Rodagem · rodagem.online · rodagem.online
Privacy Policy
How Rodagem collects, uses, stores and protects the data of coaches and athletes, including the data received from Garmin Connect.
This English version is provided for convenience. Rodagem is operated from Brazil and this policy is governed by the Brazilian General Data Protection Law (Lei nº 13.709/2018, "LGPD"). In case of conflict, the Portuguese version prevails.
1. Who we are
Rodagem is a web platform that lets running coaches and coaching teams plan, release and track their athletes' workouts. The marketing site is rodagem.online and the application is rodagem.online.
Data Protection Officer (DPO): Rogerio Tostes — privacidade@rodagem.online.
2. Who this policy applies to
This policy applies to everyone who interacts with Rodagem:
- Coaches (head coaches and assistant coaches) who manage a coaching team on the platform;
- Athletes invited by a coach, who use the app to view workouts, record activities and connect Garmin Connect;
- Visitors of rodagem.online.
Roles under the LGPD. When a coach registers and monitors their athletes, Rodagem processes that data on behalf of the coaching team, which decides the purposes (planning and monitoring training). In that relationship the coaching team is the controller and Rodagem is the processor. For account, security, billing and platform operation data, Rodagem is the controller.
3. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, password (stored only as a salted hash), role in the coaching team, time zone. | Provided by you or by the coach who invited you. |
| Athlete profile and intake form | Date of birth, sex, weight, height, level, goals, running history, injuries, health conditions and restrictions you choose to disclose, emergency contact. | Provided by the athlete through the registration link, or by the coach. |
| Training zones and reference paces | Maximum and threshold heart rate, zones Z1–Z6, 5K/10K/half/marathon reference paces. | Set by the coach. |
| Planned workouts | Training cycles, weekly cycles, workouts, blocks, pace ranges, coach notes, comments exchanged between coach and athlete, "seen" marks. | Created on the platform. |
| Completed activities | Date, distance, duration, pace, heart rate, cadence, power, elevation, calories, laps, time series (per-second samples) and, where provided, the original .FIT file. | Garmin Connect (see section 4), manual .FIT upload or manual entry. |
| Technical data | IP address, browser, operating system, access and error logs, session identifiers. | Collected automatically when you use the site and the app. |
Health data (intake form, heart rate and other physiological metrics) is sensitive personal data. We process it only with your specific consent, solely so your coaching team can prescribe and monitor your training, and never for advertising.
4. Garmin Connect data
Rodagem integrates with Garmin Connect through the Garmin Connect Developer Program, using Garmin's official APIs. The integration is optional and only happens when the athlete chooses to connect their account.
How the connection works
- Authorization uses OAuth 2.0 on Garmin's own pages. Rodagem never asks for, sees or stores your Garmin Connect password.
- On Garmin's consent screen you choose which permissions to grant. We store only the access tokens required, encrypted at rest, your Garmin user identifier and the consent date.
What we receive and send
- We receive (Activity API): summaries of the running activities synced by your watch and, where authorized, the activity detail file (.FIT) with pace, heart rate, cadence, power and elevation time series, plus laps.
- We send (Training API): the workouts your coach has released to you, as structured workouts (warm-up, intervals, pace ranges, rest), so they appear on your watch.
How we use this data
- Display the activity to you and to the coaches of your coaching team;
- Automatically match the activity with the planned workout and compute the compliance indicator (green, yellow, red);
- Render charts, laps and time-in-zone distribution;
- Nothing else. We do not sell, license or use Garmin Connect data for advertising, marketing profiles or model training.
Disconnecting and deletion
- You can disconnect Garmin Connect at any time in the app (Profile → Garmin). When you disconnect, we revoke and delete the tokens immediately and stop receiving new activities.
- If you revoke access directly in Garmin Connect, Garmin notifies us and we apply the same token deletion.
- Activities already imported remain visible in your training history unless you ask us to delete them (section 10). We honor deletion requests for Garmin-sourced data within 30 days.
Use of Garmin data is also subject to the Garmin Connect Developer Program terms and to Garmin's Privacy Policy. Garmin and Garmin Connect are trademarks of Garmin Ltd. or its subsidiaries.
