Privacy Policy

Last updated: 19 August 2026

1. Who runs PeakD

PeakD (peakd.pro) is operated by Tomasz Skalski, an individual based in Poland (EU). PeakD is not yet a registered company. For any question about your data — including export, deletion, or correction requests — write to hello@peakd.pro.

PeakD is in beta. Features and processors listed below may change as the product matures; we will update this policy when they do.

2. What we collect

Only the data you give us, plus what is technically necessary to serve the page.

• Account: your email address, received from Google when you sign in with your Google account. There is no password — we never see or store one.
• Profile: name, age, gender, your selected coach, and fitness baselines you choose to enter (starting body weight, body-fat %, muscle %, max push-ups, max pull-ups, max plank seconds).
• Training data: the workout plans you create, the sets you log (reps, weight, optional notes), weekly check-ins, and any body-metric updates you add.
• Technical: standard server request logs on our API endpoints (IP address, user agent, timestamp). These are kept by our hosting provider for short-term operational purposes only.
• AI usage records: when an optional AI feature is used for you — currently the future voice restatement of your end-of-block coach review, once that lands — we record which feature was used, when, the AI model, and the token count and cost of that request, tied to your account. We use it to run the service within budget and to detect abuse — not to profile you or to market to you. Today, none of the core coaching features use AI: creating a new training plan, your end-of-block coach review, and the block that follows it are all built on our servers by a rule-based engine. No AI usage record is written for those.

We do not collect: location, payment information, advertising identifiers, or any data we don't explicitly list above.

3. Why we process it

• To build personalised training plans for you. All three plan-building surfaces — creating a new plan, your end-of-block coach review, and the block that follows it — run on our own servers by a rule-based engine, with no AI call and no transfer to any AI provider. An optional AI voice restatement of the coach review may land later; when it does, only your review's already-computed decisions are sent, and only if the feature is enabled.
• To sync your data across the devices you sign into.
• To operate the site (hosting, anti-abuse rate limiting, error diagnosis).

4. Legal basis (GDPR)

We rely on two bases:

• Performance of a contract (GDPR Art. 6(1)(b)) — most processing is what we need to do to actually deliver the coaching service you signed up for.
• Consent (GDPR Art. 6(1)(a)) — given when you create your account. You can withdraw it at any time by deleting your account (see §7).

The fitness metrics you enter (weight, body composition, exercise baselines) are not processed as health data under GDPR Art. 9 — they are training inputs, not medical records, and PeakD is not a medical device.

5. Who else sees your data (sub-processors)

To run the service we use a small number of third-party providers. Each only sees what they need to do their job, and each is contractually bound to keep it confidential.

• Anthropic, PBC (United States) — provider we plan to use for an optional AI voice restatement of your coach review. Today no PeakD feature actually calls them: creating a new training plan, your end-of-block coach review, and the block that follows it are all built by a rule-based engine on our own servers, with no AI call. If we later enable the voice restatement, only the deterministic decisions your review has already produced will be sent to Anthropic for that specific request. It will never receive your email address. Anthropic's API terms forbid them from training on your data.
• Vercel Inc. (United States, with EU regions available) — hosting and serverless function execution. Sees standard request metadata (IP, user agent, route).
• Supabase (EU region) — authentication (via Google sign-in) and primary database. Stores your account, profile, and training data. Also serves the exercise photos and videos, which contain no personal data.
• Upstash (EU region) — a Redis datastore that still holds a copy of plans, logged workouts and check-ins alongside the primary database. We are consolidating onto the primary database and will retire it when that completes.

We do not sell your data, share it with advertisers, or use it for marketing.

6. International transfers

Your data is stored in EU regions (Supabase and Upstash). However, several of our providers are US companies, so some transfer of data outside the EU takes place. The legal basis differs by provider:

• Anthropic — EU Standard Contractual Clauses, incorporated into their data processing addendum.
• Supabase — data is stored in an EU region, but Supabase, Inc. is a US company and may transfer data to the US. This relies on EU Standard Contractual Clauses in their data processing addendum.
• Upstash — data is stored in an EU region. Upstash, Inc. relies primarily on the EU-US Data Privacy Framework, with EU Standard Contractual Clauses applying as a fallback.
• Vercel — certified under the EU-US Data Privacy Framework (including the UK Extension and Swiss-US DPF).

7. Your rights

Under GDPR you can, at any time:

• Access and export your data. Sign in, open /account, and click "Export my data (JSON)" — you get the full dump as a downloadable file, instantly.
• Correct your data. Edit your profile inside the app at any time.
• Delete your account and everything in it. Go to /delete-account (or open /account and click "Delete account"), sign in, and confirm. This wipes every plan, workout, check-in and your auth record — across every device you have ever signed in from, not just the one you are using. There is no soft-delete and no grace period: the account is gone as soon as you confirm. Two narrow exceptions apply, and we spell them out in §8 rather than hiding them.
• Restrict or object to processing — write to hello@peakd.pro.
• Lodge a complaint with a supervisory authority. For Polish users, that is the UODO (Urząd Ochrony Danych Osobowych).

8. How long we keep your data

• Active account — we keep your data for as long as your account exists.
• Deleted account — your plans, workouts, check-ins, profile, AI usage records and auth record are erased from our live database and cache the moment you confirm deletion. Two exceptions, both deliberate:
  • Backups (up to 14 days). We take a nightly backup of the database so a technical failure can't destroy everyone's training history. Your data therefore also sits in those backups, and deleting your account does not reach into them. Each backup is deleted on a rolling 14-day cycle, so a deleted account is gone from our backups within 14 days at the latest. Backups are used only to restore the service after a failure — never to bring an individual account back.
  • A deletion marker (kept indefinitely). When you delete your account we keep one small record noting that a particular internal account identifier was deleted, and when. It holds no name, email, or training data. Without it, a device you were still signed in on elsewhere could silently re-upload its leftover copy of your data and resurrect the account you just deleted. We keep this marker specifically so that deletion stays deleted.
• Sub-processor backups — our providers run their own disaster-recovery backups on their own schedules (typically 7–30 days, rolling).
• Server request logs — kept short-term by Vercel for operational diagnosis, then aged out.

9. Security

Data in transit is encrypted (HTTPS everywhere). Authentication uses Google sign-in via Supabase — there is no password for us to store or for anyone to phish. Database access is restricted by row-level security so only you can read your own rows. API endpoints rate-limit aggressive clients.

No system is bullet-proof. If we become aware of a breach affecting your data, we will notify you and the relevant supervisory authority as required by GDPR Art. 33–34.

10. Children

PeakD is not directed at children. You must be at least 16 years old to create an account. If you believe a child has registered, write to hello@peakd.pro and we will delete the account.

11. Cookies and tracking

PeakD does not use advertising cookies, and we do not run any third-party analytics or tracking product — there is no Google Analytics, no advertising pixel, and no cross-site tracker of any kind. The one usage record we keep is our own: the AI usage log described in §2, which exists to control cost and abuse. The app also stores a small amount of data in your browser's localStorage so it can work offline and remember which plan you're on — this never leaves your device unless you choose to sync it via cloud sign-in.

12. Changes to this policy

When we change how we handle data, we update the "Last updated" date at the top and, for material changes, notify signed-in users by email before the change takes effect.

13. Contact

Privacy questions, data-subject requests, breach reports: hello@peakd.pro.