Account: e-mail address (we also use it to send you one-time codes for sign-up and password reset), password (stored only as a secure hash by our authentication service), username, display name and profile photo.
Profile and fitness profile: units, height, weight, body fat, VO2 max, FTP, heart-rate values, 10K time, sports, goals, events and races, availability and preferences.
Training: your training plans, planned and completed workouts, workout notes and the reviews your coach writes.
Health and body data: sleep, heart rate, resting heart rate, heart-rate variability, recovery, weight, height, body fat, VO2 max, cycling FTP, maximum heart rate, lean body mass and workout data, only from the apps you connect (Apple Health, WHOOP, Strava, Wahoo) or enter yourself.
Subscription: whether you have Coatyc+ (the plan, its status, the product and the date it ends) and the identifiers Apple gives us for your subscription. Your payment details stay with Apple; we never see them.
Coach: your messages to the coach, the coach’s replies, and the facts the coach remembers about you (“coach memory”).
Technical data: the connection data our servers and hosting provider need to deliver the app (such as IP address and time of request), and error information.
Notifications are scheduled on your device. We do not send you marketing messages.

3. Why we process it and on what legal basis

To provide the app and your account, including the plan, the coach and the connected apps (Art. 6(1)(b) GDPR, performance of the contract).
Health data (a special category under Art. 9 GDPR): only with your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR). You give it in the “Your health data” step of the setup, by pressing “I agree and continue”; we store the time and the version of this text with your account. You can withdraw it at any time (section 9). Withdrawal does not affect what was processed before.
To keep the service secure and stable, and to prevent abuse (Art. 6(1)(f) GDPR, our legitimate interest).
To meet legal duties, for example to answer authorities where we are obliged to (Art. 6(1)(c) GDPR).
For the beta waiting list on our website: your consent (Art. 6(1)(a) GDPR), see section 14.
Giving us your account data is necessary for the contract: without it we cannot offer you an account. Health data and connected apps are voluntary. Without them the coach has less to work with and some features are limited.

4. Your health data

Coatyc only reads health data you allow. On iOS you choose in Apple Health which data types Coatyc may read, and you can change that in iOS Settings at any time. For WHOOP, Strava and Wahoo you authorise access on the provider’s own page and can revoke it there or in Coatyc.

We use health data to personalise your training, to compute fitness and fatigue, to show your health overview and to let the coach adapt your plan. We do not use it for advertising and we do not sell it.

5. Who receives your data

We do not sell your data and we use no advertising or tracking services. These recipients process data for us or because you asked for it:

Hosting and database: Supabase, data centre in Frankfurt am Main, Germany (EU). It stores your account, plan, chats and synced data and runs our server functions. We have a data processing agreement with the provider.
AI coach (chat, first plan, workout reviews and the Coach page note): your messages and the parts of your profile, plan, training and health summaries needed to answer are sent to OpenRouter, a routing service for AI models, which passes the request on to the company that runs the language model (a DeepSeek model). If the main model is not reachable, a second model of the same family answers. Only what is needed for the request is sent.
Web search (only when you ask the coach to search the web): the search terms the coach uses are sent to a search service through OpenRouter. The coach does not search the web on its own.
Voice (only if you use the spoken coach): the text to be read aloud is sent to a speech service (ElevenLabs, through OpenRouter).
E-mail: the one-time codes for sign-up and password reset, and the mails of the website beta list (section 14), are sent through Resend (Resend, Inc., United States). Resend receives the recipient’s e-mail address (for the beta list also the first name) and the content of the mail. Open and click tracking is switched off.
Connected apps: when you connect WHOOP, Strava or Wahoo we exchange data with them. During setup we also read your profile details there (height, weight, FTP, maximum heart rate and, from Strava, your profile photo) to fill in your profile, so we only ask what is still missing; you can change all of it later. If you turn on planned-workout sync, your planned cycling and running sessions are sent to Wahoo. Apple Health is read on your device and stored in your account.
Apple: distribution through the App Store and TestFlight and, if you subscribe to Coatyc+, the purchase, the payment and the renewal, subject to Apple’s own privacy policy. Apple sends our servers signed notices about your subscription (a renewal, a cancellation, a refund), which we check before we use them.

6. Transfers outside the EU/EEA

Our database is in Germany. Some of our providers are based outside the EU/EEA or use sub-processors there, for example OpenRouter, the companies that run the language models behind it, the voice service, Resend and our hosting provider’s parent company, mostly in the United States. Where data is transferred to such a country, it only happens under the safeguards of Art. 44 ff. GDPR, such as an adequacy decision (for example the EU–US Data Privacy Framework for certified companies) or the EU Standard Contractual Clauses. You can ask us for details (section 11).

