Training data stays under your control.

Effective 27 September 2026

Data we store

Training Journal stores your account details, workouts, plans, races, wellness check-ins, day notes, gear and preferences. Every account's journal is kept in its own SQLite database, separate from every other account's. The operator runs this server and its backups.

For each account the server also keeps the day it was last used (a date, not a time), so the operator can see how many accounts are active. The server's own performance figures count requests per page type, never per person. The server keeps no access log, so no record of IP addresses. To slow down password guessing and abuse, the IP address behind a sign-in, sign-up or password-reset request is held in memory for five minutes, then forgotten.

An imported file (a Strava export, a FIT or TCX file) is read into workouts, and the file itself is not kept.

Where it is hosted

The server runs at Infomaniak Network SA in Switzerland, and your journal, account and backups are stored there. Training Journal loads no scripts, fonts or images from anywhere else, and contains no ads, analytics or tracking. Opening a page contacts this server and nothing else.

Cookies and your browser

The one cookie is the sign-in cookie, which keeps you signed in for up to 30 days or until you sign out. Your browser also keeps a few things on your own device: display choices such as the colour theme, a copy of the app so it opens offline, and, while you are offline, changes that have not reached the server yet. None of it is sent anywhere else.

Email address

When you sign up you enter an email address, and your journal opens once you have opened the link mailed to it. An address can belong to one account only. If the address is not confirmed within 7 days of signing up, the account is removed with everything in it.

The address is used only to confirm that it is yours, to let you sign in with it, and to send password-reset links and notices about changes to your sign-in details. It is never used for newsletters or marketing. The mail goes out through Infomaniak's mail service in Switzerland, which therefore sees the address and the message. You can change the address under Settings → Account at any time, and deleting your account removes it.

Daily check-in reminder

If you turn on the reminder, your browser registers with its own push service: Apple's for Safari, Google's for Chrome and Edge, Mozilla's for Firefox. The server keeps the address that service gives it, and at the time you chose it sends an empty message through that service. The message carries no content about you or your training. Turning the reminder off on a device removes its address.

intervals.icu connection

If you connect intervals.icu, Training Journal receives an OAuth access token and your athlete name and id from intervals.icu. The token is stored only on the server and is left out of journal exports. Training Journal uses it only when you ask it to: to send a completed session to intervals.icu, or to read back an activity recorded there on the same day as one of your sessions, so that it can fill that session in.

Sharing

Training Journal does not sell or share personal information. Data goes to intervals.icu only when you connect it and use its sync. Infomaniak hosts the server and delivers the mail, as described above. The operator has access to the server's files and backups.

Retention and deletion

The server takes an automatic snapshot of every journal once a day and keeps the last 14 days plus 8 weekly snapshots. Disconnecting intervals.icu revokes the app's access and removes the stored token. You can delete journal entries in the app at any time. Use Settings → Account → Delete account to permanently remove your account, your journal database, stored connection tokens and the server's snapshots of your journal.

Downloaded exports and data already sent to intervals.icu are outside this deletion. Contact us about any other copies.

Security

Passwords are stored as salted one-way hashes, and the server keeps only a hash of your sign-in cookie. If you add a passkey, the server keeps only its public key, the name you gave it and when it was added and last used; the private key stays on your device or in your password manager. Every connection uses HTTPS. No internet service can promise absolute security.

Contact

For privacy questions or deletion requests, email us: