Privacy policy

The data controller is the publisher of the platform, identified in the legal notice, to which reference is made for its company name, address and registration.

A dedicated address is available for any question or request about your data; we reply within one month.

Data protection contact : postmaster@co-sport.com

Not all of the categories below concern you: we only process what corresponds to the features you actually use.

Some of the information you may enter falls into special categories under the GDPR: it benefits from enhanced protection and is only processed with your explicit consent.

• They are collected only if you turn on the matching features: weight tracking, AI coach and nutrition tracking. Until you have given your consent, those features record nothing.
• It is never used for advertising purposes and never passed to third parties for that purpose.
• It is not visible to other members, unless you explicitly choose to publish the content that carries it.
• You can withdraw your consent at any time from your settings: the features concerned are turned off and the data they produced is deleted — AI coach profile (weight, height, goals, injury history), weight history, food and hydration logs, coach conversations and proposals.
• Your training sessions fall under performance of the service contract: they carry effort indicators and are not erased by this withdrawal; they disappear when your account is deleted, or earlier on request to the contact given in the “Your rights” article. Activities imported from Strava, which carry your heart rate, are imported only with a separate explicit consent, collected before Strava is connected and kept with its date; withdrawing one of these two consents does not erase the data covered by the other. They are erased as soon as you unlink Strava in your Co-Sport settings, or as soon as you revoke access from your Strava account: feed posts you made from them then lose their Strava measurements, while your text and photos remain.

We are not a healthcare service. None of this data is subject to medical interpretation, and nothing displayed on the platform constitutes a diagnosis or a treatment.

From the Co-Sport app, you can connect Apple Health (iPhone) or Health Connect (Android). Apple Health and Health Connect also relay Samsung Health, Garmin Connect, Fitbit and other apps once you have linked them there. Nothing is read before you tap “Connect” on the app's “Connected health” screen.

• What is read, read-only: your number of steps per day and, for each workout, its activity type, start, end, duration, distance and calories when available, plus the app that recorded it (for example Garmin). Nothing else: no heart rate, no sleep, no weight. Co-Sport writes nothing to Apple Health or Health Connect.
• Why: to show your real steps in the daily goal, and to show your workouts in your planner and history, with their source, without typing them in. A workout already recorded in Co-Sport or imported from Strava at the same time is not imported a second time.
• Legal basis: your explicit consent (GDPR Article 9(2)(a)), given by tapping “Connect” and timestamped by our servers; the system permission (Apple or Android) is requested afterwards and can also be changed in your phone settings.
• Where: the data read is sent to our servers (see “Recipients and processors” and “Transfers outside the European Union”), where it becomes your daily steps and your workouts. It is never used for advertising, never shared with third parties, never shown to a coach or another member, and never appears in technical logs or notifications.
• How long: like your other workouts, for as long as your account exists or until you delete them. The first read covers the last 30 days, later reads the days since.
• How to withdraw: “Disconnect”, on the app's “Connected health” screen or in the website settings, stops all reception; you then choose whether to delete the steps and workouts already imported. You can also revoke the permission in your phone settings (Health › Data Access on iPhone, Health Connect on Android). An imported workout you delete does not come back.

Data is only read while the app is open: nothing is read in the background.

Your data is processed for the following purposes, and for those alone:

• Creating and managing your account, authenticating you and securing your access.
• Connecting you with other members. The training partners suggested to you are chosen according to your sports, your city, the age gap and your activity level. A minor is never suggested to an adult, nor shown on their map. In these suggestions, other members only see your first name and the initial of your last name.
• Recording and displaying your training history and statistics.
• Providing the automated training assistant and personalising its suggestions.
• Enabling content publication, messaging and interaction between members.
• Processing orders, payments and invoicing, and producing the required accounting records.
• Carrying out moderation and preventing fraud, abuse and uses contrary to the terms.
• Sending you the notifications and emails that match your preferences. For an account created since 26 October 2026, our news and reminder emails are only sent with your consent, given in your preferences; each one lets you unsubscribe in one click.
• Measuring the audience of the service in aggregate, in order to improve it.
• Presenting our offer to sports professionals (coaches, gyms, clubs, brands) and managing our business relationship with them.

