Legal
Privacy Policy
Peaksflare runs on some of your most personal data - how you sleep, how your heart responds, how hard you train. This policy explains exactly what we collect, why, and the control you keep over it. The short version: your data is yours, and we never sell it.
Plain-language summary
We collect the health and training data you connect so the coaching engine can adapt to you. We use it to run your account and generate your training - not to sell to advertisers. You can export or delete everything at any time.
01Data controller
The controller (administrator) of your personal data is VTD Dariusz Tarczyński, Zagajnikowa 6, 62-020 Zalasewo, Poland (NIP PL6652804992, REGON 301111092). We decide the purposes and means of processing your data as described in this policy, and we are your point of contact for any privacy question or request.
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. Privacy requests are handled directly by the controller - get in touch through our contact form.
02What we collect
- Account information - name, email address, and login credentials.
- Athlete & health metrics - sleep, heart-rate variability (HRV), resting and active heart rate, training load, workouts, and related performance data.
- Profile & goals - sport, training zones, target events, and preferences you set.
- Usage data - how you interact with the app, device type, and diagnostic logs to keep the Service reliable.
03Connected sources
When you authorise a third-party service or device - such as Garmin, Whoop, Oura, Apple Health, Wahoo, Polar or Strava - we receive the metrics needed to coach you. We request only the scopes required, and you can disconnect any source at any time, which stops future syncing from it.
04How we use your data
- To generate your daily readiness score and adapt your training plan.
- To operate, maintain, secure, and support your account.
- To communicate with you about the Service, including beta access and important notices.
- To improve the Service and our models, using aggregated or de-identified data wherever possible.
05Legal basis for processing
Under the GDPR (in Poland, RODO) we rely on the following legal bases:
- Performance of a contract (Art. 6(1)(b)) - to run your account and deliver the coaching you sign up for.
- Your consent (Art. 6(1)(a)) - to connect third-party sources and to send you non-essential communications. You can withdraw consent at any time without affecting processing already carried out.
- Legitimate interests (Art. 6(1)(f)) - to keep the Service secure, prevent abuse, and improve it using aggregated or de-identified data. We balance these interests against your rights.
- Legal obligation (Art. 6(1)(c)) - to retain certain records where the law requires it.
Health data. Sleep, heart-rate variability, heart rate and related metrics are "special category" data under Article 9 GDPR. We process them only with your explicit consent, given when you create your account and connect your data sources. You can withdraw that consent at any time by disconnecting your sources and deleting your account, and we will stop processing and delete or de-identify the data as described below.
06AI, profiling & your data
Peaksflare uses your metrics to compute recommendations specific to you. This involves automated profiling - for example, scoring your daily readiness and adjusting your plan from your training and recovery signals. These are guidance outputs that you choose whether to follow; they do not produce legal or similarly significant effects, and a human (you) always remains in control of your training decisions.
We do not sell your personal data, and we do not share identifiable health data with advertisers. Where we use data to improve our coaching models, we work with aggregated or de-identified datasets so the analysis cannot reasonably be tied back to you.
08International data transfers
Your data is hosted on servers within the European Union. Some services and sources you connect - for example providers based in the United States - may process data outside the European Economic Area. Where that happens, we rely on appropriate safeguards under Chapter V GDPR, such as European Commission adequacy decisions or Standard Contractual Clauses, so your data keeps an equivalent level of protection. You can request more information about these safeguards through our contact form.
09Storage & security
Your data is encrypted in transit and at rest. We apply access controls, monitoring, and industry-standard safeguards to protect it. No system is perfectly secure, but we work to limit access to only what is necessary and to respond quickly to any incident.
10Retention
We keep your data for as long as your account is active or as needed to provide the Service. When you delete your account, we delete or de-identify your personal data within a reasonable period (typically within 30 days), except where we must retain certain records to comply with legal obligations, in which case we keep only what the law requires and for no longer than necessary.
11Your rights & controls
Under the GDPR (RODO) you have the right to:
- Access & portability - obtain a copy of your data, in a portable format, at any time.
- Rectification - update inaccurate account or profile information.
- Erasure - delete your account and associated personal data ("right to be forgotten").
- Disconnect - revoke any connected source to stop further syncing.
- Objection & restriction - object to or restrict certain processing, including processing based on our legitimate interests.
- Withdraw consent - where we rely on your consent, withdraw it at any time without affecting the lawfulness of processing before withdrawal.
To exercise any of these, use the controls in the app or reach us through our contact form. We respond within one month, as required by the GDPR.
Right to complain. If you believe we have mishandled your data, you can lodge a complaint with your local supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa - uodo.gov.pl.
13Children
Peaksflare is not directed at children under 16 (or the age of digital consent in your country). We do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.
14Changes & contact
We may update this policy as the Service evolves or the law changes. If we make material changes, we will notify you in the app or by email before they take effect.
Questions about your privacy? Get in touch through our contact form.