Privacy policy

Who we are

DataFrame (https://dataframe.fit) is a free training dashboard for endurance and hybrid athletes, operated by Scope Limited. Scope Limited is responsible for the personal data described in this policy. DataFrame is not affiliated with or endorsed by Garmin, Polar, WHOOP, TrainingPeaks, MyWhoosh, Google, or other fitness brands.

This policy explains what we collect, how we use it, who receives it, and how you can see, correct, export or delete it, or withdraw your consent. It covers Google Sign-In, optional Google Calendar sync, the training data you connect from Garmin, Polar, WHOOP, TrainingPeaks and MyWhoosh, coaches you invite, and AI assistants you connect.

Google Sign-In

You sign in with Google. Sign-In only requests identity scopes: openid, email, and profile. We use that to create or recognise your DataFrame account. We do not receive Calendar access from Sign-In, and we do not keep the Google access token from Sign-In.

We store your Google account identifier (subject), email, name, and profile picture so you can stay signed in. The app session is a signed cookie on dataframe.fit, not a Google token.

Optional Google Calendar sync

If you tap Connect Google Calendar on the Calendar page, we ask Google for a separate permission: calendar.app.created. That lets DataFrame create one secondary calendar named DataFrame.fit and write events only on calendars we created.

From the moment you opt in, we write upcoming planned sessions and races as all-day events, then update or add timed events when a watch activity syncs. We do not dump your history. We do not read your other calendars, meetings, or email.

To keep writing after you close the browser, we store a Google refresh token on the server in your athlete folder. We use it only to create, update, and delete DataFrame.fit calendar events.

• We do not sell Google user data
• We do not use Calendar data for advertising or independent research
• We do not share Calendar data with other athletes or third-party ad networks
• Stop syncing on the Calendar page revokes the token and deletes the DataFrame.fit calendar

Garmin data

Garmin's official connection: when you connect Garmin, you approve DataFrame on Garmin's own consent screen and choose what Garmin may share. Garmin then sends us that data from the day you connect: activities (summaries and activity files with GPS, heart rate, pace, power and laps) and daily health data (such as steps, sleep, resting heart rate, heart rate variability, stress, Body Battery, Pulse Ox, respiration and body composition). If you send planned workouts to your watch, we send those workouts to your Garmin account. You can change what Garmin shares, or remove DataFrame, in Garmin Connect at any time. When you do, Garmin tells us and we stop receiving that data.

Garmin Connect sign-in (optional): some data is not available through Garmin's official connection, such as your training history from before you connected, training readiness, training status, lactate threshold, race predictions, personal bests and gear, and actions such as renaming an activity or sending nutrition to Garmin. If you choose to add Garmin Connect, you sign in to Garmin Connect through DataFrame. We keep the sign-in token Garmin issues, never your password, and use it only to fetch that data and carry out the actions you ask for. You can remove it in Settings at any time.

We use Garmin data only to show you your own training and health in DataFrame and to share it in the ways described below that you choose. We do not sell Garmin data, and Garmin data and anything derived from it is never used to train, evaluate or improve AI models.

Training and account data

If you connect Garmin, Polar, WHOOP, TrainingPeaks or MyWhoosh, we store activities, wellness, plans, nutrition logs, races and settings in your private athlete folder on our servers so the dashboard can work. That data stays behind sign-in unless you share it in one of the ways below.

Share cards are images you choose to download or post. A public activity link only shows what you selected, and you can turn it off.

How we use your data

We use the data you connect only to run DataFrame for you:

• Show your activities, laps, heart rate, pace, power and training load
• Show sleep, recovery and daily health trends
• Compare planned sessions with completed ones and track fitness and form
• Send planned workouts to your watch or calendar when you ask
• Send account emails and the training summaries you have switched on
• Share data with a coach or AI assistant only when you choose to

Who receives your data

We do not sell your data and we do not share it with advertisers or data brokers. These parties receive or process it, only for the purposes listed:

• Our hosting provider, which runs the servers where DataFrame and your data are stored
• SendGrid (Twilio), which delivers our emails. It receives your email address and the email content, which can include training summaries you have switched on
• Google, for Sign-In and, if you switch it on, Calendar sync. Google Analytics receives the pages you visit and basic device information, not your training data
• OpenStreetMap, OpenFreeMap and Esri, which supply map images. Your browser requests the map area around a route; no account data is sent
• The services you connect (Garmin, Polar, WHOOP, TrainingPeaks, MyWhoosh), when you ask us to send something to them, such as a workout to your watch
• A coach you invite, limited to the data you allow. You can change or remove their access in Settings, My coaches
• An AI assistant you connect, as described in the next section
• Authorities, only where the law requires it

AI assistants (AI transparency)

DataFrame itself does not use AI to process your training or Garmin data.

You can choose to connect an AI assistant (such as Claude, ChatGPT or Cursor) to your DataFrame account through our MCP connection. Nothing is shared until you approve that assistant on dataframe.fit and choose what it may view or change. When you then ask the assistant something, it receives the data it needs to answer, which can include Garmin data. That data is processed by the assistant's provider under their own terms and privacy policy.

You can see every connected assistant, and withdraw access at any time, in Settings, Connections, Connected AI agents. Withdrawing stops any further access.

Cookies and logs

We use a signed session cookie to keep you logged in, plus short-lived cookies during sign-in and when you connect a service. Google Analytics sets cookies to count visits. We keep ordinary server logs (time, path, errors) to run the site. We do not run advertising cookies.

How long we keep data

Account and training data stay until you delete them, delete the account, or ask us to remove them. When you disconnect a service, we stop receiving new data from it; what was already imported stays in your account until you delete it. Google Calendar tokens and the DataFrame.fit calendar are removed when you stop syncing. If a Calendar refresh token stops working, we stop writing until you connect again.

Your rights and choices

You can:

• See your data at any time in the app
• Correct it - edit planned sessions, rename activities, and change your profile and settings
• Export it - download any activity as a FIT or GPX file from the activity page, or ask us for a full copy of your data and we will send it within 30 days
• Delete it - open Settings, Profile, then Delete account to permanently remove your account and the training data we store
• Withdraw consent - disconnect Garmin, Polar, WHOOP, TrainingPeaks, MyWhoosh or Google Calendar in Settings, remove DataFrame in Garmin Connect, remove a coach, or revoke an AI assistant, without deleting your account
• Complain to the data protection authority where you live if you think we have handled your data wrongly

Contact

Questions about this policy or requests about your data: open https://dataframe.fit/support, send an idea from the signed-in app, or message @dataframe.fit on Instagram. The Google OAuth consent screen lists the support email we read for Calendar verification.