Privacy Policy

AI Coach Feed is a running and fitness app that records your workout stats and offers optional AI coaching. This policy explains, in plain language, what data we handle, why, and the rights you have under the EU General Data Protection Regulation (GDPR).

The short version: the app works without an account, and by default everything stays on your device. Nothing is sent to our cloud unless you choose to create an account.

1. Who is responsible for your data

The data controller for AI Coach Feed is:

• Data controller: [PLACEHOLDER]
• Contact: [PLACEHOLDER]

2. The basics: local-first, account optional

AI Coach Feed is local-first. Creating an account is completely optional. You can install and use the full app without an account — when you do, all of your workout data is stored locally on your device and nothing is uploaded to our cloud.

Cloud collection begins only when you create an account inside the app, and only from that point onward. Until then, no workout data, profile data, or comments ever leave your device for our cloud.

You can still use AI without an account: the app lets you copy and paste your data into the AI of your choice yourself. That happens directly between you and your AI, on your device — it does not involve our cloud, and we never see it.

3. What we handle, why, and our legal basis

Data that always stays on your device:

• Raw GPS / location: Used only on your device to calculate distance, pace, speed, and your route. It is never uploaded to our cloud. If you export a workout as a GPX file, that file is generated from data already on your device — our cloud never receives your raw location.
• Workout history, stats, comments and schedules (without an account): stored on-device only.

Data handled only if you create an account. Creating an account is optional. If you do, the following is synced to our cloud so you can access it across devices:

Data	Purpose	Legal basis (GDPR)
Email address and name	To create your account and sync data across your devices.	Performance of a contract — Art. 6(1)(b)
Workout statistics (speed, distance, time, altitude)	To sync your training history across devices.	Performance of a contract — Art. 6(1)(b)
Free-text comments (optional)	If you write notes, we sync them so they appear on your devices.	Explicit consent — Art. 9(2)(a)

A note on comments and health data: Comments are optional and written by you. They may reveal health-related information (for example, “slow run today because of a bad knee”). We therefore treat them as special-category data under Article 9 of the GDPR and sync them only on the basis of your explicit consent. Note that once synced, comments are part of the data an AI assistant can read if you connect one (see section 4). You can withdraw your consent at any time, and you never have to write comments at all.

4. AI access — Bring Your AI

AI Coach Feed uses a Bring Your AI model: we do not provide the AI ourselves. When you create an account, your synced data becomes available through our MCP (Model Context Protocol) server so that an AI assistant you connect can read it. This access is part of having an account — it is not a separate setting, and it works together with cloud sync — but nothing happens until you connect your own assistant.

Your data is only ever sent to a third-party AI service that you select when you connect and authorise it (through a secure login). Until you connect one, no data is sent to any AI service. You choose which AI service processes your data, so you should pick one you trust: that provider acts independently of us, under its own terms and privacy policy, and is not our sub-processor — we do not control it and are not responsible for how it handles your data. When you connect one, it can read the workout data and comments the MCP server makes available.

You can stop this at any time by disconnecting the AI assistant, or by deleting your account. You don't need an account to use AI at all — without one, you can still copy and paste your data into the AI of your choice yourself (see section 2), and everything stays on your device.

5. Where cloud data is stored, and security

• Cloud location: If you create an account, your cloud data is stored within the EU/EEA (in a data centre located in Sweden), using Supabase as our cloud and database provider. Some processing or support access may take place outside the EU/EEA; where it does, we rely on the European Commission's Standard Contractual Clauses (SCCs) as set out in Supabase's Data Processing Agreement (DPA). The DPA between us and Supabase is currently being put in place (in progress). Once finalised, you will be able to obtain a copy of these safeguards via that document or by contacting us. Supabase may use sub-processors under that agreement.
• Encryption: Your data is encrypted in transit (while moving between your device and the cloud) and at rest (while stored). We do not claim end-to-end encryption — some data (such as comments shared with an AI coach) must be readable by the relevant service to function.

6. How long we keep your data

• Cloud data: Kept until you delete your account; deleting your account deletes your associated cloud data.
• Local data: Stays on your device under your control. You can remove it at any time by deleting the data or uninstalling the app.

7. Your rights under the GDPR

• Access — get a copy of the data we hold about you.
• Rectification — correct data that is wrong or incomplete.
• Erasure — delete your account and associated cloud data from the app settings.
• Data portability — export your workout data as GPX at any time, which covers your right to portability.
• Withdraw consent — where we rely on your consent (such as for syncing your health-related comments), you can withdraw it at any time. You can also disconnect any AI assistant. Withdrawing consent does not affect processing that already took place.

8. Your right to complain

If you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the Swedish supervisory authority, Integritetsskyddsmyndigheten (IMY) (imy.se). You may also contact the data protection authority in your own EU country.

9. Changes to this policy

We may update this policy from time to time. When we do, we will update the Effective Date at the top of this page.