Privacy Policy

1. Data controller

The controller of your personal data is PPIT Przemysław Paczoski, registered at Rozłogi 16/50, 01-310 Warszawa, NIP (tax ID): 5223269629, CEIDG (“we”).

Contact for personal data matters: przemek@23stud.io.

We have not appointed a Data Protection Officer. The contact above handles every personal data matter.

2. What data we process

We process data you enter yourself, data from devices and services you connect, and technical data the app needs to work.

• Account data: e-mail address, first name or display name, the identifier from Sign in with Apple or Google, and your time zone. If you choose it, Apple may give us a relay address instead of your e-mail.
• Health and fitness data (GDPR Art. 9): sleep and sleep stages, resting heart rate, heart rate variability (HRV), oxygen saturation, respiratory rate, VO2max, steps, active energy, body weight and composition, and workouts, plus recovery and strain scores that device vendors calculate. Where a provider shares them, also GPS routes of workouts.
• Data you enter: training plan, routines and sets from the strength log, exercises, post-workout feel and notes, pain, goals, races you choose, a place you set as “home”, and power thresholds and other training thresholds.
• Conversations with the AI coach and its plan proposals, if you consent to AI processing.
• Original payloads from connected services (for example a provider’s workout response), which we keep next to the values derived from them so they can be read again correctly.
• Access tokens for connected services. They are stored encrypted in our database and are shown to nobody.
• Technical data: crash reports from the app (without health data), basic server logs, the IP address in requests, and your device’s push notification token if you allow notifications.

3. Purposes and legal bases

We process data for these purposes, on these bases:

• Creating your account and providing the service: plan, calendar, strength log, bringing data from your sources together and comparing it with your own usual range of the last 30 days (Art. 6(1)(b) GDPR).
• Processing health data for those purposes, on your explicit consent given separately at first launch (Art. 9(2)(a) GDPR).
• The AI coach, on a separate explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
• Security, preventing abuse, rate limiting and fixing errors (Art. 6(1)(f) GDPR, our legitimate interest).
• Meeting legal obligations and establishing, pursuing or defending claims (Art. 6(1)(c) and (f) GDPR).

4. Consents and how to withdraw them

The app asks for two separate consents. The health data consent is needed before we fetch and store health data from sources. The AI coach consent is needed before your message and selected data go to the model provider. Declining either does not lock the app: the strength log works without the health data consent, and everything but the coach works without the AI consent.

You withdraw the AI coach consent in the app: Settings, Privacy and data, Withdraw AI coach consent. From then on the coach receives none of your data. Saved conversations and proposals stay on your account until you delete it.

You withdraw the health data consent by disconnecting sources and deleting their data in the app, by deleting your account (Settings, Delete account), or by writing to przemek@23stud.io. The app does not yet have a single switch for this consent. You can also revoke Apple Health access in iOS settings (Health, Data Access & Devices).

Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

5. Data sources and attribution

A source works only after you explicitly tap it and authorise it with the provider. Disconnecting a source stops data collection and asks the provider (for example WHOOP) to revoke access. For other providers you can also revoke access in their account settings. Disconnecting does not delete data already fetched: you delete it separately with the delete-source-data action, or together with your account.

Apple Health works on the device, and the app reads only the data types it lists. We write only one thing to Apple Health: a finished strength workout (type, duration and estimated active energy).

WHOOP, Withings, Intervals.icu and Strava connect directly to our server. Garmin, Suunto, Wahoo, Polar, Oura, Ultrahuman, Fitbit (Google Health) and other sources stay off until we receive access from the provider; the app shows only sources that are switched on. Before a new source is switched on, we update this policy, including any new processor.

Google Calendar is used only to write planned workouts as events and needs its own consent, separate from sign-in.

Beside every value we show the brand of the device it comes from and the time it was measured. Values from different brands are not averaged, and scores calculated by vendors (for example sleep score, recovery, strain) are not compared across brands. Values and share cards that come from Garmin devices carry Garmin attribution.

We keep Strava data in your account with no fixed end date, until you disconnect Strava and delete its data, or delete your account. We do not pass it to the AI coach.

6. AI coach

The AI coach uses the Claude model from Anthropic. When you write to the coach, we send Anthropic the text of your messages and the data the coach asks for during the conversation: planned training and routines, completed activities (sport, duration, distance, load), health metrics of recent weeks (HRV, resting heart rate, sleep, weight), goals and races, training thresholds, and a weather forecast without your location.

We do not send your name, e-mail or exact location. Strava data never reaches the AI coach, and there is no code path by which it could read it.

