Privacy Policy

1. Introduction

Synka is a mobile app for ultra-personalized running coaching. Training plans adapt to your physiological profile (age, heart rate, performance history, training load, recovery capacity), to the recovery signals from a connected watch or health platform if you link one, and, for users who choose to, to their menstrual cycle.

This policy explains, clearly and transparently, how we collect, use, store, and protect your personal data.

Synka is currently in beta. The project is in the process of being incorporated as a company. This policy will be updated upon the company's official formation.

Data controller contact: Synka, company in formation Email: hello@synka.fit

2. What data we collect

2.1 Identification data

• Email address
• Password (stored hashed and secured)
• Username (optional)
• Declared gender (used to adapt the interface and features)

2.2 Physiological and health data

• Age / year of birth
• Maximum heart rate (HRmax)
• Resting heart rate
• Recovery signals from a connected watch or health platform (optional): heart-rate variability (HRV) and resting heart rate measured overnight, used only to gauge your recovery capacity and training readiness. Sleep is not read today.
• Menstrual cycle data (optional): period dates, reported pain, energy levels, cycle phase

Menstrual cycle tracking is entirely optional. You can use Synka without providing this data. If you enable cycle tracking, the data collected is treated as health data under Article 9 of the GDPR and is subject to enhanced protection. If you enable it, Synka can also read your period entries from Apple Health, only when you switch this on in the app (off by default). If you connect Garmin Connect and allow it, Synka can likewise read the cycle data you log there.

2.3 Training data

• Running sessions: distance, duration, pace, elevation
• Heart rate during effort (average and maximum)
• Estimated calories
• Session start location (latitude, longitude)
• GPS track of the session (encoded polyline)
• Personal notes

2.4 When we record your location

Location is recorded only while a run you started is in progress, and only to measure that run: its distance, its pace and its track.

• While a run is active, recording continues when your screen is locked or when you switch to another app. Without this, your kilometres would stop being counted the moment you put your phone in your pocket.
• Recording stops as soon as you pause or finish the run. Synka does not track your location between sessions, at any time, for any purpose.
• We never use your location for advertising, and we never sell it or share it with data brokers.
• You can revoke location access at any time in your phone's settings. Synka keeps working without it: you can still log your sessions by hand, only the automatic track and distance are lost.

2.5 Data from connected devices and third-party platforms

Synka can connect, only with your explicit authorization, to third-party fitness and health platforms in order to read your training and recovery data:

• Watch & health platforms: Apple Health (HealthKit), Google Health Connect, and the COROS, Suunto and Garmin Connect watch platforms if you connect them. Other watch brands may be added later; each connection requires your explicit authorisation

From these sources, and only for the categories you authorize, we may read:

• For a watch platform, an authentication token: for COROS, stored in your phone's secure keychain and never on our servers; for Suunto and Garmin Connect, stored on our servers in a table no user can read, and deleted when you disconnect
• Running activities: distance, duration, pace, elevation, heart rate
• Recovery metrics: heart-rate variability (HRV) and resting heart rate measured overnight

Our commitments for this data, including any data obtained from Apple Health / HealthKit and the other platforms listed above:

• We use it solely to provide and improve your running coaching: to personalize your plan and estimate your recovery capacity and readiness.
• We never use it for advertising, marketing, or any use-based data mining.
• We never sell it, and never disclose it to third parties for advertising or data-broker purposes.
• We access it only with your explicit consent, which you can revoke at any time from Synka's settings or directly with the platform.
• We delete this data at your request or when you delete your account.

Where a platform imposes additional terms on how its data may be used (for example Apple's HealthKit terms), we honor those terms in full.

2.6 What you write to us

• The feedback you send from the app, stored with your account in our own database so we can read it and answer

3. Why we use your data (purposes)

Your data is processed solely to:

1. Provide the coaching service: generate a personalized training plan adapted to your physiological profile (age, heart rate, performance) and, where applicable, to your cycle phase
2. Analyze your performance: calculate your estimated VO2max, your training load (ATL/CTL/TSB), your personal records
3. Improve the service: research and development of our training algorithms (on anonymized data only)
4. Contact you: send notifications about your activity (only with your consent)

4. Legal basis for processing (Article 6 GDPR)

You may withdraw your consent at any time from the app settings or by contacting us.

