Legal

Privacy Policy

Last updated: 24 October 2026 (company details, where our servers are, how the weather is looked up, the safeguards for AI processing; AI features now need your consent: AI features and your consent) · Effective immediately, except the new section How a session felt, which applies from 20 October 2026, and the new section Which screens you use, which applies from 1 November 2026

SPLIT / Get-Split ("we", "the platform") is operated by split (trading as Get-Split), a Danish sole proprietorship owned by Mark Morsing, CVR 46872703, Pinievej 40, 2880 Bagsværd, Denmark, and complies with the EU General Data Protection Regulation (GDPR). We are the data controller; reach us at [email protected]. This policy covers both the website and the SPLIT mobile app, and explains what data we collect, how we use it, and the rights you have over it.

1. Data we collect

Account data

• Email address, display name, password hash (salted PBKDF2-SHA256, 200,000 iterations; never stored in plaintext)
• Optional profile: tagline, avatar, height, weight, birth year
• Birth year (optional, the year only - never the day): used to size recovery and volume in your training plans and how fast a plan expects you to improve. It is stored with your account, never shown to other users, and you can remove it at any time under Settings, Profile
• Account creation timestamp, last-login timestamp, IP address of last session

Training data

• Activities synced from Garmin / Polar / Suunto via OAuth — GPS traces, heart rate, pace, cadence, power, all metrics your device recorded
• Manual activities you log, including notes
• Planned workouts, goals, race dates, target times
• Body composition (weight, body fat, muscle mass, hydration) — if synced from Garmin scale or entered manually

How a session felt (optional)

Applies from 20 October 2026. Until then SPLIT does not ask this question and stores nothing of this kind.

After a session, SPLIT may ask how it felt and whether anything hurt. This is health information, so here is exactly what happens with it.

• What we store: how the session felt (1 to 5) and, only if you choose one, a body site (for example left knee or calf) and a pain score from 0 to 10. It is stored with that one activity
• Why: only to adjust your coming sessions - when you ask the coach to adjust your week, it uses your answer to make the next run days easier. It is never shown to other users and never appears in the feed, on share cards or on your profile
• Legal basis: your explicit consent (GDPR Art. 9(2)(a)), which you give by answering. Answering is optional: Skip is always there, and skipping changes nothing else in SPLIT
• Who processes it: the same as your other training data - our own servers (section 3). If you write the coach a question about that session, the answer is included with your question and goes to the AI provider named in section 4, like the rest of the coach's context
• How long: it is kept with the activity. It is deleted when you delete the activity or your account, and you can delete a single answer at any time on the activity's page (Delete answer). After that the session is not asked about again
• Your rights: withdrawing consent is deleting the answer; everything in section 5 - access, export, correction, deletion, objection - applies to it as well

Mobile app data

• Location: precise GPS while you record an activity, including in the background so recording continues with the screen locked. Location is used only to record your route and live-track a run you start — never collected when you are not recording.
• Messages: direct messages between friends are stored encrypted, never as plain text. The key belongs to your account rather than to one handset, so your conversations are readable on every device you sign in on. That also means we hold the key and are technically able to read message content; we do not, except where we are legally required to. If you need a conversation nobody but the two of you can ever open, use a dedicated end-to-end encrypted messenger instead of this one.
• Push token: a device notification token (via Apple/Expo) so we can notify you of likes, comments, follows, messages, and off-route alerts. You can disable notifications in your OS settings.
• Photos you attach (activity photos, avatar) — only images you explicitly pick.
• Screenshots you attach to a bug report — seen only by the SPLIT team, stripped of location and camera data, and deleted after 90 days.

Usage + technical data

• Session cookie to keep you logged in (session, 30-day sliding expiry, HttpOnly, Secure)
• Browser user-agent + version for compatibility debugging
• API request logs (IP, path, timestamp) — retained 14 days then deleted

Which screens you use

Applies from 1 November 2026. Until then SPLIT measures nothing of this kind.

