Privacy Policy

1. Who is responsible

The data controller is NovaraFit Kalbermatter, c/o Loïc Kalbermatter, Solothurnstrasse 56, CH-4562 Biberist, Switzerland — loic@novarafit.app. Where EU/EEA users are concerned, this policy is intended to satisfy the requirements of the GDPR in addition to the Swiss Federal Act on Data Protection (FADP/DSG).

2. What we collect

• Account data — email address, display name, authentication identifiers, and language preference.
• Training data — workouts, sets, reps, weights, plans, splits and exercise history you log in the app.
• Health & fitness data — via Apple HealthKit, with your explicit permission: heart rate, heart rate zones, heart rate variability (HRV), resting heart rate, and sleep duration/quality, used to calculate your Readiness Score.
• AI coaching content — messages you send to the AI coach, and any past sessions you choose to attach for context.
• Usage & device data — app version, device type, crash logs, and feature usage needed to keep the app stable and to enforce AI credit limits.
• Push notification tokens — device tokens used to deliver reminders and streak/achievement notifications via Appwrite Messaging (APNS).

3. Apple Health data — specific commitments

In line with Apple's requirements for apps using HealthKit: health data obtained through HealthKit is used solely to power NovaraFit's training and recovery features — including your Readiness Score, trends, and AI coaching context. This data is never used for advertising or other data-mining purposes, and is never sold or shared with third parties for marketing purposes. You can revoke HealthKit access at any time in your device's Settings; doing so will limit Readiness Score accuracy but will not delete data already stored in your account.

4. Why we process this data

• To provide the core service: logging workouts, calculating your Readiness Score, generating plans, and running progression logic.
• To power AI features: the AI coach uses your current workout and any attached history to generate a response; usage is metered through the server-authoritative credits system.
• To operate gamification: streaks, achievements, and XP are calculated and stored against your account.
• To send notifications you've opted into: rest-day reminders, streak alerts, and achievement unlocks.
• To maintain and secure the service: debugging, abuse prevention, and infrastructure monitoring.

5. Where your data lives

NovaraFit's backend runs on a self-hosted Appwrite instance (authentication, database, storage, functions and messaging), operated by us. AI coaching requests are processed by our AI provider strictly to generate a response to your message and are not used to train third-party models beyond what that provider's own processing terms allow. We do not sell personal data to anyone, for any purpose.

6. Retention

Training and health data is retained for as long as your account is active. If you delete your account, your personal data and health data are deleted from active systems within 30 days, except where we're legally required to retain limited records for longer (e.g. billing records once payments are introduced).

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can exercise most of these directly from within the app (Settings → Account), or by contacting us at loic@novarafit.app.

If you're in the EU/EEA and believe we haven't handled your data properly, you also have the right to lodge a complaint with your local data protection authority.

8. Children

NovaraFit is not directed at children under 16, and we do not knowingly collect data from them.

9. Changes to this policy

We'll update this page as NovaraFit evolves — particularly once payment processing and social features are introduced — and will highlight material changes in-app.

10. Contact

Questions about this policy or your data: loic@novarafit.app.