Last updated: November 1, 2026
This English translation is provided for convenience. In case of any discrepancy, the Spanish version prevails.
This policy explains what personal data we process in the Run&Gui application (the "App"), for what purpose, on what legal basis, and what rights you have. Please read it carefully: the App processes health data, which the GDPR treats as a special category and which we protect accordingly.
This version describes the App from the update released on September 26, 2026. If you have not updated yet, the version installed on your device may keep behaving like the previous one until you do.
The data controller is a natural person, not a company: Run&Gui is developed and operated by a single individual.
For any question about your data or to exercise your rights, write to that address.
We collect only what is necessary to prepare your training plan and follow up on it:
a) Identification and contact data Full name and email address. In earlier versions of the App you could also give a phone or WhatsApp number; the current version no longer asks for it. When we removed that field from the sign-up records, on October 5, 2026, it was empty in every record that had it: no phone or WhatsApp number was stored. The person who administers the service can also give your account a display name, so that your coach recognises you in their console (for example, to tell apart two people with the same first name). Your coach sees that name or the one on your profile; your email is seen only by people with administration permissions.
b) Physical and sports data Date of birth (from which we calculate your age), sex, weight, height, goal, experience, weekly availability, paces, heart-rate/watch data, and the training plan your coach prepares for you.
c) Health data (special category, Art. 9 GDPR)
d) Communications The messages you exchange with your coach inside the App and the messages you write in the App's chats (the one that helps you fill in your profile and the one that adapts your plan). Because you write those messages as free text, they may contain information about your health. Messages with your coach do not reach the AI assistant: they are stored in Supabase (section 5) and read by your coach. Section 3.1 explains what happens to the App's chats and where they go.
e) Technical and subscription data Your account identifier, your device's push notification token, and your subscription status (active/expired). Payment is handled by Apple: we do not process or store your card details.
f) Data from signing in with Google or Apple (from the update published on October 7, 2026) You can create your account and sign in with Google on iPhone, on Android and on the web, and with Apple on iPhone and on the web, in addition to email and password. Apple is not offered on Android. If you do, we receive the following:
@privaterelay.appleid.com if you choose to hide it), a technical identifier of your Apple account, which we use only to recognize you when you come back, and the technical data about the identity that Apple includes in its response (for example, who issues it, whether your email is marked as verified and whether you chose to hide it). From version 0.2.7 of the App, on iPhone the App asks Apple for your email and your name (earlier versions only asked for your email). Apple gives the name only the first time you use Sign in with Apple with Run&Gui, and you can change it on Apple's sheet. If it arrives, the App stores it in Supabase with your sign-in data and we use it only to pre-fill the name field of the sign-up, which you can change or leave empty; the copy stored in Supabase is kept until you delete your account. On the web, signing in with Apple goes through Supabase, which asks Apple for your email and your name; if Apple provides it (it only does so the first time), it is stored in Supabase with your sign-in data, and we do not use it for anything other than pre-filling that same field. Whether you chose to hide your email is stored in Supabase; we do not use it.g) Pain alert to your coach Whoever coaches you can see your session reports in their console, with the effort and pain you record. In addition, only if you have the Human coach tier, every hour our server, in the European Union, checks the reports of the last few days that show pain (the level, whether it is getting worse, the date and the session) to flag three cases: severe pain in one report, pain that is getting worse, and pain that repeats. When one is triggered, it sends a notice to your coach's device (or, if you have the Human coach tier but no coach is assigned yet, to that of the person who administers the service) and records in a table of its own that it sent it. Each record stores exactly this: your account identifier; which of the three cases it was; the identifier of the report that triggered it; the identifiers of the people who were notified; how many devices received the notice; if it was not sent, the reason (that there is no registered device, that there is nobody to notify, or that you were already notified about in the previous 48 hours); and the date and time. It does not store the pain level or any text of yours, but the case (severe, getting worse or repeated) indicates a band of your pain: it is data derived from your health and we treat it as such. What Expo and Apple receive when delivering the notice is explained in sections 5 and 6. If you have a plan without a coach, or no plan, we do not check your reports for this purpose, no notice about you is sent and nothing is recorded.
It is a notice for your coach to look at your case in their console; it is not an emergency or continuous-monitoring service, and it does not guarantee that anyone will read it at a particular moment. If you have severe pain or are worried, consult a health professional.
