Privacy Policy - Stronnect

Data controller

• Controller: Antonio Gallardo Jiménez
• Privacy contact: support@stronnect.com

Legal bases (article 6 GDPR): performance of the contract to create your account, prepare and deliver your plan, charge the subscription and give you access; your consent for health data (article 9.2.a), optional measurement, Meta advertising measurement, the AI permission and meal photos, which you can withdraw at any time; compliance with legal obligations to keep payment and invoicing records; and our legitimate interest in the security of the service and the basic technical visit log.

1. Information we collect

• Account and purchase data: email address, order identifiers and payment status. Full card details are handled by Stripe; STRONNECT does not store them.
• Answers used to personalise the plan: goal, experience, availability, equipment, activity and any safety or fitness data you choose to enter.
• Generated plan: programming, workouts, validations and files associated with the order.
• Onboarding draft: we save your answers as you give them, first in your own browser so that you can continue if you close the tab, and also on our servers from the moment you agree to us processing your answers to create your plan. This saving lets us understand at which question people stop and fix what is not working. It does not include your email: the email address is collected by Stripe at payment, not by the questionnaire, and if you type one inside a free-text answer it is removed before the answer is saved.
• Basic technical visit log: we assign the browser a random first-party ID and record one row per day with the first server time, whether the optional cookies were accepted or rejected, whether «Create my plan» was tapped, the last step reached, the device type and the campaign or referring website. Reloading on the same day does not create another person; if the same browser comes back on another day, the ID allows that return to be marked. This log recognises a browser; it does not guarantee a person’s identity. We do not store here the IP address, the user agent, the email, the answers, injuries, pain or free text.
• Optional journey measurement: if you accept it, we store only screens, steps, approximate times, device, campaign and technical states. We do not send answers, free text, pain, injuries, email or plan content to analytics.
• Optional advertising measurement: if you accept it, Meta may receive the URL visited, events such as visit, onboarding completed, checkout started and purchase, the browser’s advertising identifiers and the order value. To attribute a purchase, the email collected by Stripe may be sent normalised and hashed; it is not sent in readable text.

2. Use of information

• Preparing, validating, delivering and allowing recovery of the purchased STRONNECT Plan.
• Managing checkout, confirming payment and preventing duplicate orders or charges.
• Keeping access secure and dealing with incidents.
• Using the basic technical log to understand how many different browsers visit each day, how many come back and how far they get; if you accept the optional measurement, also analysing times, steps back and technical states to improve the journey.
• Measuring and optimising Meta campaigns only when you have expressly accepted advertising measurement.

3. Your choices and consent

• We process the first onboarding screens (goal, experience, available days, where you train and measurements) in order to provide the service you requested by tapping «Create my plan», as stated on that same screen. Before the first question about discomfort or injuries we ask you, within that screen, for explicit permission to process that health information; without ticking it you cannot continue and those answers are not saved.
• Funnel measurement is a separate choice: you can accept it or continue with only what is necessary, and change it later from “Privacy” in the journey.
• Rejecting the optional cookies turns off detailed measurement and Meta advertising, but keeps the first-party ID and the daily technical row described in this policy.
• Advertising measurement with Meta is another optional and independent choice. Rejecting it does not prevent you from creating or buying the plan, and you can change it from “Privacy”.
• We do not sell your information.

4. Providers and security

• Supabase hosts the database, the files and passwordless access.
• Stripe processes checkout and payment.
• OpenAI generates the plan and replies in the Coach. It receives only what is necessary to do so (your answers, your plan, what you log, your messages to the Coach and, if you connect Apple Health or Health Connect and give the AI permission, your workouts, steps, sleep, resting heart rate, heart rate variability and active calories), processes that data on our behalf, may keep it for up to 30 days only to prevent abuse, does not use it to train its models and does not receive your access credentials.
• Apple and Google, if you use them: to sign in with your Apple or Google account (we receive your email and, if you provide it, your name), to charge the subscription taken out from the app (we receive only its status) and to deliver notifications to your phone. If you signed in with Apple and delete your account from your iPhone, we also remove STRONNECT's access to your Apple ID.
• Open Food Facts receives only the number of a barcode you scan in the app, without your account. The maps of runs and rides are loaded from Apple Maps (iPhone) or OpenFreeMap (Android), which see the map area, not your account.
• Meta Platforms Ireland Limited provides advertising measurement when you accept it. We do not send Meta onboarding answers, injuries, pain, free text or the content of your plan.
• We apply access controls, opaque tokens, idempotency and server-side permissions to protect orders and plans.