5. Who we share your data with (processors)

We never sell your data. We share it only with technical providers necessary to operate the service:

5.1 Supabase (database hosting)

• Company: Supabase Inc.
• Data location: European Union (EU-West region)
• Compliance: GDPR, SOC 2, ISO 27001
• Important note (beta phase): Synka is currently in beta. At this stage, your data is hosted on Supabase, which is not certified as a Health Data Host (HDS) under French law. A migration to an HDS-certified host is planned before commercial launch. By using the beta version, you acknowledge and accept this transitional situation.

5.2 Apple (TestFlight invitations)

When you enter your email on synka.fit to join the beta, we send that email to Apple's App Store Connect so that Apple can invite you to TestFlight. Apple Inc. (United States) then processes it under its own terms. We keep no copy of that email outside of Apple's tester list.

No generative AI service receives your data: the virtual coach that existed in earlier versions has been removed, and none of your data is sent to an AI provider.

5.3 Connected devices and health platforms (optional)

Apple Health (HealthKit), Google Health Connect, COROS, Suunto, Garmin Connect, and other watch platforms as they are added:

• Connection only if you explicitly authorize it, category by category
• We read your activity and recovery data via their official APIs (or the device's on-phone health store)
• For Suunto and Garmin Connect, we can also send your planned sessions to the platform, so you can follow them on your watch
• This data is used only to run your coaching, never for advertising, never sold, never mined (see section 2.5)
• You can revoke access at any time from Synka's settings or directly with the platform

6. How long we keep your data

6.1 Anonymization upon deletion

When you delete your account: 1. Your identifying personal data (email, name, watch-platform identifiers) is deleted immediately 2. Your training and cycle data is anonymized: we remove any link to your personal identity, keeping only aggregated values in a format that allows no re-identification 3. This anonymized data is retained for up to 3 years for:

• Research and improvement of our training algorithms
• Development of artificial intelligence features (profile clustering, personalized recommendations)

Truly anonymized data falls outside the scope of the GDPR and is no longer considered personal data.

7. Your rights

In accordance with the GDPR, you have the following rights:

• Right of access: obtain a copy of your data
• Right to rectification: correct inaccurate data
• Right to erasure ("right to be forgotten"): delete your account and your data
• Right to restriction of processing
• Right to data portability: receive your data in a structured format
• Right to object to processing, including profiling
• Right to withdraw your consent at any time
• Right to lodge a complaint with the CNIL (www.cnil.fr) or your local data protection authority

To exercise these rights:

• In the app: Me → Privacy and your data (delete your account); a data export is coming, in the meantime write to us
• By email: hello@synka.fit
• Maximum response time: 1 month

8. Security

We implement the following technical and organizational measures:

• Encryption of data in transit (HTTPS/TLS 1.3)
• Password encryption (bcrypt)
• Watch-platform tokens kept in your phone's secure keychain, never on our servers
• Hosting on certified infrastructure (Supabase, ISO 27001 / SOC 2)
• Daily automatic backups
• Data access limited to strictly necessary personnel

In the event of a data breach affecting your rights, we undertake to notify you within 72 hours in accordance with the GDPR.

9. AI Transparency Statement

Synka uses artificial intelligence technologies and automated algorithms. This section clearly describes how they work.

9.1 Current algorithms (deterministic, non-AI)

Most of Synka's features rely on deterministic algorithms (non-AI):

• Generation of the personalized training plan based on physiological profile and, where applicable, cycle phase
• Estimated VO2max calculation (HR-based formula)
• Estimation of your fitness age and adjustment of hard-session spacing to your recovery capacity (based on published VO2max age-reference norms)
• Calculation of TSS, ATL, CTL, TSB (standard scientific methods)
• Detection of menstrual cycle phases
• Matching of imported sessions (Apple Health, Google Health Connect, COROS, Suunto, Garmin Connect) with planned sessions

The user's age is used to calibrate several calculations: HRmax estimation (220 − age formula), training-load adjustment, and adaptation of recommendations to the user's age range.

These algorithms are based on published, reproducible scientific formulas. They are not considered artificial intelligence in the strict sense.

9.2 No generative AI today

The app contains no large language model and no chat. Every plan decision comes from the deterministic rules above, and each one is written down in the app with its reason, so you can read it and refuse it.

