Privacy Policy

Athles ("we", "us", or "our") is operated by Athles Limited, a company incorporated in Hong Kong. This Privacy Policy explains how we collect, use, store, share, and protect your personal data when you use the Athles platform (the "Platform"), including our mobile application, website, and related services.

This Policy is governed by the Personal Data (Privacy) Ordinance (Cap. 486) of Hong Kong ("PDPO"). By using the Platform, you consent to the practices described in this Policy.

1. DATA WE COLLECT

We collect the following categories of personal data:

1.1 Account and Profile Data

When you register and build your profile, we collect your name, email address, gender, ethnicity, preferred languages, profile photo, activity disciplines (e.g. running, HYROX, trail, cycling), experience level, training pace, race goals, training schedule, and district location within Hong Kong.

1.2 Activity and Performance Data

We collect data about your training sessions, session check-ins, activity logs, wellness data, race day records, and target events. If you connect a third-party fitness service, we also receive activity and workout data from that service (see Section 4).

1.3 Social and Community Data

We collect content you create on the Platform, including feed posts, photos, captions, location tags, comments, kudos, training requests, messages, chat messages, group memberships, and group posts.

1.4 AI Coach Interactions

When you use the AI Coach feature, your queries and the responses generated are logged to provide the service and improve response quality. These logs are associated with your account. AI Coach responses are generated by a third-party large language model provider engaged through our platform provider, Base44, which acts as our data processor; the model provider acts as a subprocessor. The AI Coach operates on the information you enter into Athles, your Athles in-app activity, and derived, non-identifying training summaries only, such as your training level, form and load status, readiness band, weekly volume band, and race readiness gap analysis. Raw wearable health metrics, including heart rate, heart rate variability, resting heart rate, and sleep values, are never sent to any AI model. Strava data is never sent to, processed by, used to train, or used to operate any AI feature, including the Athles AI Coach. A separation in our systems ensures no Strava-sourced data reaches any AI model. Derived summaries and anything you type into the AI Coach are sent to the third-party AI provider. Athles does not operate that provider's models and cannot independently control its retention or model-training practices. The provider's terms may permit it to retain or use submitted data to improve its services or models. Until we operate our own model or use an enterprise no-training service, do not enter sensitive information that is not needed for coaching. Your use of the AI Coach is covered by your consent to this Policy and, where wearable-derived summaries are used, by the wearable data consent you gave when connecting your device.

1.5 Device and Usage Data

We collect information about how you access and use the Platform, including device type, operating system, IP address, browser type, pages visited, and features used. This data is used for platform security, analytics, and improving the user experience.

1.6 Session Recordings

To diagnose problems and improve usability, we use a session replay tool provided by our platform provider, Base44, acting as our data processor. It records how you interact with the Platform interface, such as screens visited, taps, scrolls, and navigation paths, together with the device and usage data described in Section 1.5. We use these recordings solely to review user activity for troubleshooting, security, and product improvement. They are accessible only to authorised personnel, are never used for advertising or direct marketing, are never sold or shared with third parties for their own purposes, and are retained only as long as needed for these purposes. Session recordings do not capture data from your connected wearables or Strava, and are never fed into any AI feature. If you object to session recording, contact us at support@athles.ai.

1.7 Referral Data

If you join via a referral link or invite a friend, we record the referral relationship and any associated redemption data.

1.8 Reports and Moderation Data

If you submit a report about another user or piece of content, or if you are the subject of a report, we retain that information to investigate and enforce our community guidelines.

2. HOW WE USE YOUR DATA

We use your personal data to:

• Create and manage your account and profile
• Match you with compatible training partners using our compatibility scoring system
• Facilitate training sessions, group activities, and community features
• Operate the social feed, including posts, comments, and kudos
• Deliver AI Coach responses grounded in your Athles profile and in-app activity
• Send notifications relevant to your activity on the Platform
• Process account deletions and data removal requests
• Detect, investigate, and prevent abuse, spam, and policy violations
• Comply with applicable laws and legal obligations
• Improve the Platform through anonymised and aggregated analytics

We do not use your personal data for advertising purposes and we do not sell your data to third parties.