Each check also leaves a technical record that we keep for 30 days: when it ran, how many cases it found, how many notices it sent and, if it failed, the technical error message.
h) Your coach's time log Whoever coaches you can record how much time they spend on the service, with a stopwatch or by hand. Each entry stores exactly this: the coach's identifier; the category (chat, editing, review, alerts, sign-up or other); the minutes; whether they came from the stopwatch or were typed in; the start time, if there is one; the date of the entry; and, if the coach links it to a person they coach, the identifier of that person's account. It stores no text and no health data. If you delete your account, your identifier is removed from those entries and the minutes are kept without it.
i) Data read from Health Connect (Android only) If you use Run&Gui on Android and tap "Connect", the App asks permission to read (never to write) the following data from Health Connect, the Android health data store: exercise sessions (date, sport type and duration), distance, heart rate (during sessions), resting heart rate, heart rate variability, VO2max, weight and sleep. We use it for three things only: to import the runs and other activities that your watch or running app already syncs to Health Connect, so you do not have to log them by hand and your plan starts from what you actually did; to compute, on your own phone, your load and fatigue signals and the paces and zones we estimate from your VO2max (section 3.1, item 5); and to show you your VO2max, weight, resting heart rate, heart rate variability and sleep on the Health screen of the App. For each imported activity we store on our servers (European Union) only the date, the sport type and the duration, as a session report, and your human coach, if you have the Human coach tier, sees those imported activities in their console like the rest of your session reports (section 2.g). The rest of the Health Connect data (distance, heart rate, resting heart rate, heart rate variability, VO2max, weight and sleep) is not stored on our servers. The distance and duration of your runs, and the load, fatigue and pace signals your phone computes from that data, follow section 3.1: they reach our server (European Union) each time your plan is generated or adapted, so the engine can use them, and they travel to the AI assistant only if you ticked the second box. If the engine derives a warning from those signals (for example, high fatigue), the text of that warning is kept in your plan's adaptation history. Beat-by-beat heart rate, resting heart rate, heart rate variability, weight and sleep never leave your phone.
j) Approximate location for the weather forecast (from version 0.2.9 of the App) To show you today's weather on the Week tab and the best window to run, the App needs to know roughly where you are. You can give it in two ways, and neither is required:
Before leaving your device, coordinates are rounded to one tenth of a degree (a grid of cells at most about 11 km across) and stored only on your device (on the web, in your browser). Each time the App asks for the forecast, it sends those rounded coordinates to our server, which uses them to ask Apple for it (section 5). We do not store your position or your city on our server or in your account, and we keep no history of where you have been. You can delete them at any time with "Remove location" in Your account > Weather; denying or withdrawing the location permission on your phone stops the App from reading your position again, but does not delete the one already stored. Without a location the App works the same, just without the forecast.
We do not use third-party advertising or analytics SDKs, and we do not build profiles from your health data.
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating your account and giving you access to the App | Performance of a contract (Art. 6.1.b) |
| Preparing and delivering your training plan | Performance of a contract (Art. 6.1.b) |
| Asking for your date of birth to check that you are 18 or over and to calculate your age | Performance of a contract (Art. 6.1.b), because the Service is provided only to people aged 18 or over (Terms of Use, section 3) |
| Stopping you from continuing the sign-up, and stopping your plan from being generated or adapted, if in the chat you say or let it show that you are under 18 (we store only the date and time of the detection) | Legitimate interest (Art. 6.1.f), in not processing data of minors or providing them a Service that is only for people aged 18 or over |
| Generating and adapting your plan automatically (template engine and AI assistant; the assistant only receives what section 3.1 lists, with or without the second box) | Performance of a contract (Art. 6.1.b) |
| Processing your health data (PAR-Q, injuries, cycle) to adapt the plan safely | Explicit consent (Art. 9.2.a). These are three independent consents: processing your health data (required for sign-up), sending it to the AI assistant provider (optional) and menstrual cycle tracking (optional), which includes your human coach seeing your phase, your symptoms and the changes to your plan because of them (section 5). You withdraw the cycle consent by turning it off in Your account › Your cycle, which deletes your cycle data; the others, by writing to us; all of them, by deleting your account (section 8) |
| Sending the AI assistant's provider the training data that depends on the second box (runs and signals from your watch, type and minutes of another activity, duration and distance of your reports, effort and pain) | Consent (Art. 6.1.a), the second box at sign-up, and explicit consent (Art. 9.2.a) to the extent that this data reveals your state of health. You withdraw it by writing to us or deleting your account (section 8) |
| Sending the AI model provider the text you write in the App's chats, which may contain information about pain or injuries if you choose to share it | Explicit consent (Art. 9.2.a) for whatever part is health data, and performance of a contract (Art. 6.1.b) for the rest |
| Communicating with your coach (messages) | Performance of a contract (Art. 6.1.b) |
| Notifying your coach when a report of yours shows severe pain, getting worse or repeated, and keeping the record of that notice (section 2.g), only if you have the Human coach tier | Explicit consent (Art. 9.2.a), that of the first box at sign-up (processing your health data in the European Union to adapt and brake your plan), and performance of a contract (Art. 6.1.b). It does not depend on the second box: the notice does not go to the AI assistant |
| Sending you notices (plan published, coach reply) | Performance of a contract (Art. 6.1.b). They are only shown if you allow the App's notifications on your device; if you turn them off, your device stops showing them; for us to stop sending them, write to us |
| Managing your subscription | Performance of a contract (Art. 6.1.b) and legal obligations (Art. 6.1.c) |
| Showing you the weather forecast for your area and the best window to run, from your approximate location or the city you choose (section 2.j) | Legitimate interest (Art. 6.1.f), in giving you useful information for training, with the safeguards in section 2.j: position rounded to a grid of at most about 11 km, stored only on your device, no history. The App reads your phone's location only if you grant the permission, and you can withdraw it at any time |
Part of the Service is automated: on the free tier the plan is generated automatically from your profile (template engine); on paid tiers (AI trainer and Human coach) an AI assistant helps adapt it; and on the Human coach tier, a person responds to you by messages and can adjust your plan when needed. None of this processing produces legal or similarly significant effects on you (Art. 22 GDPR), and you can always contact us.
