Privacy policy

Who is responsible

MCP for Suunto at suunto.mcp.visin.ch is run by Marco Visin, Lugano, Switzerland. Marco Visin is responsible for your personal data: the controller under the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

For any question about your data, or to use your rights, write to marco@visin.ch.

What we store and why

We store only what the service needs to work:

• Your account. Your email address and the password you chose for MCP for Suunto. The password is stored only as a scrypt hash, so we cannot see it. We also store when you created the account and last signed in, and whether it is disabled or an administrator account. We need this to give you an account and keep it secure.
• Your access request. If you request access, the message you write to the administrator, so the administrator can decide. It is deleted when your request is approved. If this service has a mail server set up and the administrator did not turn off e-mail notifications, your email address and this message are also sent to them by e-mail (see "Who receives your data").
• Invite codes. If you sign up with an invite code, the invite records your email address and when you used it.
• Your Suunto connection. Your Suunto username, the access token and the refresh token that Suunto gives when you connect your account here, when the access token expires, whether the connection must be renewed, and your settings: units, read-only mode and time zone, with the time you connected and the result of the test request made then (how many workouts you had in the last 30 days, or why the request failed). They are stored encrypted with AES-256-GCM. You sign in on Suunto's own page, so your Suunto password never reaches this server. While you connect, we keep a hash of a one-time code that expires after 10 minutes, to check that the answer from Suunto belongs to you. We need this to reach your Suunto data for you.
• Connected AI apps. When you connect an AI app, we store the app's registration (the name and web addresses it gives itself) and the tokens that let it act for your account. Tokens are stored only as hashes. We also store when each connection was made and last used, so you can see it and revoke it.
• Activity log. For each action an AI app takes (a tool call, for example suunto_list_workouts), we record the time, the app, the tool, how long it took and whether it worked. We do not record what was read or written: no workouts, heart rate, sleep, locations, routes or points of interest. You see the latest entries on the Connected apps page, and we use the log to find errors and abuse.
• Browser sessions. When you sign in, your browser gets a random session code in a cookie. We store only a hash of it, with the time it was created and when it expires.
• IP address. Like every website, the server sees the IP address of each request. MCP for Suunto keeps it only in memory, for at most one day, to limit repeated attempts such as too many sign-ins. It does not save it in its database or in its log.
• Server log. The server writes a short technical log of events such as a failed sign-in, a new account or an error. It contains no passwords, tokens, IP addresses or contents of your Suunto data. But when an action fails, the error message can include a short detail, such as a value that Suunto refused.

Your workouts and health data are not stored

When an AI app asks for your workouts, daily activity, heart rate, sleep, recovery, routes or points of interest, MCP for Suunto gets them from Suunto and passes them on to the app. They are not saved in the database or on disk. This includes FIT files and the locations in your workouts and routes. To save calls to Suunto, recent answers are kept in the server's memory for 2 to 30 minutes (at most 20 MB per user) and are gone when the server restarts. The server log holds only the short error details described above. Your account page shows the result of the test request made when you connected, and never asks Suunto just to show the page.

Routes and points of interest that your AI app adds are saved in your Suunto account, as if you added them in the Suunto App, and can sync to your watch. MCP for Suunto does not change or delete them later: you can delete them in the Suunto App.

Legal bases

We process your data in line with the Swiss FADP. Where the GDPR applies, we rely on these legal bases:

• Contract (Art. 6(1)(b) GDPR): to provide the service you signed up for, that is your account, your Suunto connection, your connected apps and your activity log.
• Your explicit consent (Art. 9(2)(a) GDPR) for health data, such as heart rate, sleep and recovery: you give it when you connect your Suunto account and ask your AI app for this data. You can withdraw it at any time by removing the Suunto connection.
• Legitimate interest (Art. 6(1)(f) GDPR): to keep the service secure and running, with limits on repeated attempts, the server log, backups and protection against abuse.
• Legal obligation (Art. 6(1)(c) GDPR): when the law requires us to keep or hand over data.

How long we keep data

• Account: until you delete it, or the administrator does.
• Suunto connection: until you remove it on the Suunto account page or delete your account. The tokens are then deleted from this server, and MCP for Suunto asks Suunto to end the connection. A one-time code used while connecting is deleted when it is used, and expired codes are deleted regularly.
• Access requests: deleted at once if rejected, and after 30 days if nobody answers. The message to the administrator is deleted when the request is approved. A notification e-mail about a request stays in the administrator's mailbox until they delete it.
• Browser sessions: until you sign out, at most 14 days.
• App connections: an access token is valid for 60 minutes. A connection ends when you revoke it, or after 60 days without use. Each token is deleted one day after it expires.
• App registrations (not linked to your account): deleted after one day if nobody approved the app, otherwise once no connection uses it, at the earliest 90 days after it was first approved.
• Activity log: 90 days.
• Invites: until the administrator deletes the invite. Deleting your account does not remove your email address from an invite you used, so write to us and we will delete it.
• Server log: kept in files of limited size (50 MB in total). The oldest entries are overwritten.
• Backups: a copy of the database is made before each software update or rollback, or by hand, and only the 10 newest copies are kept. They are kept on the same server. Data you delete can remain in these copies until they are replaced. Your Suunto connection stays encrypted in them.

