Tilpas · Privacy policy
Datamadsen ApS · Version 0.9 (beta) · 3 November 2026
Tilpas shows you your own numbers on training, recovery, sleep and body from your Garmin watch and your Withings scale or blood-pressure monitor, answers "should I train today?" with the reasons shown, and keeps track of your routines. This page tells you what data Tilpas processes, why, who else touches it, how long we keep it, and what you can do about it.
Tilpas is in beta
This page describes what happens to your data today, not what we plan. Where something is planned, it says so. When Tilpas starts doing something new with your data, this page changes first.
Who we are
The controller is Datamadsen ApS, a Danish private limited company, CVR CVR number, address, Denmark. Contact for everything on this page, including your rights: support@tilp.as. Tim Madsen is responsible for data protection at Datamadsen ApS.
Tilpas is a wellness and training service. It is not a medical device and not a healthcare provider; see Not medical advice.
What data Tilpas processes
| Data | What it is | What it is used for |
|---|---|---|
| Account | Your email address, when you signed up, when you gave consent, your language. For each sign-in: when it was made and last used, and whether by link, code or password. If you chose a password, only a one-way hash of it (scrypt) is kept, never the password. | Signing you in and keeping you signed in, sending you sign-in emails. |
| Waitlist | If you sign up while Tilpas is closed to new users: your email address, your language and when you signed up. Nothing else. | To write to you when Tilpas opens to new users. |
| Garmin data | In the beta, new users cannot yet connect Garmin from Tilpas. Before that opens, this page will be updated with exactly how the connection works. With Garmin connected, Tilpas fetches: activities (type, time, distance, duration, heart rate, pace, power, cadence, elevation, laps, strength sets, the name you gave the activity and the GPS route), sleep, overnight heart-rate variability, stress, Body Battery, resting heart rate, steps, calories, intensity minutes, pulse ox, training readiness, training status and load, VO₂ max, fitness age, race predictions, heart-rate zones, lactate threshold and your personal records. | Showing you your own data and working out your own statistics: load, trends, the week's numbers, records and the day's answer to "should I train today?". |
| Withings data | When you connect Withings (with Withings' own sign-in and your permission): weight, body composition (fat, fat-free mass, muscle, water, bone), blood pressure and pulse, with their times. | Shown next to your training: weight trend, blood pressure and the home average, reminders to measure. As information, never as a diagnosis. |
| What you write yourself | Your profile (year of birth, height, maximum heart rate, units, time zone, notes for the coach), weekly targets, routines and to-dos, what your watch suggested, a picture of yourself if you add one, and the questions you ask the coach. | Only what they are for: your targets, your reminders, the app icon, the coach's answers. |
| The coach's answers | The coach's answers, kept on your account. | So you can read them again without asking again. |
| Weather | The weather at the start point of each outdoor activity during the hours it lasted, looked up at Open-Meteo. | Explaining heart rate and pace affected by heat, wind or rain. |
| Technical | Server logs: the time, which page or function was called, the response code, how long it took, and an internal id for your account. No email address, no IP address and no health values. Your IP address is held in memory only as long as needed to slow down repeated sign-in attempts. Also counts without personal data (for example how many people use a password). | Keeping the service running and secure, finding faults. |
| In your browser | A sign-in cookie (tilpas_session), needed to stay signed in. Your choice of language and light/dark theme in the browser's local storage. The app keeps a copy of itself in the browser so it opens quickly. | Keeping you signed in and the page as you chose it. |
Tilpas uses no tracking cookies, has no third-party analytics, shows no ads, sells no data and buys no data about you from anyone. The beta is free, so no payment data is processed.
Why we process it, and on what basis
- The account and the service itself
- Sign-in, the views, the statistics, the reminders. Basis: performance of the contract with you, GDPR Article 6(1)(b).
- The waitlist
- Your email address, so we can tell you when it opens. Basis: your consent, Article 6(1)(a), given when you sign up for it. Write to support@tilp.as and we take you off the list.
- Your health data
- Training, sleep, heart rate, weight, blood pressure and what you write about your health. Basis: your explicit consent, Article 9(2)(a), given when you sign up. You can withdraw it at any time; what happened before stays lawful.
- The coach
- Sending a summary of your numbers to an AI model when you ask for it. Basis: the same consent; it only happens when you press. See the next section.
- Keeping the service secure
- Logs and the brake on sign-in attempts. Basis: our legitimate interest in a secure service, Article 6(1)(f).
- Answering your email
- Basis: legitimate interest, Article 6(1)(f).
The coach and artificial intelligence
Tilpas has one feature that uses artificial intelligence: the coach. Everything else, including the day's answer to "should I train today?", the training focus and the load numbers, is worked out by fixed rules in Tilpas' own code without AI, and nothing leaves the server for them.
When anything is sent
Only when you press a button that asks the coach for something: a read of a day, an activity or a period, or a question. Nothing is sent on its own.
