What this does with your data

When you sign in, your email and password are passed straight to Garmin to be exchanged for an access token. The password is never written to disk, never logged, and is dropped from memory the moment Garmin accepts it. It is not kept in any form: not encrypted, not hashed, not at all. Nobody can recover it later, including me.

Garmin turns away sign-ins from data-centre addresses, so the sign-in step goes out through a residential relay in the UK run by IPRoyal. The connection is encrypted between this server and Garmin before it reaches the relay, the same way your browser encrypts a connection to your bank: the relay can see that something is going to Garmin, but not your email, your password or anything Garmin sends back.

If you would rather not type it here at all, that is a reasonable instinct. Run the whole thing on your own machine and your Garmin session never leaves it.

One row per person, on a single server in London, run by Fly.io. That row holds:

Nothing from Garmin is stored: no activities, no heart rate, no sleep, no location. (The one thing you can choose to change that is joining a Daash crew, below.) Each question fetches from Garmin fresh and the answer is gone when the request ends. The one exception is speed: your scheduled workouts and workout list are held in memory for up to ten minutes, so a chat about your plan doesn’t refetch them every turn, and are dropped whenever a change is made through Daash. Nothing is written to disk. There is no copy of your training history on this server to leak, subpoena or lose.

Your IP address is held in memory for a few minutes so that repeated failed sign-ins can be slowed down. It is never written to disk, and the web server’s request log is switched off precisely so that private connector addresses do not end up in it.

Reading is unrestricted. Activities, splits, heart-rate zones, daily summaries, sleep, body battery, weight, personal records, the same things you see in the Garmin Connect app.

Writing is to the workout library: creating a workout, putting it on a date, taking it off again, and deleting one you no longer want. And, only when you ask, a run you recorded can be renamed, given notes, corrected in type or given its shoes. Deleting is gated rather than merely discouraged. The first attempt only reads the workout’s name back, and removing it takes a second one quoting that name, so nothing goes without having been named out loud first.

Your training history stays as recorded. There is no tool that deletes a recorded activity or changes what it measured (its distance, time, heart rate, splits or route), changes your profile, posts anything, or touches anyone else’s account. A run you actually did cannot be lost through this, whatever is asked of it.

This is the part people miss, so it gets said plainly.

Sharing a week or a plan is up to you. The plan card’s Share button opens a page on this site that draws the week you are looking at as an image, for you to post, send or keep. The week travels in the part of the link after the #, which browsers keep to themselves, so it never reaches this server or any other, and that page has no analytics and stores nothing. It carries only what the image shows: the plan’s name, the dates, and each session’s day, type, name, distance and shape, with the pace or time once it is done. With a plan, the link also carries its other weeks the same way, without the shapes, so the page can save the whole plan as a PDF or an image; that is drawn on your device too. Its “Send Daash to a friend” link is the front page marked as coming from a share, with nothing about you or your week in it. Who sees the image after that is your choice.

Beyond that: nothing is sold, rented, or handed to advertisers, data brokers or anyone else. There is no third party with access to the database. It is one server, one person, no business model.

Which AI systems process your Garmin data. Only the assistant you connect Daash to: Claude, made by Anthropic; ChatGPT, made by OpenAI; Gemini, made by Google; or Grok, made by xAI. Daash runs no AI model of its own.

What for, and when. To answer your questions about your training, sleep and recovery, and to build the workouts and plans you ask for. The assistant reads your Garmin data through Daash only when you ask it something that needs it, and only your own.

Your consent, asked before anything is shared. Before an assistant gets any access, Daash shows its own page naming the assistant and saying it will be able to read your Garmin data. Nothing reaches it until you choose Allow there. Claude also asks before Daash first reads or changes anything, unless you tell it not to. You can withdraw your consent at any time: remove Daash from your assistant’s connectors, or choose Disconnect on the sign-in page, which also deletes everything Daash keeps.

Nowhere else. Daash’s own features, such as the Daash app, the app’s plan builder and the Monday email, work from fixed rules, not AI. Your Garmin data goes to an AI system only when you ask your assistant something.

Kept up to date. This statement changes when the law or Garmin’s policies change, or before Daash uses your data with AI in any new way. The date at the top of this page says when it last changed.

Training AI models. Daash never uses your Garmin data, or anything made from it, to train, test or improve any AI model, and lets no one else do so with what it holds. What reaches your chat is handled by the company behind your assistant under its own policies, and whether it may learn from your chats is a setting in your account with it: in Claude, Settings → Privacy → Help improve Claude; in ChatGPT, Settings → Data controls → Improve the model for everyone; Gemini and Grok have their own data settings in your Google or X account. Turn it off and your chats, Garmin data included, are not used for training.