2.1 Reward Fulfilment

Reward fulfilment. When you redeem a physical reward for delivery, we collect your name, delivery address and phone number. We use them solely to fulfil your redemption, and we transfer them to our delivery courier for that delivery only. The courier collects any cash-on-delivery carrier fee directly from you; Athles does not process that payment. When you redeem a reward at a partner venue, the venue confirms your redemption and may see your name and the reward being redeemed, and nothing else. We do not share your data with couriers or venues for their own marketing. Delivery details are retained only as long as necessary for fulfilment and record-keeping, then deleted.

3. MATCHING AND COMPATIBILITY SCORING

A core function of the Platform is our compatibility matching system, which generates a score between 0 and 100 for pairs of users based on factors including training schedule overlap, geographic proximity within Hong Kong, pace compatibility, experience level, race goals, and shared group membership.

This scoring is used to determine which profiles are surfaced to you in the partner discovery and suggested partners features. Only users who meet a minimum compatibility threshold are shown. You can update the inputs to this score at any time by editing your profile.

4. THIRD-PARTY INTEGRATIONS

4.1 Strava

Athles integrates with Strava via the Strava API. If you connect Strava, its data is used only for your private activity history and non-reversible personal training aggregates. It is never used for partner matching, public performance summaries, or any AI feature.

If you connect your Strava account, we receive activity data including workout type, distance, duration, and pace. This data is used solely to enrich your personal profile and training context within the Platform. In accordance with the Strava API Agreement and API Policy (effective June 1, 2026):

• Strava activity data is displayed only to the user who connected their account, for that user's private training history
• Strava data is never sent to, processed by, used to train, or used to operate any AI feature, including the Athles AI Coach. Our AI Coach operates solely on the information you enter into Athles and your Athles in-app activity. A separation in our systems ensures no Strava-sourced data reaches any AI model.
• Raw Strava activity data is cached only transiently and is not retained for longer than 7 days, in line with Strava's API Policy. We retain only non-reversible aggregate training metrics derived from this data to power your training history. All Strava activity data is deleted immediately when you disconnect Strava or delete your account, and activity deletions on Strava are reflected in Athles within 48 hours.
• If you delete an activity on Strava, that deletion will be reflected in the Platform within 48 hours
• You may disconnect Strava at any time via Settings. Upon disconnection, your Strava access tokens will be revoked and all imported Strava activity data deleted immediately
• You acknowledge that Strava may monitor and collect usage data related to your use of the Strava integration within this Platform, in accordance with Strava's own Privacy Policy

4.2 Polar

If you connect your Polar account, we receive exercise and workout data via the Polar API. This data is used to enrich your training profile. You may disconnect Polar at any time via Settings.

4.3 Oura

If you connect your Oura Ring, we receive wellness and recovery data including sleep, readiness, and daily activity scores. This data is used to provide context for your training; only derived, non-identifying summaries (such as your readiness band) inform AI Coach responses, never the raw values. You may disconnect Oura at any time via Settings.

4.4 Other Wearables

We may support additional wearable integrations over time. Each integration will be subject to the same principles: data used only for your personal experience, not shared without consent, and revocable at any time.

5. USER-GENERATED CONTENT

Content you post on the Platform, including feed posts, photos, captions, comments, and location tags, may be visible to other users of the Platform in accordance with your visibility settings. The default visibility for feed posts is your network (users with a compatibility score of 60% or above).

You retain ownership of content you create. By posting, you grant us a limited, non-exclusive, royalty-free licence to host, display, and distribute that content within the Platform solely for the purpose of operating the service.

You are responsible for the content you post. Do not post content that includes personal data of others without their consent.

6. DATA SHARING AND DISCLOSURE

We do not sell your personal data. We share your data only in the following circumstances:

• With other users: Profile information and content you choose to make visible, as described above
• With service providers: Trusted third parties who assist in operating the Platform (e.g. cloud infrastructure, analytics), under confidentiality obligations
• With Base44: The Platform is built on the Base44 development platform, which processes data on our behalf as a data processor
• Legal obligations: Where required by Hong Kong law, court order, or to protect the safety of users or the public
• Business transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction, subject to equivalent privacy protections

7. DATA RETENTION

Account-lifetime retention. We retain your wearable, profile, and training data for as long as your account is open. This is what powers partner matching, your training log, and any other purpose you have consented to. We do not delete this data on a fixed schedule and we do not delete it because your account has been inactive for a period of time. Your data is deleted only when you request account deletion, at which point we remove your personal data within 30 days, except where we are required to retain it for legal, regulatory, or dispute resolution purposes.

