hiron
Log in

Privacy Policy

Last updated: 2026-10-02

Data controller

Hiron is operated by Hiron prosta spółka akcyjna, a Polish simple joint-stock company. The company is the data controller for personal data processed via the Hiron product, including its web and mobile apps and the integrations you authorize.

  • Legal name: Hiron prosta spółka akcyjna
  • KRS: 0001240969
  • NIP: 6731923047
  • REGON: 544728364
  • Email: [email protected]

What we collect

We collect the following categories of personal data:

  • Account data: email address, name, sign-in identifiers (login codes, Google account or passkey), language and timezone.
  • Athlete profile and onboarding answers: age, sex, training background, goals, races, available training time and performance metrics such as FTP, threshold pace or CSS.
  • Health-related data you choose to share: for example current or past injuries you report in the onboarding survey, weekly check-ins or chat. We process this data only with your explicit consent.
  • Training and activity data: workouts and activities you upload or sync from connected services, completed sessions and your weekly check-in answers.
  • Coach chat: the messages you exchange with the AI coach.
  • Voice recordings: if you dictate a chat message, the audio is sent for transcription and is not stored after the text is produced.
  • Usage and technical data: device push notification tokens, email delivery events and technical logs needed to operate and secure the service.

How we use it

We use this data to:

  • generate, adapt and analyse your personalized training plan and sessions;
  • run the coach chat and answer your questions;
  • send you service emails (e.g. login codes, important account notices) and, if you enable them, push notifications such as workout reminders;
  • keep the service secure, prevent abuse and debug problems;
  • improve the quality of the product, including reviewing how our AI features perform;
  • send you the newsletter and product updates, only if you opted in; you can unsubscribe at any time.

Legal bases

We only process your data when we have a proper reason to:

  • Most of what we do (your account, training plans, analyses, authorized activity sync and the coach chat) is needed to provide the service you signed up for.
  • Some things happen only with your consent: processing health-related data, the newsletter and analytics cookies. You can withdraw consent at any time.
  • A few things are in our legitimate interest as the operator of the service: keeping Hiron secure, preventing abuse and improving the product.

Garmin data

When you connect your Garmin account through Garmin Connect™, we receive data recorded by your Garmin device via the Garmin Connect Developer Program APIs. This includes activity summaries and activity details such as sport type, duration, distance, pace, speed, heart rate, power, cadence, elevation and calories, and (if you grant the corresponding permissions) Garmin health and wellness data recorded by your device. We only receive the data types covered by the permissions you grant on Garmin's consent screen. We also send the structured workouts from your training plan to your Garmin device. Your use of Garmin Connect™ itself is governed by Garmin's own privacy policy.

We use Garmin data solely to provide Hiron's core features: matching completed activities to your training plan, analysing your sessions, and generating and adapting your personalized training plan. Analyses and plans produced by our AI features are derived in part from Garmin device-sourced data. We never sell Garmin data and we do not use it for advertising.

Garmin data is stored in our database for as long as your account exists. Garmin access tokens are stored encrypted (AES-256-GCM). Raw data payloads received from Garmin are additionally kept for up to 30 days for troubleshooting. If you disconnect your Garmin account (in Hiron or in Garmin Connect™), we stop receiving new Garmin data. You can request deletion of previously synced Garmin data at any time via [email protected]; deleting your Hiron account removes it as well.

Garmin data is shared with or processed by third parties only to the extent necessary to deliver the service: OpenRouter and the AI model providers it routes requests to (such as Anthropic or Google) process relevant excerpts of your training data to generate analyses and training plans, and our hosting providers store it on our behalf. We do not share Garmin data with any other third parties.

Garmin® and Garmin Connect™ are trademarks of Garmin Ltd. or its subsidiaries.

COROS data — planned integration

Direct COROS integration is not yet available. The following describes the intended processing once the integration is enabled and you authorize it. We do not currently collect data through a direct COROS connection.

With your authorization, we will receive COROS account identifiers and authorization tokens, activity summaries and detailed workout files (including time, distance, pace, heart rate, power and GPS routes where available). If enabled and you explicitly consent, we will also receive relevant daily health and recovery metrics, such as sleep, resting heart rate and HRV.

We will use this data to show your training history, match activities to your plan, analyse training load and progress, and personalize training and recovery recommendations. If you enable workout export, we will send structured workouts and training plans from Hiron to your COROS account.

You will be able to revoke access in the integration settings. Revoking access stops future synchronization; it does not itself delete previously imported data. You can request deletion or delete your Hiron account using the options described below.

The legal bases, AI processing, service providers, international transfers, retention and user rights described in this policy also apply to COROS data. Relevant training and recovery data may be included in AI analysis as described below; health-related data requires your explicit consent. COROS will receive the workouts and plans you choose to synchronize.

Polar data

When you connect your Polar account (Polar AccessLink), we receive the training sessions you sync to Polar Flow after connecting and your sleep and Nightly Recharge data from the last 28 days (sleep times and duration by stage, overnight HRV). For sessions: sport type, start time, duration, distance, pace, speed, heart rate, power, cadence, elevation, calories and GPS route where available. We store your Polar user identifier and an access token (encrypted, AES-256-GCM). We do not send anything to your Polar account.

