Privacy Policy

Quick Summary

• What we collect — account details, contact info, subscription data, and fitness / biometric data streamed from wearables you connect (Section 1).
• Why we use it — to deliver adaptive coaching, operate the Apps, secure the platform, comply with law, and communicate with you (Section 2).
• Legal bases (EEA/UK/Canada) — consent, contract performance, legitimate interests, legal obligations (Section 3).
• Sharing — with processors who help us run the Service (e.g., cloud hosting, payment platforms), advertising and attribution partners (e.g., Meta) where you have consented, in business transfers, or when you ask us to (Section 4).
• Your rights — access, correction, deletion, portability, opt-out of marketing, and regional rights (e.g., CCPA, CPRA, VCDPA) (Sections 8–11).
• Security & retention — industry-standard safeguards; we keep data only as long as needed (Sections 6–7).
• Google Calendar — if you connect it, Kyde only touches the calendar it creates for you. It cannot see any of your other Google calendars (Section 15).
• Run clubs — if you join a club, the club's organizers see your membership and, if the club has a waiver, whether and when you signed it. A record of that signature is kept for the club for as long as the club exists, even after you leave or delete your account (Section 16).

1. What Information Do We Collect?

a) Information you give us

• Account & profile — name, nickname, e-mail, password, avatar, preferred units, date of birth (used for eligibility), and an optional Instagram handle you choose to show to your clubs.
• Run clubs — the clubs you create or join, your answers to club events, your posts and comments on a club's board, and, when a club requires a waiver, your electronic signature on it (Section 16).
• Subscription & billing — Apple / Google Play transaction IDs (payment details stay with the storefront).
• Feedback & support — messages, survey responses, beta feedback.

b) Information we receive automatically

• Device & usage — IP address, device IDs (including the iOS Identifier for Advertisers (IDFA) where you consent via App Tracking Transparency, and the Google Advertising ID on Android), OS, browser, crash logs, in-App actions (for security, diagnostics, analytics, and to measure the effectiveness of our advertising).
• Log & telemetry — time-stamps, feature use, referral URL (for product improvement). Once you are signed in, in-App analytics events carry your account id and e-mail so we can see how a feature is used; they never contain your heart-rate readings or your workout routes (Section 5c).
• Location (optional) — GPS route data for mapping & pace calculations (disable in device settings to opt-out).

c) Information from connected wearables (Sensitive / biometric)

Apple Health and Health Connect. If you allow it, the App connects to Apple Health (iOS) or Health Connect (Android). We save your completed Kyde workouts there: workout type, start and end time, distance, heart rate recorded during the workout and, for outdoor runs, the GPS route. With your separate permission, we also read workouts and related exercise data (such as heart rate, distance and routes) that you recorded with other apps or devices, so Kyde can include them in your training history and coaching. We only access the data types you approve, do not sell them or use them for advertising, and do not share them with third parties except service providers who process them on our behalf. You can revoke access at any time in Apple Health or Health Connect settings.

Bluetooth sensors. With your explicit permission we also ingest heart-rate, pace, cadence, distance, motion and related exercise metrics broadcast over Bluetooth LE. These data are used solely to generate in-workout coaching and post-workout analytics.

We do not collect data from minors and the Services are intended for users age 18+.

d) Microphone Access (Android only)

If you use the Android version of our Apps and enable voice commands, we request permission to access your device's microphone. This access is used solely for real-time speech-to-text transcription to enable hands-free interaction during workouts.

We do not record, store, or share any audio data captured via the microphone. The voice input is processed on-device or by trusted speech recognition providers solely for generating text. No audio is saved or sent to our servers.

Summary Table of Collected Information

2. How Do We Process Your Information?

• Provide the Service — pair with wearables, compute real-time zones, deliver AI voice prompts, store workouts.
• Account management — sign-up, log-in, subscription management, restore purchases.
• Customer support — respond to e-mails, bug reports, surveys.
• Research & development — aggregate, de-identify usage statistics to improve coaching models.
• Marketing — send product updates or offers, and measure the effectiveness of our advertising (you may opt out of marketing emails at any time; for advertising measurement, see Section 5).
• Legal / security — detect fraud, enforce Terms, respond to lawful requests.

We do not use your biometric data for advertising or sell it to third parties.

