Privacy

Privacy Policy

Effective August 2026. Kresta is an independent training app built in Stockholm, Sweden. Kresta is the data controller for your personal data. This policy explains what Kresta collects, why, and the choices you have. Questions: hello@kresta.app.

What we collect

• Account. Your name, email address, and a securely hashed password.
• Training data. Activities from the services you connect (such as intervals.icu or Garmin), files you import, and workouts you record in the app: rides and runs with power, heart rate, pace, cadence, GPS routes, and timestamps.
• Health and body. If you connect a wellness source (such as Garmin via intervals.icu), data such as resting heart rate, HRV, and sleep; plus body values you enter (weight, threshold power or pace, heart-rate zones).
• Your inputs. How you are feeling, your goals, plan changes, and the messages you send to the AI coach.
• Technical. Basic device and app information and error logs, used to keep Kresta running.

How we use it

We use your data only to provide Kresta: to build your fitness signature and training load, generate coaching and daily guidance, run your calendar and training plan, and keep the app reliable. Under the GDPR, our legal bases are performance of our contract with you (running the app you signed up for) and your consent (for connecting your training and wellness services, and for processing health data). We do not use your data for advertising, and we never sell it.

The AI coach

When you chat with the coach or receive a daily brief, your message and the relevant parts of your training context are sent to Anthropic (the Claude API) to generate the response. Anthropic processes this on our behalf as a service provider and does not use your content to train its models. The coach only ever sees your own data.

Who we share it with

We share data only with the service providers that make Kresta work, and only as needed to run it:

• Connected services (such as intervals.icu or Garmin), to import the activities and wellness data you authorize. You control every connection.
• Anthropic, to power the AI coach, as described above.
• Hosting and database providers, to store your account and training data and serve the app.

We disclose data if required by law. We never sell your personal data.

How long we keep it

We keep your data while your account is active. When you delete your account (in the app under Settings, or by emailing us), we delete your personal data, except anything we must keep for legal reasons.

Your rights

Because you are in the EU/EEA, you can ask us to access, correct, delete, or export your data, and to restrict or object to processing, and you can withdraw consent at any time. You can disconnect any connected service whenever you like, and delete your account from within the app. We have processes in place to comply with the GDPR, and on request we will anonymize or delete the data we hold about you. To exercise any right, email hello@kresta.app. You also have the right to complain to your supervisory authority (in Sweden, the IMY, Integritetsskyddsmyndigheten).

Security and international transfers

We use reasonable technical and organizational measures to protect your data, though no online service can be completely secure. Some of our providers (such as Anthropic and our hosting) may process data outside the EU/EEA under appropriate safeguards such as the EU Standard Contractual Clauses.

Children

Kresta is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe a child has created an account, email us and we will delete the account and its data.

Changes

We may update this policy as Kresta evolves. We will change the effective date above and, for significant changes, let you know in the app.