Privacy Policy

1. Who we are

• Company: M Augustsson Holding AB
• Registered address: Markviksvägen 22a, 165 59 Hässelby, Sweden
• Organisation number: 556942-8039
• Email: support@ma-dev.se

M Augustsson Holding AB is the controller for the processing described in this policy. For questions about your personal data, or to exercise your rights, email support@ma-dev.se. We have not appointed a Data Protection Officer.

2. What we collect

2.1 Your account

You can use parts of the app without an account, and your plan then stays on your device. Syncing between your devices, subscriptions and the AI coach require an account, which you create with Sign in with Apple or with an email address and a password.

• Sign in with Apple. We receive a pseudonymous identifier for your Apple Account and, if you choose to share it, an email address, which may be a private relay address from Apple. Apple also gives us a code that we exchange for a token, stored encrypted, which we use for one thing only: to revoke the app's access to your Apple Account when you delete your account.
• Email and password. Your email address and a password, which we store only as a salted hash made with a deliberately slow algorithm (scrypt). We send you a link to verify the address and, if you ask for it, a code to reset your password. We only send emails that concern your account.
• When you create an account, you confirm that you are 16 or older, and we store when you did.
• Your settings, such as language and units.

2.2 Your plan and goals

The plan the app makes for you and what it is based on: your goal (for example a race, its date and a target time), the sport, the days and the time you have for training, and your equipment, such as an Apple Watch, a heart rate strap, a power meter or access to a pool. Every change to the plan is recorded with what changed, who made it (you, the app's training rules, the coach or a connected service), when, why and from which device.

2.3 Training and health data

Much of what the app uses is health data, a special category of personal data under the GDPR:

• your current training and baselines, for example recent training volume, results from a race or a test, pace, functional threshold power (FTP), critical swim speed (CSS) and resting and maximum heart rate;
• workouts you log or record: sport, date and time, duration, distance, heart rate, pace, power, cadence, swim lengths, your rating of the effort and any notes;
• events you register, such as illness, injury or travel, and their dates. We never ask about symptoms;
• if you allow it, data from Apple Health (2.4).

Health data reaches our server only if you have an account and have given your consent to store and sync it (section 3).

2.4 Apple Health

If you allow it, the app reads data from Apple Health on your iPhone: workouts and their measurements (such as heart rate, distance, pace and power), resting heart rate, heart rate variability (HRV), sleep, VO2 max, body weight and workout routes. Workouts you record with the app are saved to Apple Health.

Data in Apple Health can come from other apps and devices, for example Garmin Connect, Polar or Suunto. We record which app wrote each workout, because some sources have their own rules for how their data may be used (sections 4 and 5).

• Routes are read on your iPhone to show a private map of a workout. They are not sent to our server.
• What we send to our server are summaries of your workouts rather than raw recordings, and only if you have given your consent to store and sync.
• Data from Apple Health is used only for your training in the app. It is never used for advertising or marketing.

2.5 The AI coach

If you turn on the coach: the messages you write to it, and the explanations and suggestions it gives you. See the AI Transparency Statement.

2.6 Subscriptions

If you subscribe: which subscription you have, its status and renewal date, and Apple's identifiers for the purchase. We never receive your payment details. Apple handles the payment, and we use RevenueCat to keep track of subscriptions (section 7).

2.7 Notifications

Notifications are off until you allow them on your device. If you allow them, we store the token that Apple's push notification service gives the app on your device, and use it to tell you, for example, that a workout has been imported, that your plan has been adjusted or that a change awaits your approval. We also send silent notifications that let the app sync in the background. You can turn notifications off in your device's settings at any time.

2.8 Technical data and error reports

When the app talks to our server, the server receives technical data such as your IP address, the app version, the iOS version and the time of the request. We use it to run the service, to protect it against abuse (for example by limiting attempts to sign in) and to find errors. If the app or our server runs into an error, a report is sent to Sentry with a description of the error, the app version and the device model and system version. Neither our logs nor the error reports contain health data, email addresses or passwords.

