We've got you.Your data stays yours.

1. Who we are

IronMind is a training service made of an iPhone app, an Apple Watch app with widgets, and a web application at www.ironmind.be (together, the "Service").

The Service is operated by Gregory Wullaert, a sole trader established in Belgium, trading as IronMind ("IronMind", "we", "us").

• Registered address: Heuvelstraat 46 bus 201, 3090 Overijse, Belgium
• Enterprise number (KBO/BCE): 1032.389.311
• Email: support@ironmind.be

We are the controller of the personal data described in this policy, within the meaning of the EU General Data Protection Regulation (GDPR). We have not appointed a Data Protection Officer because the law does not require one for our activities; all privacy questions go to support@ironmind.be.

This policy explains what we collect, why, who receives it, how long we keep it and which rights you have. It applies to every part of the Service. It does not cover third-party services you choose to connect, such as Strava or Apple Health, which follow their own policies.

2. The short version

• We use your data to build and adapt your training plan, record your workouts and run the features you choose. We do not sell it, we show no ads and we do not track you across other apps or websites.
• Some of what you share is health data: injuries you tell us about, heart rate, and workouts from Apple Health and Apple Watch. We only process it with your explicit consent, and you can withdraw that consent at any time.
• AI features are powered by OpenAI. What we send depends on the feature and is described in section 6.
• Connecting Strava is optional. Once connected, we read your activities and we write titles and descriptions onto activities that match your plan. Uploading Watch workouts to Strava only happens if you switch it on.
• You can delete your account at any time from the app or the website. Everything linked to your account is deleted at once, with the narrow exceptions in section 9.
• On the website, analytics cookies are only set after you accept them.

3. What we collect

3.1 Your account

• First and last name, email address and password. We only store the password as a bcrypt hash and never see it in plain text.
• Year of birth, gender and phone number.
• Optional address: street, city, postal code and country. We convert it into map coordinates (latitude and longitude) to suggest routes near you.
• Preferred language, and the date and time you accepted our Terms of Service.
• Settings such as automatic plan adjustment and automatic upload to Strava.

3.2 Your training profile

The questionnaire you fill in to create a plan:

• Your sport, your event (distance, date and location) and whether you have more than one event.
• Experience level, goal, days you cannot train and recent training volume.
• Sport-specific details such as recent race times, FTP, target paces, preferred long-session days and swim equipment.
• Whether you train with a heart rate monitor.
• Injury status and any injury details you type in. This is health data (see section 4).

3.3 Training plans and results

• The plan we generate for you: phases, weeks, workouts, steps, targets and coaching notes.
• Completed workouts, a performance score per workout (comparing what you did with what was planned), plan adjustments and the reasons for them, and how often you regenerated your plan.
• Insights we calculate from your history, such as training load, fitness and freshness, heart rate zones, an estimated VO2max, race predictions and personal records.

3.4 Workouts recorded with IronMind (iPhone and Apple Watch)

When you record a workout in IronMind, the app collects and sends to our servers:

• Type, date, start and end time, duration, distance, ascent and descent, calories, cadence, power and swim data.
• Average and maximum heart rate, a time series of heart rate, distance, cadence and power, laps and time spent in each heart rate zone.
• The GPS route of the workout (positions with timestamps).
• A log of the voice cues the live coach gave you.
• After the workout, the answers you give the coach in the review (typed or dictated, up to 1,000 characters) and the points the coach draws from them, for example about nutrition, sleep, fatigue, pacing, conditions or small aches.

The Apple Watch never connects to the internet itself. It hands workouts to your iPhone, which sends them to us.

3.5 Apple Health

If you allow it, the iPhone app reads from Apple Health:

• Workouts you record elsewhere, so they can be imported and matched to your plan. For each imported workout we store its type, times, duration, distance, elevation, speed, cadence, heart rate, power, calories, splits, laps, the recording device's name and app, indoor or outdoor, the temperature and humidity saved with the workout, and its GPS route and data streams.
• Heart rate variability, resting heart rate and sleep, to calculate your morning readiness score. This happens on your iPhone only. These values and the score are not sent to us.
• Body weight, only to estimate calories for workouts recorded on the iPhone. It stays on your device.

The apps write the workouts you record with IronMind, including routes and heart rate, back to Apple Health.

Data from Apple Health is never used for advertising or marketing and never sold. You can remove imported Apple Health workouts by disconnecting Apple Health in the app, and you can revoke access at any time in the Health app.

3.6 Strava

Connecting Strava is optional and happens through Strava's own sign-in screen. Once connected, we receive and store:

• Your Strava athlete ID, name and username, and the access tokens that let us call Strava for you.
• Your activities, including private ones: names, descriptions, type, times, distance, speed, heart rate, cadence, power, calories, elevation and device name.
• Detailed data streams per activity, including GPS positions, heart rate, altitude, cadence, power and temperature, plus splits, laps, best efforts, segments you rode or ran and your gear.