Data from Garmin devices is never sent to the AI coach or to any other AI or machine-learning provider and is not used to train models, the same as Strava data. When Garmin is the preferred source for a metric on a given day, the coach gets no value for that day, not a value from another brand. Wellness data from Intervals.icu whose device of origin is unknown is not sent to the coach either.

The coach never changes your plan by itself. It prepares a proposal that you review and approve. Only an approved proposal reaches the plan, and from there your calendar and connected services. The coach’s answers can contain mistakes.

Under Anthropic’s Commercial Terms, Anthropic may not train models on content submitted through the API (inputs and outputs). Anthropic deletes these inputs and outputs within 30 days of receiving or generating them. It keeps them longer only where the law requires it or to enforce its Usage Policy: content that its automated safety systems flag as a violation is kept for up to 2 years.

With Tuffr Premium you can also connect your own AI assistant (for example Claude or ChatGPT) over the MCP protocol. You approve the connection in the app and see what the assistant will be able to do. The assistant reads the same kinds of data as the AI coach and can only save a plan proposal for your approval. Data from Strava and Garmin devices never reaches such an assistant or any AI provider and is not used to train models.

Your data goes to your assistant at your request and on your explicit consent. From then on the assistant’s provider processes it as a separate controller, under its own privacy policy. Disconnect it at any time in Settings → AI assistants, which ends access immediately.

7. Recipients and processors

We entrust data to the entities in the table below under data processing agreements. Beyond them, data goes to services you connect yourself and to the sign-in providers named below. We do not sell data and do not use it for advertising.

If you join a Duet, your partner sees your plan and finished sessions. They see duration, distance, effort and feeling only if you allow it, and never readiness, sleep, HRV or weight without your separate consent. Strava data is never shown to a partner, and Garmin details are not shown until Garmin's terms are confirmed. You can change these settings at any time, and leaving the Duet ends access immediately.

The AI coach can see a Duet partner's plan and finished sessions only when you both gave a separate consent (off by default), and only in the coach of the person who has Premium. It sees the duration and distance of finished sessions only if the partner shares them. It never receives a partner's feeling, readiness, sleep, HRV or weight. Garmin and Strava data of either of you never reach the coach or any other AI service. Either of you can withdraw the consent at any time, and leaving the Duet deletes it.

8. Transfers outside the EEA

Some providers process data in the United States. Transfers rely on the Commission’s adequacy decision (Data Privacy Framework) where the provider is certified, and otherwise on the standard contractual clauses approved by Commission Decision 2021/914. The table above gives the detail for each transfer.

9. How long we keep data

We keep account data, health and training data, the plan, the strength log and coach conversations until you delete your account, and after that we remove them from our database. Deleting your account in the app (Settings, Delete account) deletes the account and the data tied to it and ends your sessions. Our hosting providers’ backups expire on their own schedule.

We do not delete data automatically after a fixed period. Data from a source you disconnect stays until you delete it (delete source data) or delete your account. That includes Strava data: we keep it until you disconnect Strava and delete its data, or delete your account.

Deleting your account removes our records and encrypted tokens, so we can no longer use them. The permission you gave a provider may still be listed in that provider’s account settings until you revoke it there.

We keep your device’s push token until you turn off notifications, sign out or delete your account.

Server logs and data needed to defend claims are kept as long as the law or our legitimate interest requires.

10. Your rights

You have the right to access your data, to rectify it, to have it erased, to restrict processing, to data portability, to object to processing based on our legitimate interest, and to withdraw consent at any time.

You export your data (a JSON file) in the app: Settings, Export my data. You delete it by deleting your account or a source’s data. For anything else write to przemek@23stud.io. We reply within one month.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. Providing data is voluntary, but without the e-mail address from sign-in an account cannot be created, and without data from sources the app has nothing to draw conclusions from.

We take no decisions that produce legal effects about you by solely automated means. Metrics and AI coach proposals are informational.

11. Apple Health

We do not use HealthKit data for advertising, marketing or data mining for any purpose other than showing you your own results and fitting your plan. We share it with nobody beyond the entities in the table above, as far as the app needs to work. We do not store health data in iCloud. Apple Health readings sent to our server are stored like the rest of your account data.

12. People under 18

The app is meant for people aged 18 or over. We do not knowingly process data of younger people. If we learn that an account belongs to a minor, we will delete it.

13. Cookies on the websites

The policy pages (this document and the terms) set no cookies and load no analytics or advertising tools. The Tuffr web dashboard is a private tool of the service owner. After sign-in it uses only strictly necessary session and security cookies (Auth.js and the Google sign-in state token), which are required for sign-in to work and are not used for tracking. The iPhone app uses no cookies.

14. Changes to this policy

When we change how we process data, we change this document and its update date, and we tell you about material changes in the app before they take effect. If a change needs new consent, we ask for it before you use that feature further.