Privacy policy
Who we are
ThresholdLink is run by Kaspar Birk, an individual based in Denmark (“we”, “us”). We are the data controller for the personal data described in this policy. You can reach us about privacy at privacy@thresholdlink.app.
What ThresholdLink does
ThresholdLink connects your Intervals.icu account to your own AI assistant, such as Claude or ChatGPT. You add ThresholdLink as a connector in your assistant, sign in, and authorise ThresholdLink to access your Intervals.icu account.
When your assistant uses one of ThresholdLink’s tools, ThresholdLink fetches the data from Intervals.icu with your authorisation and returns it to your assistant. If you ask your assistant to plan a workout or add a race or note, ThresholdLink writes it to your Intervals.icu calendar. If you ask it to, it can also change or delete the workouts, races and notes it added itself; it never changes or deletes anything else in your calendar or your activities.
What we store and for how long
- Your Intervals.icu connection. Your Intervals.icu athlete ID and the access token Intervals.icu gives ThresholdLink when you authorise it. The token is encrypted at rest. We keep these until you disconnect ThresholdLink or revoke its access in Intervals.icu. We delete them as soon as ThresholdLink learns of a revocation, and in any case we delete connections that have not been used for 12 months. You can disconnect from within ThresholdLink or by emailing privacy@thresholdlink.app, or revoke access in your Intervals.icu settings.
- Your assistant’s access to ThresholdLink. The authorisation grants and tokens ThresholdLink issues to your AI assistant so it can call ThresholdLink for you. These are deleted when you disconnect or revoke access, or when your connection is deleted after 12 months without use.
- Server logs. IP address, time, the requested path (without query parameters) and any errors. Logs never contain the content of requests or responses, so your training and health data is not in them. Logs are kept for 14 days and then deleted.
- One cookie. A strictly necessary, short-lived session cookie is set while you sign in and give consent. It is not used for anything else.
We do not use analytics, tracking or advertising, and we do not sell your data.
What passes through but is not stored
Your training and health data, including activities, heart rate variability (HRV), resting heart rate, sleep, weight and fitness and fatigue, is fetched live from Intervals.icu when your assistant asks for it, and passed straight on to your assistant. It is never written to disk or to a database. It is held in memory for at most 15 minutes so the same data is not requested from Intervals.icu again and again.
Planned workouts, races and notes you ask your assistant to create are sent to your Intervals.icu calendar and are not kept by ThresholdLink.
Legal basis
- Health data. Data such as HRV, resting heart rate, sleep and weight is health data, a special category under the GDPR. We process it only with your explicit consent (Article 9(2)(a) GDPR), which you give when you connect ThresholdLink. You can withdraw consent at any time by disconnecting from within ThresholdLink, by emailing privacy@thresholdlink.app, or by revoking the app in your Intervals.icu settings. Withdrawing does not affect processing that happened before.
- Providing the service. Storing your athlete ID and tokens and passing your data to your assistant is necessary to provide the service you ask for (Article 6(1)(b) GDPR).
- Security logs. We keep server logs because of our legitimate interest in keeping ThresholdLink secure and working (Article 6(1)(f) GDPR).
Who else is involved
- Intervals.icu is the source of your data. Its own privacy policy covers the data it holds about you.
- Your AI provider (for example Anthropic or OpenAI) receives the data your assistant requests, because you direct it there. Their processing is governed by your own agreement with that provider, and we are not responsible for it.
- Hetzner Online GmbH hosts the server that runs ThresholdLink and stores the data described above. The server is located in Germany (Nuremberg).
- Cloudflare, Inc. (United States) provides DNS and sits in front of ThresholdLink as a reverse proxy. Cloudflare terminates the encrypted connection, so all data to and from ThresholdLink, including health data, passes through its network in decrypted form. Cloudflare acts as our processor: it does not store this data, and dynamic responses are not cached. Cloudflare also forwards email sent to thresholdlink.app addresses. Transfers to Cloudflare are covered by the EU-US Data Privacy Framework and standard contractual clauses.
- Ko-fi (if you choose to donate). Donations are handled by Ko-fi and its payment providers under their own privacy policies. ThresholdLink never sees your card or payment details; Ko-fi shows us the details it shares with creators about a donation, such as your name, email address and any message you add.
Your rights
Under the GDPR you have the right to access your personal data, have it corrected or erased, restrict or object to its processing, receive it in a portable format, and withdraw your consent at any time. To use any of these rights, email privacy@thresholdlink.app.
Your training data itself lives in Intervals.icu, so you can view, change or delete it there.
You can also complain to the Danish data protection authority, Datatilsynet, at www.datatilsynet.dk.
Security
Connections to ThresholdLink use HTTPS. Intervals.icu access tokens are encrypted at rest. Your training and health data is never written to disk, and server logs contain no request or response content.
Children
ThresholdLink is not directed at children under 16, and they should not use it.
Changes
If this policy changes, we will update this page and the “Last updated” date at the top.
Contact
Privacy questions and requests: privacy@thresholdlink.app.
Anything else: hello@thresholdlink.app.