Your data in Train-Ray
Train-Ray processes health and training data to give you a training recommendation every day. This page explains which data that is, who sees it, which services are involved and what rights you have. No advertising, no tracking, no selling of data.
Last updated: 5 October 2026. Supplements the general privacy policy of cmventures.xyz.
1. Controller
The controller is the operator of cmventures.xyz. Name, address and contact details are given in the legal notice. Please also send any questions, requests for access and requests for erasure there.
2. What data Train-Ray processes
| Data | Source | Purpose |
|---|---|---|
| Account: username, name, email (optional), password (hash only), sex, year of birth, height, weight | Created by you or by the admin | Sign-in, reference values, calculations |
| Recovery: HRV, resting heart rate, sleep, SpO2, respiration, stress, Body Battery | intervals.icu, WHOOP, Garmin export | Readiness and recommendation |
| Training: sessions with duration, distance, power, heart rate, load | intervals.icu, Strava, WHOOP, Garmin export | Load, fitness, plan |
| Body: weight, body fat, InBody reports, body photos, uploaded medical reports | Your uploads and entries | Body analysis and history |
| Check-in and journal: energy, motivation, stress, muscle soreness, alcohol, illness, notes, feedback | Your entries | Recommendation, analysis of influences |
| Cycle (only if you turn it on): start of period, symptoms | Your entries, intervals.icu | Cycle phase and tips |
| Nutrition: calories and macros per day | CSV import (e.g. MyFitnessPal), Garmin | Comparison with your daily target |
| Goals, races, tests | Your entries and uploads | Plan and progress |
| Technical: sign-in cookie, your device's push subscription | Your browser | Staying signed in, morning reminder |
Train-Ray only sets technically necessary cookies (sign-in, selected view). There are no analytics, advertising or tracking cookies.
3. Legal basis
Health data is a special category of personal data. Train-Ray processes it only with your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7) Swiss FADP). You give it when registering or on your first sign-in. Account data is processed in order to provide the service to you.
You can withdraw your consent at any time. Your account will then be deleted together with all data. Processing carried out before the withdrawal remains lawful.
4. Who sees your data
- You see all your data.
- A coach sees your data only if the admin has assigned them to you.
- The admin (operator) can technically view all accounts in order to maintain the service.
- Cycle data is visible only to you by default. Under Account you decide whether your coach and the admin can see it and whether the AI takes it into account.
5. Services involved
| Service | What for | What is sent there |
|---|---|---|
| Vercel Inc., USA | Hosting, private data storage, daily sync | All data listed above (stored, not public) |
| Anthropic PBC (Claude), USA | AI texts: explanation of the recommendation, weekly brief, feedback; reading uploads; race search | Metrics, goals, notes and, for uploads, the image or PDF. Not: password, email, username |
| intervals.icu, Strava, WHOOP | Data sources, only if you connect them | Train-Ray retrieves your data from them; the access keys are stored encrypted |
| Apple, Google, Mozilla | Delivery of push notifications, only if turned on | Text of the notification |
Vercel and Anthropic are based in the USA. The transfer is based on the EU-US or Swiss-US Data Privacy Framework where the provider is certified, otherwise on standard contractual clauses. Under its commercial terms, Anthropic does not use data submitted via the API to train its models. For intervals.icu, Strava and WHOOP, their own privacy policies apply.
6. Retention and deletion
- Your data is stored for as long as your account exists.
- You can delete uploads (photos, InBody, tests) and journal entries yourself at any time.
- You can disconnect intervals.icu, Strava and WHOOP under Sources.
- If your account is deleted, Train-Ray removes all associated data and files. You can request deletion from the admin or via the contact in the legal notice.
7. Security
Connections are encrypted (HTTPS). Data and files are kept in private storage that is not publicly accessible. Passwords are stored only as a hash; access keys for other services are encrypted with AES-256-GCM.
8. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and withdrawal of your consent. To exercise these rights, use the contact in the legal notice.
You can lodge a complaint with a supervisory authority, e.g. the Data Protection Authority of Liechtenstein, the FDPIC (Switzerland) or the authority where you live.
9. No medical advice
Train-Ray gives training recommendations based on your data. This is not a medical diagnosis or medical advice. If you have health complaints, please see a doctor.