5. Retention

• The local onboarding draft expires after 24 hours. The draft saved on our servers is deleted after 30 days, a shorter retention period than for the rest of the measurement precisely because it contains your answers.
• Detailed optional measurement events have an operational retention period of 90 days.
• The browser’s technical ID expires after 90 days without activity and the associated rows are deleted after 90 days. Aggregated daily totals may be kept without that identifier.
• The advertising choice and the attribution identifiers, if any, remain linked to the order. Meta retains the data it receives in accordance with its own terms and privacy policy.
• Photos you send to the Coach are deleted after 30 days (or sooner, if you remove them). The photo of a meal you scan is kept for 30 days, without your location or the camera data, so that the STRONNECT team can check that we recognise foods and quantities correctly; it is deleted automatically, when you withdraw permission for the photo (in the app, Menu › Settings › Meal photos) or when you delete your account. Permission to send photos to the Coach comes with the AI permission and is withdrawn with it.
• App performance data is deleted after 30 days.
• Error logs from the apps and the website, and the logs of the notifications we send you (whether it was delivered, opened or dismissed), are deleted after 90 days.
• If you delete your account, it is deleted completely after 30 days and until then you can recover it. After that we only keep payment records, because the law requires it, and app error logs, anonymised (without your user or your email).
• We keep the order, the plan and the necessary information for as long as you keep access and for the applicable legal periods.

6. User rights

Under the GDPR, you have the right to access, rectify or erase your data, to object to or ask us to restrict its processing, to request portability and to withdraw your consent at any time. If you think we haven’t handled your rights properly, you can complain to the Spanish Data Protection Agency (aepd.es).

To delete your account and your data: from the app (Menu › Settings › Delete my account) or as explained at stronnect.com/en/delete-account. From the app, the account is closed immediately and fully deleted after 30 days; until then you can ask us to restore it.

Contact: support@stronnect.com

7. Local storage and measurement

The main journey uses necessary local storage to keep the draft and recover the checkout state. Detailed optional measurement is only enabled if you choose to help improve STRONNECT.

Regardless of that choice, STRONNECT keeps a basic technical visit log: it stores in this browser a random first-party ID that expires after 90 days without activity, and the server creates one row per day with the first time, the decision on optional cookies, whether «Create my plan» was tapped, the last step, how long the visit lasted if you left without going past the first screen, whether there was any gesture on it (a tap or a scroll, not where or on what), which elements of the home page you opened or swiped and how many seconds you spent on it and on each sample screen you opened (the element’s identifier and a duration, never its content or what you read), the device type and the campaign stated in the link. Reloading or coming back on the same day updates the same row; if this browser comes back on another day, another row appears with the same ID and is marked as returning. The ID does not allow you to be recognised on another website, and it recognises a browser, not a guaranteed person: another device, another profile, private mode or clearing the data generates another ID. We do not combine it with IP address, user agent, email, answers, injuries, pain or free text.

The Meta Pixel, its cookies and browser events are not loaded until you choose “Measure advertising with Meta”. If you accept, STRONNECT may also send from the server, via the Conversions API, the onboarding completed, checkout started and purchase events, with the value of 24.99 EUR and the permitted attribution data. When the same event travels from both the browser and the server, both use the same identifier so that Meta counts it only once. The normalised and hashed email is only added to the purchase; events before payment do not receive your email. This privacy page does not load the advertising pixel.

You can withdraw this choice from “Privacy” in the journey. You can also consult Meta’s privacy policy and its off-Meta activity controls.