3. Legal Bases (EEA / UK GDPR, Canada PIPEDA)

• Consent — when you connect a wearable, enable location, join beta programs, or, in regions where the law requires it, share product analytics with us (Section 5c).
• Contract — to deliver the Services you request.
• Legitimate interests — to develop and secure our platform.
• Legal obligation — to keep tax or accounting records, comply with court orders.

You may withdraw consent at any time (see Section 8).

4. When & With Whom We Share Data

• Cloud infrastructure & analytics (e.g., AWS, Google Cloud) — hosting and data processing; PostHog — product analytics (which screens and features are used); Sentry — error monitoring; Firebase Crashlytics — crash reporting.
• Payment & app-store providers (Apple, Google) — managing subscriptions and refunds.
• AI & speech vendors (e.g., 11 Labs for TTS) — generating voice prompts; only the text of the prompt, never raw biometric streams.
• Advertising & attribution partners (Meta Platforms, Inc.) — to measure the effectiveness of our advertising on Facebook and Instagram, optimize ad campaigns, and create lookalike audiences. We share your device's advertising identifier (where you have provided consent), IP address, and a subset of in-App events (such as installs, sign-ups, completed workouts, and subscriptions). This sharing occurs only after you have completed (or declined) the App Tracking Transparency prompt on iOS. We never share biometric or precise-location data with Meta. See Section 5 for opt-out methods.
• Business transfers — an acquisition, merger, or asset sale (we will notify you).
• Legal / safety — to comply with subpoenas or protect rights, property, or safety.

All processors are bound by strict data-protection agreements.

If you reside in the EEA or UK, your data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) and additional safeguards to protect your information in accordance with GDPR requirements.

5. Cookies, App Tracking & Advertising Measurement

a) Cookies (Site)

The Site uses a small number of cookies and similar technologies:

• a region cookie, so we can show you the right cookie choice for where you are;
• the PostHog analytics cookie, set only after you accept analytics in the cookie banner;
• an attribution cookie, set when you arrive through a Kyde promo link, so the code can be applied when you sign up;
• the ChatGPT Ads measurement pixel, which tells us whether an ad on ChatGPT led to a visit or a sign-up.

You can change your choice at any time using the "Cookie settings" link in the Site footer, or by managing cookies in your browser.

b) App Tracking & Advertising Measurement (Apps)

On iOS 14.5 and later, Apple requires us to ask permission before tracking you across other companies' apps and websites. Kyde requests this permission to measure the effectiveness of our advertising on Facebook and Instagram. You can grant or deny this permission when prompted in the App, and you can change your choice at any time in iOS Settings → Privacy & Security → Tracking → Kyde.

On Android, you can opt out of personalized advertising by resetting or deleting your Google Advertising ID under Settings → Google → Ads.

Kyde uses Meta's SDK for app install attribution and ad performance measurement. With your consent (where required), Meta may receive your device's advertising identifier, IP address, and information about your activity in the Kyde App (such as installs, sign-ups, completed workouts, and purchases). Meta's data practices are described at facebook.com/about/privacy. We do not share biometric or precise-location data with Meta.

c) Analytics in the Apps

The Apps use PostHog for product analytics: which screens are opened, which features are tried, and where people stop. Once you are signed in, these events carry your account id and e-mail so that we can understand how the App is used over time. They never contain your heart-rate readings or your workout routes. Where a feature depends on where you are (checking in at a run club meeting spot, for example), the event records the outcome and the distance involved, not your position.

You choose whether to share analytics with us when you set up the App, and you can change that choice at any time in the App under Settings → Athlete Profile → Analytics. When analytics is off, the App sends no analytics events from your device.

6. Data Retention

We keep personal data only as long as necessary for the purposes described or as required by law. Workout and biometric history remain until you delete it or close your account.

Billing & Transaction Records: Retained for up to 7 years as required by tax and accounting laws.

Back-ups are purged on a rolling 30-day schedule.

Deletion Records: when an account or a club is deleted, we keep a short record of the deletion under its internal ID, with no content. For an account: when it was created and deleted, and whether it had a paid subscription. For a club: when it was created and deleted, how many members it had, which account deleted it, any reason chosen from a list, and anything the person deleting it chose to write; the club's name is kept only as long as its waiver records are. These records are not shown in the App and are kept to prevent abuse and to answer legal claims.

Club Waiver Records: if you sign a club's waiver, the version of the document you signed and the record of your signature are kept on the club's behalf for as long as that club exists on the Service and for three years after the club is deleted. This is separate from, and longer than, the 30-day backup window above. Section 16 says what the record holds and what happens to it if you delete your account.