Nothing is sold, and nothing is shared beyond this list. Each one only does the job beside it.

Daash can also connect through Garmin’s official developer programme. That way, you approve Daash on Garmin’s own sign-in page instead of typing your password here, and you are asked first whether Daash may use your data with your assistant. Garmin currently limits how many accounts can connect its official way, so for now most new accounts connect as this page describes above.

Garmin doesn’t share your email address that way, so Daash asks for it on its own page. It’s kept encrypted and used to recognise you if you connect again, for a Monday email on your training week (your last week, the week ahead and a link to ask Daash about it), for one email when your first activity arrives from Garmin, for one on how to finish if your app doesn’t finish connecting after you approve, and for the odd update email. Any of them stops with one click. If the address already has a Daash account, Daash emails it a 6-digit code first, so nobody can join someone else’s account by typing their address. The code is kept only as a scrambled check, and only for ten minutes.

Garmin then sends Daash your data as your watch syncs, rather than Daash asking for it each time: daily summaries, sleep, heart rate and HRV, stress and Body Battery, fitness markers such as VO2 max, and your activities. Where Garmin allows it, Daash also asks Garmin once for the last month of your history when you first connect, so it isn’t starting from nothing; it’s kept the same way. It keeps the summaries, not the raw streams: an activity as its distance, time, splits and laps, without its GPS track, and a night or a day as its totals rather than minute-by-minute readings. Garmin also offers the file your watch recorded; Daash reads it once for the figures the watch worked out (time in your heart rate zones, running dynamics, training effect, power) and doesn’t keep the file. So that connection keeps that data, encrypted, on the same London server, for as long as you stay connected and only to answer your own questions. The workouts and plans Daash writes to that account are kept here too, because Garmin’s API doesn’t let Daash read them back: the sessions themselves, and the dates they sit on. If you add your past activities from the CSV that Garmin Connect’s activities list exports, Daash keeps each one’s type, title, date, distance, time, heart rate, calories and climb the same way, encrypted, so every chat can see your training from before you connected; the file itself isn’t kept. Disconnecting here, or removing Daash in Garmin Connect, deletes all of it, and Daash tells Garmin you have gone.

These pages count views using PostHog on its European servers, configured to leave nothing behind: no cookies of its own, no advertising identifiers, no session recording, and no profile built about you. The site itself sets one small cookie, daash_src, which remembers for 30 days where you arrived from (a site name such as chatgpt.com, or “search”), so that if you go on to connect, Daash knows what brought you. It holds nothing about you and goes nowhere else. It records that a page was opened and that a button was pressed, which is how I know whether the instructions actually work. If you use the box on the front page that asks which connector should be next, the name you tapped or typed is recorded the same way, and that is all it carries.

The server reports a few moments the same way: a sign-in that worked, a sign-in that failed and roughly why, the first time a new connection is used, once a day that it was used that day, once a day the name of each tool used (such as “get_plan”, and how many seconds it took to answer, never what it returned), once an hour how long each tool took across everyone, with no one’s name or address on it, when a tool failed in a way it shouldn’t (its name and the kind of error, never the message), when a tool was held back because it was asked for at the same time as the plan card (its name only), when a “what’s new” note was shown, when a plan or workout card was sent to the chat and whether it then drew (the app it drew in, how long it took, and any error the card hit, never what it showed; a card that opened, or was still waiting for its answer, is counted with no one’s name or address on it), when a Monday, first-activity or finish-connecting email was sent and when its link to ask Daash was clicked (which app and which week, nothing else), how many past activities were added from a CSV (with no one’s name on it), when someone unsubscribed from update emails, and when a connection could not be renewed, by Claude or by Garmin, so it would need connecting again. If you answer the optional “How did you hear about Daash?” when you allow a connection, your choice is recorded too, with the few words you type if you choose “Somewhere else”. Each carries a few yes-or-no flags, the app you connected from (such as Claude or ChatGPT) and a masked form of your email address (its first letter and domain, never the full address), so I can see who is using it, which features earn their place, and help if something breaks. If you came to Daash through daash.run in the same browser, your sign-in is linked to that visit, so I can see which pages lead to people connecting. Sign-ins also carry the country you connected from, worked out on Daash’s own server from your connection’s address using DB-IP’s free country table; the address itself is neither kept nor sent. They also say whether you were on a phone, tablet or computer, its system (iOS, Android, Mac or Windows) and which kind of browser (Safari, Chrome, an app’s own and so on), never the browser’s full details, so a sign-in that keeps failing on one kind of device can be found and fixed.

