Privacy Policy

2.1 Account Information

• Email address (for login and communication)
• Password (encrypted with bcrypt, never stored in plain text)
• Full name (optional, for personalization)
• Profile photo/avatar (optional, stored securely)

2.2 Athlete Profile Data

• Date of birth (for age-based recommendations)
• Weight and height (for power-to-weight calculations)
• Resting heart rate and maximum heart rate
• Functional Threshold Power (FTP)
• Sport type and experience level
• Training goals and preferences

2.3 Training & Activity Data

• Activity records from connected devices and services
• GPS data, routes, and location information
• Power output, heart rate, cadence, and speed data
• Activity duration, distance, and elevation gain
• Lap times and split data
• Training load and stress calculations (TSS, CTL, ATL)

2.4 Health & Recovery Data

When you connect health tracking services (like Whoop):

• Sleep duration and quality metrics
• Recovery scores and readiness indicators
• Heart rate variability (HRV)
• Strain and exertion metrics

2.5 AI Coach Interactions

• Chat conversation messages with the AI coach
• Training questions and coaching responses
• Uploaded images (e.g., power files, bike fit photos, training screenshots)
• Training plan requests and generated proposals

2.7 Job & freelance applications

When you apply for a role with N+One (for example by email to an address we publish), we use what you send—contact details, portfolio links, attachments, and message content—only to evaluate your application and to reply to you; we do not use it for unrelated marketing and we do not sell it. If you are not engaged for the role, we delete application data within twelve months of the decision unless the law requires otherwise or you become our contractor or employee. You may request earlier deletion at hi@nplusone.app.

3.1 Contract performance — Art. 6(1)(b)

Necessary to operate your account and paid subscription (not for health/AI coaching content):

• Creating and managing your account and authentication
• Providing billing metadata and fulfilling Pro subscriptions (via Stripe)
• Customer support about account/billing that does not require health metrics

3.2 Explicit consent — Art. 6(1)(a) and Art. 9(2)(a)

Collected via our in-app consent gateway (versioned and logged) before the relevant processing starts. Withdrawal is available in Settings and is as easy as giving consent.

• Importing and storing health-related metrics from connected services (e.g. heart rate, HRV, sleep, recovery, readiness from Whoop, Garmin, Apple Health, and similar)
• GPS tracks / activity polylines and precise location from activity streams
• Generating personalized training plans, session recommendations, and coach chat that use the above data
• Transferring minimized athlete context to AI/LLM processors used to deliver coaching (named in §5 / Trust; currently including OpenAI and other processors disclosed there)
• Connecting third-party integrations (Strava, Whoop, Wahoo, Garmin, intervals.icu, Zwift, Apple Health) after the required purpose consents above
• Optional: AI quality evaluation using live athlete context (default off; not required to use the coach)
• Analytics cookies (Google Analytics 4) — TDDDG § 25 / Art. 6(1)(a); managed via Cookie Settings (not Art. 9)
• Newsletter / marketing email — Art. 6(1)(a) only

We do not rely on Art. 9(2)(h) (healthcare). N+One is not a medical device and does not provide medical treatment.

3.3 Legitimate interests — Art. 6(1)(f)

• Security, fraud prevention, abuse detection
• Aggregated / anonymized product analytics where no Art. 9 data is required
• Technical troubleshooting that can be done without special-category data

4.1 Providing Core Services

• Authenticating your access to the platform
• Synchronizing activities from connected devices and services
• Calculating training load, readiness scores, and performance metrics
• Generating personalized AI coaching responses
• Creating and adapting training plans based on your goals and fitness
• Displaying performance analytics, trends, and progress charts

4.3 Service Improvements

• Analyzing usage patterns to identify popular and underused features
• Identifying and fixing technical issues and bugs
• Understanding which features provide the most value to users
• Planning new features and integrations based on user needs
• Optimizing performance and loading times