We would rather list what is sent than promise you what is not. A promise about what never leaves can break without anyone noticing the day we add a feature; a list of what does leave forces us to update this policy when it changes.
When the AI assistant is involved (generating your plan, adapting it from the chat, composing your week, or the chat that helps you fill in your profile), the following is sent to the model provider (Anthropic, see section 5), and nothing else:
Read points 4, 7 and 8 carefully, because they are the ones that affect you most. That text is sent unfiltered. If you describe an ache, pain or injury in it, that information about your health is sent to the model provider. This is not a side effect: the system is designed to read it. If you describe pain, the assistant identifies it and the engine uses it to ease, hold back or stop the relevant sessions, which is precisely what makes it safe to adapt a plan in writing.
If you would rather not send free text, you can leave the session report note empty, not write in the chats and leave the sign-up context field empty (the free text of your preferences, which travels to the assistant with your profile, item 1 of this list, whether or not you tick the box): your plan is still generated and adapted without it. Bear in mind that, if you ticked the sending box, your PAR-Q questionnaire and declared health notes travel to the assistant on every generation (item 1 of this list), not only when you write. If you left it unticked, or if you withdraw it later, they stop travelling to the model provider, but they are still used inside our service, in the European Union, to brake or block the sessions that warrant it: what the consent governs is the sending, not the safety of your plan. Your workouts (runs, activities and watch signals) work the same way: without the box they do not travel to the assistant, but our engine, in the European Union, keeps using them to adjust your weeks.
What is not sent from your profile fields: your name, your email address, your phone or WhatsApp number and your date of birth (the app does not send your date of birth to the assistant; only your age in years). Those fields are excluded by a closed list in the code itself, which an automated test checks every time we run our test suite. This applies to the fields of your profile, not to what you write in the chats, which is sent exactly as you write it (items 4 and 7 of this list): if you type your date of birth there, it will travel. The raw data from your watch (beat-to-beat heart rate, resting heart rate, heart rate variability and sleep) does not leave your device either.
Use of Health Connect data (limited use). The data we read from Health Connect is used only to provide you with the App features described in section 2.i. We do not sell it, we do not use or share it for advertising (personalised or interest-based), we do not pass it to data brokers or advertising platforms and we do not use it for creditworthiness, lending, insurance or employment decisions. We do not send it to any third party other than the AI assistant, under the conditions of section 3.1 and only with your consent (section 4), and the processors in section 5 that host our servers; beyond that, only where the law requires or for security and abuse prevention. People on our side do not read it except to handle a support request from you, for security, for a legal obligation, or in aggregated form for the internal operation of the service; the exception is your human coach, who sees the imported activities as explained in section 2.i.
Processing your health data requires your explicit consent. We collect it in the App as independent consents, and we ask for them before asking you anything on those topics:
You can withdraw them at any time: the cycle consent, by turning it off in Your account › Your cycle (first we show you the list of what gets deleted and ask you to confirm; when you turn it off your coach stops seeing it and we delete your cycle data, section 7); the others, by writing to us; all of them, by deleting your account; withdrawal does not affect the lawfulness of processing before it.
And one important clarification, because it is easy to read it backwards: not ticking (or withdrawing) the sending consent stops the sending to the model provider, not the use of that data inside our service. The block triggered by an affirmative PAR-Q answer, the brake on pain and the step-down on cycle symptoms are computed by our engine on servers in the European Union, with the complete data, whether the sending is open or closed, and the same goes for your workouts. If you also want us to stop processing it, you can ask us in writing or delete your account; section 7 explains what deleting it altogether means if you have the medical block active.
If you created your account before September 26, 2026, you accepted an earlier version of this consent, which was a single checkbox with a less complete text than this one. We will ask you inside the App as soon as you update to the version released on September 26, 2026. Until you do, your health data stops being sent to the AI assistant's provider; your plan keeps being generated and adapted in the meantime.
If you turned cycle tracking on before version 0.2.12 of the App, you accepted a text saying that your coach would not see your cycle in any case. That stays true until you accept the new text inside the App: we store no dates and nothing new, and your coach sees nothing of your cycle. What does change from that version, whether you accept or not, is how symptoms are used: we no longer ease the following week because of them. If you do not accept, since we do not ask you whether a symptom limits you, we only suggest an easier session and you decide; if you accept, what this section describes applies.