2.9 Records of your consents

For each consent: the purpose, the version of the text you agreed to, when you gave it and, if you have, when you withdrew it.

2.10 Support

If you email us, we keep your message and our reply so that we can help you.

3. Health data and your consents

Because health data is a special category of personal data, we process it only with your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR). You give a separate consent for each purpose, and you can withdraw each one in the app's settings at any time. Withdrawing a consent does not affect what was processed before.

• Storing and syncing your training details. We ask when you create an account, and without it we cannot create the account. It lets your plan and workouts sync between your devices and lets a new phone adjust your plan. If you withdraw it, our server deletes your training details (your current training, events and logged workouts) and stops receiving them. They remain on your phone, and copies in our backups are gone within seven days.
• Reading Apple Health. We ask when you turn on the connection to Apple Health. You also control the access in iOS, under Settings, Privacy & Security, Health.
• The AI coach. We ask when you turn the coach on (section 4).
• Each connection to another service, such as Garmin (section 5).

If we add a feature that uses your health data for a new purpose, we will ask for a new consent before it does.

4. AI Transparency Statement

What the AI does. The app has an optional AI coach. It explains your plan in plain language and suggests changes, which you can apply, edit or ignore. It never changes your plan by itself and never decides how much you train: every suggestion is checked against the app's training rules before you see it. The coach is for training and well-being, and it does not diagnose or treat any condition. If a message mentions warning signs such as chest pain or fainting, the app answers with a fixed text that refers you to health care instead of an answer from the AI. The coach is off until you turn it on, and the app tells you that it is an AI before you use it.

Who provides it. The coach uses Claude, an AI model provided by Anthropic. Anthropic processes the requests outside the EU/EEA, for example in the United States (section 7).

What is sent. Only what one answer needs: a summary of your plan and recent training, for example distance, duration and effort, your question, and a pseudonymous ID. Never your name, email address or account details.

Data from Garmin and other sources. Data from Garmin, including data that Garmin Connect has written to Apple Health, is used by the coach only if you have given a separate consent for that. Data from sources whose terms do not allow AI processing is never sent.

No training of AI models. We do not use your data to train or fine-tune AI models, and Anthropic's commercial terms do not allow it to train its models on the data we send.

Your consent. We ask for your explicit consent, naming the provider and what is sent, before any of your data is processed by AI. You can withdraw it at any time in the app's settings, and from then on no data is sent to the AI. The coach's messages and texts are kept with your account until you withdraw this consent or delete your account.

Changes. We update this statement when the law, our AI provider or the terms of a data source such as Garmin change, and we tell you in the app before the change takes effect.

5. Garmin

Connecting a Garmin account is not available yet. It is planned for a later version of the app, and this section describes how it will work. We will update it before the connection is released.

• Connecting. You connect your Garmin account in the app's settings, through Garmin's own sign-in and consent. Before that, the app explains what is shared in each direction.
• What we receive from Garmin. The activities you record, with details such as laps, swim lengths and power, and, if you turn it on, daily summaries such as sleep, resting heart rate and heart rate variability. They are stored on our servers in Stockholm, and the access token is stored encrypted.
• What we send to Garmin. The planned workouts you choose to send to your Garmin Connect calendar, so that you can follow them on your Garmin device. Before the first workout is sent, we ask for your explicit consent and link to Garmin's privacy notice for Garmin Connect. Once sent, the workouts are in your Garmin Connect account, and Garmin handles them under its own privacy policy.
• How we use Garmin data. Only to provide the service to you. Garmin data is shown to you, and others see it only if you share it yourself, for example as an image you share from your phone. We never sell it, use it for advertising or pass it on to other services or apps, apart from the providers in section 7. The AI coach uses it only with your separate consent (section 4).
• Disconnecting. You can disconnect Garmin in the app at any time. We then stop receiving data and delete the access token, and you can choose to delete the data we have received from Garmin. Workouts already sent to Garmin stay in your Garmin Connect account until you delete them there.

