Privacy Policy — Lactate Engine
Effective date: 23 August 2026 (the date this document is published)
Publisher: AFSIsoft SAS ("AFSIsoft", "we"), société par actions simplifiée, SIRET 824 942 163 00026 (RCS Saint-Brieuc), 38 route de Trégastel, 22560 Pleumeur-Bodou, France.
Contact: the contact form at https://lactateengine.com/contact.php (or by post at the address above)
Lactate Engine is a training-analysis app for endurance athletes. It models blood lactate from your own training data and lactate tests so that you can make physiological decisions about your training. This policy explains what data the app handles, where it lives, and your rights. The short version: your data stays on your device, we run no analytics, no advertising, and no account.
1. Data the app processes
| Category | Examples | Where it is stored |
|---|---|---|
| Profile | name (optional), date of birth, weight, height, body-fat %, sex, FTP, PMA, max/resting heart rate, photo (optional) | On your device only |
| Lactate tests | stage power or pace, heart rate, blood-lactate values you type in, test dates and notes | On your device only |
| Field samples | lactate values you record during sessions (typed, via Siri, or as lap markers from the Connect IQ data field), with the time they were taken | On your device only |
| Activities | rides and runs you import (FIT, TCX, CSV files) or that you connect from Apple Health, Garmin or Strava: time series of power, pace, heart rate, cadence, altitude, speed, GPS route when present, summaries | On your device only |
| Daily wellness | sleep, HRV, resting heart rate, steps, active and basal energy (from Apple Health), Body Battery and stress (from Garmin, when connected) | On your device only |
| Planned workouts | sessions you plan or export as TCX files | On your device only |
| Backups | a JSON file you choose to export | A file you control (Files, iCloud Drive, AirDrop…) |
We do not collect usage analytics, crash reports, advertising identifiers or location history. The app has no user account; a Garmin connection (section 3) creates only a random identifier on our relay. The app currently has no in-app purchases; if a subscription is offered in the future it will be handled by Apple and we will never see your payment details.
2. Apple Health (HealthKit)
With your permission the app reads workouts and routes, heart rate, cycling and running power, cadence, speed and distance, sleep, heart-rate variability, resting heart rate, steps and energy expenditure. It never writes to Apple Health. Health data is used only to provide the app's features (session analysis, readiness, physical-activity level, lactate modelling). It is never used for advertising or marketing, never sold, never shared with third parties, and never transmitted off your device. You can revoke access at any time in the iOS Health app; already-imported sessions stay in the app until you delete them.
3. Optional connections
- Garmin Connect. If you connect your Garmin account, you authorise AFSIsoft through Garmin's official Connect Developer API. Garmin then sends your activities (including the original FIT files) and your daily health metrics (sleep, stress, Body Battery, HRV, resting heart rate) to AFSIsoft's server, hosted by Bluehost (Newfold Digital, United States) — transfers outside the EU are covered by [[TRANSFER_SAFEGUARD]] (EU-US Data Privacy Framework certification or Standard Contractual Clauses — to be confirmed with Bluehost), which relays them to your device. The server keeps your Garmin authorisation tokens until you disconnect, and keeps activity files only until they have been delivered to your device (at most 30 days). You can disconnect in Settings or revoke the app in your Garmin account; either ends the transfer and deletes the tokens. Garmin data is used solely to provide the app's features to you, in accordance with Garmin's API terms and branding rules.
- Strava. If you connect Strava, the app uses Strava's official API with your authorisation to read your own activities. Tokens are stored on your device. You can disconnect in Settings; revoking the app in your Strava account also ends access. Strava data is used for your personal analysis only, in accordance with Strava's API terms.
- Connect IQ data field (Garmin devices). The "Lactate Engine Live" data field runs on your watch or bike computer, computes the lactate model locally and writes its values into your activity file as developer fields. It has no network access.
4. Siri, Shortcuts and notifications
Logging a lactate value with Siri is processed on your device through Apple's App Intents framework; the value is stored in the app. Session cues are local notifications scheduled by the app; they are not sent through any server.
5. Our server (Garmin relay only)
The only server operated by AFSIsoft is the Garmin relay described in section 3. It never receives your lactate tests, field samples, profile or Apple Health data. It holds, per connected user: a random user identifier, Garmin authorisation tokens, and activity/health files in transit (deleted after delivery, at most 30 days). Access is restricted to AFSIsoft for operation and support. Hosting: Bluehost (Newfold Digital), United States, under the transfer safeguard stated in section 3. Legal basis: performance of the service you requested (GDPR art. 6-1-b) and, for health data, your explicit consent (art. 9-2-a), which you give when connecting Garmin and can withdraw at any time by disconnecting. Support requests you send through the contact form are handled only to answer you and are deleted afterwards.
6. Retention and deletion
Your data remains on your device until you delete it: individual items in the app, or everything by deleting the app. Backups you exported are files you own. On the Garmin relay, tokens are deleted when you disconnect and files at most 30 days after they were received; deleting the app without disconnecting leaves the tokens until you revoke the app in your Garmin account or write to us.
7. Your rights (GDPR)
You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Since your data lives on your device, you exercise most of them directly in the app (export = portability, delete = erasure). For anything held on the Garmin relay, or any question, use the contact form at https://lactateengine.com/contact.php — we answer within one month. You may lodge a complaint with the CNIL (www.cnil.fr).
8. Children
Lactate Engine is not intended for people under 16 and we do not knowingly process their data.
9. Medical disclaimer
Lactate Engine provides physiological estimates for training purposes. It is not a medical device and does not provide medical advice. Blood sampling must be done with proper hygiene and, where appropriate, supervision.
10. Changes
We will publish any change to this policy at https://lactateengine.com/privacy.html and in the app, with the effective date above.