5. How we use data
- Create and maintain your account and authenticate your access;
- Let your coaching team plan, release and track your workouts;
- Import and display activities, match them with the plan and compute compliance;
- Send structured workouts to your Garmin watch when connected;
- Enable communication between coach and athlete within a workout;
- Produce aggregate indicators for the coaching team (active athletes, joins and departures, compliance summary);
- Send transactional communications (invitations, password reset, security notices);
- Keep the service secure, prevent fraud and abuse, and comply with legal obligations;
- Improve the platform using technical logs and aggregated, anonymized usage metrics.
6. Legal bases
| Processing | Legal basis (LGPD) |
|---|---|
| Account, authentication, service operation | Performance of a contract (art. 7, V) |
| Intake form, heart rate and other health data | Specific and highlighted consent (art. 11, I) |
| Garmin Connect connection | Consent (art. 7, I), given on Garmin's authorization screen and revocable at any time |
| Access logs and security | Legal obligation (Brazilian Internet Act) and legitimate interest (art. 7, IX) |
| Transactional communications | Performance of a contract (art. 7, V) |
| Aggregated, anonymized metrics | Legitimate interest (art. 7, IX); anonymized data is not personal data |
7. Who we share data with
- Your coaching team. The coaches of the team you belong to see your profile, intake form, zones, workouts, activities and comments. Assistant coaches see only the athletes assigned to them. Athletes never see other athletes' data.
- Garmin. When you connect your account, we send Garmin the workouts released to your watch and receive your activities, as described in section 4.
- Infrastructure providers. Hosting, database, file storage and transactional email providers, bound by confidentiality and security obligations, who process data only on our instructions.
- Authorities. When required by law, court order, or to protect rights, safety and the integrity of the platform.
We do not sell personal data and do not share it with advertisers, data brokers or social networks.
8. Storage and retention
- Account, workout and activity data is kept while your account is active.
- When you close your account or leave a coaching team, data is deleted or anonymized within 30 days, except what we must keep by law (for example, access logs for 6 months under the Brazilian Internet Act) or to exercise legal rights.
- Garmin Connect tokens are deleted immediately upon disconnection.
- Backups are kept for up to 35 days and then overwritten.
9. Security
- Traffic encrypted with HTTPS/TLS across the site and the app;
- Passwords stored only as salted hashes; Garmin Connect tokens encrypted at rest;
- Logical isolation per coaching team: no query crosses another team's data;
- Role-based access control (head coach, assistant coach, athlete, platform administrator);
- Access logging, monitoring and an incident response policy. If a security incident may create relevant risk to you, we will notify you and the Brazilian National Data Protection Authority (ANPD) as required by law.
10. Your rights
Under article 18 of the LGPD you may, at any time, request:
- Confirmation that we process your data, and access to it;
- Correction of incomplete, inaccurate or outdated data;
- Anonymization, blocking or deletion of unnecessary or unlawfully processed data;
- Portability of your data, including export of your activities;
- Information about who we share your data with;
- Withdrawal of consent (including for the intake form and for Garmin Connect) and deletion of data processed on that basis;
- Objection to processing based on legitimate interest.
To exercise these rights, write to privacidade@rodagem.online. We respond within 15 days. You may also lodge a complaint with the ANPD.
11. Cookies and similar technologies
- rodagem.online uses no tracking cookies or advertising tools and loads no third-party resources; fonts and images are served from our own domain.
- rodagem.online uses only strictly necessary local storage to keep you signed in and to run as an installable web app (PWA). There are no third-party cookies.
12. International transfers
Our servers may be located outside Brazil, with cloud providers that adopt contractual clauses and security measures compatible with the LGPD. Data exchanged with Garmin is processed on Garmin's servers, which may be located in other countries, under Garmin's privacy policy.
13. Minors
The platform is intended for people aged 18 or older. Athletes aged 16 to 18 may only be registered with authorization from a legal guardian, provided to the coaching team. We do not knowingly register anyone under 16; if we become aware of such a registration, it will be removed.
14. Changes to this policy
We may update this policy to reflect changes in the platform or in the law. The current version is always available at rodagem.online/privacy, with the update date at the top. Material changes are communicated by email or by notice in the app.
15. Contact
Privacy questions: privacidade@rodagem.online
General contact: contato@rodagem.online