To provide the service we rely on providers that process data on our behalf, under a data processing agreement (Art. 28 GDPR) or, in the case of Expo and Google (FCM), under the terms of service described in its entry:
Apple (App distribution, subscription payment and, if you sign in with Apple, verification of your identity) does not act on our behalf or as our processor. It is an independent controller of its own processing, which is governed by its privacy policy; according to that policy, the personal data of individuals in the European Economic Area is controlled by Apple Distribution International Limited (Ireland). What binds us to Apple is the Apple Developer Program License Agreement, which for these services is not a data processing agreement. From Run&Gui it receives exactly this: your account identifier, which accompanies the purchase of the subscription; if you sign in with Apple, the sign-in request, which carries a random one-time value, with which your iPhone asks it to confirm your identity and tells it which data are requested (your email and, from version 0.2.7 of the App, also your name); on the web the App has no Apple sheet: your browser takes you to Apple's page (appleid.apple.com) with a request that Supabase prepares (which application is making it, where to return to, that your email and your name are requested, random one-time values, and your IP address); and, if your account has Apple sign-in and you delete it from the App on iPhone, the request to remove Run&Gui's access to your Apple ID, with the one-time code Apple gives you at that moment and the identification of Run&Gui as an application (section 8). It does not receive your health data. For the weather forecast it also receives what is described below, under "Weather forecast (Apple WeatherKit)".
To deliver notices on iPhone, Apple (APNs) receives your device token and the notice (fixed title and text, sound, icon counter and type of notice); the same applies to the internal notices for your coach if they use an iPhone (section 2.g). We have not signed a processor agreement or Standard Contractual Clauses with Apple for this service: Apple provides it under its Apple Developer Program License Agreement, in which it undertakes not to access the content of notices except where required by law, for security or fraud prevention, to enforce that agreement or to protect the rights, property or safety of Apple or third parties. If your iPhone is offline, Apple may keep the latest notice for up to 30 days to deliver it.
Weather forecast (Apple WeatherKit). To give you the forecast (section 2.j), our server (not your device) asks Apple, through its WeatherKit service, for the weather in your area. Apple receives only the coordinates rounded to one tenth of a degree (a grid of at most about 11 km), the language and the time zone; in that request it does not receive your name, your email, your account identifier or your device's IP address. Apple provides WeatherKit under its Developer Program License Agreement, not as our processor. If someone else in the same area asks for the forecast in the same hour, they get the same stored answer without asking Apple again. That answer is kept on our server (Supabase, European Union) as a temporary copy, with nothing that says who asked for it; it expires within 30 minutes at most and is deleted on a later request. To limit abuse, we record each time your account asks for the forecast (only the kind of request, whether it was served and the time, without the location); those records are deleted after 90 days and when you delete your account. Separately, to show you the Apple Weather mark, your device downloads Apple's logo image from Apple; for that download Apple sees your device's IP address and type, as with any image on a website, but not your location or your account.
In addition, the mailbox where we receive email is provided by Proton (a Swiss company). It receives in our mailbox the messages sent to [email protected] and [email protected] (sender, subject, content and attachments) and the complaint, suggestion and bug emails you send from the App, which arrive directly at our mailbox and include the App version, the platform and a short fragment of your user identifier. That is where we read and answer them. They may include health data if you write it in an email. We have not signed a data processing agreement (Art. 28 GDPR) with Proton: the mailbox service is provided under Proton's terms of service and privacy policy, as Proton publishes them.
Signing in with Google or Apple. If you choose to sign in with your Google or Apple account, that provider verifies your identity on its own servers. In that role it does not act on our behalf or as our processor: it is responsible for its own processing, which is governed by its privacy policy, and it gives us the data in section 2.f. From Run&Gui, Google receives this. On iPhone: the App's sign-in request (which application is making it, which data from your account it asks for, which is your basic identity, where to return to when it finishes, and three random single-use values that are used to check that the response corresponds to that request) and, when the App exchanges the result for your identity token, the exchange request from your iPhone (the authorisation code, the application's identifier, the return address, another random single-use value that proves the party exchanging the code is the one that asked to sign in, and your IP address). Neither request carries data from your profile, your plan, your health or your messages. The sign-in sheet opens in the system browser, so Google can recognise in it a session you already have open with your account, as in Safari. In its response to the exchange, Google gives the App, besides the identity token, other tokens (access and refresh) that the App receives in the iPhone's memory and discards: it does not store them, does not use them and does not send them anywhere. On the web: your browser takes you to Google's page with a request that Supabase prepares: which application is making it, which data from your account it asks for (your basic identity), where to return to (a Supabase address), a random one-time value and your IP address. That is why Google's page shows Supabase's domain (supabase.co) and not the name Run&Gui. Supabase exchanges the authorisation code from its own servers, not your browser. On Android: signing in with Google does not open the browser; a Google system sheet (Google Play Services) is shown inside the App, with a picker of the Google accounts already signed in on your phone, and it always asks you to choose one. Google receives which application is asking (Run&Gui's web client identifier and the App's package, com.guille.runandgui, with its signing fingerprint, which Google Play Services checks against the registered applications), that your basic identity is requested, the hash (SHA-256) of a random single-use value that is used to check that the response corresponds to that request (not the value itself) and the technical device data that Google Play Services needs to show you your accounts. That request carries no data from your profile, your plan, your health or your messages. Google gives the App only the identity token: on Android we receive no access or refresh token. The App sends Supabase only that identity token and the random value itself, so that Supabase can check that they match. What Apple receives is listed above, in its paragraph.
