Skip to content

Data sources and provenance

SweatStack ingests activity data from wearable and training platforms and makes it available to your app through one API. This page documents where that data comes from and on what basis it reaches SweatStack, so you can document your own data supply chain (for example for your GDPR records of processing) by linking or copying it.

One relationship covers every source

This is the core of SweatStack: an app built on the SweatStack API receives data from every supported source without registering separately with any of them. You integrate once, against SweatStack. When a user authorizes your app, they authorize SweatStack to share the data they have connected, whatever its original source.

This includes sources added later. When a new platform comes online, apps on the SweatStack API get it with no extra approval and no code change.

SweatStack only adds a source once that source's terms permit serving its data to third-party apps, so every source listed here is available to your app.

Sources today

Source How your app receives it Separate provider approval needed?
Garmin Connect The user authorizes their Garmin account in SweatStack. SweatStack ingests the data under its Garmin developer agreement and serves it to your app under the user's SweatStack authorization. No
Intervals.icu The user connects their Intervals.icu account. Their activities are served to your app under the same authorization. No
Wahoo The user authorizes their Wahoo account in SweatStack. Their activities are served to your app under the same authorization. No

Where a source aggregates data from other platforms (such as Intervals.icu), some activities may carry the original platform's own forwarding restrictions. See the help center for specifics.

Garmin asks that Garmin-sourced data be attributed when you display it, following their brand guidelines. It is the only such requirement across all our sources. See attribution.

What you can do with the data

SweatStack does not restrict how your app uses the data a user has authorized it to receive. There is no lock-in, no gatekeeping, and no per-use approval. You integrate once, and the data flows to your app for as long as the user allows it.

The one obligation is not something SweatStack adds. It is the one GDPR already places on you: if you pass SweatStack-sourced data on to further third parties, you need a lawful basis with your users and must hold those parties to equivalent protections. That governs your relationship with your own users, not what SweatStack permits you to do with the data. See No re-sharing.

  • Sub-processors: the providers that process data on SweatStack's behalf (hosting, monitoring, and so on).
  • Security: how SweatStack protects the data it holds.