Data sources and provenance¶
Last updated: 2026-11-06
Where the data your app receives from SweatStack comes from, on what basis it reaches you, and which conditions come with it. Link to this page or copy it into your own GDPR records of processing.
At a glance¶
- SweatStack answers to each source. Athletes connect a source under SweatStack's own developer agreement with it, and SweatStack is accountable to the source for that connection. When your app collects data from a source itself and sends it to SweatStack, that connection runs under your app's own agreement with the source.
- Users grant categories, not sources. A user who grants your app their activities gives it their activities from every platform they connect, now and later.
- Each party is the controller of what it holds. The source for the data on its side, SweatStack for what it stores, your app from the moment it receives the data.
- The original is always there. SweatStack keeps the file each activity came from, and your app can download it.
- One set of rules, whatever the source. Plus a short list of conditions that individual sources set, below.
Sources¶
| Source | How the user connects it | What it sends to SweatStack | What SweatStack sends to it |
|---|---|---|---|
| Garmin Connect | Authorizes their Garmin account in SweatStack and chooses permissions on Garmin's own screen | Activities. Dailies: sleep duration, HRV, resting heart rate, body mass, body fat percentage. | Planned workouts (running, cycling, pool swimming) |
| Wahoo | Authorizes their Wahoo account | Activities | Nothing |
| Intervals.icu | Connects their Intervals.icu account | Activities, except those it may not forward (why) | Nothing |
| The user, or an app they authorized | Uploads a file or writes through the API | Activities (FIT or CSV), dailies, reproductive health records, planned workouts | Not applicable |
Garmin Connect through SweatStack's own connection is available in SweatStack itself. An app connects Garmin Connect with its own developer access and keys, preferably through a self-hosted integration, tells Garmin that SweatStack processes the data on its behalf, and sends SweatStack the files.
Who connects the source¶
An app chooses per source who talks to it and who signs the athlete in. That choice decides whose user the athlete is.
| Who talks to the source | Who signs the athlete in | How data reaches SweatStack | Whose user it is | |
|---|---|---|---|---|
| Hosted | SweatStack, on its own keys | SweatStack | SweatStack fetches it | A SweatStack account, which grants your app access |
| Own keys, where the source allows it. For Garmin Connect, only with Garmin's approval in writing | SweatStack, on your app's keys | SweatStack | SweatStack fetches it | Your app's |
| Self-hosted integration | Your app | SweatStack, with your app's own connection to the source | Your app sends it | Your app's |
| Bring your own data | Your app | Your app | Your app sends it | Your app's, or a SweatStack account that lets your app write to it |
For a self-hosted integration, the SweatStack bridge is a reference implementation you deploy and run yourself, with no guarantees. See self-hosted integrations for what it takes.
The user can disconnect a source at any time, in SweatStack or at the source. New data from it stops; what's already in their account stays theirs. Per-source details, like how far back history goes, are on the integrations page.
Categories your app can be granted¶
| Category | Scopes | Sources |
|---|---|---|
| Activities | activities:read, activities:write |
Garmin Connect, Wahoo, Intervals.icu, uploads. Includes the analyses SweatStack computes from them: zones, the metabolic map, the intensity-duration model. |
| Wellness | wellness:read, wellness:write |
Garmin Connect, and what the user or an app records |
| Reproductive health | reproductive_health:read, reproductive_health:write |
Only what the user or an app records. No connected platform sends it. |
| Workouts | workouts:read, workouts:write |
Planned in SweatStack by the user or an app, then sent to Garmin Connect if the user connected it |
A new source arrives under the categories a user already granted: no code change, no new consent. A new category comes with a new scope, and your app gets it only if it asks and the user agrees. See scopes.
Conditions from data sources¶
Your app must follow these (terms). When one changes, we update this table and tell you.
| Source | Condition |
|---|---|
| Garmin Connect | Attribute Garmin-sourced data when you display it, following Garmin's brand guidelines. The API gives you the line to show with the data: see where the data came from. |
| Wahoo | None |
| Intervals.icu | None |
Rules for every source¶
SweatStack doesn't approve individual uses of the data. Your app receives what the user granted, for as long as they allow it, under the rules in Part B of the terms:
- Use the data only for the purposes you told the user about. Don't sell it.
- Pass it on only with a lawful basis, and bind the recipient to the same protections.
- Get the user's explicit consent before you put their data into a general-purpose AI model, and never use the data to train one, unless it serves only that user. See AI models.
- When the user revokes access, delete what you hold about them within 30 days.
For your records of processing¶
The facts on SweatStack's side, ready to copy. Your own lawful basis and purposes are yours to fill in.
| Received from | Sweatkraft AS (SweatStack), Norway, through the SweatStack API |
| Original sources | Garmin Connect, Wahoo, Intervals.icu, and the user's own uploads and records |
| Categories | The scopes your app holds: activities, wellness, reproductive health, workouts |
| Special category data | Yes. Activity, wellness and reproductive health data contain health data under GDPR Art. 9. |
| SweatStack's basis for sharing it with you | The user's explicit consent on SweatStack's authorization screen (Art. 9(2)(a)), shown per category with your stated purpose |
| Where SweatStack stores it | Finland (EU), Hetzner. Sub-processors are listed. |
| Your role | Independent controller, from the moment your app receives the data |
| When it stops | The user revokes your app or deletes their account. Delete what you hold within 30 days. |
Common questions¶
Which source did a record come from?
Every daily has a source field: garmin_connect, intervals_icu, wahoo or manual. An activity lists its recording devices, and GET /api/v1/activities/{activity_id}/download returns the original file.
What if a source changes or ends SweatStack's access? The data already in the user's account stays, and stays exportable. New data from that source stops. See connected platforms in the terms.
Does the user see who gets their data? Yes. SweatStack's authorization screen names your app, each category it asks for and your reason for it. The user can revoke your app at any time in their SweatStack settings.
Does my app need its own agreement with a source? If athletes connect a source through SweatStack, no. The connection runs under SweatStack's agreement with that source, and your app follows the conditions from data sources and the rules for every source.
If your app collects data from a source itself and sends it to SweatStack, yes. The source's terms then apply to your app directly. For Garmin Connect, your app connects to Garmin with its own developer access and keys, tells Garmin that SweatStack processes the data on its behalf, and sends SweatStack the files. For the users your app manages this way, your app is the controller, and SweatStack processes their data for you under the Data Processing Agreement.
Related¶
- Sub-processors: the providers that process data on SweatStack's behalf.
- Security: how SweatStack protects the data it holds.
- Privacy policy: what SweatStack does with the data, for users.