5.1 Essential Service Providers

We use trusted third-party service providers to operate our platform. All providers have Data Processing Agreements (DPAs) in place:

5.2 Integration Services (With Your Consent)

When you connect third-party fitness services, we access only the data you authorize via OAuth:

• Strava: Activities, athlete profile, activity streams (power, heart rate, GPS)
• Whoop: Recovery scores, sleep data, workout data
• Wahoo: Activities and workout data
• Garmin: Activities, health metrics (sleep, HRV, resting HR) for readiness, and workout upload to devices
• intervals.icu: Planned workout calendar sync, optional completed-activity import, and optional wellness/recovery metrics you authorize
• Zwift: Indoor ride / activity sync and optional scheduling of planned bike workouts to Zwift

We store access tokens securely and only access data necessary for providing coaching services. You can disconnect integrations at any time via Settings > Integrations.

5.3 Payment Processing

We use Stripe for subscription billing (including Checkout and the customer portal):

• Stripe processes Pro subscription payments and related billing events
• We do NOT store your credit card information on our servers
• Stripe maintains PCI-DSS Level 1 compliance (highest security standard)
• We receive only payment confirmation, invoice metadata, and subscription status needed to provision Pro access

5.4 Analytics

Google Analytics 4: With your consent (TDDDG § 25 / GDPR Art. 6(1)(a)), we use Google Analytics 4 (Google Ireland Ltd. / Google LLC) for usage analytics — for example page views, navigation, and feature usage that help us improve the Dynamic Coach experience. Measurement cookies and IDs (such as _ga and _ga_*) load only after you accept analytics in Cookie Settings. Consent Mode defaults keep analytics storage denied until then. Transfers to the USA use Google's applicable transfer mechanism; further details are in Cookie Settings, section 6 below, and Google's privacy documentation. You can withdraw analytics consent at any time via Cookie Settings in the footer.

Vercel Analytics: We also use Vercel Analytics for privacy-friendly, aggregated usage statistics. It does not set analytics cookies or track personal identifiers across sites.

7.1 Active Account

• Profile data: Retained while your account is active
• Training sessions / detailed activity history:
  • Free tier: 90 days
  • Pro tier: 2 years while the subscription is active; after Pro ends, retain under Free-tier rules unless you delete the account sooner
  • Advanced tier: not offered yet — no Advanced retention applies
• Chat conversations: Retained while account is active
• Activity logs: Server logs retained for 90 days for security purposes
• Google Analytics 4: Event and identifier data retained according to our GA4 property retention settings (typically up to 14 months) and Google's product terms; you can stop further collection via Cookie Settings

7.2 After Account Deletion

• All personal data permanently deleted within 30 days of account deletion request
• Aggregated, anonymized statistics may be retained for business analytics
• Legally required records (e.g., tax, accounting): Retained for 7 years as required by German law
• Backup systems purged within 90 days

8.1 Right of Access (Art. 15)

You have the right to request a copy of all personal data we hold about you, including:

• Profile information and account details
• Training sessions and activity data
• Chat conversations with the AI coach
• Integration connections and sync history
• Goals, training plans, and readiness scores

How to exercise: Go to Settings > Privacy > Export Data. Your data will be provided in JSON format for easy portability.

8.2 Right to Rectification (Art. 16)

You have the right to correct inaccurate or incomplete personal data.

How to exercise: Update your information directly via Settings > Profile, or contact support for assistance.

8.3 Right to Erasure / "Right to be Forgotten" (Art. 17)

You have the right to request deletion of your personal data. We will permanently delete your data within 30 days, except where:

• We are legally required to retain certain records (e.g., tax records for 7 years)
• Data is needed to complete an ongoing transaction
• Data is needed to comply with legal obligations

How to exercise: Go to Settings > Privacy > Delete Account. This action is permanent and cannot be undone.

