Courtesy translation. In case of any discrepancy, the Spanish version is the legally binding one.
Privacy Policy
Last updated: November 4, 2026 · Version 1.4
1. Controller
The controller is LoGua Labs LLC ("LoGua KLK"), a limited liability company organized in the State of Florida, USA (registration No. L26000334382; principal office: 7901 4th St N, STE 300, St. Petersburg, FL 33702). Privacy contact: [email protected].
2. Data we process
Account data (name, email, Google or Apple sign-in, or password hash), sports data you import or authorize (activities, power, heart rate, GPS, FIT/GPX/TCX/CSV files, wellness/recovery), athletic profile data, photos you upload to your activities (we strip EXIF/GPS metadata on the server) and technical/usage data. Payments are handled by Stripe, Inc. (USA) as a processor; we do not store your card details. Heart rate, HRV, sleep, weight, VO₂max, SpO₂ and respiratory rate are health data, processed with your explicit consent.
Phone health data (Apple Health and Health Connect). Only if you authorize it on the device itself, the app reads Apple Health (HealthKit) on iPhone and Health Connect on Android: resting heart rate, HRV, sleep, weight, VO₂max, oxygen saturation (SpO₂) and respiratory rate; on iPhone, also steps. We only read: we never write to those apps. We read the last 7 days and send those readings, encrypted, to our servers, where they fill in your history with what your other sources do not provide.
We use them to show you your recovery metrics, estimate your daily readiness and adjust your plan; our AI provider processes them to generate it (section 4). These readings are for you alone: they are not shown to other athletes. Your power-to-weight ratio comes from the weight in your profile, not from the one the phone reads. We do not use these readings for advertising or marketing, we do not sell them or transfer them to data brokers, and we do not use them for employment, insurance or credit decisions.
You can withdraw permission at any time, in Health Connect → App permissions or in Health → Profile → Apps. We stop reading, and what we already received stays in your history until you delete your account or ask us to erase it at [email protected].
3. Purposes and legal basis
Providing the service and calculating your metrics and plans (performance of the contract); connecting your data sources and sending you communications (consent); security and legal compliance (legitimate interest / legal obligation).
4. Artificial intelligence
We send data from your account to our AI provider — currently Anthropic PBC (Claude), USA — only to generate your plan (per-user inference). We do not train or fine-tune models with your data; the provider operates without training retention and acts as a processor under its privacy policy. Strava data is excluded from AI processing. Recommendations do not constitute medical advice.
5. Recipients
We share data, only as necessary, with the AI provider, hosting/infrastructure, the payment gateway (Stripe, Inc.), the email provider, analytics (if applicable) and the connectors you authorize. We do not sell your data.
6. International transfers
We process data primarily in the USA. For users in the EEA, the United Kingdom and the Dominican Republic we apply appropriate safeguards (e.g. Standard Contractual Clauses).
7. Retention and deletion
We keep your data while your account is active. When you disconnect a connector you decide whether to keep what was imported; Strava data is always deleted, because its API requires it. Withdrawing the Apple Health or Health Connect permission stops the reading but does not erase what we already received. You can delete your account at any time. Exceptionally we may retain specific data when a legal obligation requires it (e.g. tax or court requirements, or fraud investigation), only for the legally necessary period. Requests: [email protected].
8. Your rights
GDPR (EEA/UK): access, rectification, erasure, restriction, portability, objection and withdrawal of consent. USA (CCPA/CPRA and state laws): to know, access, correct, delete and opt out of sale/sharing — we do not sell. Dominican Republic (Law 172-13): access, rectification, objection, erasure and habeas data.
9. Security and breaches
Encryption in transit (TLS) and at rest, access control and secure secrets management. We notify breaches in accordance with the FTC Health Breach Notification Rule, state laws, the GDPR and Law 172-13.
10. Minors
The service is not directed to children under 16 and we do not knowingly collect their data.
11. Changes
We may update this policy; we will notify material changes. Contact: [email protected].
LoGua KLK is a service of LoGua Labs LLC, a limited liability company organized in Florida, USA (registration No. L26000334382 · 7901 4th St N, STE 300, St. Petersburg, FL 33702). This is a courtesy translation of the current Spanish text, which is the binding version; both may be updated. Questions: [email protected].