Privacy Policy
Last updated: March 15, 2026
1. Introduction
SideKikk is a sports coaching app built by Arch's Technologies (Lyon, France). It cross-references biometric data from Garmin wearables, a life journal you fill in, and your training calendar to produce coaching insights and weekly reports using an AI analysis service.
This Privacy Policy describes how we collect, use, store, and protect your personal and biometric data. By using SideKikk, you agree to the practices described below.
2. Data controller
Arch's Technologies
Represented by Sebastien Segond
Lyon, France
Contact: contact@archstechnologies.com
3. Data collected
3.1 Account data
- Email address (for authentication)
- Display name
- Profile information (age, weight, sport preferences, provided during onboarding)
3.2 Biometric data from Garmin
When you connect your Garmin account, SideKikk retrieves the following data via the Garmin Health API:
| Data type | Frequency | Purpose |
|---|---|---|
| Heart Rate Variability (HRV) | Daily | Recovery and physiological stress indicator |
| Sleep (score, duration, phases) | Daily | Night recovery quality |
| Body Battery | Daily | Overall energy level |
| Average Stress | Daily | Cumulative stress load |
| Resting Heart Rate | Daily | Long-term fitness/fatigue trend |
| Completed Activities | Per activity | Volume, intensity, type of training |
| Activity Details (splits/samples) | Per activity | Heart rate, pace, elevation, cadence |
3.3 Data NOT collected from Garmin
SideKikk does not access or store:
- Real-time GPS location
- Contacts or address book
- Garmin Pay payment data
- Other users' data
3.4 Life journal data (user-provided)
SideKikk uses an exception model: you only record anomalies from your normal routine. By default, "everything is fine." Categories include:
- Stress (intense work period, conflict, deadline)
- Fatigue (bad night, jet lag)
- Pain (knee, tight calf)
- Nutrition (dietary deviation, alcohol, fasting)
- Mood (low motivation, euphoria)
- Events (moving, exam, social event)
3.5 Training calendar data
- Planned training sessions (type, duration, distance)
- Life constraints (travel, late nights, stressful periods)
- Session status (planned, completed, skipped)
4. How we use your data
4.1 AI-generated analyses
Your data is sent to our AI analysis provider to generate three types of output:
- Daily Snapshot: a fitness assessment with a training recommendation (go / moderate / rest) and alerts if indicators look abnormal.
- Weekly Report: a written summary of your training load vs. recovery, how life events correlated with performance, trends, and recommendations for the next week. Generated on Sunday evening and never recalculated after that.
- Partial Recalculation: triggered when your HRV deviates more than 20% from your personal baseline. Limited to 3 per week with a 4-hour cooldown between each.
4.2 Anti-extrapolation guarantee
The AI only reasons on the data you provide. SideKikk does not make medical inferences, diagnoses, or guesses beyond what the data shows. Every AI prompt includes anti-extrapolation rules enforced at the system level.
4.3 No data sharing
Your data is never:
- Shared with third parties
- Used to train AI models
- Accessible to other users
- Sold, rented, or transferred
Data sent to our AI analysis provider is processed per our AI provider's data processing terms, which state that API inputs are not used to train models.
5. Data storage and security
5.1 Infrastructure
- Database: Supabase (PostgreSQL), hosted in the EU
- Frontend: Vercel, globally distributed CDN
- All data transmission: HTTPS/TLS encryption
- Data at rest: encrypted by Supabase infrastructure
5.2 Access control
- Row Level Security (RLS): every table enforces a PostgreSQL policy (
auth.uid() = user_id), so each user can only access their own data. This is enforced at the database level, not the application level. - Authenticated Edge Functions: JWT verified on every API request
- Secrets management: API keys (Garmin, AI provider) stored as environment variables, never in source code
- service_role key: never exposed to the client; used only for system operations (cron jobs, AI generation)
5.3 OAuth token storage
Garmin OAuth tokens are stored encrypted in the database. Encryption keys are managed via environment variables and are never accessible from the client-side application.
6. Data retention
- Biometric data: retained as long as your account is active
- Weekly reports: frozen at generation time, retained for your consultation history
- Life journal entries: retained as long as your account is active
You may request deletion of specific data categories at any time by contacting us.
7. Your rights
Under the General Data Protection Regulation (GDPR), you have the right to:
- Access your data: request a copy of everything we hold about you.
- Rectification: correct inaccurate personal data.
- Erasure: delete your account and all associated data. Deletion cascades across all tables (biometric data, journal entries, reports, insights, training sessions, credentials).
- Portability: receive your data in a structured, machine-readable format.
- Restriction: restrict processing of your data.
- Objection: object to data processing.
- Withdraw consent: disconnect your Garmin account at any time via Settings. Historical data can be retained or deleted at your choice.
To exercise any of these rights, contact us at contact@archstechnologies.com.
8. Account deletion
You can delete your account at any time from the Settings page. Account deletion is permanent and irreversible. It triggers a CASCADE deletion across all database tables:
- Profile and account data
- All biometric data (Garmin daily data, activities, activity details)
- Life journal entries
- Training sessions and calendar
- Daily snapshots and weekly reports
- Athlete insights and detected patterns
- Wearable credentials (OAuth tokens)
- Immutable constraints and life agenda
9. Garmin data usage compliance
SideKikk uses the Garmin Health API in compliance with Garmin's developer terms:
- Data is used solely to provide coaching insights to the data owner
- Data is never shared with third parties or used for advertising
- Data is never used to train machine learning models
- Users can disconnect their Garmin account and request data deletion at any time
- We access only the endpoints necessary for our stated functionality
10. Third-party services
| Service | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication, serverless functions | All user data (encrypted at rest) |
| Vercel | Frontend hosting | No user data (static assets only) |
| AI Analysis Provider | AI analysis generation | Biometric summaries and journal context processed per request in accordance with our AI provider's data processing agreement. Data is not retained or used for model training by the provider. |
| Garmin Health API | Biometric data retrieval | OAuth tokens for data access |
12. Children's privacy
SideKikk is not intended for use by individuals under the age of 16. We do not knowingly collect data from children. If you believe we have inadvertently collected data from a minor, please contact us immediately.
13. Changes to this policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. We will notify registered users of material changes via email.
14. Contact
For any questions about this Privacy Policy or to exercise your data rights:
Arch's Technologies
Email: contact@archstechnologies.com
Website: archstechnologies.com