• What we measure: how long each screen and panel of SPLIT is on your screen, on the website and in the app, paused whenever the app or the browser tab is in the background. Only the names of our own screens and panels are recorded, never what is on them
• Why: to decide what to improve next. Only totals across members are ever shown, to the SPLIT team, and never to other members; a total that covers fewer than 3 people is not shown at all
• Legal basis: our legitimate interest in improving the service (GDPR Art. 6(1)(f)). It runs on our own servers; no third party sees it, and it is not advertising or cross-site tracking
• How long: stored with your account for 90 days, then combined into daily totals that no longer say who they came from
• Switching it off: under Settings, Privacy, "Share which screens I use", on the website and in the app. Switching it off stops the measuring and deletes what was already stored for you

2. How we use it

• Deliver the service: render your dashboard, calculate stats, generate training plans, push structured workouts to Garmin
• Improve training recommendations: the AI Coach reads your last 30 days of data to give contextual advice
• Social features (optional): share activities with friends you follow, participate in challenges, send encrypted direct messages
• Your home and privacy zone (optional): if you save a home under Settings, Privacy, it is used to hide where your activities start and end, within the distance you choose, from everyone but you (the feed, activity maps, share cards and segment leaderboards); to keep the start and finish of every segment at least 200 m from any home; and as the start of routes you build. Your home is never shown to anyone else. A suggested home, worked out from where your activities most often start, is shown only to you and saved only if you confirm it
• Live tracking + safety: record your route and warn you when you drift off a planned route
• Billing (premium users): process subscription payments via Apple In-App Purchase (in the app) or LemonSqueezy (on the web)

We never sell your data, and we never use it to train AI models. Where an AI provider processes your data on our behalf, it is named in section 4.

3. Where it lives

• Primary server in the EU (Contabo GmbH). A standby server at netcup GmbH (Nuremberg, Germany) holds a copy of the database for failover
• PostgreSQL database on that server. The disk is not currently encrypted at rest; access is limited to key-based SSH and the application service. Encryption at rest is on our roadmap, and this line changes when it ships
• Nightly database dumps kept on the same host for 14 days, then deleted. Until 5 September 2026 a compressed copy of the database was also pushed nightly to a private repository at GitHub (GitHub, Inc., USA); that transfer has been stopped and the historical copies are being deleted
• LemonSqueezy (merchant of record for web purchases) and Apple hold your payment details — we only see a subscription status
• Garmin Connect OAuth tokens stored server-side and never exposed to your browser
• Direct messages are stored as ciphertext only — never as plain text, and decrypted only in the app with your account's key

4. Third parties

• Garmin: receives push requests when you schedule workouts; we send workout structure + target date, nothing else
• Polar / Suunto: we only READ from these. Your activities flow in from them when you connect an account; we never send them your workouts or any other data, and they are not a destination for anything you enter here
• Wahoo: only if you connect it. Receives the planned sessions you choose to send it (workout structure, targets and date) and, if you switch it on, a summary of activities you record in SPLIT (sport, date, duration, distance, average heart rate). Your Wahoo workouts flow in to us. You choose which sports go there under Settings, Device connections
• LemonSqueezy / Apple / RevenueCat: premium-tier billing — Apple In-App Purchase processes app subscriptions, RevenueCat records subscription status, LemonSqueezy (Lemon Squeezy, LLC, USA) is the merchant of record for web payments. None receive your training data
• Brevo: (Sendinblue SAS, France) delivers our transactional email — verification, password reset, account notices. Receives your email address and display name
• Apple / Expo: delivery of push notifications (device token only)
• AI features (only with your consent): the coaching chat, the weekly review, automated activity summaries and the “deep analysis” option are generated with Claude by Anthropic (Anthropic PBC, USA), which processes the data on our behalf. A language model on our own EU server answers instead when Claude is unavailable, when our monthly budget for it is used up, or when you have not opened SPLIT for 14 days. Neither runs unless you have allowed AI; see AI features and your consent below. To Anthropic we send, along with the question you ask the coach, your recent activities (distance, pace, heart rate, training load, notes you wrote), from 20 October 2026 how a session felt and any pain you reported for it when your question is about that session, VO2max, readiness and training-status metrics, goals, age and display name. We do not send your email address. Because Anthropic is outside the EU/EEA this is an international transfer; Anthropic processes it under its Data Processing Addendum, which is part of its Commercial Terms and includes the EU Standard Contractual Clauses for the transfer, and under those terms it may not train its models on our data
• Weather: the weather for a run, an upcoming session or your home is looked up from a rough area of a few kilometres, never your exact position, and the request contains nothing about you
• Map tiles: Esri (Esri Inc., USA) on the website and VersaTiles (OpenStreetMap data, hosted in Germany) in the app. Your browser or app requests tiles directly, so the provider sees your IP address and the map area you view, not your identity
• Route building and address search: OpenRouteService (HeiGIT, Germany) and Nominatim (OpenStreetMap Foundation) receive the coordinates or address text you enter, not your identity

