Vaast

Privacy Policy

Last updated: August 20, 2026

1. Introduction

Vaast is committed to protecting your privacy and handling your data responsibly. This Privacy Policy explains how we collect, use, share, and protect your information when you use our mobile app, website, and connected services (collectively, the “Services”).

By using our Services, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Services or disconnect your account and data.

2. Data We Collect

We collect information necessary to deliver your personalized training experience. This includes:

2.1 Information you provide

  • Account details: such as name, email address, profile preferences.
  • Fitness & health data: When you connect a device or service (e.g., Garmin, Apple Health, Wahoo), we may receive workout sessions, heart-rate, GPS/route information, device metrics, performance statistics.
  • Device & app usage: optional inputs you provide (e.g., goal setting, training preferences).

2.2 Automatically collected information

  • Device identifiers, operating system, app version, crash/log data, usage patterns.
  • Location and movement data only when you grant permission (for tracking routes, workouts) and only to the extent needed.
  • Analytics data: We may collect aggregated or anonymised usage data to understand how the app is used and improve our Services.

2.3 Integration & third-party services

If you connect Vaast with third-party platforms (e.g., Garmin Connect, Wahoo, Apple Health) you authorize the flow of relevant data into Vaast. We only access the data you permit.

We do not collect extra data beyond what’s necessary for the integration.

2.4 AI processing of your data

Vaast is an AI coaching product. To generate your training plans, coaching conversations, and workout recommendations, we send relevant data to third-party AI service providers who process it on our behalf. These providers are currently OpenAI, xAI, and Cerebras, used for chat coaching, plan generation, and workout generation. The data sent can include your name, training goals, workout history, and fitness and health metrics such as heart rate, heart-rate variability (HRV), sleep duration and quality, VO2 max, and pace or speed data, including metrics derived from devices you connect.

These providers act as data processors: they process your data solely to provide the service to us, under data-protection terms that require them to safeguard your data with the same or equal level of protection described in this policy. They are not permitted to sell your data or use it for their own purposes. We ask for your consent in the app before your data is first processed by these AI services. You can stop AI processing at any time by deleting your account (Settings > Account > Delete Account) or contacting us.

3. How We Use Your Data

We use your data to:

  • Provide, maintain and personalise your training plans and workout experiences.
  • Sync and analyse your workouts and device data to adapt and refine your programs.
  • Send you communications about your account, updates, features or support (you may opt out of non-essential messages).
  • Improve our Services: e.g., analytics on usage patterns, detecting bugs or errors, enhancing app performance.
  • Comply with legal obligations or enforce our terms if required.

We do not sell or rent your personal data to anyone.

4. Your Rights & Data Ownership

4.1 You own your data.

Your data belongs to you. You have the right to access, download/export or delete your data. You control your device and service integrations and may revoke permissions at any time.

4.2 Your rights under applicable law

Depending on your country/region (e.g., EU residents under the General Data Protection Regulation (GDPR), California residents under the California Consumer Privacy Act (CCPA)), you have rights such as:

  • Accessing the personal data we hold about you.
  • Correcting or requesting deletion of your personal data.
  • Objecting to or restricting processing of your data.
  • Withdrawing consent where the processing is based on consent.
  • Lodging a complaint with a supervisory authority.

To exercise these rights or for data-export/deletion requests, please contact us at support@vaast.ai.

5. Data Sharing & Disclosures

We only share your data in limited circumstances:

  • With the third-party service you connect (e.g., Garmin, Wahoo) only when you authorise.
  • With our AI service providers (currently OpenAI, xAI, and Cerebras), who generate your coaching and training plans on our behalf as described in section 2.4, with your consent.
  • With trusted service providers (e.g., cloud hosting, analytics providers) who process data on our behalf, all bound by data-protection agreements.
  • If required by law, e.g., responding to lawful requests, subpoenas or government authorities.
  • In connection with a business transaction such as merger, acquisition or asset sale, in which case you will be notified.

We never share your personal data for advertising purposes without your explicit consent.

6. International Transfers & Data Storage

Even if you are located in the EU or other jurisdictions with data-protection laws, your data may be transferred to and processed in servers located in the United States (or other jurisdictions). We apply appropriate safeguards (such as Standard Contractual Clauses, encryption) to protect your data in transit and at rest.

7. Data Security & Retention

  • We use industry-standard measures (e.g., encryption in transit (TLS/HTTPS), secure storage, access controls) to protect your data.
  • We limit employee access to the data and monitor for unusual activity.
  • We retain data only as long as your account is active or as needed to provide Services/comply with legal obligations. If you delete your account, we will permanently delete or anonymise your personal data within 30 days unless we reasonably need to retain it (e.g., for legal purposes).

8. Children’s Privacy

The Services are not intended for children under the age of 16 (or the minimum age in your jurisdiction) without parental consent. If we become aware that we have collected data from a child without consent, we will take steps to delete that data.

9. Cookies & Tracking Technologies

We use cookies and similar technologies (such as web beacons, analytics tools) on our website and app to:

  • Remember your preferences and settings.
  • Understand how you interact with our Services to improve them.
  • Provide aggregated, anonymised statistics.

If you prefer, you can disable cookies by changing your browser/device settings, though this may limit some functionality of the Services.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time (for example, when introducing new features or to comply with new laws). When we do, we will post the revised version with a new “Last Updated” date and notify you via the app or email if required. Continued use of the Services after changes constitutes your acceptance of the amended policy.

11. Contact Us

If you have any questions, requests or concerns about this Privacy Policy or the way we process your data, please contact us at: