Privacy Policy

Montagneur — www.montagneur.com and tracker.montagneur.com Last updated: [DATE]

Montagneur is an independent, non-commercial project about mountain endurance sports. It has two parts, and they treat your data very differently:

The knowledge base (www.montagneur.com) — open articles about training,

gear, skills and mindset for mountain sports. No account, no tracking.

The Workout Tracker (tracker.montagneur.com) — an invitation-based

training platform where athletes build a season plan and follow it with their own training and health data.

This page explains what we collect, why, and what we will never do with it.

1. Who we are

Montagneur is published by Romain Mouton, an individual based in France (the "publisher" and, in GDPR terms, the data controller for the services described here). Contact: contact@montagneur.com.

2. The knowledge base (www.montagneur.com)

You can read everything without an account. We do not use advertising, ad trackers, or third-party analytics, and we do not sell anything on the site. Like any web server, our infrastructure keeps short-lived technical logs (IP address, requested page, timestamp) for security and abuse prevention; they are not used for profiling and are deleted on rotation.

3. The Workout Tracker (tracker.montagneur.com)

The Tracker is invitation-based and intended for a small community of athletes. Creating an account and connecting any data source is always your choice.

3.1 Account data

Email address (used as your login and, if needed, to contact you about your

account — never for marketing).

Password, stored only as a salted scrypt hash. We cannot read it.
Session cookie (wt_session, essential, HttpOnly) and a CSRF token.
Security logs: failed login attempts are counted per email and IP address

to block brute-force attacks.

3.2 Training and health data

This is the heart of the service, and it is sensitive data. Depending on what you import or connect, the Tracker stores:

Workouts: GPS traces, heart rate, power, cadence, pace, elevation,

calories, core body temperature (if you use such a sensor), and metrics derived from them (training load/TSS, zones, climb statistics…).

Daily health metrics: heart-rate variability (HRV), resting heart rate,

sleep duration/phases/score, body weight, and similar recovery metrics.

Your plan: target races, weekly availability, training zones and

thresholds, and the generated season plan.

3.3 Data sources — always connected by you, always read-only

The Tracker never reaches into any service you have not explicitly connected, and it only ever reads; it never writes to or posts on a connected service.

Manual upload — FIT files you drag and drop yourself.
intervals.icu — if you paste your personal intervals.icu API key, new

activity files are fetched automatically. Remove the key to stop.

Garmin — when you connect your Garmin account (via Garmin's own consent

screen), activity files recorded by your device are delivered to your Tracker account. See section 6.

Oura — if you paste a personal Oura token, your nightly HRV, resting

heart rate and sleep data are synced. Remove the token to stop.

Withings — if you link your Withings account (OAuth), your weigh-ins

are synced. You can disconnect at any time in Settings.

Disconnecting a source stops all future collection from it. Data already imported stays in your account until you delete it or delete your account.

3.4 Weather

To annotate outdoor workouts, the Tracker asks the Open-Meteo weather service for the historical weather at the approximate midpoint of your route. Only rounded coordinates and a time are sent — no name, account or identifier of any kind. Weather annotation is skipped for workouts without GPS.

4. What we do with your data — and what we never do

Your data is used for exactly one thing: showing your own training back to you and adapting your own plan (load management, recovery-based adjustments, race preparation).

We never:

sell, rent, or trade your data;
show your data to any other user of the platform — each account only ever

sees its own data;

use your data for advertising or marketing;
use your data to train AI or machine-learning models, ours or anyone

else's — all analysis is computed by our own deterministic, rule-based code on our own server;

transfer your data outside the hosting and services described on this page.

5. Where your data lives, and how it is protected

The Tracker runs on a server hosted by Hetzner in the European Union. All traffic is encrypted in transit (HTTPS). Each athlete's data is stored in a strictly separate per-user space, and every request is checked against your session before any data is read or written. Daily backups are kept on the same EU infrastructure and rotated (backups older than 30 days are deleted).

6. Garmin data

If and when you connect your Garmin account:

Collection happens only after **your explicit consent on Garmin's own

authorization page**.

We receive the activity files your device records (the same FIT files you

could export yourself), and we use them solely as described in section 4 — displayed only to you, never to other users, never for AI/ML, never for advertising, never sold.

You can revoke access at any time, either in the Tracker's Settings or

from your Garmin Connect account settings. Revocation immediately stops any new data from being received.

Activities already imported remain in your account (they are part of your

training history) until you delete them or your account; deleting your account deletes them.

7. Retention and deletion

Your data is kept for as long as your account exists.
You can delete your account yourself at any time (Account page). Deletion

removes your account and all associated data — plan, workouts, health metrics, connected-service tokens.

Deleted data disappears from backups within the backup rotation window

(30 days at most).

Accounts can also be deleted on request to contact@montagneur.com.

Performance of the service (art. 6(1)(b)) for account data and the

features you use.

Your explicit consent (art. 9(2)(a)) for health-related data — given

when you create an account, upload files, or connect a source, and withdrawable at any time by disconnecting the source or deleting your data.

Legitimate interest (art. 6(1)(f)) for security logs and abuse

prevention.

9. Your rights

Under the GDPR you can ask for access to, rectification, erasure, or portability of your data, restrict or object to processing, and withdraw consent at any time — most of it self-service in the app, everything else via contact@montagneur.com. You can also lodge a complaint with your supervisory authority (in France, the CNIL — www.cnil.fr).

10. Minors

Neither the knowledge base's interactive features nor the Tracker are directed at children. The Tracker is not intended for users under 15.

11. Cookies

The Tracker uses only essential cookies: the session cookie that keeps you logged in. No advertising or third-party cookies anywhere on montagneur.com.

12. Changes to this policy

If this policy changes in a way that matters (new data, new purpose, new processor), we will say so on this page and, for Tracker users, in the app.

Résumé en français

Montagneur.com est une ressource de partage sur les sports d'endurance en montagne : la partie éditoriale se lit sans compte et sans traceur. Le Workout Tracker (tracker.montagneur.com), sur invitation, stocke tes données d'entraînement et de santé (séances, FC, HRV, sommeil, poids) dans le seul but de te les afficher à toi et d'adapter ton plan. Les sources (upload manuel, intervals.icu, Garmin, Oura, Withings) ne sont connectées que par toi, en lecture seule, et sont déconnectables à tout moment. Jamais de publicité, jamais de vente de données, jamais d'entraînement d'IA, jamais d'affichage à un autre utilisateur. Hébergement en Union européenne (Hetzner), HTTPS, données isolées par compte. Tu peux supprimer ton compte et toutes tes données toi-même, à tout moment (les sauvegardes sont purgées sous 30 jours). Droits RGPD et questions : contact@montagneur.com — réclamation possible auprès de la CNIL.