Privacy Policy

1. Scope

This Privacy Policy explains how Roxya collects, uses, stores, and protects personal data when you use the Roxya website, backend services, and Garmin Connect IQ application.

Roxya does not use the Garmin Connect Activity API to retrieve your data from Garmin Connect. Data described here is limited to information you submit directly to Roxya or that your Roxya Connect IQ watch application sends to Roxya after you choose to link your device and enable activity sync.

2. Data We Collect

Account data: email address, account credentials, athlete tag, profile settings, and related authentication metadata.

Device link data: Garmin device identifier, device link timestamps, and device sync authorization records.

Training data: session start and end timestamps, duration, distance, workout structure, lap or segment data, pace, speed, heart rate, calories, and related training metrics sent by the Roxya Garmin application or entered through Roxya services.

Technical data: security logs, request metadata, IP address, browser metadata, and operational telemetry required to protect the service.

3. How We Use Data

We use data to authenticate users, link devices, sync workouts, display training history, analyze performance, troubleshoot support issues, secure the platform, and operate Roxya features requested by the user.

We do not sell, rent, or broker your personal data or Garmin-derived activity data.

4. Legal Basis And Consent

When Roxya syncs Garmin-derived activity data from the Connect IQ application, Roxya relies on your explicit consent and your request to use the sync functionality.

You can stop future sync by unlinking the device or disabling use of the Roxya Garmin application. Where required by law, you may also request deletion of previously stored data.

5. Garmin-Specific Notice

Garmin-derived activity data is processed only for the features you enable in Roxya. Roxya uses Garmin Connect IQ capabilities made available to application developers, including on-device activity metrics and secure network communication.

In the current Roxya Garmin flow, Roxya does not intentionally collect or transmit exact geolocation points or route traces. Roxya currently focuses on training metrics such as distance, pace, speed, heart rate, duration, and related performance values.

If location-derived activity data is collected or transmitted in a future version, Roxya will require a clear opt-in before enabling that behavior.

6. Sharing And Processors

Roxya hosts and stores data using infrastructure providers needed to operate the service, including hosting and database providers controlled by Roxya or engaged as processors.

Based on the current Roxya stack, services may be hosted through Infomaniak in Switzerland for backend and data infrastructure and Vercel for web delivery and frontend hosting.

7. Retention

Roxya keeps personal data only for as long as needed to provide the service, maintain linked training history, secure the platform, comply with legal obligations, and resolve support or abuse issues.

Device link records are retained while a device remains linked. Activity records are retained while your account remains active unless you request deletion, subject to legal or security retention requirements.

8. Security

Roxya uses access controls, token hashing, transport security, CSRF protections, security headers, rate limiting, and encrypted storage for selected sensitive message content. Roxya also works to minimize the amount of directly identifying data stored with training payloads.

No system can guarantee absolute security. If Roxya identifies a material incident affecting your personal data, Roxya will respond and notify affected users when required by applicable law.

9. Your Rights

Depending on your jurisdiction, you may have rights to access, correct, delete, export, or restrict the processing of your personal data.

To exercise these rights, contact Roxya at info@roxya.ch.

10. International Transfers

If Roxya uses providers located in different jurisdictions, data may be processed outside your country of residence. Roxya will use appropriate contractual and technical safeguards where required.

11. Changes

Roxya may update this Privacy Policy to reflect legal, technical, or product changes. The latest version will be published on this page with an updated effective date.