AI features and your consent (AI Transparency Statement)

SPLIT uses AI only if you allow it. We ask once - at sign-up, with a box that starts unticked, or the next time you open SPLIT - and you can give or withdraw your consent at any time under Settings, Privacy, on the website and in the app. Without it the AI features are off: no model reads your data, and plans, analysis numbers, charts and every other feature work as before.

• What is sent: your recent activities (distance, pace, heart rate, laps, training load and notes you wrote), your plan and goals, fitness numbers such as VO2max and threshold, and the question you ask. This can include data from Garmin and your other connected devices. Never your email address or password
• To whom: Claude, an AI model made by Anthropic (USA), which processes it on our behalf. When Claude is not available, a language model on SPLIT's own server in the EU answers instead. Nobody else
• What for: only to write what you asked for: coach replies, activity summaries, the deep analysis and the weekly review
• Never for training: we never use your data, or anything worked out from it, to train, evaluate or improve any AI model, and Anthropic does not train its models on it. Data from Garmin is covered by the same rule
• How to withdraw: turn AI off under Settings, Privacy. It takes effect immediately: from your next request nothing more is sent to any AI model. Texts the AI already wrote for you stay in your account
• Legal basis: your consent (GDPR Art. 6(1)(a)); where the data includes health data, your explicit consent (Art. 9(2)(a))

No advertising networks, no tracking pixels, no Google Analytics. The screen-time measuring described under Which screens you use is our own and never leaves our servers.

5. Your rights under GDPR

• Access: export every byte of your data via Settings → Privacy → Export account data — available on every tier, never behind a paywall
• Deletion: request full account deletion from Settings; data is purged within 14 days (backups rotate out within 14)
• What deletion leaves behind: one row recording that your email address has already used its free trial. It holds a one-way cryptographic hash of the address — not the address itself — and two yes/no flags. It cannot be reversed to identify you, is never used to contact you or to rebuild your account, and exists only so a free trial cannot be claimed repeatedly by deleting and re-creating an account. We keep it under our legitimate interest in preventing abuse (GDPR Art. 17(3)); everything else about you is erased
• Correction: edit profile + metric overrides directly in Settings
• Portability: one-click archive with your full account as JSON, activities as CSV, and a GPX track per GPS activity
• Withdrawing consent: turn AI or health data off under Settings, Privacy at any time; it is as easy as giving it
• Objection: email [email protected] to object to any processing

6. Cookies

We use these cookies:

• session — required, keeps you logged in
• split_ref — set only when you arrive through a referral link (?ref=); keeps the campaign code for 30 days so the referrer is credited if you sign up. It contains the campaign code only. Your dark/light preference is kept in your browser's local storage, not in a cookie

No advertising cookies and no cross-site tracking.

7. Children

SPLIT is not intended for users under 16. If you believe a child has created an account, email [email protected] and we will delete it immediately.

8. Changes to this policy

Material changes are announced on the home page 14 days before taking effect. The "Last updated" date above always reflects the current revision.

9. Contact

Data Protection questions: [email protected]
General support: [email protected]
Data Protection Authority (DK): Datatilsynet