Who receives your data

We do not sell your data, do not share it with advertisers and do not use it to train AI models. Your data goes only to:

• Suunto. To reach your data, MCP for Suunto sends Suunto the requests that you or your AI apps make, with your access token and the key of this service: reading workouts, FIT files, daily activity, heart rate, sleep, recovery, routes and points of interest, and adding routes and points of interest. Suunto Oy is an independent controller of the data in your Suunto account and handles it under its own privacy policy.
• The AI apps you connect. Each app you approve, for example Claude by Anthropic or ChatGPT by OpenAI, receives the workout, health, route and point of interest data it asks for and the results of its actions. What the app does with this data is governed by its own terms and privacy policy and by your settings in that app. We have no control over it.
• Our hosting provider. MCP for Suunto runs on a server rented from a cloud hosting provider. The provider stores the data for us and is not allowed to use it for its own purposes.
• The administrator. The administrator of MCP for Suunto sees a list of accounts with the email address, status, whether Suunto is connected, the last sign-in, the number of tool calls in the last 7 days, and the messages in access requests. The admin pages never show your Suunto tokens or your Suunto data. If this service has a mail server set up and the administrator did not turn off e-mail notifications about access requests (they are on by default), they also get the email address and the message of each new request by e-mail, sent through the mail server of this service.
• Authorities, only when the law requires it.

We use no analytics, advertising or tracking services, and these pages load nothing from other websites.

Data in other countries

The data that MCP for Suunto stores is kept on its server and in its backups, at the hosting provider. Suunto and the AI apps you connect may process your data in other countries, including the United States. This happens because you choose to use their services. If you request access, your email address and message may be e-mailed to the administrator, so the provider of the mail server may process them too. Their privacy policies explain where they process data and how they protect it.

How we protect your data

• Your Suunto connection, with its tokens, is encrypted with AES-256-GCM. Passwords for MCP for Suunto are hashed with scrypt, and session codes, tokens and invite codes are stored only as hashes.
• Connections to MCP for Suunto use HTTPS, and connections to Suunto use HTTPS too.
• Forms are protected against forged requests, the pages run under a strict content security policy, and repeated attempts are limited.
• The service runs in a locked-down container with no extra rights, and its file system is read-only except for its data folder.

Because MCP for Suunto talks to Suunto for you, the server holds the encryption key and can decrypt your Suunto tokens. That is why it never asks for your Suunto password, only for the tokens, which you can remove at any time on the Suunto account page.

No system is perfectly secure. If you find a security problem, please report it to marco@visin.ch. We will reply as soon as we can and fix confirmed problems.

Your rights

You have the right to know what data we hold about you, to get a copy, to have it corrected or deleted, to restrict or object to its use, and to take it elsewhere. You can do much of this yourself:

• Change your Suunto connection, or remove it, on the Suunto account page. For the data in your Suunto account itself, use the Suunto App or ask Suunto.
• See your connected apps and the activity log, and revoke any app, on the Connected apps page.
• Delete your account on the Security page. This deletes your account, your Suunto connection, your sessions, your app connections and your activity log at once. Copies in the backups disappear as the backups are replaced. Your data at Suunto is not touched.

For anything else, write to marco@visin.ch. We answer within 30 days.

You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority of the country where you live or work.

Cookies

MCP for Suunto uses only the cookies it needs to work. There are no tracking or advertising cookies. The cookies are sent only to this site, cannot be read by scripts on the page and are not shared with anyone.

• __Host-sum_session keeps you signed in. It is deleted when you sign out and lasts at most 14 days.
• __Host-sum_pre protects the sign-in and sign-up forms against forged requests. It lasts 12 hours.
• __Host-sum_lang remembers the language you chose in the language menu. It lasts 365 days.

Children

MCP for Suunto is not meant for children. You must be at least 16 years old to use it. If you think a child has created an account, write to us and we will delete it.

Changes to this policy

We update this policy when the service or the law changes. The date at the top shows the last change. If a change affects how your data is used, we will point it out on this site.