What is sent
A summary of the numbers Tilpas shows you for that day or period: dates, durations, distances, heart rate, training effect, sleep, heart-rate variability, readiness, stress, steps, weather, weight, blood pressure, the names you gave your activities (they can contain place names), your age, height, your notes for the coach, your targets and routines, and the question you asked. It does not contain your email address, your GPS route or your picture.
Who receives it
A language model (Claude) from Anthropic, PBC in the USA, which writes the answer. In the beta this goes through Anthropic's tool Claude Code on Datamadsen ApS' account. Confirm the account type and whether Anthropic's use of data for model training is off; state it here. Planned: before the beta opens to more users, the coach moves to Anthropic's commercial API with a data processing agreement and the European Commission's standard contractual clauses for the transfer to the USA.
Limits
The coach's answers are general information made by software and can be wrong. They are not medical advice, and the coach is told not to give any: no diagnoses, no medicines or doses, and on blood pressure only "take it to your doctor". Tilpas trains, fine-tunes or builds no AI model on your data.
Who else processes your data
| Who | What they get | Where |
|---|---|---|
| Hetzner Online GmbH | Runs the server Tilpas runs on. All data sits there, on an encrypted disk Hetzner cannot unlock. | Germany. |
| Anthropic, PBC | The coach's summary and answer, only when you ask (see above). | USA. |
| Fastmail | Sends Tilpas' sign-in emails. Gets your email address and the email (with the link and the one-time code). | country |
| Open-Meteo | Weather lookups: an outdoor activity's start point, rounded to about 100 metres, and the date. No account and no id for you. | country |
| OpenStreetMap | Map images around a route, fetched by your own browser when you open an activity with a map. OpenStreetMap sees your IP address, as any website you visit does. | OpenStreetMap Foundation, United Kingdom. |
Garmin and Withings are not our processors. They are the sources: independent controllers of your accounts with them, sharing only what you allow. We share your data with no one else unless the law requires it (for example a court order) or you ask us to.
Where it is kept, and for how long
Tilpas runs on a server at Hetzner Online GmbH in Germany. Your data sits in a folder of its own, apart from other users', on an encrypted disk (LUKS2, AES-256). The disk can only be unlocked with a passphrase the server itself does not know, so a copy of the disk outside the running server cannot be read, not by Hetzner either. Access to the server is limited to Tim Madsen, with SSH keys. Backups: none yet. Planned: encrypted backups at Hetzner in Germany; this page will be updated when they run.
| Data | Kept |
|---|---|
| Your account and everything in it | As long as the account exists. If you ask us to delete it, that happens within 30 days. |
| The waitlist | Until you get an account (the account then takes your place on the list), or you ask us to delete you. |
| A sign-in | Ends when unused for 30 days, and after 180 days at the latest. Sign-in links and codes work once, for 15 minutes. |
| The coach's answers | Until you delete your account. |
| Server logs | 30 days. |
| Counts without personal data | 90 days. |
| Emails with us | As long as we need them to help you, 2 years at most. |
Security
- Every connection uses HTTPS.
- You sign in with a link or a six-digit code by email that works once for 15 minutes, or with a password if you chose one. Passwords are kept only as a scrypt hash. Setting or removing a password needs a sign-in within the last hour.
- The sign-in cookie is random, and the server keeps only a hash of it, so a copy of the server's files cannot be used to sign in as you.
- Repeated sign-in attempts are slowed down; five wrong codes void your open links.
- If a security breach affects your data, we tell Datatilsynet (the Danish data protection agency) within 72 hours of learning of it, and you when the breach can matter to you.
Your rights and your control
- Sign out everywhere: Settings → Account → Sign out everywhere.
- Disconnect Withings: remove Tilpas in your Withings account; Tilpas then receives nothing more from it.
- Correct something: what you wrote yourself you can change in the app; data from Garmin and Withings is corrected at the source.
- Get everything, or have it deleted: write to support@tilp.as from the address the account belongs to. In the beta this is done by hand, within 30 days. Planned: export and deletion right in Settings, before the beta opens to more people.
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, objection and data portability, and to withdraw your consent at any time without affecting what happened before. We answer within a month. You can complain to Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk, or to the supervisory authority of the EU country you live in.
Tilpas makes no decisions about you with legal or similarly significant effect. The day's answer is a suggestion you can ignore.
Children, medical advice, changes
Children
Tilpas is for adults. We do not knowingly accept users under 16 and delete an account if we learn it belongs to someone younger.
Not medical advice
Nothing in Tilpas, including the blood pressure, the home average, the training answer and the coach's answers, is a diagnosis, a treatment or a replacement for a doctor. Blood pressure is shown as the monitor measured it; what it means for you is a conversation with your doctor.
Changes
When Tilpas starts processing a new kind of data, uses a new processor, moves server or changes how the coach works, this page changes first, and the version and date at the top change with it. If the change matters for your consent, we ask again before it takes effect.
The self-hosted edition
Tilpas also exists as software you can run on your own computer. In that edition no data reaches Datamadsen ApS at all; its own, shorter policy is at /privacy.html.