Your coach accesses your profile, your plan and your messages to provide the service. If you turned cycle tracking on (section 4), they also see your phase (on your period, days before, neither or unknown), your symptoms with their intensity (whether they limit or bother you) and the changes we make to your plan because of them, with the reason, and the requests you send them from the App to change a session because of your cycle. They see unknown both when we cannot compute your phase and when you use hormonal contraception or have not answered, so they cannot tell those cases apart; if they see a phase, they can work out that you told us you do not use hormonal contraception. They never see the dates of your periods, your cycle length or your answer about contraception. If you turned the cycle on before version 0.2.12 of the App and have not accepted the new text, they see nothing of your cycle (section 4).
We do not sell or share your data with third parties for commercial purposes.
Where your data is stored: everything we store in the App and in our service, including your health data (PAR-Q, injuries and menstrual cycle), is kept on servers in the European Union (Supabase, EU region). It is not moved anywhere else for storage. The only exception is the emails you write to us: the messages you send to [email protected] or [email protected], and the complaint, suggestion and bug emails you send from the App, end up in a Proton mailbox, a Swiss company, and are stored there.
What is processed outside the European Union: some technical providers process data in the United States, and one in Switzerland, and you should know exactly which:
Transfers to the United States rely on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914) and on the contracts described below, except for Google (FCM), explained further on. In the case of the AI assistant, those clauses form part of Anthropic's data processing addendum, whose contracting entity for customers in the European Economic Area is Anthropic Ireland, Limited. In the case of RevenueCat, they are incorporated by its data processing addendum (with RevenueCat, Inc.), which forms part of the terms of use we accepted, in the controller-to-processor module. In the case of Expo, they are incorporated by its terms of service (section 3.2), also in the controller-to-processor module; the contracting party is 650 Industries, Inc. For Google (FCM), transfers rely on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, as provided in the Firebase Data Processing and Security Terms, which form part of the terms of service we accepted; if that framework ceased to be available, those same terms apply the Standard Contractual Clauses. Apple is outside this group (see section 5): there is neither a data processing agreement nor Standard Contractual Clauses between us for these services; notices are delivered to Apple by Expo from the United States, and Expo lists Apple among its subprocessors (see Expo in section 5); according to Apple's privacy policy, its international transfers of personal data of individuals in the European Economic Area are governed by Standard Contractual Clauses. In the case of Cloudflare, they are incorporated by its data processing addendum, which forms part of the terms of service we accepted. For the App's traffic that passes through Cloudflare's network, the data processing agreement we have with Supabase applies, which includes the Standard Contractual Clauses and allows Supabase to use sub-processors under equivalent obligations. The transfer to Switzerland, where Proton is based, needs no clauses: the European Commission has decided that Switzerland ensures an adequate level of protection (Decision 2000/518/EC). We have not signed a data processing agreement with Proton: Proton's terms of service and privacy policy apply.
Signing in with Google or Apple. When you sign in with either one, the provider processes your sign-in data on its own servers, which may be outside the European Union, including the United States, under its own policy. In that role it is an independent controller, not our processor, so what is said above about the Standard Contractual Clauses and the contracts listed does not apply to that part. What we receive from them (section 2.f) is stored in Supabase, in the European Union.
If you would rather your health information did not leave the European Union, leave the second box at sign-up unticked, the one about sending to the AI assistant. Sign-up completes all the same and your plan is still generated (without your runs or your watch signals, the assistant adjusts it with more caution): what is required to complete sign-up is the first box, the one about processing your data in the European Union, because without the PAR-Q questionnaire we cannot prepare a plan for you. The cycle one is optional too. If you already have an account and you write to us to withdraw the sending consent, we stop sending that data to the assistant's provider from that moment on (what the assistant already wrote with it while the box was ticked, such as its replies in the chat, the summaries of changes to your plan and the titles and descriptions of your sessions, may mention it and keep being part of the conversation and the plan that are sent to it); your plan keeps being generated by our engine on servers in the European Union. That avoids the sending to the AI assistant, but it does not prevent what the App sends to our service (and what your coach sees, writes or changes from their web console, including the messages they send you), including health data, from passing in transit through Cloudflare's network (see above), nor does it change what you write in an email: if you do not want your health information to reach Cloudflare and Proton by email, do not include it in the messages you send us; we do not need it to handle your request, unless it is precisely what you are asking us to deal with.
