Privacy Policy

From signing in

• An Apple identifier. Sign in with Apple gives the app a stable identifier for your account. It is not your Apple ID and cannot be used to sign in anywhere else.
• Your name and email, if Apple sends them. Apple provides these once, on the first authorisation, and never again. If you use Hide My Email, we only ever see the relay address.
• A Google identifier, your name and your email, if you sign in with Google. Google sends them with every sign-in. We ask for nothing else, and we do not keep your Google profile picture or any of the tokens Google issues for the sign-in.
• Apple's sign-in token, encrypted, if you sign in with Apple. We keep it for one purpose: to revoke Groundwork's access to your Apple sign-in at Apple when your account is deleted.
• A session for each device you sign in on: a random token (stored only as a hash), the name your device or browser reports for itself, and when the session was made and last used. It ends 90 days after its last use, or when you sign out. Your IP address is not stored with it.

What you enter

• First name, date of birth, height and gender, asked once when you start, together with how often you train, which you can skip.
• Optional details you can add in Settings: a surname, your goals, how you like to be coached, your units, areas of focus, limitations or injuries, a target weight, the name of your gym, when you started training, your maximum heart rate, and free-text notes to the coach.
• A profile photo, if you add one.
• Your training: exercises, weights, repetitions, dates, notes and plans, your gyms and the equipment you say they have, and exercises you create.
• Events you record, such as an illness or a trip; your recovery check-ins (soreness and energy); and areas of your body you mark as protected.

Apple Health — only if you allow it

The iPhone app asks iOS for permission before it reads anything from Apple Health. If you grant it, the app reads:

• sleep: how long, the stages (deep, REM, core, awake) and when
• heart rate variability
• resting heart rate
• heart rate during your workouts
• blood oxygen
• VO2 max
• steps
• active and resting energy
• body weight
• your workouts: the type, when they started and ended, how long, the energy, and the distance walked, run or cycled

It reads the last 90 days first, then new data as it arrives, and uploads it to the server, where it is stored with your account.

If you wear an Apple Watch, it sends your heart rate to the server while a workout runs and the energy it measured once the session has ended, and it saves the finished session to Apple Health, where it counts toward your rings.

Groundwork uses this to judge how recovered you are and to set your heart-rate zones and rest timer. Part of it also goes to AI models (see Where your data goes and Your agreement to AI processing).

Permission is optional, and logging and history work without it. You can withdraw it at any time in iOS Settings, and Groundwork stops reading at once. What was already stored stays until you delete your account.

Notifications: only if you allow them

Rest alerts are scheduled on your iPhone itself and never pass through the server. Besides them, the coach may send one message when you have been away from training for a while, and for that the server stores, for each iPhone you are signed in on, the push token Apple issued the app there and the phone's time zone, so the message arrives in your own evening or at the hour you usually train.

• At most one message each time you have been away, from seven days without a session and once the gap is longer than usual for you. It is not sent if you recorded an illness or a trip covering that time, if Apple Health shows workouts during it, or if you already saw the coach's message in the app.
• No numbers and no health data in it. It lands on your lock screen, so it is one line saying your next session is ready when you are, and whether it starts lighter.
• A record of each message stays with your account: when it went, what it said, and whether Apple accepted it, so that it is never sent twice.
• You can turn it off in Settings → Coach, or turn off notifications for Groundwork in iOS Settings.

Your conversations with the coach

Messages you exchange with the coach are kept for 24 hours after the last one and then expire. Each message is sent to an AI model so that it can reply. To make the coach quicker, a text summary of your training is kept for up to 1 hour and the coach's daily greeting for up to 24 hours.

Separately, the coach keeps short durable notes about you, things worth remembering between conversations. It can save one by itself when you tell it something that will still matter next week. You can ask the coach to forget a note: its text is then deleted from our database at once. Backups can still hold a copy, as described under How long it is kept. There is no screen in the app that lists these notes for every account; email us for a copy.

What the server records by itself

• Request logs. Every request to the server is logged with the IP address it came from, the name your device or browser reports, what was asked for and when. Logs are deleted automatically after at most 30 days.
• A copy of the logs for monitoring. The server's monitoring tools keep a copy of the server's logs, on the same server, for 28 days, so that a fault can be found and fixed. Before a line is copied, every IP address in it is shortened: an IPv4 address ends in 0 instead of its last number, and an IPv6 address keeps only its first three groups.
• Counts and timings. The same tools record how the service is doing: how many requests the server answered and how fast, how many accounts exist, how much AI was used and what it cost in total, and how full the server's memory and disk are. None of it is about one person.
• AI usage records. For each call to an AI model: which feature made it, which model answered, how many tokens it used, what it cost, how it ended and when, under a keyed hash of your internal account number. They are used to limit and account for AI spending.
• Your agreements. For each answer you give to the questions below: which agreement, yes, no or withdrawn, the version of the text you saw, the date and the app you used.

The coach, your written analysis and the short notes Groundwork writes for you come from AI models. The website asks for your agreement to AI processing: during first run for a new account, and in front of the app at your next visit for an account made before the question existed. The two answers are Agree and Continue without AI.

Your answer is recorded, whichever it is. You are asked once, and you can change your answer at any time in Settings → Privacy.

You can change your answer in Settings → Privacy on the website.