When you delete your account, your data is removed from active systems immediately. Copies may persist in encrypted backups for up to 30 days, after which they are automatically permanently deleted. These backups are not used for routine access or processing and are automatically overwritten after the retention window.

Sensitive Personal Information (SPI)

Kyde processes sensitive personal information, such as biometric workout data (e.g., heart rate, cadence) and precise geolocation, solely to provide and improve the Service. We do not use or disclose sensitive personal information for advertising, profiling, or any purpose not permitted under California Civil Code §1798.121. California residents may exercise their right to limit the use of SPI (see Section 10).

7. Security

Kyde employs SOC-2-aligned controls: encryption in transit (TLS 1.2+), encryption at rest (AES-256), least-privilege access, routine pen-testing, and incident-response procedures. No Internet system is 100% secure; you transmit data at your own risk.

8. Your Privacy Rights

Depending on your region you may have the right to:

• access or download a copy of your data in a portable format (e.g. JSON/CSV);
• correct inaccurate data;
• delete your account and associated data;
• restrict or object to certain processing;
• withdraw consent;
• turn analytics off (in the App under Settings → Athlete Profile → Analytics; on the Site via the "Cookie settings" link in the footer);
• opt out of marketing e-mails (click "unsubscribe" in any message).

To exercise rights, e-mail privacy@kyde.ai or submit an in-App request. We will respond within the timelines required by applicable law.

We provide exports in standard machine-readable formats (e.g., CSV/JSON) covering account data, subscription history, and workout summaries. Raw biometric time-series can be included upon request.

9. Do-Not-Track

Because there is no uniform DNT standard, Kyde does not currently respond to DNT signals.

10. California Privacy (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA):

• Right to Know/Access — request disclosure of the categories and specific pieces of personal information we have collected about you.
• Right to Delete — request that we delete personal information we hold, subject to certain exceptions.
• Right to Correct — request that we correct inaccurate personal information.
• Right to Opt Out of Sale/Sharing — request that we do not sell or share your personal information for cross-context behavioral advertising. Kyde does not sell your data. We share a limited set of device identifiers and in-App events with Meta Platforms for advertising measurement (see Section 5). To opt out of this sharing, decline the App Tracking Transparency prompt on iOS, reset or delete your Google Advertising ID on Android, or email privacy@kyde.ai with "Opt-Out Request" in the subject line.
• Right to Limit Use of Sensitive Personal Information — restrict our use of SPI (e.g., biometric and location data) to only what is necessary to provide the Service.
• Right to Non-Discrimination — we will not discriminate against you for exercising your rights.

To exercise these rights, email us at privacy@kyde.ai with "California Rights Request" in the subject line or submit a request via the App.

11. Virginia Privacy (VCDPA)

Virginia residents may exercise rights of access, correction, deletion, and opt-out of targeted advertising. To opt out of targeted advertising, decline the App Tracking Transparency prompt on iOS, reset or delete your Google Advertising ID on Android, or email privacy@kyde.ai with "Opt-Out Request" in the subject line. Other rights are detailed in Section 8. Appeals may be sent to the same address; unresolved complaints may be raised with the Virginia Attorney General.

12. Changes to This Policy

We may update this Policy periodically. Material changes will be highlighted in-App or on the Site. The "Last updated" date reflects the latest revision. Continued use after an update constitutes acceptance.

13. Contact Us

14. Review / Update / Delete Your Data

To protect your privacy and security, we verify consumer requests by matching the information you provide (such as your account email, device authentication, or transaction records) with the information already on file. We may request additional information if necessary to confirm your identity.

Submit an in-App request under Settings or e-mail privacy@kyde.ai. If we deny your privacy request, you may appeal our decision by emailing privacy@kyde.ai with "Appeal" in the subject line. We will review and respond within the time required by law. If you remain unsatisfied, you may contact your state Attorney General.

When you delete your account, we permanently erase your personal identifiers and unlink them from workout data, apart from the deletion record described in Section 6. Remaining workout data is stored only in a de-identified form that cannot reasonably be re-associated with you. We may retain de-identified or aggregated workout data (e.g., GPS traces, heart rate samples) that cannot reasonably identify you, for analytics and product improvement.

One exception: if you signed a club's waiver, the club keeps its record that you agreed. On deletion we remove your name and nickname from that record; the document version, its fingerprint, the statements you agreed to, and the time are kept, as described in Section 16.

