Effective Date: 2026-09-03
Theron ("Theron," "we," "us," or "our") is committed to protecting the privacy of your personal and sensitive training data. As an EU-based company, we process all data in compliance with the General Data Protection Regulation (GDPR) and local Dutch law. This statement explains what data we collect, how we use it, and your rights concerning your information.
Data Controller: Theron Triathlon
Email for Privacy Enquiries: hello@theron.app
We collect data only as necessary to provide, maintain, and improve the Theron Triathlon Training Service.
| Data Category | Specific Data Collected | Purpose of Collection | Legal Basis (GDPR) |
|---|---|---|---|
| Identity Data | Name, Email Address, Password (encrypted), and identifiers from Google Sign-In or Sign in with Apple when you choose those methods. | To create and secure your user account. | Contract (Processing necessary for the performance of the service agreement) |
| Health & Fitness Data (Sensitive) | From Apple Health, Health Connect, Google Health, Garmin Connect, COROS, Rouvy, Strava, and Wahoo: Activity data (e.g., swim, bike, run), duration, distance, pace, power, heart rate, GPS routes, resting heart rate, sleep data, HRV, FTP/threshold values, and related recovery metrics (e.g., readiness, training load). On Android, Health Connect heart-rate variability, resting heart rate, and sleep samples are read on the device and uploaded to Theron servers so we can calculate your Recovery Score and daily log. | To generate, customize, and display your personalized triathlon training plans and performance analytics, and to generate AI coaching insights (workout summaries, score explanations, Theron's Take, and personalized notifications). | Consent (Explicit consent is required for processing sensitive health data) |
| Configuration Data | Training preferences, current fitness level, goal races, app settings. | To configure the service to your specific needs. | Contract |
| AI-Generated Content | Personalized coaching text produced by our AI features (e.g., workout summaries, score explanations, Theron's Take, and related push notification copy). | To deliver personalized coaching in the app and via push notifications. | Contract (and Consent for the underlying health data used as input) |
| Purchase Data | Subscription status, product identifiers, and purchase tokens processed by Apple, Google Play, and RevenueCat. | To unlock Theron Unlimited and restore purchases. | Contract |
| Technical Data | IP address, device type, operating system, app version, time zone, push notification token, Firebase app instance ID, and crash diagnostics. | To ensure the app functions correctly and for security and debugging. | Legitimate Interest (Necessary for operational security and service maintenance) |
Theron relies on your explicit consent to access data from the following third-party services:
You can revoke Theron's access to your data through the settings of these respective third-party platforms at any time. Revoking access may prevent the Theron app from functioning as intended.
We use your personal data only for the following purposes:
We do not sell or rent your personal training data. Your data is not shown to any other user, as Theron does not have social features (e.g., leaderboards or public profiles). We do share data with service providers who process it on our behalf to run the app, and with AI providers as described below.
Service providers (processors) include:
To provide AI coaching features, we share limited personal and health-related data with AI service providers acting as processors solely to generate the coaching content described above. Our primary AI provider is Google (Gemini). We may also use OpenAI and/or Anthropic as alternative AI service providers.
The data we may send to these providers includes:
We do not send passwords, payment data, raw GPS route tracks, photos, voice recordings, or free-text journals to AI providers.
These providers process the data only to return generated coaching text. Theron does not sell your data to them for their marketing. Theron does not use your personal data to train our own AI models. Any further processing by AI providers is subject to their terms and our arrangements with them as processors.
We may also disclose data if legally required to do so by law enforcement or government authorities.
When AI coaching features are used, structured context is sent to the active AI provider’s API. This may involve temporary processing of data outside the European Union (EU) or the European Economic Area (EEA).
Theron continues to store your account data, training data, and generated AI coaching text on servers located within the EU or EEA. Generated AI content is retained in our database until your account is deleted, at which point it is deleted along with your other identifiable personal data.
You can request deletion of your data or exercise your other GDPR rights by contacting us at hello@theron.app. Deleting your Theron account removes stored AI-generated content associated with your account.
Security: We implement appropriate technical and organizational measures (e.g., encryption, access controls) to protect your data against unauthorized access, alteration, disclosure, or destruction.
Location: As an EU-based company, your personal and training data is stored on servers located within the European Union (EU) or the European Economic Area (EEA), ensuring compliance with GDPR data protection standards. AI inference may involve temporary processing by the AI providers named above outside the EEA, under appropriate safeguards and our contractual arrangements with those providers.
We do not intend to keep your data longer than is necessary.
Account Deletion: If you delete your Theron account, we will immediately initiate the deletion of all identifiable personal data, including AI-generated coaching content associated with your account. You can request deletion in the Theron app or on the web at theron.app/delete-account/.
Anonymization Policy: To support service analytics and legal auditing requirements, we will anonymize your core training data upon account deletion and retain this anonymized data for an allowed period as per our internal retention policy. Anonymized data cannot be linked back to you.
As a user of Theron, you have the following rights concerning your personal data:
| GDPR Right | Description |
|---|---|
| Right of Access | You have the right to request a copy of the personal data we hold about you. |
| Right to Rectification | You have the right to have inaccurate or incomplete data corrected. |
| Right to Erasure ('Right to be Forgotten') | You have the right to request the deletion of your personal data. |
| Right to Restriction of Processing | You have the right to request that we limit the way we use your data. |
| Right to Data Portability | You have the right to receive your data in a structured, commonly used, machine-readable format. |
| Right to Object | You have the right to object to the processing of your data, including processing for marketing purposes. |
To exercise any of these rights, please contact us at hello@theron.app.
Theron is not intended for children. We do not knowingly collect or solicit any information from anyone under the age of 16. If we become aware that we have collected personal data from a child without parental consent, we will take steps to delete that information promptly.
We may update this Privacy Statement periodically to reflect changes in our data practices or legal requirements. We will notify you of any material changes by posting the new statement on the app or by sending an email notification.
Scan this QR code with your iPhone to download Theron from the App Store
Or open in browser