What this does today. The server does not yet refuse AI calls for an account that said no or withdrew its agreement: your answer is recorded, but the coach can still be answered and work the server does on a schedule for your account, such as the weekly written analysis, goes on. Deleting your account (Settings → Account) takes it out of that scheduled work at once.

The public pages of groundwork-sports.com, the sign-in and invitation pages and the web app at app.groundwork-sports.com ask whether they may measure how they are used, with Google Analytics. Until you agree, they load nothing from Google for this. The page you open from the waiting list's confirmation email loads nothing from Google at all, whatever you answered.

This page and the Terms load nothing from Google.

If you are not signed in, your answer is kept in a cookie in your browser and nowhere else: Groundwork keeps no record of it on its server.

If you are signed in, your answer is also recorded with your account, like your other agreements, and holds in every browser you sign in with. An answer you gave in your browser before you signed in is recorded when you sign in. If the two answers differ, the web app and the sign-in pages load nothing from Google until you settle it in Settings → Privacy. The public pages go by your browser's answer alone.

You can change your answer under Cookie settings at the foot of the public pages and the sign-in and invitation pages, or in Settings → Privacy once you are signed in. When you withdraw, the website deletes the Google Analytics cookies from your browser and stops loading it.

• Groundwork does not track you across other apps or websites. The only analytics is Google Analytics on the website, and only if you agree to it (see Your agreement to analytics); the iPhone app has no analytics service.
• No advertising and no advertising identifiers, and no ad or tracking SDKs in the apps.
• No location. Groundwork never asks for it.
• Your data is never sold, rented or shared for marketing.

You can ask for a place on the waiting list on groundwork-sports.com with your email address. Groundwork sends one message to that address with a link to confirm it. Until you press the link, your address is stored in no database and no log of Groundwork's, and you are on no list.

The link works for seven days. When you press it, your address is added to the waiting list at Resend, with the date you asked, the date you pressed the link and the version of the text you saw when you asked.

We use the list to write to you once, on the day Groundwork opens.

To stop one address from being mailed again and again, Groundwork keeps a one-way fingerprint of the address, not the address itself, for 15 minutes. To stop one connection from asking over and over, it counts the requests that come from one IP address for 5 minutes.

To leave the list, or to have your address deleted, email [email protected].

A place on the waiting list is kept until you ask for it to be removed. A confirmation link that is not used stops working after seven days, and the address it was for is never added to the list.

Google Analytics keeps what it received for 14 months. Reports of totals that identify nobody are kept without that limit.

Your data stays while your account exists. Coach conversations, the summary and the greeting expire on their own, as described above.

A phone's push token is kept only as long as the session that registered it. Signing out ends the session and removes the token. If the phone was offline when you signed out, the token goes once someone signs in on that phone again with notifications allowed: at once if it is you, within the hour if it is someone else. Ending that session from another device, or deleting your account, removes it too.

You can delete your account in Settings → Account. It signs you out on every device at once, and deletion takes effect after a 30-day grace period: signing in again during that window and choosing Keep my account restores it.

After the grace period your account and everything attached to it are removed from our database and caches: profile, training history, Health data, avatar, coach notes, conversations, your record of agreements, and your sign-in. This is not recoverable from the live system.

Backups are the exception. Nightly copies of the database are deleted after 14 days. Our hosting provider also keeps seven daily backups of the whole server, rotating: the oldest is deleted when a new one is made. Snapshots of the whole server taken by hand stay until they are deleted. A deleted account can sit in any of these copies until it is deleted. Request logs are not edited when you delete your account either: they expire on their own, within 30 days.

One kind of record is kept after deletion on purpose, and we would rather say so than not. The AI usage records described above are kept after deletion, with no end date yet. They carry no name, no email and no account number, only the keyed hash, and once backups have aged out nothing we keep connects it to you.

If you ever agreed to analytics, deleting your account also makes Groundwork ask Google Analytics to delete what it holds under your pseudonymous identifier. The request carries that identifier and nothing else about you, and Google carries it out under its own terms. What Google Analytics received before you signed in, under the random identifier in your browser's cookie, is not part of that request: it stays until it expires, 14 months after it was sent.

• All traffic runs over HTTPS.
• The database enforces per-account isolation at the row level, so one account's queries cannot reach another's data even if application code were wrong.
• Credentials we hold for outside services and Apple's sign-in token are stored encrypted, and session tokens only as hashes.
• Logging in to the server needs a key; passwords are switched off.

No system is perfectly secure. Groundwork is built carefully, and that is a different claim from being invulnerable.

• See it. Your profile and your training history are visible in the app.
• Correct it. Profile details are editable in Settings.
• Delete it. Settings → Account, as described above.
• Withhold Health data. Decline the permission, or revoke it later in iOS Settings.
• Change your answer on AI processing. Settings → Privacy on the website, as described above.
• Change your answer on analytics. Cookie settings, or Settings → Privacy on the website, as described above.
• Stop the message when you are away. Settings → Coach, or turn off notifications for Groundwork in iOS Settings.
• Ask. Email [email protected] for a copy of your data or with any question about it.

If you are in the EU or UK, data protection law gives you rights of access, correction, erasure, restriction, objection and portability. The controller is Groundwork Sports UG (haftungsbeschränkt), reachable at the address above.

Groundwork is not intended for children under 16 and is not directed at them.

Groundwork is currently invite-only and in active development. Features change, and while data is not deleted casually, this is beta software and should not be your only record of anything you would be sorry to lose.

If what we do with your data changes, this page changes with it and the date at the top moves.