It is worth knowing when it actually leaves: the AI assistant is also involved on the free tier, in the chat that helps you fill in your profile during your first sign-up; outside that, it is only involved on paid tiers. Not even in that free-tier chat do your PAR-Q, your health notes or your cycle reach the model provider: that chat does not include health data (section 3.1).
We keep your data while your account is active. When you delete your account (see section 8) we delete your data, including health data and what we received from Google or Apple when you signed in (section 2.f). The pain alerts to your coach (section 2.g) are recorded and kept for 90 days, and are deleted automatically after that (the record of the technical check, after 30 days); if you delete a session report, the record of the alert it triggered is not deleted with it, but after 90 days. Your coach's time entries (section 2.h) are deleted automatically 24 months after their entry date, or earlier if your coach's account is deleted; those that link to you lose your identifier when you delete your account. The minor flag in section 10 is kept until you delete your account or we remove it at your request. If what you want is to withdraw the sending consent without deleting your account, write to us: we will stop sending that data to the AI assistant's provider and will keep it only inside our service, in the European Union, to carry on braking or blocking the sessions that need it (section 4). If you would rather we deleted it altogether, tell us that too, but bear in mind that your plan then loses the information that sustains the PAR-Q block: the block stays on as a precaution and we will no longer be able to lift it, even if you bring us your doctor's clearance. We only keep the minimum information the law requires us to retain (for example, records related to tax or commercial obligations) for the legally required periods, blocked for any other use.
Health Connect data. You can stop giving us access at any time in the Health Connect settings of your phone (the exact path varies by manufacturer and Android version). When you withdraw the permission, the App stops reading Health Connect. The activities you already imported (session reports with date, type and duration) are kept like the rest of your data and are deleted when you delete your account (section 8). Deleting data in Health Connect does not retroactively delete session reports already imported: to remove them, delete the report in the App, delete your account or write to [email protected].
Cycle data. Of the start dates of your periods we keep the last 13 (those of your last 12 cycles); older ones are deleted automatically, because they are not needed to compute your phase. Your symptoms, the length you gave us and your answer about contraception, while you keep tracking turned on. If you turn it off in Your account › Your cycle, we first warn you of what gets deleted and, if you confirm, we delete all of that, the record of the session changes we made because of your symptoms and, from our internal record of how we generated your weeks (which we keep for 90 days), the weeks in which we used your cycle, and the requests you made to your coach to change a session because of your cycle, including any they already answered (weeks your coach already accepted stay as published). Anything already sent to the AI assistant before that cannot be taken back from the App.
Location for the weather forecast. The approximate location and the city you choose for the forecast (section 2.j) are stored only on your device (on the web, in your browser), until you remove them in Your account > Weather, sign out or delete your account on that device, or uninstall the App. Your position is not stored on our server; the temporary copy of each area's forecast expires within 30 minutes at most and is deleted on a later request, and the records of how many times you ask for the forecast are deleted after 90 days.
You can exercise at any time your rights of access, rectification, erasure, objection, restriction, portability and to withdraw consent:
If you sign in with Apple or Google, this is what happens when you delete your account:
Deleting your account does not cancel your Apple subscription; to cancel it, go to Settings › your name › Subscriptions on your device.
If you believe we have not handled your rights properly, you can lodge a complaint with the Autoriteit Persoonsgegevens (the Dutch data protection authority, autoriteitpersoonsgegevens.nl), the authority of the country we operate from, or with the authority of your country of residence (in Spain, the AEPD, www.aepd.es).
We apply appropriate technical and organisational measures: encryption in transit and at rest, EU hosting, and row-level access control (each user can only access their own data). We do not write the content of your health data to our diagnostic logs: not the PAR-Q answers, not your cycle entries, not the pain figures from your reports, not the text you write. Nor do we use third-party analytics. And since the controller is a single person (section 1), there is no company or team behind it: the database is administered by that one person. If you have a human coach, they see your training profile, your session reports (with effort and pain) and the health notes recorded in order to train you, but they do not see your PAR-Q questionnaire. Of your cycle, if you turned tracking on, they see your phase, your symptoms and the changes to your plan because of them (sections 4 and 5), and never the dates of your periods, your cycle length or your answer about contraception. With one exception we would rather tell you about: when your PAR-Q questionnaire triggers the medical block, the server records in its technical log that the block fired and for what reason, without your name or your identifier.
The App is intended for people aged 18 or over. To check this we ask for your date of birth when you sign up, and we calculate your age from it. If the date shows you are under 18, we do not save it and you cannot continue. We do not knowingly collect data from anyone under that age, with one exception: if in the sign-up chat you say or let it show that you are under 18, we store on your profile the date and time we detected it (not the age you gave and not your message) so that we do not let you continue the sign-up. While that marker exists we also do not generate or adapt your plan (neither at your request nor in automatic processes). The marker does not expire and is not rechecked on its own against a later date of birth. We keep it until you delete your account or until we remove it at your request: if you think it is a mistake, write to [email protected]; we will remove it once we confirm that you are 18 or over. This also applies to anyone using an earlier version of the App with that chat. We cannot verify that the date is true: we rely on what you declare.
