Privacy policy

Who is responsible

The data controller is Daniel Ortega (Spain), owner of goforit.day and pedalytics.bike and of their applications. You can write to support@goforit.day about anything to do with your data.

What it applies to

To the GoForIt app for iPhone, Apple Watch and Android, to the goforit.day website (landing, professional panel, «My space» and account), to the API behind them and, for what they share (account, rides and deletion), to the Pedalytics app, which also has its own policy for what only happens there (bikes, components, bike photos and maintenance).

What data we handle

We only handle the data needed for the service to work and what you decide to add, sync or share.

• Account: email address, name (optional), password (stored encrypted by our authentication provider; we cannot see it), language and time zone. If you sign in with Apple or Google, we receive your name and email from them (or the private relay address you choose).
• What you accept: which version of these texts and of the terms you accepted, that you are 16 or over, the consent to read your health data and those you give for a source, a professional or your AI, with date, language and from which app. We keep it to be able to prove it and so as not to ask you again.
• Health and activity from Apple Health (iPhone and Apple Watch) or Health Connect (Android), only if you consent and type by type from the system permissions: steps, distance and energy, workouts (with the GPS route of those that have one), sleep, heart rate and its variability, weight and body composition, and other measures you grant (blood pressure, glucose, oxygen saturation, temperature, respiration). On Android also the data from before the install and background reading, if you grant them.
• What you log yourself: workouts, routines, sets, meals and foods, supplements, habits, measurements, goals, notes and how you feel.
• Rides and activities from other sources, only if you connect them: Strava, Google Health, the FIT files you upload and the band or watch providers you link. From each activity we receive the date, duration, distance, GPS route and the heart-rate, power, cadence, speed and altitude readings the source has, and the device's battery when the source gives it.
• One account shared with Pedalytics: your bike rides are the same in both apps; what you record in Pedalytics (bikes, components, maintenance, bike photos) is only shown there. Deleting the account from either deletes both.
• Shared plans: the content of the plans you create, send or import, and the links you generate.
• Professional mode: if you are a coach or nutritionist, your clients' records (name, email, notes) and their plans. You decide what data you enter and why; we process it on your behalf, as processor, under the terms of use.
• Follow-up with a professional (when switched on and only if you turn it on, type by type): your daily reports, your weight and the photo of the scale, body photos, your activity and your nutrition, and the messages between you two. Nothing is shared by default and you can withdraw it at any time.
• Subscription: your tier (free, Plus or Pro), its period and whether the purchase was made with Apple, Google or on the web. We do not receive your card details: Apple, Google or Stripe handle them.
• Camera, microphone and voice: the camera only to read a product's barcode; the microphone and speech recognition so that you can dictate a meal or a workout. Everything is processed on your phone; we keep no images or audio, and only the text or the names of foods or exercises you confirm reach our server.
• Weather of your rides: to know the wind and temperature of a ride we send a weather service the date and the rounded coordinates of its start, never your name or your account.
• Barcodes: when you scan a product we do not have, we look up its code in Open Food Facts; only the code travels.
• Technical data: IP address, date, browser or app version and errors in the logs of our servers and of the network that protects them, for security and to detect failures.
• Errors of the app and of the signed-in web: if a screen fails, we send our API a description of the failure (type, screen without identifiers, version, device, language) after removing emails, identifiers and long numbers. The table where it is stored records neither your account nor your IP, groups repeats and deletes them after 60 days without repeating.
• Your AI and your data: if you create a personal token or connect ChatGPT, Claude or another tool of yours, or press «Send to your AI», that tool receives the data you ask it for (health data included) and handles it under its own conditions. We never send anything to an AI on our own and we do not use your data to train models.

What we use it for and the legal basis

• Providing the service (account, sync, readiness and load computation, plans, reminders, notices): performance of the contract (the terms of use).
• Health and activity data: your explicit consent, given in the app before the first reading (in addition to the system permission), recorded, and which you can withdraw at any time from the app, from the phone's permissions or by writing to us.
• Connecting an external source, sharing with a professional or with your AI: your consent, each one separately and revocable.
• Security, abuse prevention and bug fixing: our legitimate interest in a working, secure service.
• Invoicing and accounting, once there are payments: legal obligation.
• Analytics on the public website: only if you accept it (see «Cookies and web analytics»).

We do not sell your data. We do not use health or activity data for advertising or commercial profiling, and we do not pass it to third parties for those purposes. We make no automated decisions with legal effects about you: readiness, load and the day's proposals are guidance computed from your own data, not a diagnosis, and you can always ignore them.

