Privacy Policy

Who is responsible for your data

The data controller is MB Clearstack Labs, a private limited company (mažoji bendrija) registered in Vilnius, Lithuania. You can reach us about anything in this policy at [email protected].

We have not appointed a statutory Data Protection Officer. Privacy questions go to the address above and are handled by the founder.

What we collect

Account data: your email address, a hashed form of your password, your language preference, and your first name if you choose to give one.

Wearable and health data, once you connect a source: workouts and activities (type, start time, duration, distance, average and maximum heart rate, calories), daily metrics (resting heart rate, heart-rate variability, sleep duration and sleep score), and the model of the device that recorded them. If you connect Apple Health, the Bėga app reads this data on your iPhone with your permission and uploads it to Bėga. If you connect Garmin, you authorize Bėga in Garmin Connect and Garmin sends the data to Bėga directly. Bėga requests roughly 28 days of history when you first connect so the model is useful on day one.

Training inputs you provide: session effort ratings, manually logged strength sessions, and the feedback you give the coach when you accept, decline, or renegotiate a workout.

Feedback you send us: the comment you write, an optional screenshot you attach, and technical context (app version, device model, operating system, language, and the screen you were on) sent along with it so we can act on the report without writing back to you first. A screenshot may contain anything visible on your device at the time - be mindful of what you capture.

Coaching conversations: the messages you exchange with the AI coach, and the readiness context assembled for each reply.

Planned workouts Bėga generates and pushes back to your watch.

Technical data: IP address, browser or device user-agent, request timestamps, and server logs, collected automatically when you use the app or site.

Waitlist data: if you join the early-access list, your email address and chosen language, and nothing else.

Health data

Heart-rate variability, resting heart rate, sleep metrics, and the readiness scores derived from them are data concerning health under Article 9 of the GDPR.

We process this category of data only on the basis of your explicit consent, which you give when you connect a wearable, and only to produce your readiness signal and the coaching built on it. You can withdraw that consent at any time by disconnecting the wearable in the app, or for Garmin by removing Bėga from the connected apps in Garmin Connect; we then stop retrieving new data and delete or anonymise what we hold in line with the retention section below.

Why we process it, and our legal bases

To provide the service you asked for, reconciling your training load, producing readiness, coaching you, and writing workouts to your watch, on the basis of our contract with you (Article 6(1)(b)).

To process health data specifically, on the basis of your explicit consent (Article 9(2)(a)).

To keep the service secure, debug problems, prevent abuse, and improve how readiness is calculated, on the basis of our legitimate interests in running a reliable product (Article 6(1)(f)); we use aggregated or de-identified data for this wherever we can, and never to train AI or machine-learning models.

To contact you about early access, if you joined the waitlist, on the basis of your consent, which you can withdraw with one reply.

Who we share it with

We do not sell your personal data and we do not use it for advertising or profiling unrelated to coaching. We do not use your data for cross-app or cross-site tracking, and we do not share it with data brokers.

Data you receive from Garmin is used only to produce your own readiness signal, coaching, and training plan, and to send the workouts you accept back to your watch. Wherever Bėga shows it, we label it with Garmin and the device that recorded it.

Apple and Garmin are where your wearable data comes from, not processors acting for us. When you connect Garmin, Garmin also receives the planned workouts Bėga sends to your watch. Their own privacy policies cover what they do with your data.

We rely on a small number of processors who act on our instructions. This is the complete list of third parties that receive or process your data, including data received from Garmin:

• Hetzner Online GmbH (Germany) hosts Bėga's servers and database. All account, training, and wearable data, including data received from Garmin, is stored there, in the EU.
• OpenRouter, Inc. (United States) routes the coach's requests to the AI model, and Anthropic, PBC (United States) runs that model (Claude). Only if you allow AI coaching, the messages you send the coach and the training context for each reply - which can include activities, sleep, heart-rate variability, and resting heart rate received from Garmin - are sent to them to generate the reply. See AI Transparency Statement below.
• Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging) deliver notifications to your phone. The notification text can mention your planned session or readiness.
• Functional Software, Inc. (Sentry, United States) receives error reports when something breaks in the app or on our servers, so we can fix it. Reports carry technical details such as the app version and the failing request; we configure it not to collect personal data, and it is not used to store or analyze your training data.
• Resend, Inc. (United States) delivers transactional and waitlist email on our behalf - account verification, password resets, and product updates. It receives your email address only, never training or Garmin data.