We also send data to Strava:

• When a Strava activity matches a workout in your plan, we update its title and description to show the IronMind session.
• If you switch on automatic upload, workouts you record with IronMind, including GPS route and heart rate, are uploaded to Strava as new activities.

3.7 AI coach chat

When you chat with the coach (Premium), your message and the recent conversation are sent to our servers to generate an answer. We do not store chat conversations on our servers. The conversation is kept on your device: in the app's protected storage on iPhone, and in your browser's local storage on the web. It is removed when you sign out.

3.8 Location

• During a workout on iPhone or Apple Watch, the app uses GPS to show your position, guide you along a route and record your track. It keeps doing so while the screen is off, but only during a workout you started, and only with your "While Using" permission. We never collect your location outside a workout.
• When you plan a route, the app can use your current approximate position to suggest routes nearby and sends it to our servers for that request. Otherwise we use the address in your profile.

3.9 Subscriptions and payments

• On iPhone, you subscribe through Apple. We receive and verify Apple's signed transaction data and store the transaction and product identifiers, plan, purchase and expiry dates and subscription status. We never see your card details or Apple ID.
• On the web, you subscribe through Stripe. We give Stripe your name, email and your IronMind account ID, and we store your Stripe customer ID, plan and subscription status. Stripe handles your card details; we never see them.

3.10 Technical data

• Request data: to keep the Service secure and working, our servers handle your IP address and the app version, device model, operating system version and language that the app sends with each request. We use IP addresses to limit abusive traffic. We do not store them in our database, though they can appear in our hosting provider's short-lived server logs.
• Crash reports: the iPhone app sends crash and performance reports produced by Apple's MetricKit, together with the app version and build. These reports contain no name, email or account ID and are not linked to your account.
• Sign-in tokens: we keep a one-way hash of your refresh token so sessions can be renewed and revoked.

3.11 Things that stay on your device

• Voice answers: when you answer the coach out loud, speech recognition runs on your iPhone. The recording never leaves the device; only the resulting text is sent.
• Bluetooth heart rate straps: the pairing is stored on your device only.
• Notifications: workout reminders, countdowns and milestones are created on your device. We do not use push notifications, and no notification content passes through our servers.
• Widgets and Live Activities show data the app already holds on your device.

3.12 Our website

See section 12 for cookies and storage. When you view a map in the web app, map images are loaded from CARTO, which receives your IP address and the map area shown.

4. Why we use your data, and on what legal basis

Under the GDPR every use of personal data needs a legal basis. Ours are:

To provide the Service you signed up for (contract, Art. 6(1)(b) GDPR):

• creating and managing your account
• generating your plan, matching workouts, scoring them and showing statistics
• recording workouts, planning routes, the calendar feed and the AI coach
• processing your subscription
• sending emails you need, such as the welcome email and password resets

Health data, with your explicit consent (Art. 9(2)(a) GDPR):

This covers injuries you tell us about, heart rate and other workout data from Apple Watch, iPhone, Apple Health and Strava, and the review answers you give the coach. You give this consent when you allow Apple Health or connect Strava, record a workout, or fill in injury details. You can withdraw it at any time by:

• revoking Health access
• disconnecting Strava
• removing injury details from your questionnaire
• deleting your account

Withdrawing consent does not affect processing that already took place. Without this data, features that depend on it stop working.

Our legitimate interests (Art. 6(1)(f) GDPR):

• keeping the Service secure and preventing abuse, for example through rate limiting and token revocation
• analysing crash reports to fix bugs
• counting website visits with cookie-free statistics, to see which pages are useful
• defending legal claims

We have weighed these interests against your rights. You can object to them (section 10).

Your consent (Art. 6(1)(a) GDPR and the Belgian Electronic Communications Act):

• analytics cookies on our website
• optional features you switch on, such as automatic upload to Strava and automatic plan adjustment

Legal obligations (Art. 6(1)(c) GDPR):

• keeping accounting and tax records of payments
• answering lawful requests from authorities

We do not send marketing emails or newsletters. If we ever want to, we will ask for your consent first.

5. Health and safety

IronMind gives training guidance. It is not a medical device and does not give medical advice, diagnosis or treatment. Readiness scores, VO2max estimates, race predictions and AI answers are estimates and can be wrong. Consult a doctor before starting or changing a training programme, especially if you have an injury or a medical condition, and stop training if you feel unwell.

Only share the health information that the Service needs. The free-text fields (injury details, coach chat, workout reviews) are for training context; please do not enter information about other people or medical details beyond what matters for your training.