We use Polar data to match completed sessions to your training plan, analyse them and adapt your plan. Sleep and HRV are used as context for your plan and coach, and are shown in your Health tab and in the daily readiness check. We never sell Polar data and do not use it for advertising.

Before you connect, Hiron asks for your explicit consent to send relevant excerpts of your Polar training data to external AI service providers, as described in "AI processing". Without that consent Polar is not connected. Our hosting providers store the data on our behalf; we do not share it with anyone else.

You can disconnect Polar in your profile at any time: this withdraws your consent, revokes Hiron's access at Polar and stops new imports. Disconnecting also deletes the imported sleep and HRV data. Previously imported sessions stay in your account until you delete them or your account; deleting your Hiron account also de-registers it at Polar.

Hammerhead Karoo data

When you connect your Hammerhead account, we receive the rides recorded on your Karoo from the last 30 days and every new ride afterwards, as FIT files: sport type, start time, duration, distance, speed, heart rate, power, cadence, elevation, calories and GPS route where available. We store your Hammerhead user identifier and access tokens (encrypted, AES-256-GCM). We send your planned bike workouts for the next 7 days and your FTP to your Hammerhead account so they appear on your Karoo.

We use Hammerhead data to match completed rides to your training plan, analyse them and adapt your plan. We never sell Hammerhead data and do not use it for advertising.

Before you connect, Hiron asks for your explicit consent to send relevant excerpts of your Karoo training data to external AI service providers, as described in "AI processing". Without that consent Hammerhead is not connected. Our hosting providers store the data on our behalf; we do not share it with anyone else.

You can disconnect Hammerhead in your profile at any time: this withdraws your consent, revokes Hiron's access at Hammerhead and stops new imports. Previously imported rides stay in your account until you delete them or your account; deleting your Hiron account also revokes the link at Hammerhead.

Hiron watch apps (Wear OS and Apple Watch)

When you record a workout with the Hiron app on your Wear OS watch or Apple Watch, the watch collects your heart rate (through Health Services on Wear OS or HealthKit on Apple Watch) and, for outdoor sports, your location (GPS). Both are read only while a recording is running, including with the screen off, and never in the background otherwise. The watch also keeps a copy of your upcoming sessions so it works without the phone.

The recording (time, distance, route, heart rate and the steps of the planned session) is uploaded to your Hiron account and used like any other activity: matched to your training plan, analysed and used to adapt your plan, as described in "AI processing". We never sell this data and do not use it for advertising.

You can revoke the heart rate or location permission at any time in the watch settings; the app then records without it. Deleting your Hiron account removes this data.

AI processing

Training plans, session analyses and the coach chat are generated with large language models. To do this we send relevant excerpts of your data (athlete profile, training and wellness data, and your chat messages) to OpenRouter, which routes them to the model provider used for that feature (such as Anthropic or Google). We never sell your data and do not allow it to be used for advertising. These requests are sent without your name or email address, and our AI routing only uses providers that do not retain your data or use it to train their models. If you dictate a chat message, the recording is sent directly to OpenAI to be transcribed into text. This is the one case where we send data to a model provider ourselves instead of through OpenRouter. We do not store the recording anywhere: it exists only for the duration of that request, and only the resulting text is saved, as an ordinary chat message.

Hiron does not make automated decisions about you that produce legal or similarly significant effects. Plans and analyses are training suggestions. You stay in control of what you follow.

Cookies and analytics

Hiron uses cookies that are necessary to run the service: they keep you signed in, remember your language and store your cookie choice.

With your consent, we also use Google Analytics to understand how Hiron is used. Analytics stays off until you accept it in the cookie banner, and we do not use any advertising cookies. You can withdraw your consent at any time by deleting the site's cookies in your browser. You will then be asked again.

Third parties and international transfers

We rely on the following providers and share your data with them only to the extent necessary to deliver the service: Garmin (training and wellness data sync), Polar (training session import, only if you connect it), OpenRouter and its model providers such as Anthropic and Google (AI inference), OpenAI (transcribing dictated chat messages), Mailgun (transactional email), Google (sign-in, Android push delivery and, with your consent, analytics), Apple (iOS push delivery) and our hosting providers (servers and database). When the planned COROS integration is available and you authorize it, COROS will also be a provider for activity, health and training plan synchronization.

Some of these providers process data outside the European Economic Area, in particular in the United States. Such transfers are protected by safeguards recognised by the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision (e.g. the EU-US Data Privacy Framework).

Data retention

We keep your personal data for as long as your Hiron account exists. You can delete your account at any time in the app or by emailing [email protected]. This permanently removes your personal data from our database. Raw data payloads received from Garmin are deleted after at most 30 days, and we retain specific records only where the law requires it.

Your rights

Under the GDPR you have the right to access, rectify, export (data portability), delete and restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw any consent at any time (without affecting the lawfulness of processing before the withdrawal). Email [email protected] to exercise any of these rights.

You can also delete your account and your data yourself, at any time and without contacting us. See Delete your Hiron account.

You also have the right to lodge a complaint with a data protection authority: in Poland, the President of the Personal Data Protection Office (UODO), or the authority in your country of residence.

Children

Hiron is not directed at children under 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

Changes to this policy

We may update this policy as Hiron evolves. The current version is always available on this page with the date above; if we make material changes we will notify you in the app or by email.

Contact

Product questions: [email protected].

Privacy and data-controller matters: [email protected].