9.3 Chrono forecast: an AI model, on your phone

The chrono forecast ("what you will be worth on race day") uses Chronos-2, an artificial intelligence model for time-series forecasting. It runs on your phone: your runs are not sent to any AI service. It is used only to compute your own forecast and is never trained on your data.

Garmin Connect runs: they are used in this forecast only with your explicit consent, given in the app (switch "Chrono forecast with my Garmin runs", off by default). You can withdraw it at any time in the same place: your Garmin runs then stop being used by the forecast.

9.4 Future developments (automated profiling and AI personalization)

We plan to develop more advanced AI features over time:

• User profile clustering: grouping similar profiles to optimize recommendations
• Predictive personalization: automatic plan adaptation based on your history and age range
• Pattern detection: identifying trends in your performance

These features constitute automated profiling within the meaning of Article 22 of the GDPR. Before their deployment:

• We will inform you explicitly
• You will need to give specific consent to enable these features
• You may object at any time without losing essential functionality
• A human decision will always remain possible (intervention by a human coach)

9.5 Data used to improve our AI

Anonymized data from deleted accounts (see section 6.1) may be used to train and improve our future AI models. As this data is anonymized, it cannot be traced back to you personally. Data received from Garmin Connect, and anything derived from it, is excluded: it is never used to train, evaluate or improve any AI model.

10. Minors

Synka is intended for adults (18 and over), of any gender. If you are under 18, you must obtain the consent of your legal guardian before using our services. For users between 15 and 18, under French law, parental consent may be required in certain cases.

If we discover that an account belongs to a minor without parental consent, we will delete the data.

11. Cookies and trackers

Synka is a mobile application and does not use cookies in the traditional web sense.

We currently use no third-party behavioral analytics tools (no Google Analytics, Mixpanel, Amplitude, PostHog, etc.).

If we integrate any in the future, this policy will be updated and your consent will be requested.

11.1 Usage measurement inside Synka

To know how many people use Synka and whether the project is worth continuing, the app records a small number of product events in our own database, hosted in the European Union (Supabase, Paris region). No third-party tool receives them.

• The events are: first launch of the app, the app being opened, the name of the screen you view (for example “plan” or “stats”, never what it shows), onboarding completed, first plan created, a run started or saved (guided, free or custom), a session entered by hand, the daily check-in done, a plan suggestion accepted or declined (and its kind), an explanation chapter read, a price survey shown and your answer, a subscription screen shown, a purchase, feedback sent from the app, an invitation shared, the App Store review prompt shown, and a strength session opened or finished.
• First launch is recorded without any identifier. The other events are linked to your account, with the app version and the type of phone.
• They never contain health data, cycle data, location or the content of your runs: they say what you did in the app, never how far, how fast or how you felt.
• If you answer the optional question How did you hear about Synka? during onboarding, your answer is stored in your profile.
• Legal basis: our legitimate interest in measuring the use of our service (Article 6(1)(f) GDPR). You can object at any time by writing to hello@synka.fit. All of this is deleted with your account.

11.2 Error reports

When the app crashes or an operation fails, it sends an error report to the same database, so we can fix the problem without waiting for you to tell us. A report contains the error message, the technical trace, the name of the screen, the app version and the type of phone, linked to your account when you are signed in. It never contains health data, cycle data or location. Reports are kept for 12 months at most, deleted with your account, and rest on the same legal basis (our legitimate interest in keeping the service working).

11.3 Short links on synka.fit

When you open a short link such as synka.fit/t, we count the visit before sending you on: the name of the link, an invitation code if the link contains one, the type of phone (iOS, Android or other) and the date. We store no IP address, no cookie and no identifier, so a visit cannot be traced back to you.

12. Changes to this policy

We may modify this privacy policy. In the event of a material change, we will notify you by email and in the app at least 30 days before it takes effect. At that point you may refuse the new terms and delete your account.

13. Contact

For any question about this policy or your personal data:

• Email: hello@synka.fit

You may also contact the CNIL (French data protection authority):

• Website: www.cnil.fr
• Address: 3 Place de Fontenoy, 75007 Paris, France
• Phone: +33 1 53 73 22 22

This privacy policy is written in English. Synka operates primarily under French and EU data protection law (GDPR).