) or Google Ireland Ltd. (Ireland) may also be used. Transfers to the USA are based on the EU-US Data Privacy Framework where the provider is certified, and otherwise on standard contractual clauses. Legal bases: performance of contract (Art. 6(1)(b) GDPR); where health data is concerned, your consent (Art. 9(2)(a) GDPR).

Use of Cookies

The term „cookies" refers to functions that store and read information on user devices. We only use technically necessary cookies and comparable storage technologies (localStorage) — these serve the functionality of the app (e.g. login status, language selection, theme preference) and are permitted without separate consent according to § 25 (2) No. 2 TTDSG.

Storage duration: Session cookies are deleted after the browser is closed. Permanent cookies (e.g. for language settings) remain on the device for up to 2 years or are removed upon manual logout. Users can delete cookies at any time in their browser settings.

Registration, Login and User Account

Users can create a user account. During registration, email address, password (hashed) and a self-chosen username (pseudonyms permitted) are processed. Additional profile data (sport disciplines, FTP value, marathon best time etc.) may optionally be stored.

  • Registration with pseudonyms: Users are permitted to use pseudonyms as usernames instead of real names.
  • User profiles are not public: Profiles are not viewable outside of assigned coach-athlete relationships.
  • Deletion of data upon termination: Upon termination of the user account, all personal data is deleted within 30 days — subject to statutory retention obligations.

Legal bases: Performance of a contract (Art. 6 (1) (b) GDPR), legitimate interests (Art. 6 (1) (f) GDPR).

Contact and Inquiry Management

When contacting us (e.g. by email, feedback function or via social media) and in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the contact inquiries and any requested measures. Legal bases: Legitimate interests (Art. 6 (1) (f) GDPR).

Social Media Presence

We maintain online presences within social networks and process user data in this context to communicate with users active there or to offer information about us. User data may be processed outside the European Union.

Instagram: Social network that allows sharing of photos and videos, commenting and favoriting of posts, messaging, subscribing to profiles and pages. Service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Privacy policy: privacycenter.instagram.com/policy. Basis for third-country transfers: Data Privacy Framework (DPF). Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Plug-ins and Embedded Functions and Content

We integrate functional and content elements into our online offering that are obtained from the servers of their respective providers (hereinafter referred to as „third-party providers"). Integration always requires that third-party providers of this content process the user's IP address, as they could not send the content to the user's browser without an IP address.

Integration of third-party software, scripts or frameworks: We integrate software libraries into our online offering that we retrieve from servers of other providers (Supabase JS SDK, Leaflet for maps, jsPDF for PDF generation, Tabler Icons). The respective providers collect the user's IP address and may process it for the purposes of transmitting the software to the user's browser and for security purposes. Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Google Fonts (loaded from Google server): For displaying fonts, we use Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the website loads, the browser loads the Manrope and JetBrains Mono fonts directly from the Google Fonts CDN. The user's IP address is transmitted to Google. Google may process this data in the USA. Privacy policy: business.safety.google/privacy. Basis for third-country transfers: Data Privacy Framework (DPF). Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

OpenStreetMap: We integrate maps of the „OpenStreetMap" service, which are offered on the basis of the Open Data Commons Open Database License (ODbL) by the OpenStreetMap Foundation (OSMF). The data processed may include IP addresses and location data of users. Service provider: OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Privacy policy: osmfoundation.org/wiki/Privacy_Policy. Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Management, Organization and Support Tools

We use services, platforms and software of other providers for the purposes of organization, administration, planning and provision of our services. The main providers (Cloudflare, Supabase, Strava, Geoapify) are described in detail in the preceding sections. Legal basis: Legitimate interests (Art. 6 (1) (f) GDPR).

Changes and Updates

Please regularly inform yourself about the content of our privacy policy. We will adjust the privacy policy as soon as changes to the data processing we carry out require it.

Definitions of Terms

In this section you will find an overview of the terms used in this privacy policy.

  • Inventory data: Information for the identification and administration of contractual partners, user accounts, profiles (name, contact details, user IDs).
  • Content data: Data generated in the course of creating, editing and publishing content (texts, images, GPS routes, training data).
  • Contact data: Information for communication (phone numbers, email addresses, postal addresses).
  • Meta, communication and procedural data: Information about the manner in which data is processed, transmitted and managed (file size, timestamps, IP addresses).
  • Usage data: Information about interactions with digital products (page views, click paths, features used).
  • Personal data: Any information relating to an identified or identifiable natural person.
  • Log data: Information about events or activities in a system (timestamps, IP addresses, error messages).
  • Controller: The natural or legal person who decides on the purposes and means of processing personal data.
  • Processing: Any operation performed on personal data, whether or not by automated means (collection, analysis, storage, transmission, deletion).

This privacy policy was created based on a text by datenschutz-generator.de (Dr. Thomas Schwenke) and supplemented with Yama-specific third parties.