We may also disclose data where the law requires it, or to establish or defend legal claims.

AI Transparency Statement

Bėga uses a large language model (LLM) - Claude, made by Anthropic and reached through OpenRouter - for its AI coaching: replies in the Coach tab, your weekly plan, the coach's note on each session, and the weekly review. To do this, each request sends the model the messages and training context it needs to respond, which can include data received from Garmin (activities, sleep, heart-rate variability, resting heart rate) and the readiness Bėga calculates from it. We never send your email address, password, or payment details.

AI coaching runs only with your explicit consent. Bėga asks for it before the coach first uses your data, and does not send anything to the model until you allow it. You can withdraw consent at any time in the app under You → AI coaching: the coach then stops sending your data to the model, and AI coaching stays off until you allow it again. Your readiness score, training history, and the workouts already on your plan keep working without it, because Bėga calculates readiness itself, without the AI model.

The model provider processes the text only to return a response and, under the API terms we rely on, does not use it to train its models. The coach's replies and your messages are stored in your account so the conversation can continue, and are deleted with it.

We do not use your data, including any data received from Garmin, to train, fine-tune, or otherwise develop AI or machine-learning models, ours or anyone else's. Bėga's readiness model adapts to you by calibrating against your own history; that calibration stays in your account and is never applied to other users.

AI output can be wrong. The coach gives training guidance, not medical advice, and you can decline or renegotiate anything it proposes. See Automated decisions below.

International transfers

Some of the processors above are located outside the European Economic Area, including in the United States. Where data is transferred there, we rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision as the transfer mechanism.

How long we keep it

Account and training data are kept while your account is active. If you delete your account, we delete or irreversibly anonymise your personal data within 90 days, except where we must keep something longer to meet a legal obligation or resolve a dispute.

Server logs are kept for up to 12 months.

Feedback reports, including any screenshot, are kept for up to 12 months, or until your account is deleted, whichever comes first.

Waitlist emails are kept until the beta programme ends or you ask to be removed, whichever comes first.

Your rights

You can delete your account at any time from Settings in the app. If you no longer have the app installed, email [email protected] from your account's address and we will delete it for you - you do not need to reinstall the app or log in.

You can see your data in the app - activities, sleep, readiness history, body details, and coaching conversations - and correct your body details and session effort in it. Disconnecting a wearable in the app (You → Sources) withdraws your consent for that source and stops syncing. The data we already received stays in your account, so a new watch picks up where the old one left off, unless you choose Delete history when you disconnect - then we delete it within 24 hours. For Garmin, removing Bėga from the connected apps in Garmin Connect withdraws consent and deletes that data within 24 hours.

Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable format (we send a machine-readable JSON export). You can withdraw any consent you have given without affecting processing that already happened. Exercise any of these by emailing [email protected]; we respond within one month.

If you believe we have handled your data unlawfully you can complain to the State Data Protection Inspectorate of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the supervisory authority where you live.

Automated decisions

Your readiness score and the workouts Bėga proposes are produced automatically. They are advisory: you can always override them, and none of them produces a legal or similarly significant effect on you within the meaning of Article 22 of the GDPR.

Children

Bėga is not intended for anyone under 16. We do not knowingly collect data from children; if you believe a child has used the service, contact us and we will delete the account.

Security

We encrypt data in transit, store passwords only in hashed form, and limit access to production data to people who need it. No system is perfectly secure, and during the beta you should not treat Bėga as a system of record for anything you cannot afford to lose.

Changes to this policy

We will post any changes on this page and update the date above. If a change materially affects how we use your data, we will tell you by email before it takes effect.