15. Google Calendar Integration (Google User Data)

Kyde offers an optional Google Calendar integration. If you connect it, Kyde creates a separate calendar named "Kyde" in your Google account and writes your planned workouts to it, so your training sits alongside the rest of your week. This section describes exactly what Kyde can and cannot see. It applies only if you choose to connect; the integration is off until you do.

a) What Kyde accesses

Kyde requests a single Google permission, https://www.googleapis.com/auth/calendar.app.created, which grants access only to calendars the app itself creates. Within that permission we access:

• the Kyde calendar — created by the app on your behalf. We store its identifier so that we keep writing to the same calendar rather than making a new one each time.
• the workout events on that calendar — we create, update and delete them as your training plan changes.
• Google authorization tokens — issued by Google so that Kyde can keep the calendar in sync without asking you to sign in again. These are held subject to the safeguards described in Section 7.

b) What Kyde cannot access

The permission does not extend to any other calendar in your Google account. Kyde cannot read, write or list your personal, work, shared or subscribed calendars, and cannot see the events on them. That boundary is enforced by Google rather than by a setting of ours: we deliberately requested the narrowest calendar permission Google offers instead of one that would have granted broader access. Kyde also does not request or receive your Google contacts, Gmail, Drive files, or Google profile data beyond what is needed to complete sign-in.

c) Why we use it

Solely to project the planned workouts from your Kyde training plan onto a calendar you can see in Google Calendar. We do not use Google Calendar data for advertising, to train AI or machine-learning models, or for any purpose unrelated to showing you your own training schedule.

d) How long we keep it, and how you remove it

• You can disconnect at any time in the App under Settings. On disconnect we delete the stored Google authorization tokens and stop syncing.
• The Kyde calendar belongs to your Google account, not to us. It and its events remain until you delete them in Google Calendar.
• You can also revoke Kyde's access directly from your Google account at myaccount.google.com/permissions.
• Deleting your Kyde account removes the stored tokens along with the rest of your personal data (Section 14).

e) Limited Use

Kyde's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We do not sell Google user data, do not use it for advertising, and do not allow humans to read it except where you have given specific consent, where it is necessary for security purposes or to resolve a support issue you have raised, or where we are required to by law.

16. Run Clubs and Club Waivers

Run clubs and other groups on the Service ("Clubs") are operated by independent organizers, not by Kyde. This section describes what Kyde collects and shares when you take part in one.

a) What a Club's organizers can see

When you join a Club, its organizers can see that you are a member, the name and nickname on your account, your avatar, the Instagram handle you have chosen to show (if any), when you joined, your answers to the Club's events, your check-ins, and anything you post on the Club's board. If the Club has a waiver, organizers can also see whether you have signed the current version and when. Organizers are independent of Kyde and are responsible for their own handling of this information.

b) Club waivers

A Club may upload its own waiver as a PDF and require members to sign it in the App. Kyde displays the document exactly as the Club uploaded it and does not draft, review, or interpret it. Nothing in the document is filled in by you, and Kyde does not collect medical or health information through a club waiver. When you sign, Kyde records:

• your account, the Club, and the version of the document;
• a fingerprint of the file, so the exact document you saw can be identified later;
• the first name, last name, and nickname on your account at the moment of signing;
• the agreement and consent statements shown to you; and
• the time of your signature.

We then e-mail a copy of the document, exactly as uploaded, to the e-mail address on your account, and note when that e-mail was handed off for delivery. Kyde does not produce a signed copy of the document.

c) How long we keep the signing record, and why

The signing record and the document version it refers to are kept on the Club's behalf for as long as the Club exists on the Service and for three years after the Club is deleted, and are then deleted. The three years exist so that deleting a Club cannot destroy the record while a claim could still be brought. They are kept if you leave the Club, are removed from it, or delete your Kyde account. If you delete your account, we remove your first name, last name, and nickname from the record; the document version, its fingerprint, the statements you agreed to, and the time remain, so that the Club keeps its proof that the account agreed. We keep this record because it is what the Club relies on to establish, exercise, or defend a legal claim, which is a recognized exception to the right to erasure (for example, Article 17(3)(e) of the GDPR and California Civil Code §1798.105(d)).

d) Club organizers

If you create or administer a Club, Kyde also records your acceptance of the Club Organizer Terms — your account, the Club, the version you accepted, and when — for as long as the Club exists.