Privacy Policy
Effective: 24 October 2026. This policy describes the public EverTri website and the current invitation-only pilot, rather than features that are only planned.
Who operates EverTri
EverTri is operated by Aleksandr Khamidulin as an independent project. Contact: [email protected]. Access is currently by invitation; public account registration is unavailable.
Website and protected prototypes
The demonstration uses synthetic activity data and is accessible only after sign-in. The public site does not expose the athlete’s dashboard or activity records. Calendar changes and effort reports made in that demonstration stay in your browser’s local storage. Selected demonstration videos are previewed locally and are not uploaded. We do not use advertising trackers, third-party analytics or marketing cookies. Browser requests still disclose technical information such as your IP address and request metadata to our hosting and network providers.
Private pilot data
We store the invited athlete’s login email, password hash, date of birth, sex, height, weight, and any training summaries provided for the pilot. We also store laboratory plans, laboratory report files, manually entered results, units, reference limits and notes when the athlete explicitly confirms saving health data. Do not upload another person’s medical records. Uploaded files are not automatically read or interpreted by an AI model.
Why we process data
We use account data to restrict access, profile and training data to present the athlete’s training context, and laboratory data to keep records and compare entered numbers with the reporting laboratory’s reference limits. Saving health records requires an explicit confirmation in the interface. These comparisons are informational and do not provide diagnosis, treatment or medical clearance. Clinical decisions and any changes to medication or exercise restrictions require an appropriate healthcare professional.
Garmin data and planned integrations
For the owner’s pilot, an owner-authorized local Personal API component retrieves activity information and FIT files from Garmin Connect. A selected summary is copied into the private pilot. Garmin credentials are not sent to the browser or published in source code. Business API integration is planned and remains subject to Garmin’s approval; the website does not currently offer public Garmin account linking or write planned workouts to Garmin Connect. Future multi-user Garmin access will require a separate authorization flow and an updated explanation of the data requested, its purpose and how to disconnect. EverTri is not endorsed by Garmin.
Where data is processed and who can access it
The pilot is hosted on a virtual server supplied through Timeweb Cloud. Cloudflare provides DNS, proxy and HTTPS edge services. The owner’s local development computer also holds source activity files and pilot copies. Hosting and network providers process data as necessary to deliver these services; server administrators can access stored pilot records. Data is not sold, used for advertising or sent to external AI services by this pilot. Depending on provider infrastructure, network processing may occur outside your country. This pilot does not offer a guarantee of storage in a particular jurisdiction.
Security and browser storage
Private routes require a server-validated session. Passwords are stored as salted hashes; the service uses HTTPS and a Secure, HttpOnly session cookie with a seven-day maximum lifetime. The initial password must be changed. Training calendar edits and perceived-effort reports in the current prototype are still stored in the browser rather than synchronized between devices. Laboratory records and profile changes in the private pilot are saved on the server. A person with access to an unlocked device or the same browser profile may be able to view browser-held information. Use sign out after a shared-device session.
Retention, deletion and your choices
Session records expire after seven days. Failed login records are retained for up to 15 minutes for rate limiting. Profile, training and health records remain for the duration of the pilot unless deleted earlier. You can delete an individual laboratory record or uploaded file in the interface; the deletion removes it from live storage. To request access, correction, export, withdrawal of health-data permission, or deletion of the whole account and retained pilot copies, contact [email protected]. Stop saving new health records if you withdraw permission. Operational copies, if created, may retain deleted information until they are replaced. We will explain any retention that is necessary for a legal obligation rather than promise immediate removal from every copy.
Contact and changes
This is an adult, invitation-only development pilot. It is not a medical service. We will update this policy before introducing materially different collection, external AI processing, public registration or additional integrations. Questions and requests: [email protected].