8.4 Right to Restriction of Processing (Art. 18)

You have the right to request that we limit processing of your data in certain circumstances:

• When you contest the accuracy of the data
• When processing is unlawful but you don't want data deleted
• When we no longer need the data but you need it for legal claims
• While we verify legitimate grounds following your objection

How to exercise: Contact us at hi@nplusone.app

8.5 Right to Data Portability (Art. 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (JSON) and transfer it to another service.

How to exercise: Use the Export Data feature in Settings > Privacy to download your complete data archive.

8.6 Right to Object (Art. 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes:

• Object to direct marketing at any time (unsubscribe links in all marketing emails)
• Object to processing based on legitimate interests
• Object to automated decision-making and profiling

We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

8.7 Right to Withdraw Consent (Art. 7(3))

Where processing is based on consent, you have the right to withdraw it at any time:

• Disconnect integrations via Settings > Integrations
• Manage cookie preferences via Cookie Settings
• Unsubscribe from newsletters using links in emails
• Withdraw explicit consent for health-data import and AI coaching via Settings → Privacy (the Art. 9 purpose toggles). That does not affect other withdrawals listed here.

Withdrawal does not affect the lawfulness of processing before withdrawal.

8.8 Right to Lodge a Complaint

If you believe we are not complying with GDPR, you have the right to file a complaint with your local Data Protection Authority:

You may also lodge a complaint with the supervisory authority in your place of residence or workplace in the EEA. We encourage you to contact us first so we can address your concerns directly.

9.1 Technical Measures

• Encryption in transit: TLS/SSL encryption (HTTPS) for all data transmission
• Encryption at rest: Database encryption for stored data
• Password security: Passwords hashed using bcrypt (never stored in plain text)
• Encrypted database connections: All database queries use encrypted connections
• OAuth 2.0: Secure authorization for third-party integrations
• Token management: Access tokens encrypted at rest, expire automatically
• Regular security updates: Dependencies and systems kept up to date

9.2 Organizational Measures

• Access controls: Least privilege principle for system access
• Security training: Regular security awareness and best practices
• Incident response: Procedures for detecting and responding to security incidents
• Secure development: Security-first development practices and code reviews
• Third-party assessments: Regular security audits of service providers

9.3 Infrastructure Security

• Databases hosted in secure, ISO-certified data centers
• Automated encrypted backups
• DDoS protection and rate limiting
• Intrusion detection and prevention systems
• Regular security monitoring and logging

10.2 Analytics cookies (opt-in)

With your consent (TDDDG § 25 / GDPR Art. 6(1)(a)), we use Google Analytics 4. These cookies and IDs are not set before you accept analytics in Cookie Settings. Provider: Google Ireland Ltd. / Google LLC. Purpose: usage analytics to improve our Dynamic Coach platform. Opt-out: Cookie Settings (Reject all / disable Analytics) or browser controls. See also section 5.4.

Legal basis (GA4 cookies): Consent (GDPR Art. 6(1)(a) / TDDDG § 25)

12.1 AI Coaching Recommendations

• Our AI coach provides training suggestions based on your profile and activity data
• These are recommendations only, not binding decisions
• You maintain full control over your training choices
• No decisions with legal or similarly significant effects are made automatically
• You can always override or ignore AI suggestions

12.2 Training Load Calculations

• Automated algorithms calculate training stress (TSS), fitness (CTL), and fatigue (ATL)
• Based on established sports science principles
• Calculations are transparent and use standard formulas
• You can view, question, and ignore these metrics at any time

13.1 Your Responsibility

• Review the privacy policies of Strava, Whoop, Wahoo, Garmin, intervals.icu, and Zwift
• Understand what data you're authorizing us to access through OAuth permissions
• You can revoke access at any time via Settings > Integrations
• Disconnecting removes our access but doesn't delete data from the third-party platform

13.2 Our Responsibility

• Access only the data scopes you explicitly authorize
• Store access tokens securely with encryption
• Respect your data deletion requests
• Delete integration data when you disconnect a service
• Use accessed data only for providing coaching services