Privacy Notice

Pilot template, version 2026-10-31. The operator must complete legal review, controller details, retention settings and processor agreements before collecting real customer data.

Data and purpose

We process account identifiers, training goals, availability, activities, recovery check-ins, conversation history and communication preferences to provide your training workspace. Training and recovery information can reveal health information. We request separate, explicit consent before processing it.

Optional AI

AI coaching is optional. When enabled, a minimized summary of permitted training history, your goals and current recovery check-in, plus your current message, may be sent to the configured model provider. We exclude Strava-derived and unknown-provenance activity data. Classic coaching does not call an AI provider. We do not train models on your data. Provider retention and processing regions must be disclosed by the operator before launch.

Connections and communications

Provider access is authorized separately through OAuth. You can disconnect supported integrations in Connections. Email, WhatsApp and push are optional and respect your preferences and quiet hours. Messages contain a generic prompt to open your account, not detailed health records.

Your controls

You can export your account data in Settings, withdraw optional AI and messaging consent, and delete your account and training data. Account deletion cancels active billing and revokes supported provider access before removing the account. Financial records legally required by the payment processor may be retained by that processor.

Storage and retention

Demo data is stored only in this browser. Live data is stored in the Supabase project configured by the operator. Provider credentials are encrypted server-side. The pilot caps stored activities at 5,000, check-ins at 730, and chat messages at 200. Notification and AI usage records are purged after 90 days by the maintenance job. The operator must publish a time-based retention policy, backup expiry and deletion process before launch.

Contact

Controller identity not yet configured. Privacy contact not yet configured.

No advertising or analytics cookies are enabled. Authentication cookies are necessary for live sign-in. Language and local-demo storage remain on your device.