6. How we use AI

We use models from OpenAI to generate and adapt plans and to write coaching text. What we send depends on the feature:

• Plan generation and regeneration: your questionnaire (including injury details and event location), sport metrics, recent training history and language. Not your name or address.
• Workout debriefs, live-coach briefs and post-workout reviews: the workout and its results, the voice cues it gave you, your review answers and a short summary of recent sessions and reviews.
• Feedback on an activity: the activity's data and your language.
• Automatic plan adjustment (Premium, only if you switch it on): your recent completed workouts and scores, and the upcoming days of your plan.
• Coach chat (Premium): your message, the recent conversation, your profile (name, year of birth, gender, language, address and its coordinates, subscription), your questionnaire including injury details, and, when the coach looks them up to answer you, your plan, workouts and activities. When the coach searches the web, the search query (never your profile) is sent to DuckDuckGo.

OpenAI processes this data on our behalf under its data processing addendum and does not use data sent through its API to train its models. We monitor the reliability of AI requests with Arize Phoenix, configured so that the content of prompts and answers is not sent; it receives technical metadata only, such as timings and model names.

AI-generated content can contain mistakes. Plans, automatic adjustments and scores are training suggestions that you can review, change or revert. They have no legal or similarly significant effect on you, so they are not automated decisions within the meaning of Article 22 GDPR.

7. Who receives your data

We do not sell or rent your personal data, and we do not share it for advertising. We share it only with the parties below, and only what they need.

Service providers who process data on our behalf (processors):

• Railway (Railway Corporation, USA; servers in the EU, Netherlands region). Hosting of our servers, database and route engine, and their logs and backups.
• OpenAI (OpenAI Ireland Ltd and OpenAI, L.L.C., USA). AI features, as described in section 6.
• Arize Phoenix (Arize AI, Inc., USA). Monitoring of AI requests, without prompt or answer content.
• Combell (Combell nv, Belgium). Sending account emails.
• Plausible (Plausible Insights OÜ, Estonia; servers in the EU). Cookie-free visit statistics for the website. For each page view it receives the page address, the referring site, browser, operating system, device type and the country derived from your IP address. It does not store your IP address and cannot recognise you across days or sites.
• Google Analytics (Google Ireland Ltd / Google LLC). Website visit statistics, only if you accept analytics cookies.

Organisations that receive data to provide a function you use, as independent controllers:

• Strava (Strava, Inc., USA). Only if you connect it; see section 3.6.
• Apple (Apple Distribution International Ltd / Apple Inc.). In-app subscriptions, Apple Health and Apple Watch, under Apple's privacy policy.
• Stripe (Stripe Payments Europe, Ltd., Ireland). Web payments, under Stripe's privacy policy.
• OpenStreetMap Nominatim (OpenStreetMap Foundation, United Kingdom). Turns your profile address into map coordinates. It receives the street, city, postal code and country.
• Overpass API (overpass-api.de, Germany). Finds points along a route. It receives the coordinates of the area around the route.
• DuckDuckGo (Duck Duck Go, Inc., USA). Web searches by the AI coach; it receives the search query only.
• CARTO (CartoDB Inc., USA/Spain). Map images in the web app; it receives your IP address and the map area shown.

We may also disclose data:

• when the law requires it, or to respond to a valid request from a court or authority
• to establish or defend legal claims
• to a successor if the Service is transferred; we would notify you before your data becomes subject to a different policy

8. Transfers outside the European Economic Area

Some of the parties above are based in, or reach their data from, the United States or the United Kingdom.

• United Kingdom: the European Commission has decided that it protects personal data adequately, so transfers there need no further safeguards.
• United States: we rely on the EU–U.S. Data Privacy Framework where the recipient is certified under it, or otherwise on the European Commission's Standard Contractual Clauses.

You can ask us for more information about these safeguards.

9. How long we keep your data

• Your account and everything linked to it: until you delete your account. This covers your profile, questionnaires, plans, workouts, reviews, Strava and Apple Health data, and settings.
• On account deletion: all of the above is deleted at once. At the same time we revoke IronMind's access to your Strava account and ask Stripe to delete your customer record. Data we already wrote to Strava, Apple Health or your calendar stays there until you remove it.
• If you disconnect Strava: we stop collecting new data and delete our access tokens. The activities already imported stay in your history so your statistics remain correct, until you delete your account or ask us to delete them. If you revoke IronMind's access from within Strava, we delete the imported Strava activities automatically.
• If you disconnect Apple Health in the app: imported Apple Health workouts are deleted.
• Records of Apple purchases: after you delete your account, we keep the transaction records Apple sent us, no longer linked to your account, for as long as Belgian accounting and tax law requires.
• Records of notifications from Strava, Stripe and Apple: 90 days. We use these only to avoid processing the same event twice.
• Crash reports: 90 days.
• Sign-in data: expired sessions are removed automatically; revoked sessions after 30 days. Password reset links expire after 24 hours.
• Backups: deleted data can remain in database backups until those backups expire, at the latest three months later. Backups are only used to restore the Service after an incident, never to bring back data you deleted.
• Server logs: our hosting provider keeps them for a short period for operations and security.