6. Why we process your data, and the legal basis

Where we rely on legitimate interests, we have weighed them against your rights and freedoms, and you can object (section 9).

7. Who receives your data, and where

We store your data in the EU/EEA. We use the following providers to run the service. They process your data only on our instructions, under data processing agreements.

• Fly.io (USA) runs our server and database in Stockholm, Sweden. Everything stored on our server is stored there.
• Amazon Web Services (USA) stores encrypted backups of our database in Amazon S3 in Stockholm, Sweden (region eu-north-1), encrypted with our own key.
• Resend (USA) sends our emails, such as verification links and password reset codes, from its sending infrastructure in Ireland. It receives your email address and the content of each email.
• Anthropic (USA) provides the AI coach, only if you turn it on, and processes the requests outside the EU/EEA (section 4).
• Apple (Ireland and USA) provides Sign in with Apple, payments in the App Store and the Apple Push Notification service. If you allow notifications, your device's notification token and the text of each notification are sent to Apple, which delivers it.
• RevenueCat (USA) keeps track of subscriptions. It receives a pseudonymous ID, your purchases and subscription status from the App Store, and basic device information such as model, system version and country. Never health data.
• Sentry (USA) receives error reports from the app and our server, stored in its EU region in Germany. Never health data.

Garmin is not one of our providers. Workouts we send to Garmin at your request are handled by Garmin under its own privacy policy (section 5).

Some of these providers are based in, or process data in, countries outside the EU/EEA, such as the United States. For those transfers we rely on adequacy decisions of the European Commission, the EU Standard Contractual Clauses or other safeguards that the GDPR allows. We also disclose data to authorities when the law requires it.

8. How long we keep it

You can delete your account in the app. We then delete your account and everything linked to it from our database, and if you used Sign in with Apple, we revoke the app's access to your Apple Account. Our database backups keep a daily snapshot for seven days, and the server's storage is snapshotted daily and kept for five days, so within seven days of a deletion all copies are gone.

The app keeps a copy of your plan and training data on your iPhone and Apple Watch, so that it works offline. That copy is not included in iCloud backups, and it is removed when you delete the app.

9. Your rights

You have the right to access your data, to have it corrected or erased, to restrict or object to its processing, to receive it in a machine-readable format and to withdraw your consents. In practice:

• Access and portability: export your data in the app, or email us.
• Correction: change it in the app, or email us.
• Erasure: delete entries or your whole account in the app (section 8).
• Withdrawing a consent: in the app's settings (section 3).
• Everything else: email support@ma-dev.se.

We respond within one month, once we have verified that the request comes from you.

10. Age limit

You must be 16 or older to create an account. If you are under 16, you can use the app without an account, and your plan then stays on your device and is not sent to us. If we learn that someone under 16 has created an account, we delete it.

11. Security

Traffic between the app and our server is encrypted (HTTPS). Passwords are stored only as salted hashes, and tokens from Apple and other services are stored encrypted. The server's storage and our backups are encrypted, the backups with our own key. We use Apple's App Attest to check that requests to the AI coach come from a genuine copy of the app. Our logs never contain health data, email addresses or passwords.

12. Do we sell your data?

No. We never sell or rent your personal data, there is no advertising in the app, and we never use your health data for marketing or to decide which offers or prices you see.

If our business changes owner, for example through a merger or a sale, your data may be transferred as part of it, in accordance with data protection law.

13. Changes to this policy

We post changes here and update the date at the top. We tell you in the app about important changes, and before a change in how we use health data takes effect.

14. Complaints

Please contact us first at support@ma-dev.se, and we will do our best to help. You can also complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at www.imy.se, or to the data protection authority where you live.