Contents
- 1.Who we are
- 2.What this policy covers
- 3.Personal data we collect
- 4.Why we process it, and our legal basis
- 5.Health data
- 6.Who we disclose personal data to
- 7.Connecting a training platform
- 8.International transfers
- 9.How long we keep personal data
- 10.Your rights
- 11.Automated processing
- 12.Cookies and similar technologies
- 13.Security
- 14.Children
- 15.Changes to this policy
- 16.Contact and complaints
1. Who we are
thedebrief.cc (“the service”) is a tool that analyses an athlete’s own race or training files and returns a written debrief. It is operated by Ruurd-Jan Zwarts, who is the data controller for the personal data described in this policy. “We”, “us” and “our” below mean Ruurd-Jan Zwarts.
You can reach us about anything in this policy at privacy@thedebrief.cc. A postal address is available on request. We have not appointed a Data Protection Officer; we are not required to.
2. What this policy covers
It covers personal data we process when you visit thedebrief.cc, upload a file for analysis, sign in, or send us feedback. It does not cover the practices of the third parties listed in section 6, each of which has its own policy.
3. Personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Contact data | Email address. | You, when you upload a file or sign in. |
| Athlete profile data | Age, gender, and optionally functional threshold power, race-simulation power and lactate-threshold heart rates. | You, in the upload form. |
| Race and activity data | Race name and date, finishing time, whether you were pursuing a qualifying slot, and the activity file itself, which typically contains a GPS track, heart rate, power, cadence, temperature and timestamps for the whole activity. | You. |
| Derived analysis | The metrics our engine computes from the file, and the written report produced from them. | Generated by the service. |
| Account data | Your verified email address, a display name derived from it, and sign-in timestamps. | You, when you sign in. |
| Connected account data | If you connect a training platform: your account identifier there, the display name it reports, the access you granted us, and the credential that access uses, held encrypted. | You, when you connect the platform. |
| Feedback | Anything you write in the feedback form, linked to the report it concerns. | You. |
| Technical and log data | Your IP address, browser user agent, and the time and outcome of requests to the site, recorded in our hosting provider’s server logs. We do not read these routinely; they exist so that faults and abuse can be investigated. | Collected automatically. |
| Usage data | Page views and counts of clicks on the upload button, collected by our analytics provider. These carry no email address, no report identifier and no cookie, and are not linked to your report or your account. | Collected automatically. |
Providing contact, athlete profile and activity data is a contractual requirement in the sense that the service cannot produce a debrief without it. You are not obliged to provide it, but if you do not, we cannot analyse your file.
4. Why we process it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Analysing your file and producing your debrief. | Performance of a contract (Art. 6(1)(b)): you asked us to. |
| Emailing you the link to your report. | Performance of a contract (Art. 6(1)(b)). |
| Operating accounts, verifying your email address and listing your reports. | Performance of a contract (Art. 6(1)(b)). |
| Understanding in aggregate how the service is used and where it fails, so we can improve it. | Legitimate interests (Art. 6(1)(f)): our interest in maintaining and improving the service. The data used for this does not identify you. |
| Connecting a training platform and importing a race you choose from it. | Performance of a contract (Art. 6(1)(b)): you asked us to connect it. |
| Acting on feedback you choose to send. | Legitimate interests (Art. 6(1)(f)): our interest in fixing what you tell us is wrong. |
| Keeping the service available and secure, and investigating faults or misuse using server logs. | Legitimate interests (Art. 6(1)(f)): our interest in a service that works and is not abused. |
5. Health data
An activity file records heart rate, and often other physiological measurements. Together with the threshold heart rates you may enter, this is data concerning health, a special category of personal data under Article 9 of the GDPR.
We rely on your explicit consent under Article 9(2)(a). You give it by ticking the consent box on the upload form. The box is not pre-ticked and the form will not submit until you tick it. We record when you gave it and which version of this policy was in force; the current version is 2026-09-13.
You can withdraw your consent at any time by emailing privacy@thedebrief.cc. Because the service cannot produce a debrief without processing the health data in your file, withdrawing also ends our arrangement: we stop processing and delete your uploads, files, analyses and reports. Withdrawal does not affect processing carried out before you withdrew, and it is as easy as giving consent was.
We do not use health data for anything other than producing your debrief and the aggregate, non-identifying counts described in section 4. We never use it for advertising, we do not sell it, and we do not disclose it to anyone beyond the processors in section 6.
6. Who we disclose personal data to
We do not sell personal data and we do not share it with advertisers. We disclose it to the categories of recipient below, each a processor acting on our instructions under a data processing agreement. A current list of the companies in each category, and where they are established, is available on request.
| Category of recipient | What they process | Why |
|---|---|---|
| Cloud hosting provider | Requests to the site, including IP addresses and user agents at the network level, and the server logs described in section 3. | Serving the site. |
| Managed database and file storage provider | Your email address, your account, your upload record, your activity file, and the analysis and report produced from it. | Storing your data. |
| Transactional email provider | Your email address, and the sign-in code or link we send to it. | Delivering sign-in emails. |
| AI language model provider | Computed values only. The metrics and findings our software has already determined, your age, gender, race name, race date, finishing time and any threshold figures you supplied, and, so that conditions on the day can be described, a single coordinate for the centre of the course, rounded to about a kilometre, and the start and end times of each leg. It does not receive your activity file, the GPS track of your route, your email address, or any account or report identifier. | Writing your report. |
Our analytics provider sits outside that description. It counts page views and clicks on the upload button; it receives no email address and no report identifier, and it sets no cookie. For the counts it produces it acts as a controller in its own right rather than on our instructions, so it is not a processor of ours and its own privacy notice governs what it does with them.