7. How long we keep data

We keep your data while your account exists. When you delete your account in the app (Settings, Privacy & security, Delete account), your account and the data linked to it are deleted right away, and access we hold at WHOOP, Strava and Wahoo is revoked. Copies in the hosting provider’s backups are overwritten in its regular backup cycle. Data we must keep by law is kept only as long as the law requires.

You can also delete individual items, such as chats, coach memory entries, workouts or plan sessions, inside the app.

Technical connection data in server logs is kept only as long as security and error analysis need it. The data of the beta waiting list is described in section 14.

8. Security

Data is encrypted in transit (TLS) and at rest by our hosting provider. Every database table is protected by row-level security, so an account can only read its own rows. Secret keys of the AI and connected services stay on our servers and are never shipped in the app. You can lock the app with Face ID or your device passcode. No system is perfectly secure; if a breach puts you at risk we notify you and the authority as the law requires.

9. Your rights

You have the right to:

access your data (Art. 15) and receive a copy in a common format (Art. 20): Settings, Privacy & security, Download your data;
have inaccurate data corrected (Art. 16) in your profile and settings;
have your data erased (Art. 17): Settings, Privacy & security, Delete account;
restrict processing (Art. 18) and object to processing based on legitimate interests (Art. 21);
withdraw consent at any time (Art. 7(3)): disconnect the app in Settings, Connected apps, or revoke access in iOS Settings; deleting your account removes everything; for the beta list use the unsubscribe link in any list mail;
lodge a complaint with a data protection authority. The authority responsible for us is the Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany, www.datenschutzzentrum.de. You can also contact the authority in your own country.

10. Automated recommendations

The coach is an AI. Its training advice is a suggestion. It never changes your plan by itself: changes appear as a proposal that you confirm. We make no decisions about you that have legal or similarly significant effects (Art. 22 GDPR). See “AI Coach transparency”.

11. Contact and children

For questions about your data or to use your rights: Niels Petersen (Solytiq), Krimweg 7, 24975 Maasbüll, Schleswig-Holstein, Germany. E-mail: hello@coatyc.de.

Coatyc is for people aged 16 and over. If you are younger, please do not use the app.

12. Changes

We update this policy when the app or the law changes. The effective date is at the top. We tell you in the app about changes that matter.

13. This website

When you open coatyc.de, the web servers of our website host, Framer, process technical connection data: your IP address, the date and time, the page requested and your browser and device type. We need this to deliver the page and keep it secure (Art. 6(1)(f) GDPR, our legitimate interest). We do not use analytics, advertising or tracking services, and we set no cookies that need your consent. Fonts, images and scripts are delivered by Framer’s content delivery network, not by third-party font or tracking services. Your cookie choice is saved only in your browser (local storage), which is strictly necessary to remember it (§ 25(2) no. 2 TDDDG), and is not sent to us. See also “Cookies and tracking”.

If you write to us by e-mail, we use your message and address only to answer you (Art. 6(1)(b) or (f) GDPR) and delete them when the matter is closed.

Website host: Framer (Framer B.V., Amsterdam, Netherlands). The website is hosted by Framer on its global content delivery network, so it is not hosted in Germany. Only the app backend (database and server functions) is hosted in Frankfurt, Germany, by Supabase (see section 5).

14. Beta waiting list

When you join the beta list on our website, we process your first name, last name, e-mail address and, if you choose, your main sports, plus the time of your confirmation and the version of the terms and privacy policy shown to you. We use them to send you the confirmation mail, to invite you to the TestFlight beta and to send you updates about the beta by e-mail. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 3 UWG). We do not pass the data on to anyone else; the mails are sent through Resend (section 5), without tracking of opens or clicks, and the list is stored in our Supabase database in Frankfurt.

We use double opt-in: you are on the list only after you click the link in the confirmation mail. The link works for 48 hours. Entries that are never confirmed are deleted a few days after the link has expired. To limit abuse we keep a salted hash of your IP address for one day; the address itself is not stored (Art. 6(1)(f) GDPR).

You can withdraw your consent at any time with the unsubscribe link in every list mail. We then keep your address on a block list so that we do not write to you again (Art. 6(1)(f) GDPR, our legitimate interest in respecting your choice) and delete it on request. Otherwise we keep the data until you unsubscribe or ask us to delete it.