Raw Strava activity data is cached only transiently and is not retained for longer than 7 days, in line with Strava's API Policy. We retain only non-reversible aggregate training metrics derived from this data to power your training history. All Strava activity data is deleted immediately when you disconnect Strava or delete your account, and activity deletions on Strava are reflected in Athles within 48 hours.

Anonymised and aggregated data that cannot identify you may be retained indefinitely for analytical purposes.

8. DATA SECURITY

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. Access to personal data is restricted to authorised personnel on a need-to-know basis.

While we take reasonable precautions, no internet-based service can guarantee absolute security. You are responsible for keeping your login credentials confidential.

9. YOUR RIGHTS UNDER THE PDPO

Under the Personal Data (Privacy) Ordinance (Cap. 486), you have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete personal data
• Deletion: Request deletion of your account and associated personal data via Settings > Delete Account
• Opt-out: Disconnect third-party integrations and manage your notification preferences at any time via Settings

To exercise your rights, contact us at support@athles.ai. We will respond within 40 days as required by the PDPO.

10. COOKIES AND ANALYTICS

The Platform may use cookies and similar tracking technologies to maintain your session, remember your preferences, and collect anonymised usage analytics. You can manage cookie preferences through your browser settings, though disabling certain cookies may affect Platform functionality.

As described in Section 1.6, we also use session replay to review how users interact with the Platform interface for troubleshooting, security, and product improvement.

11. CHILDREN

The Platform is not intended for use by persons under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. Material changes will be notified to you via the Platform or by email. Continued use of the Platform after any update constitutes acceptance of the revised Policy. The effective date at the top of this page reflects the date of the most recent revision.

13. WEARABLE AND ACTIVITY DATA

Wearable and activity data. If you connect a device or platform, we collect activity and health data from your chosen provider: currently WHOOP, Oura, Polar, Garmin and COROS through their supported connections, and potentially other providers in future. We collect workout type, pace, distance, duration, moving and elapsed time, average and maximum heart rate, training load, weekly volume, and daily readiness inputs (heart rate variability, resting heart rate, and sleep), with the date and time of each activity. We collect this only after you connect a device and consent, and only what we need for the features below.

How we use it. This data powers your personal training log and calculates performance summaries for each sport. Public summaries use up to the latest 20 qualifying activities and appear only after at least five activities. They may also support matching with users of a similar level and volume. Race readiness remains private to you. Anonymised model-improvement contributions are governed separately below.

What others can see. Rounded pace, speed, distance and volume summaries are visible to other members by default, together with a confidence indication based on the amount and quality of evidence. Raw workouts, heart rate, sleep and recovery remain private. You can hide all orange verified performance metrics at any time under Settings > Privacy > Hide verified performance.

Help improve Athles is enabled by default for new and existing accounts. When enabled, Athles may use anonymised training data to train and evaluate its own matching and recommendation models. Strava data is excluded. You can opt out at any time in Settings > Privacy > Help improve Athles, without losing access to the service. Opting out stops future contributions; data already irreversibly anonymised cannot be linked back to your account for removal. This setting does not control a third-party AI provider’s data practices.

Strava. Where you connect Strava, we use it only to show your own activities to you in your feed. Strava data is not used to calculate your level and is never used for matching or shown to other users.

Providers and processors. We access each provider under its developer terms, and where you connect through Terra, Terra acts as our data processor to obtain data from your provider. We do not sell your personal data and do not share it with third parties for their own marketing.

Direct marketing. We only use your data for direct marketing if you give explicit opt-in consent, which is off by default. We never treat silence or a pre-selected option as consent, every marketing message includes a free opt-out, and you can withdraw in Settings at any time.

Your rights. You may ask whether we hold your data, request a copy, and request correction. You can disconnect any device in Settings to stop further collection, and request deletion of your wearable and activity data or your whole account in Settings. To make a request, contact support@athles.ai. We respond within the time the Hong Kong Personal Data Privacy Ordinance requires and may charge a reasonable fee for a data access request as permitted.

14. CONTACT US

For privacy enquiries, data access requests, or complaints, please contact:

If you are unsatisfied with our response, you may lodge a complaint with the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.