To describe the conditions on the day, we look up historical weather from Open-Meteo. That request contains a single coordinate for the geographic centre of the course, rounded to four decimal places, and the date range of the activity. It carries no identifier, no account reference and no name, so Open-Meteo is not a recipient of your personal data.
We may also disclose personal data where we are legally required to, or to establish or defend legal claims.
If we change or add a processor, we will update this section before the change takes effect.
7. Connecting a training platform
You can connect a training platform you already use, so that a race you have recorded there can be analysed without exporting the file and uploading it yourself. Connecting is optional and always will be: uploading a file by hand needs no account and no connection.
We ask the platform for the smallest access that does the job, which is permission to read your activities. We do not ask for permission to write to your training log, and we do not write to it.
What we hold. Your account identifier on that platform, the display name it reports, the access you granted, and the credential that access uses. The credential is encrypted before it is stored, and it is never displayed, written to a log, or sent anywhere other than back to that platform to identify you as its owner. When you pick a race to import we download that one activity file, and from that point it is treated exactly as a file you had uploaded yourself, including the health data described in section 5.
What the platform receives from us. Nothing about you. We authenticate as you and read; we send it no email address, no report, and no data from any other source.
Disconnecting. You can disconnect at any time from your account page, which deletes the stored credential. You can also revoke our access from your own settings on the platform, which works whether or not you tell us first. Disconnecting does not by itself delete reports already produced from imported races. Section 9 covers erasing those.
8. International transfers
Our processors are established in the United States, Singapore and Ireland. Where personal data is processed outside the European Economic Area and the United Kingdom, the transfer is made under the European Commission’s Standard Contractual Clauses, incorporated into that provider’s data processing terms, together with the International Data Transfer Addendum where the United Kingdom is involved. One processor is established inside the European Economic Area and transfers data onward to the United States under its own safeguards. You can ask us for details of any of this at privacy@thedebrief.cc.
9. How long we keep personal data
We retain the personal data described in section 3 for as long as the service operates, unless you ask us to delete it sooner. We do not currently operate an automatic deletion schedule.
You can have your data erased at any time by emailing privacy@thedebrief.cc. We will delete your uploads, your stored files, your reports and your account, and confirm when it is done. You do not need to give a reason. Aggregate counts that contain nothing identifying you may remain.
10. Your rights
If the UK GDPR or the EU GDPR applies to you, you have the right to: obtain confirmation of whether we process your data and a copy of it (access); have inaccurate data corrected (rectification); have your data deleted (erasure); restrict how we process it; object to processing carried out on the basis of our legitimate interests; and receive the data you gave us in a portable, machine-readable format. Where we rely on consent, including the explicit consent for health data in section 5, you may withdraw it at any time, and doing so is as easy as giving it: one email.
Exercise any of these by writing to privacy@thedebrief.cc. So that we do not hand your data to somebody else, we will ask you to write from the address on the account, or to confirm that the address is yours. We will respond within one month; if a request is complex we may extend that by up to two further months, and we will tell you inside the first month if we do. We will not charge you or treat you differently for asking.
11. Automated processing
Your report is produced in two stages. Our own software performs the analysis: it computes the metrics, applies the thresholds and determines the findings. A large language model then receives those findings, selects which matter most and writes them up as prose, which our software checks back against its own findings. Each report is a single request carrying no conversation history, no earlier reports and no data about any other athlete.
This is automated processing. It is not automated decision-making of the kind Article 22 concerns: nothing in the service produces a legal effect or a similarly significant effect on you.
12. Cookies and similar technologies
We set one cookie, and only if you sign in: a session cookie that keeps you signed in. It is strictly necessary for that function, so it does not require consent, and signing out clears it. Our analytics provider sets no cookies and does not track you across other sites. We use no advertising or third-party tracking cookies.
13. Security
Sign-in is passwordless, so there is no password of yours for us to lose. All traffic is served over HTTPS. A credential for a connected training platform is encrypted before it is stored, and if we cannot encrypt it we refuse the connection rather than keep it in the clear.
Each report is published at a long, randomly generated URL, so that you can send it to a coach or a training partner without either of you needing an account. It also means that the link is the key: anyone who has it can read the report, including anyone it is forwarded to. Report pages are excluded from search engine indexing, but you should treat the link itself as confidential.
No service is perfectly secure. If you believe you have found a vulnerability, please write to privacy@thedebrief.cc.
14. Children
The service is intended for adults; the upload form requires an age of 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact privacy@thedebrief.cc and we will delete it.
15. Changes to this policy
If we change this policy in a way that affects data we already hold, we will update the date at the top and describe what changed. Where the change is material and you hold an account, we will tell you by email.
16. Contact and complaints
For any question about this policy, or to exercise a right under section 10, write to privacy@thedebrief.cc.
If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with a data protection supervisory authority. Ours is the Autoriteit Persoonsgegevens in the Netherlands. You may also complain to the authority in the country where you live or work, or where you believe the problem occurred. We would ask you to raise it with us first so we have the chance to put it right.