Each processing activity rests on one of the grounds set out in the GDPR:

Co-Sport presents its offer to coaches, gyms, clubs and sports brands. To do so, we keep a business prospecting file:

• Data: name or company name, business contact details (email address, phone, city), SIRET number, sports, the offer considered and the history of our exchanges.
• Source: public business information (website, directories, professional networks), meetings at events or a third party's recommendation. When your data did not come from you, we inform you within one month, and at the latest at our first contact (Article 14 GDPR).
• Legal basis: our legitimate interest in making known a service related to your professional activity (Article 6(1)(f) GDPR).
• Period: 3 years after the last contact if it went unanswered, then deleted.
• Objection: you can ask at any time, without giving a reason, not to be contacted again (Article 21). Your record is then erased; only a fingerprint of your email address or SIRET number is kept, with the date of the request, so that we never contact you again.

Your data is only accessible to the people who need it, and to the providers below, who act on our instructions or, for signing in with Google or Apple, as controllers of their own service. For each one: what it receives, where, and the safeguard covering any transfer outside the European Union.

We do not sell your data and do not pass it to any data broker or advertising network.

Some providers are established outside the European Union, in particular in the United States.

• Each transfer relies on one of the safeguards provided by the GDPR and shown in the table above: the European Commission's adequacy decision for companies certified under the EU–US Data Privacy Framework (Article 45) or, failing that, the standard contractual clauses adopted by the Commission (Article 46). Switzerland itself benefits from an adequacy decision.
• They are limited to the data strictly necessary for the feature concerned.
• The features that involve such a transfer — signing in with Google or Apple, Strava import, the training assistant — are optional and are your choice.

We keep your data only for as long as the purpose requires:

You have the following rights over your personal data:

• Right of access: obtain confirmation that your data is processed and receive a copy of it.
• Right to rectification: correct inaccurate or incomplete information, directly from your profile.
• Right to erasure: request deletion of your data, by deleting your account.
• Right to portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest, and to marketing.
• Right to restriction: ask for processing to be frozen while a challenge is examined.
• Right to withdraw your consent at any time, without affecting the lawfulness of earlier processing.

Exporting your data and deleting your account are done directly from your settings, with no involvement on our part. For the other rights, write to the contact address given above: we reply within one month, extendable by two months for complex requests.

If you live in Switzerland, the Federal Act on Data Protection of 25 September 2020 (FADP) also applies to our processing. Everything above applies to you, with the following details:

• Your rights: right of access (Art. 25 FADP), right to receive or transmit your data (Art. 28), right to have your data corrected or erased and to object to processing (Art. 32). They are exercised as described in the "Your rights" article, free of charge; we answer an access request within 30 days (Art. 18 of the Data Protection Ordinance).
• Sensitive data: health data is sensitive data (Art. 5(c) FADP); we process it only with your express consent (Art. 6(7)).
• Transfers: your data is hosted in the European Union, whose level of protection the Federal Council recognises as adequate (Annex 1 of the Ordinance). Transfers to the United States rely on the Swiss-US Data Privacy Framework for certified companies, or on standard contractual clauses recognised by the Federal Commissioner (Art. 16 FADP).
• Data breaches: if a breach is likely to result in a high risk to your personality or fundamental rights, we report it to the Federal Commissioner as soon as possible and inform you when your protection requires it (Art. 24 FADP).
• Supervisory authority: you can contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

The service is not intended for children under 16. We do not knowingly collect their data. If you hold parental authority and believe your child has opened an account, write to us: the account will be closed and the data deleted.

We implement technical and organisational measures appropriate to the risk:

• Encryption of traffic between your device and our servers.
• Passwords stored as hashes, never in clear text and never reversible.
• Separation of environments and access limited to authorised staff only.
• Logging of administrative actions and two-factor authentication for administrator accounts.
• Regular, encrypted backups.
• Rate limiting and detection of automated behaviour.

In the event of a data breach, we notify the CNIL within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to your rights and freedoms (Article 33 GDPR). If it is likely to result in a high risk, we inform you directly and without undue delay (Article 34). Every breach is recorded in an internal register. For people in Switzerland, see "Users in Switzerland".

The platform uses only cookies that are strictly necessary for it to work, and its audience measurement is carried out without cookies or persistent identifiers. Details are set out in the cookie policy.

This policy may be amended to reflect changes in the service or in regulations. Each version carries a date, and any substantial change is notified to you before it takes effect.

If you believe your rights are not being respected, send your complaint to us first: it is the fastest route.

You may also lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris, or with the supervisory authority of your country of residence.