November 1, 2026. From version 0.2.12 of the App, cycle tracking changes, with a new consent. If you accept it: you mark the start of each period with one tap and, if you like, tell us your cycle length; from the dates we compute your phase, which can only be on your period, days before, neither or unknown (section 2.c); you can tell us whether you use hormonal contraception, and if you do or do not answer we do not compute phases; you log whether a symptom limits you or only bothers you; and your coach sees your phase, your symptoms and the changes to your plan because of them, with the reason, and the requests you send them to change a session because of your cycle (sections 4, 5 and 9), something this policy excluded in every case until now; there is no way to turn tracking on without your coach seeing it. For everyone, how symptoms are used changes: they no longer ease the hard sessions of the following week; a symptom that limits you changes your next hard session that day or the next, with the option to undo it, and one that bothers you only brings a suggestion (section 4). The dates, the length and your answer about contraception are never sent to the AI assistant (section 3.1). We keep the last 13 start dates (section 7), and turning the cycle off in Your account › Your cycle deletes your cycle data, after a warning that lists what gets deleted (sections 7 and 8). If you already had the cycle turned on, what we store and what your coach sees do not change until you accept the new text in the App (section 4). The second box and what is sent to the assistant outside the cycle do not change.
October 27, 2026. Since October 15, 2026, sign-in to your coach's web console no longer uses Cloudflare Access: the coach signs in with their account (email and password), which Supabase manages, and only those with the coach role get in (section 5). So Cloudflare no longer receives the coach's email nor keeps a record of each sign-in with its IP address to protect it; it still hosts the console, with the IP address and technical data of each visit, like the other websites. This replaces what the October 8 entry said about Cloudflare Access. Nothing changes in which of your data we process, in what is sent to the AI assistant or in the second box, and no new consent is requested.
October 19, 2026. From version 0.2.9 of the App, the Week tab shows today's weather and the best window to run. For this the App uses your approximate location (with your permission, once, and only while you use it) or the city you type in Your account > Weather. We describe for the first time which location is used and how it is rounded (section 2.j), its legal basis, legitimate interest (section 3), that Apple (WeatherKit) receives only the rounded coordinates, without identifying you (sections 5 and 6), and that your position is stored only on your device (section 7). It is optional: if you give neither a location nor a city, the App works the same, without the forecast. It does not change what is sent to the AI assistant or the second box, and it does not ask for a new consent.
October 15, 2026. The paid tiers are renamed AI trainer (formerly "Plan") and Human coach (formerly "plan with a coach"), matching the App and the terms. This is a name change only: no processing, recipient or retention period in this policy changes.
October 13, 2026. From version 0.2.7 of the App, when you sign in with Apple on iPhone the App asks Apple for your name as well as your email (sections 2.f and 5); until now this policy said that on iPhone we did not ask for it. Apple gives the name only the first time; if it arrives, we store it in Supabase with your sign-in data and use it only to pre-fill the name field of the sign-up, which you can change or leave empty. The name that Supabase receives from Apple on the web, which we said we did not read or use, may be used for the same purpose and nothing else. It does not change what is sent to the AI assistant or the second checkbox, and it does not ask for new consent.
October 13, 2026. We offer signing in with Google on Android as well, and we describe what Google receives in that case (section 5); no more data is processed. We name Google (Firebase Cloud Messaging) as the provider that delivers push notices on Android (sections 5 and 6), which already happened and which this policy did not say. In section 3.1 we point out that the sign-up context field is free text that travels to the assistant with your profile, whether or not you tick the box. We add how long Expo, Google and Apple may keep notices, and we clarify what Apple's notice delivery and the transfer to Google rely on (sections 5 and 6). Push notices now rely on performance of a contract instead of consent (section 3): if you turn notifications off, your device stops showing them, and for us to stop sending them you need to write to us. We also clarify that the notice that your week is ready may say that we are not raising your load because you have not logged new data (section 5). This describes things better, it does not process more data: it does not change what is sent to the AI assistant or the second checkbox, and it does not ask for new consent. For Android we describe for the first time which data we read from Health Connect, what we use it for, who sees it and how to stop giving us access (sections 2.i, 3 and 7). It is only read if you grant that permission on Android; your human coach sees the imported activities like the rest of your session reports, and it does not ask for new consent.
October 13, 2026. Your coach's time entries (section 2.h) are now deleted automatically after 24 months (section 7). This is processing less data, not more: it does not ask for new consent.
October 9, 2026. We narrow the pain alert to your coach (section 2.g): from this date it exists only if you have the plan with a coach. With that plan and an assigned coach, the notice goes to your coach; with that plan and no coach assigned yet, to the person who administers the service; with a plan without a coach, or no plan, we no longer check your reports for this purpose, we send no notice and we record nothing. This is processing less data, not more: it changes nothing in what is sent to the AI assistant or in the second box, and it requests no new consent. Notices recorded before this date follow the 90-day period in section 7.
