Privacy Policy

This Privacy Policy explains how we collect, use, disclose, and safeguard personal data when you use the Services. “Personal data” means information that identifies you directly or indirectly.

We collect data in the following categories:

• Provide and operate the Services (accounts, training plans, logs, personalization)
• Generate insights, recommendations, and summaries you request or enable
• Sync connected-service data you authorize and display it inside the app
• Send notifications you opt into (e.g., training reminders, insights)
• Maintain security, prevent abuse, debug issues, and improve reliability
• Comply with legal obligations and enforce our terms

Depending on your location and the context, we process personal data under one or more of the following bases:

• Contract — to provide the Services you request.
• Consent — for optional features (e.g., wearable integrations, certain notifications, marketing where required).
• Legitimate interests — security, fraud prevention, basic analytics, and service improvement.
• Legal obligation — where required by law.

You may withdraw consent at any time (for example by disconnecting an integration or disabling notifications), which does not affect the lawfulness of processing before withdrawal.

If the Services offer AI-generated insights, we may process your training data and journal inputs to generate summaries and suggestions. These outputs are informational and are not medical advice.

• AI features may use your inputs to produce personalized recommendations.
• You remain responsible for decisions about training, recovery, and health.

We do not sell personal data. We share data only as needed to provide the Services, including with:

• Service providers that help operate our infrastructure (e.g., Vercel)
• Analytics/diagnostics providers (e.g., Vercel)
• Payment processors (if you subscribe to paid plans)
• Messaging providers that deliver emails and push notifications
• Connected services (e.g., WHOOP) when you enable and authorize the integration
• Authorities or other parties when required by law, to protect rights, safety, and prevent fraud

Some service providers may process data outside your country. Where required, we use appropriate safeguards to protect personal data for international transfers (for example, contractual protections and other legally recognized mechanisms).

We retain personal data only as long as necessary to provide the Services and for legitimate business needs, such as:

• Maintaining your account while it remains active
• Providing features you use (training logs, history, insights)
• Complying with legal obligations (e.g., billing and accounting)
• Resolving disputes and enforcing agreements

You may request deletion of your account and associated data. Some limited information may be retained where legally required or for security/fraud prevention.

Depending on your location, you may have rights regarding your personal data, including:

• Access to the personal data we hold about you
• Correction of inaccurate or incomplete data
• Deletion of personal data, in certain circumstances
• Restriction or objection to processing, in certain circumstances
• Data portability, where applicable
• Withdrawal of consent, where processing is based on consent
• Lodging a complaint with a supervisory authority, where applicable

We use reasonable administrative, technical, and organizational measures to protect personal data, such as encryption in transit, access controls, and least-privilege practices. No method of transmission or storage is 100% secure; therefore, we cannot guarantee absolute security.

The Services are not intended for children under 16. If you believe a child has provided personal data, please contact us so we can take appropriate action.

We may update this Privacy Policy from time to time. We will update the “Effective date” above and, where appropriate, notify you through the Services or by other means.