8. STRONNECT apps for iPhone and Android

In addition to the above, the apps process, only if you use that feature:

• Health and activity: with your permission, we read from Apple Health or Health Connect your runs, bike rides and other cardio sessions (with distance, average heart rate and elevation) so that they count in your plan without logging them by hand; they are saved in your account like the rest of your workouts. We also read a summary of each day (steps, walking distance, how long you slept, resting heart rate, heart rate variability and active calories) and save it in your account so the Coach can take it into account when answering you; if you give it AI permission, it goes with everything else we send it. We save there the workouts you do with the app (with their distance and, for a treadmill session you log by hand, its steps) and what you log in Food: calories, protein, carbohydrates, fat and water; if you correct or delete a meal in the app, it is corrected or deleted there too. We do not use this data for advertising or sell it, and it only leaves your account to the providers in section 4 when needed to provide the service (for example, to the Coach if you give permission). You disconnect it in Menu › Connections; on Android this also withdraws the Health Connect permission, and on iPhone the permission is fully removed in the iPhone Settings (Health › Data Access & Devices).
• Food: what you log (foods, amounts, calories, macronutrients and micronutrients), your recipes and water are saved in your account. With what you eat on the days you log and your weight trend, the plan adjusts your daily calories in small steps; if you don’t log enough, it adjusts with your weight alone. When you scan a barcode, only the number is looked up in Open Food Facts, without your account.
• Your recipes: if you turn on “Suggest when scanning”, when you scan a plate we suggest your saved recipes that look like it. You turn it off in Food › Your recipes.
• Location: only while you have a GPS run or bike ride in progress, including with the screen off, to measure the distance and save the route to your account. When you pause or finish, recording stops.
• Camera and photos: only when you ask for it: scanning a meal (the photo is kept for 30 days to review the recognition), your profile photo, a photo for the Coach or for sharing a workout. Photos for the Coach and meal photos are analysed with OpenAI.
• Microphone: only when you tap the mic to dictate. Your voice is converted to text on your phone and the audio is neither stored nor sent.
• The Coach uses an OpenAI artificial intelligence model to reply to you. We send it your message and what it needs from your plan and from what you log (including, if you connect Apple Health or Health Connect, your workouts and the summary of your recent days: steps, sleep, resting heart rate, heart rate variability and active calories) in order to reply; OpenAI processes it on our behalf to reply; it may keep it for up to 30 days only to prevent abuse and does not use it to train its models. We ask for your permission before the first message, with a text that names that health data (without that permission, the Coach does not receive it), and you can withdraw it in the app (Menu › Settings › Coach) or on the website (Settings › AI permission); without it, the Coach only does the basics.
• Your conversations with the Coach are saved in your account so that you have your history. To improve the Coach, the STRONNECT team may review them (only authorised people, and a record is kept of who opens each conversation and when) and use anonymised copies, without your email, your name or your identifiers, as test cases. They are deleted with your account; the anonymised copies do not identify you and are kept.
• Notifications: if you allow them, we store your phone’s notification identifier, your time zone, the language and the app version to send you the notifications you choose (for example, today’s workout; the one to log your meals only if you turn it on and haven’t logged for 2 days). You can turn them off by type in the app or in your phone’s settings.
• Performance: the apps measure how long some screens and actions take (for example, opening a session) and send us those times together with the phone model and the system and app versions. They do not include what you type or health data, and they are deleted after 30 days. If the app closes or crashes, it also sends us the type of failure and in which part of the code it occurred, without the error text or what you type; if you delete your account, those records are no longer linked to you.
• Widgets: what they show (your workout for today, your week and, on Android, your weight) is stored only on your phone to display them; it may be visible on the home screen or lock screen if you add them.
• Subscription: if you subscribe from the app, payment is handled by Apple or Google; we only receive the status of your subscription to give you access.
• Deleting your account: from the app (Menu › Settings › Delete my account) or by writing to us from your account email (how). From the app, the account is closed immediately and fully deleted after 30 days (together with the photos and your access), in case you made a mistake; until then you can ask us to restore it. Your account and your data are deleted; the web subscription is cancelled at that moment; an Apple or Google subscription is cancelled in its store.
• The apps do not use advertising, third-party analytics or cross-app tracking.

9. Policy on minors

STRONNECT has no minimum age. Under Spanish law (article 7 of Organic Law 3/2018, LOPDGDD), if you are under 14 the processing of your data requires the permission of your parent or guardian.

10. Changes to this policy

We may update this policy from time to time. We will notify you of any significant change within the app or via your registered email address.

11. Contact

support@stronnect.com