10. Your rights

Under the GDPR you have the right to:

• Access your personal data and receive a copy.
• Rectify incorrect data. You can change most of it yourself in your profile and questionnaire.
• Erase your data. You can delete your account yourself (see section 11) or ask us.
• Restrict how we use your data while a question about it is being resolved.
• Data portability: receive the data you gave us, and the data generated by your use of the Service, in a structured, machine-readable format (JSON), or have it sent to another provider where technically possible. You can download this file yourself at any time (see section 11).
• Object to processing based on our legitimate interests.
• Withdraw consent at any time, for health data, analytics cookies and optional features.
• Lodge a complaint with a data protection authority. In Belgium this is the Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be. You can also contact the authority in the EU country where you live or work.

We would appreciate the chance to resolve your concern first at support@ironmind.be.

11. How to exercise your rights

• Delete your account:
  • iPhone app: Settings → Support → Delete Account.
  • Website: Settings → Support & Legal → Delete account.
• Disconnect Strava or Apple Health: in the app's settings. You can also revoke IronMind's access in your Strava settings.
• Switch off Health, location, microphone or notification access: in your iPhone's Settings or the Health app.
• Download a copy of your data: on the website, Settings → Support & Legal → Download my data. You receive one JSON file with everything we store for your account, except credentials such as your password hash. You can also ask for it by email.
• Change your cookie choice: "Cookie settings" in the website footer.
• For anything else (a correction, a restriction or an objection): email support@ironmind.be from the address linked to your account.

We answer within one month. If a request is complex we may extend this by up to two more months, and we will tell you why. We may ask you to confirm your identity first. Exercising your rights is free, unless a request is clearly unfounded or excessive.

12. Cookies and similar technologies

12.1 Website

Strictly necessary storage. Our website stores the following in your browser. It sets no cookies of its own and needs no consent for this storage:

• your sign-in tokens, in session storage, or in local storage if you choose "Stay logged in"
• your language and display preferences, and your cookie choice
• the AI coach conversation history (on this device only, removed when you sign out)
• small interface states, such as dismissed notifications and which updates you have read

Cookie-free statistics (Plausible). We count visits to the website with Plausible. It sets no cookies, stores nothing on your device and does not track you across sites, so it needs no consent. It sees which page addresses are visited, including pages of the web app, but never what you enter or your training data.

Analytics cookies (Google Analytics), only with your consent. If you accept analytics cookies in our cookie banner, Google Analytics sets cookies (named _ga and _ga_*, kept for up to 2 years) to count visits and see which pages are used. If you decline, Google Analytics is not loaded at all. You can change your choice at any time through "Cookie settings" in the footer.

12.2 Apps

The iPhone and Apple Watch apps contain no third-party analytics, advertising or tracking code and do not use the advertising identifier. They store your sign-in tokens in the iOS Keychain, and settings, caches and data shared between the app, the Watch and widgets in protected storage on your device. This data is removed when you sign out or delete the app.

13. Security

We protect your data with appropriate technical and organisational measures:

• encrypted connections (HTTPS/TLS) between the apps, the website and our servers
• passwords hashed with bcrypt
• refresh and reset tokens stored only as hashes
• short-lived access tokens, with refresh tokens rotated and revoked on reuse
• rate limiting against brute-force attempts
• tokens stored in the iOS Keychain, and app data in iOS protected storage
• servers and databases in the EU, with access limited to the operator of IronMind

No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the Belgian data protection authority within 72 hours, and you without undue delay where the law requires it.

14. Children

The Service is for people aged 16 and over. Registration requires a year of birth showing you are at least 16. If you believe a younger child has given us personal data, contact support@ironmind.be and we will delete it.

15. Residents of California

We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we do not use it for cross-context behavioural advertising. You can ask to know, correct or delete the personal information we hold about you by emailing support@ironmind.be. We will not treat you differently for doing so.

16. Changes to this policy

We update this policy when the Service or the law changes. The date at the top shows the latest version. If a change materially affects how we use your data, we will tell you in the app or by email before it takes effect, and ask for your consent again where the law requires it.

17. Contact

• Gregory Wullaert, trading as IronMind
• Heuvelstraat 46 bus 201, 3090 Overijse, Belgium
• Enterprise number (KBO/BCE): 1032.389.311
• support@ironmind.be