Last updated: [DATE — fill in when you publish this]
This Privacy Policy explains how PEAK Performance OS ("PEAK") collects, uses, and protects your personal data when you use this application at peak-9ae.pages.dev (the "Service"). PEAK is a personal project — it is not currently operated by a registered company.
Note to the operator (Oliver): This is a template drafted to match how PEAK is actually built. It is a starting point, not legal advice.
Oliver Suvanto Contact email: oliver.suvanto89@gmail.com Location: Finland
We are the data controller for the personal data described in this policy.
We do not collect or store your card details. Payments and subscription management are handled entirely by Stripe, Inc., our payment processor. See Stripe's own privacy policy at stripe.com/privacy.
We use your data to: - Provide and operate the Service (store and sync your training, recovery, and goal data across your devices) - Generate AI Coach responses based on a summary of your recent activity - Process your subscription payment and manage billing - Communicate with you about your account (e.g., password resets, service updates) - Improve and maintain the Service
We do not sell your personal data, and we do not use your health-related entries (sleep, recovery, weight) for advertising.
We use the following third-party services to operate PEAK. Each acts as a data processor on our behalf under their own security and privacy terms:
| Service | Purpose | Data involved |
|---|---|---|
| Supabase | Account authentication and cloud database | Account data, all app data you log |
| Anthropic (via our own server-side proxy) | Generates AI Coach responses | Your message and a summary of your recent activity — sent per request, not stored by Anthropic beyond what's needed to generate the response |
| Stripe | Payment processing and subscription billing | Payment details, billing email |
| Cloudflare | Hosting and content delivery | Standard web request data (e.g., IP address, for security and rate-limiting purposes) |
These providers may process data outside the European Economic Area (e.g., in the United States). Where they do, they rely on their own compliance mechanisms (such as Standard Contractual Clauses). You can review each provider's own privacy policy for details.
Messages you send to the AI Coach, together with a summary of your recent training, recovery, goal, and journal entries, are sent to Anthropic's API to generate a response. This happens through our own server, so your Anthropic account (if you have one) is never involved. The AI Coach is not a medical or licensed coaching professional, and its responses should not be treated as medical, nutritional, or professional coaching advice — see also the in-app disclaimer on the AI Coach page.
We keep your account and app data for as long as your account is active. If you delete your account or use the in-app "Clear all data" option, your data is removed from our systems, except where we're required to retain billing records for tax or legal purposes (typically handled by Stripe under their own retention rules).
Under the EU General Data Protection Regulation (GDPR), you have the right to: - Access the personal data we hold about you - Correct inaccurate data - Delete your data ("right to be forgotten") - Export your data in a portable format - Object to or restrict certain processing - Withdraw consent at any time, where processing is based on consent
You can exercise most of these rights directly in the app: - Settings → Export data as JSON to download a copy of everything stored on your account - Settings → Clear all data to delete your logged data - Settings → Sign out, and contact us to fully delete your account
For anything else, or if you have concerns about how we handle your data, contact us at oliver.suvanto89@gmail.com. You also have the right to lodge a complaint with your local data protection authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi).
We rely on our infrastructure providers' security measures (Supabase's Row Level Security, which ensures each account can only access its own data; Cloudflare's network security; Stripe's PCI-compliant payment handling). No system is completely secure, but we take reasonable steps to protect your data.
PEAK is intended for users aged 16 and older [adjust to your target market's legal minimum — some jurisdictions set this at 13 or 18]. If you are younger than this, please do not create an account without a parent or guardian's involvement. If we learn that we've collected data from a child without appropriate consent, we will delete it.
PEAK does not use tracking or advertising cookies. We use your browser's local storage to cache your data for faster loading; this stays on your own device and is not a tracking mechanism.
We may update this policy from time to time. If we make material changes, we'll update the "Last updated" date above and, where appropriate, notify you in the app.
Questions about this policy or your data: oliver.suvanto89@gmail.com
This document is a template and does not constitute legal advice. Review with a qualified professional before relying on it for a commercial product, particularly before selling to customers outside Finland.