Last updated: 30 May 2026
UltraFlow is an AI-powered daily training report service for mountain ultra runners. We take privacy seriously — especially because we handle sensitive health data. This policy explains what we collect, why, and how you stay in control.
Tomasz Zuchlke — Founder, UltraFlow
Katowice, Silesia, Poland
Email: tomek@ultraflow.run
Website: ultraflow.run
| Category | Data | Source |
|---|---|---|
| Account data | Email address, Telegram username | You provide at registration |
| Health data (sensitive) | HRV (overnight, trend), resting heart rate, sleep (duration, stages, score) | Garmin Connect API, Coros, Suunto — via Runalyze API |
| Training data | Training load (ATL, CTL, TSB, A:C ratio), activities (type, duration, distance, HR, power), VO₂max | Garmin Connect API, Coros, Suunto — via Runalyze API |
| Body composition | Body weight (optional) | Runalyze API |
| Athlete profile | Upcoming races, injury history, dietary notes (e.g. IBS/FODMAP), current training phase | You provide during onboarding |
| Subjective data | Energy, motivation, soreness (1–10, evening check-in) | You provide via Telegram reply |
We do not use your data for advertising, commercial profiling, or sell it to any third party — ever.
UltraFlow connects to your training data through Runalyze as the primary data hub:
| Device | Integration | What We Access |
|---|---|---|
| Garmin | Garmin Connect → Runalyze → UltraFlow | HRV, sleep, training load, activities, VO₂max |
| Coros | Coros → Runalyze → UltraFlow | Training load, activities, sleep (where available) |
| Suunto | Suunto → Runalyze → UltraFlow | Training load, activities |
| Any device | Manual .FIT file upload | Activity data from the uploaded file only |
We never store your Garmin, Coros, or Runalyze passwords. Access is granted via Runalyze Personal API token that you generate in your Runalyze account and can revoke at any time.
| Provider | Role | Region |
|---|---|---|
| Anthropic, PBC | AI analysis via Claude API — data is processed transiently and not retained by Anthropic | USA |
| Neon, Inc. | PostgreSQL database (encrypted at rest, AES-256) | EU (Frankfurt) |
| Fly.io | Backend application hosting | EU |
| Telegram Messenger | Report delivery to your phone | Dubai |
| Resend | Email delivery (fallback) | USA |
| Cloudflare | DNS, CDN, static site hosting | EU / USA |
For transfers to the USA, we rely on Standard Contractual Clauses (SCCs) as per Art. 46 GDPR.
| Right | What it means |
|---|---|
| Access | Request a copy of all data we hold about you |
| Erasure | Delete all your data — no questions asked |
| Portability | Receive your data in JSON format for use elsewhere |
| Rectification | Correct any inaccurate data we hold |
| Withdraw consent | Stop health data processing at any time |
| Object | Object to processing based on legitimate interest |
To exercise any right, email tomek@ultraflow.run. We respond within 30 days. You may also lodge a complaint with the Polish data protection authority (UODO), ul. Stawki 2, Warsaw, Poland, or with the supervisory authority in your country of residence.
UltraFlow does not use tracking or advertising cookies. Session cookies may be used solely to keep you logged into the web interface and are never shared with third parties.
We will notify you of material changes via Telegram or email with at least 14 days' notice before they take effect. Continued use of UltraFlow after that date constitutes acceptance.
Privacy questions: tomek@ultraflow.run
We aim to respond within 2 business days.