October 8, 2026. We add to this policy the pain alert to your coach and what surrounds it. What we describe for the first time: that every hour we check your session reports that show pain and, if one of three cases is triggered (severe pain, getting worse or repeated), we send a notice to your coach's device, or to that of the person who administers the service if you have no coach assigned, and record that we sent it (section 2.g); what that notice looks like and what Expo and Apple receive when delivering it (sections 5 and 6); that this record is data derived from your health, that it is kept for 90 days and that it is not in the App's export (sections 2.g, 7 and 8); your coach's time log (section 2.h); the display name that can be given to your account (section 2.a); and that your coach sees your session reports, with effort and pain (sections 2.g and 9), which was already the case and which this policy did not say. Your coach's web console can now write messages to you and is now listed among what Cloudflare hosts, which also protects its sign-in with Cloudflare Access (section 5). Nothing changes in what is sent to the AI assistant or in the second box, and no new consent is requested: section 4 stays as it is.
October 7, 2026. When you sign up or redo your sign-up we now ask for your date of birth instead of your age, to check that you are 18 or over and so that we do not ask you again every time. We store it in your account, in the European Union, and delete it if you delete your account. The app does not send your date of birth to the AI assistant; only your age in years (what you type in a chat is sent as written, see section 3.1). If in the sign-up chat you say or let it show that you are under 18, we store the date and time of that detection so that we do not let you continue and do not generate or adapt your plan while the marker exists (see section 10). If you already had a profile, we keep your age as you gave it; we do not turn it into a date.
October 7, 2026. We add Google and Apple as ways to create your account and sign in to the App, on iPhone and on the web, alongside email and password. What we describe for the first time: what we receive from each provider (section 2.f); that Google and Apple, in their sign-in role, are independent controllers and not our processors, and that they process data on their servers (sections 5 and 6); that Apple receives, if you sign in with Apple, your sign-in request and, when you delete the account, the request to remove the access (section 5); and what happens when you delete your account with each, including when we remove Apple's access and when we do not, which is a best-effort attempt, and that we keep the record of its result for 90 days at most (section 8). This does not change what is sent to the AI assistant or ask for new consent: section 4 stays the same.
October 5, 2026. On that day we removed the phone or WhatsApp field from the sign-up records; the current version of the App (0.2.3, published on October 5, 2026) no longer asks for it. It was empty in every record that had it: no phone or WhatsApp number was stored. This replaces what the October 4 entry said about that field (that it might still be stored and that you could ask us to delete it). Nothing else changes about your data.
October 4, 2026. This revision corrects and completes what this policy said about which data the AI assistant and other providers receive:
October 2, 2026. The contact and privacy email is now [email protected]. In addition, section 5 adds to its list of recipients Cloudflare, which hosts the websites, forwards the emails sent to support@ and coach@, and whose network Supabase uses for the App's traffic, and Proton, whose mailbox receives those emails and the complaint, suggestion and bug emails you send from the App; health data may reach them by email if you write it. Section 6 is corrected accordingly: it said that everything we store is in the European Union, and did not account for emails, which are stored in the Proton mailbox, in Switzerland; and it implied that leaving the sending box unticked kept your health information inside the European Union, without saying that what the App sends to our service (and what your coach sees or changes from their web console) passes in transit through Cloudflare's network. What the App collects does not change: your health data in the App is still stored in Supabase, in the European Union, and is sent to the AI assistant's provider only if you consent.
September 29, 2026. Four statements about the role of the AI and of the coach are corrected. Section 3 no longer says that a person reviews the messages before they are sent to you: on this tier, your coach responds to you directly by messages and can adjust your plan when needed. The same section 3 now says you can always contact us, and no longer that you can always contact your coach: that phrase was not true for the tiers without a coach (Free and Plan). Section 3.1 no longer says the AI assistant is involved in preparing your coach's draft reply: that feature does not exist in the App. As a result, your messages with your coach are no longer listed among what is sent to the assistant; they are stored in Supabase (section 5) and read by your coach, not by the model provider. And section 6 no longer says that the AI assistant is only involved on the paid tiers: it is also involved in the chat that helps you fill in your profile during your first sign-up, which any tier uses, the free tier included. That chat does not include health data, so neither your PAR-Q, nor your health notes, nor your cycle reach the model provider through it.
September 24, 2026. This revision corrects several things the previous version stated that were not accurate, and describes the new consent:
September 15, 2026. Section 3.1 is completed with two things the code was already sending to the assistant's provider and the list did not name: your session reports (including the effort, the pain and the note you write) and the text your coach writes about you (their instructions when generating the plan, and the health notes they record in your medical record). This is not a new processing operation nor a new recipient: same purpose, same processor and same category of data already covered by your health consent; what was wrong was the list, which said "and nothing else" without being complete.
We may update this policy to reflect legal or service changes. We will publish the current version at this same address and indicate the date of the last update. If the changes affect the processing of your health data, we will inform you and, where appropriate, ask for your consent again.