Email to support@daash.run is received by Resend and passed through the server on its way to my inbox. The server keeps no copy of it.

Neither receives your Garmin data or your connector address. That is also why this site has no cookie banner: there is nothing to ask you to consent to.

A Daash crew is a small group of friends who all use Daash. It shows them each other’s easy and long runs for the week and suggests runs to do together. Nobody is in a crew unless they join one with an invite code, and while you are in one, the crew’s members can see this, and the server keeps it so they can:

These are read from your own plan when you look at it in Daash, so a crew causes no extra requests to Garmin. How your runs went, your pace, heart rate, sleep, routes, location and everything else from Garmin are never kept or shown to the crew: crews match people by day and time, never by speed. Only members of your crew can see any of it, through their own Daash, unless whoever started the crew turns on its page (below).

The crew card can turn the crew’s week into a message or an image: a calendar of each member’s chosen name and their easy and long runs by day with distances (a hard session as the word “hard”), the club run, and the invite code, for a member to copy, save or send to WhatsApp. The image is drawn on the member’s own device by the same share page as a plan week, and the week travels in the link the same way, reaching no server. That only happens when they press the button, and it goes to whichever chat they choose; Daash sends nothing itself.

The crew’s page, only if its starter turns it on. Whoever started a crew can make a link to a web page of the crew’s week, for the group to pin in its chat. Daash asks them first, and every member’s crew card says when the page is on. Anyone with the link can see what the crew card shows for this week and next: members’ chosen names, the days they run, easy, long or “hard” with distances, which runs line up and at what time of day, and the club run. It never shows the invite code, pace or anything else. The link is long and random, the page is kept out of search engines and has no analytics or cookies, and the crew’s starter can replace the link, which stops the old one working, or turn it off at any time.

Friends without Daash, on the crew’s page. Anyone with the page’s link can add their easy runs to it without Daash or Garmin. What is kept for them: the first name they type, the times of their usual week they run easy (a day and morning, afternoon or evening), whether they usually do the crew’s club run, any changes they make to this week or next, and a four-digit PIN, stored scrambled so it can’t be read back, not even by Daash. Their phone remembers them with a random key kept in its browser. Nothing else is asked for or kept: no email, no account, no location. Days that have passed are deleted. After three weeks without them opening the page, their runs stop being matched until they say they’re still running. “Remove me” on the page deletes everything kept for them at once, and whoever started the crew can remove them too.

Leaving the crew deletes all of it at once, from the page too. So does Disconnect. When the last member leaves, the crew itself is deleted.

Open the sign-in page and choose Disconnect. That deletes your row outright (token, email, fingerprint, timestamps, markers), your place in any crew with everything it kept, and the address of any phone it sent notifications to, and the connection stops working immediately. Nothing is retained afterwards, so there is no backlog to request a copy of or ask to be forgotten from.

Signing in again has the same effect on whatever came before it: the old session is destroyed as the new one is created. If you ever think a connection has ended up somewhere it shouldn’t, signing in once more takes it back.

Removing the connector in Claude or ChatGPT is worth doing too, but it only removes it at their end. The Disconnect button is what deletes the stored session here. Nothing changes on Garmin’s side either way.

To see what is held about you, get a copy of it, or correct it, email support@daash.run from the address you signed in with, and you’ll get it within a month, as the law requires. To stop the occasional Daash email, use the link in any of them.

You can ask for a copy of what Daash holds about you, in a form you can take elsewhere, and have it corrected or deleted. You can also object to, or ask Daash to restrict, how it is used. Email support@daash.run from the address you connected with, and it is done within one month. Disconnect, above, deletes everything at once without asking anyone.

If you are unhappy with how your data is handled, you can complain to the UK Information Commissioner’s Office at ico.org.uk.

This is a personal project run by Bart Etcheverry, in the UK. It is not affiliated with, endorsed by, or connected to Garmin, Anthropic, OpenAI, Google or xAI. It reaches Garmin through the same private interface the Garmin Connect website uses, which is why it can break when Garmin changes something, and is moving onto Garmin’s official developer programme (above).

It is not intended for children under 13, and it is not a medical device. Nothing it tells you is medical advice.

If this policy changes, the date at the top changes with it, and the edit history is public like the rest of it. Questions, or anything here that turns out not to match the code: open an issue on GitHub.