Privacy policy
Last updated 30 October 2026
1. Who we are
NextSession is a training planner and coach for runners, cyclists, swimmers and triathletes. It reads your training data, builds a plan around your week, and puts sessions on your calendar and watch.
NextSession is run by Matt Fuchs in the United States, who is responsible for looking after your data (the "data controller" under European law).
Questions and requests about your data: support@getnextsession.com. We answer within 30 days.
2. What we collect
| What | Examples | Where it comes from |
|---|---|---|
| Account | Your name, email address, a hashed password, sign-in times | You, when you join |
| Intervals.icu link | Your athlete ID and API key (stored encrypted, never shown again) | You, when you connect |
| Activities | Sport, date, duration, distance, heart rate, pace, power, load, laps, the second-by-second streams and the recording file, which can include GPS position | Intervals.icu, which receives them from your watch, bike computer or app |
| Wellness readings | Heart rate variability (HRV), resting heart rate, sleep, respiration, blood oxygen, and recovery scores where your device sends them | Intervals.icu |
| Thresholds and zones | Threshold pace, threshold power, threshold and maximum heart rate | Intervals.icu, or worked out from your activities |
| Your plan | Goals and races, training days and times, planned sessions, changes you approve or undo | You and the coach |
| Coach conversations | What you ask the coach and its answers, and short notes it keeps about how you like to be coached | You |
| Notifications | Your browser's push subscription, and the notes we have sent | Your browser, when you turn notifications on |
We do not collect payment details (there is no paid plan), contacts, advertising identifiers, or anything from apps you have not connected.
3. Health data
Heart rate, HRV, resting heart rate, sleep and recovery are health data. Under European law they are a special category, and several US states (Washington, Nevada and Connecticut among them) treat them as consumer health data. We handle them this way:
- We use them only to plan and adjust your training and to write your coach's notes.
- We never sell them, never use them for advertising, and never share them with data brokers.
- Connecting Intervals.icu is your consent for us to read them. You can withdraw it at any time by disconnecting Intervals.icu in the Account menu, or by writing to us to delete your data.
- We do not use them to train AI models, ours or anyone else's.
4. How we use it, and the AI coach
We use your data to:
- build your plan and fit it to the days and times you can train;
- write the coach's morning note, workout reviews and pre-session notes, and answer what you ask;
- put planned sessions on your Intervals.icu calendar, and from there on your watch or bike computer;
- send the notifications you turned on;
- keep the service secure and fix problems you report.
The coach is an AI. It runs on two models: Claude, made by Anthropic, answers you and changes your plan, and Grok, made by xAI, writes the morning note, workout reviews and pre-session notes (Claude writes them when Grok is unavailable). To write each answer or note, we send that provider the training data it needs: your name, your plan, recent activities, readings, thresholds and, for answers, the conversation. We do not send your email address or password. Both process this under their business API terms, which do not allow them to train models on our requests.
The coach suggests; you decide. Changes you ask for are made at once and can be undone; changes the coach suggests wait for your approval. Its advice is general training guidance, not medical advice. NextSession makes no decision about you that has legal or similarly significant effects; the most it does on its own is suggest changes to your training.
Legal bases (European law). We use your account, plan, activities and conversations to provide the service you signed up for (performance of a contract). We read health data only with your consent, which you give by connecting Intervals.icu and can withdraw at any time. We keep the service secure and fix problems on the basis of our legitimate interest in running a safe, working service. Your email address and an Intervals.icu connection are needed for NextSession to work; without them we cannot build or adjust a plan.
5. Who processes it
We do not sell or rent your data, and we share it only with the services that run NextSession for us:
| Service | What it does for us | Where |
|---|---|---|
| Supabase | Database, sign-in and its emails, encrypted key storage, file storage for recordings | United States |
| Vercel | Hosts the app and runs its server code | United States |
| Anthropic | Runs the AI coach (Claude) | United States |
| xAI | Writes the coach's notes and reviews (Grok) | United States |
| Cloudflare, Google and Resend | Receive and send email to and from support@getnextsession.com | United States |
| Your browser's push service (Apple, Google, Microsoft or Mozilla) | Delivers the notifications you turned on | Varies |
If you live outside the United States, your data is transferred there. Where the law requires it we rely on the providers' standard contractual clauses or EU-US Data Privacy Framework certification.
We may disclose data when the law requires it, and to a buyer if NextSession is ever sold, under this same policy.
6. Connected services and AI assistants
Intervals.icu is a separate service with its own privacy policy. Data from Garmin, Zwift, COROS, Polar, Suunto, WHOOP and other devices reaches us only through your Intervals.icu account. NextSession writes your planned sessions to your Intervals.icu calendar; you can turn that off under Connections in the Account menu. Disconnecting removes your key from NextSession; data held by Intervals.icu is managed there.
Direct connections. NextSession has none yet. Before we add one, such as WHOOP, this section will say exactly what it reads and writes, and that disconnecting stops access and deletes what we hold from it.
Your AI assistant. You can connect Claude, ChatGPT, Cursor or another assistant to NextSession through our MCP server. You sign in and approve the connection, and the assistant can then read your plan and readings and make changes you ask for. What it does with that data is governed by the assistant's own policy. You can stop it at any time by removing the connection in that assistant.
7. Retention and deletion
| Data | How long we keep it |
|---|---|
| Account, plan, activities, readings, coach conversations, recordings | While your account exists; deleted within 30 days of you asking us to delete it |
| Intervals.icu key | Until you disconnect or delete your account; deleted at once |
| Push subscription | Until you turn notifications off or the browser drops it |
| Server logs and backups | Kept by Supabase and Vercel for their standard short periods, then overwritten |
To delete your account or get a copy of your data, write to support@getnextsession.com from the address you sign in with.
8. Cookies, security and your rights
Cookies and storage. NextSession sets no cookies. It keeps your sign-in in your browser's local storage so you stay signed in. There is no advertising, analytics tracking, pixels or session recording.
Security. Data travels over HTTPS. Your Intervals.icu key is encrypted at rest and never sent back to the browser. Each athlete's data is walled off at the database level, so one account cannot read another's. No system is perfectly secure; report a problem to support@getnextsession.com.
Your rights. Wherever you live, you can ask to see, correct, export or delete your data, and to withdraw consent for health data. If you are in the EU or UK you also have the rights to restrict or object to processing and to complain to your data protection authority. If you are in a US state with a consumer health data law, you can also ask which services we shared your health data with. We do not discriminate against anyone who uses these rights.
Children. NextSession is not for anyone under 18, and we delete any account we learn belongs to a child.
Changes. We post changes here with a new date. If a change affects what we collect or who we share it with, we tell you in the app or by email before it takes effect.