Who we share it with and where it lives

Our servers are in the European Union (Frankfurt, Germany). We work with providers that process data on our behalf, each under a processing agreement, and we share data with other people only when you decide to:

• Supabase (database, authentication and files): Frankfurt, Germany. Supabase Inc. is a US company and its support may access under contract; the data stays in Frankfurt.
• DigitalOcean (the server of the API and the integrations): Frankfurt, Germany.
• Cloudflare (the network that protects the API and the domains): sees the encrypted traffic in transit and keeps short technical logs; a US company under the EU-US Data Privacy Framework (DPF).
• Vercel (the website): signed-in pages are served from Frankfurt and the edge network is global; a US company under the DPF.
• Apple and Google: if you sign in with them, and to read Apple Health, Health Connect and Google Health with your permission. Apple Health and Health Connect live on your phone; Google Health is a Google service.
• Strava and the other activity providers you connect: they send us your data with your permission. What comes from Strava is shown only to you; a professional or your AI receives it reduced to the minimum (see the terms of use).
• Payments: Apple, Google, Stripe and RevenueCat. They receive your user identifier, the product and the purchase status, never your health data. RevenueCat (US, DPF) and Stripe (Ireland and US).
• Email: Mailgun (EU region) for the service's notices and Resend for account codes and emails; they receive your address and the content of the email.
• Errors and technical monitoring: Sentry may receive already-scrubbed errors from our servers, without health data or identifiers.
• Weather: Visual Crossing (US) receives the date and the rounded coordinates of the start of a ride, with nothing that identifies you.
• Open Food Facts (France): receives the barcode you scan.
• Google Analytics: only on the public website and only if you accept it (US, DPF).
• Other people: they only see what you share (a plan by link, what you share with a professional in the follow-up, or what you ask your AI). A professional is responsible for what they do with what you share with them.

When a provider processes data outside the European Economic Area it does so with the GDPR's safeguards: the adequacy decision of the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. You can ask us for a copy of those safeguards.

How long we keep it

For as long as you have an account. If you delete it, we erase your personal data from our systems at once, except what we must keep by law (for example, the accounting records of a payment). Backups are kept for 7 days and what they hold disappears with them; the servers' technical logs, 30 days at most; the app and web errors, 60 days without repeating.

What you log and what we compute per day or per activity (workouts, meals, weights, check-ins, each morning's readiness number, each activity's summary with its totals and laps) is kept while you have an account, on any plan.

An activity's raw data (the second-by-second readings of heart rate, power, cadence, speed and altitude, and the GPS route) is a copy of what the source has (Strava, a FIT file, your watch). An account without a paid plan keeps the last 12 months; Plus and Pro keep them while the plan lasts. After that they are deleted and the activity's summary remains; if you reconnect the source they can be imported again. The copy of each record a provider sends us, kept to be able to review a failed import, is emptied after 30 days.

An account nobody enters for 24 months is deleted with everything in it. Entering is opening either app (GoForIt or Pedalytics), signing in on the web or a sync of one of your sources. A month before, we write to the account's email with the date; opening the app before that day is enough to keep it, and you can export your data first. We never delete an account without having sent that notice.

An account with no activity at all for 24 months is deleted, after telling you by email. You can ask for your account to be deleted from the app or the web (Account › Delete my account), which deletes it at once, or by writing to support@goforit.day; we handle that request within 30 days at most.

Your rights

You can access your data, rectify it, erase it, object to its processing, restrict it, ask for its portability and withdraw your consent at any time, without affecting what was processed before.

From the app you can export your workouts, withdraw the health consent, disconnect a source, cut what you share with a professional, revoke a token of your AI and delete the account. For anything else write to support@goforit.day. You can withdraw the Health permissions in Settings > Health > Data Access & Devices (iPhone) or in Health Connect (Android). If you believe we do not handle your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Security

Data travels encrypted (HTTPS) and the database access rules make each account able to read only its own data. The credentials of the sources you connect are stored encrypted, files (photos) are private and served with temporary links, and only the essential staff access the systems. Even so, no system is infallible: if an incident affected your data, we would tell you as the law requires.

Children

GoForIt and Pedalytics are not aimed at people under 16. When you create the account we ask you to confirm it; if we learnt that an account belongs to someone younger, we would close it and delete its data.

Cookies and web analytics

The iPhone and Android apps include no third-party analytics or advertising. On the public website we use Google Analytics only if you press «Accept» in the notice: it measures visits and performance, is not used for advertising and receives no account or health data.

Rejecting is as easy as accepting, and you can change your mind in «Analytics preferences», at the foot of the home page. Without your acceptance no Google cookie is loaded or created. To keep you signed in we use essential technical storage.

Language cookie: in the professional panel, «My space», the account and the sign-in screens we store our own cookie, gf_locale, with only the language you choose (es or en) for one year. It is created only when you press the language switch; until then we use your browser's language. It identifies nobody, is not shared and is not used for analytics.

Waitlist

If you leave your email on the home page so that we tell you about the launch, we keep that email, the page language, which button you sent it from, the date and the version of this text you saw. We do it because you ask for it by pressing the button (GDPR, art. 6.1.a) and we use it only to write to you when GoForIt is available and for notices directly related to that launch.

Every message will carry a link to unsubscribe. We do not pass it on or use it for third-party advertising. If you unsubscribe, we stop writing and keep only the email with the unsubscribed mark, so as not to do it again; if you prefer us to delete it entirely, write to support@goforit.day.

Changes to this policy

If we change it in a relevant way we will ask you again in the app or on the web before you go on, and the version you accepted is recorded in your account. The date above is that of the latest version.