Privacy Policy

Last updated: 10 October 2026

1. Who runs PeakD

PeakD (peakd.pro) is operated by Tomasz Skalski, an individual based in Poland (EU). PeakD is not yet a registered company. For any question about your data — including export, deletion, or correction requests — write to hello@peakd.pro.

PeakD is in beta. Features and processors listed below may change as the product matures; we will update this policy when they do.

2. What we collect

Only the data you give us, plus what is technically necessary to serve the page.

• Account: your email address, received from Google when you sign in with your Google account. There is no password — we never see or store one.
• Profile: name, age, gender, your selected coach, and fitness baselines you choose to enter (starting body weight, body-fat %, muscle %, max push-ups, max pull-ups, max plank seconds).
• Training data: the workout plans you create, the sets you log (reps, weight, optional notes), weekly check-ins, and any body-metric updates you add.
• Subscription (only if you subscribe to PeakD Coach): the identifiers Stripe gives us for your customer record and subscription, the subscription's status (for example active or cancelled), and the date the current period ends. That is all we keep — your card details, billing address and payment history stay with Stripe and never reach our servers.
• Technical: standard server request logs on our API endpoints (IP address, user agent, timestamp). These are kept by our hosting provider for short-term operational purposes only.

We do not collect: location, card or bank details, advertising identifiers, or any data we don't explicitly list above.

3. Why we process it

• To build personalised training plans for you. All three plan-building surfaces — creating a new plan, your end-of-block coach review, and the block that follows it — run on our own servers by a rule-based engine, with no AI call and no transfer to any AI provider.
• To sync your data across the devices you sign into.
• If you subscribe: to know whether your subscription is active, so the paid coaching features are switched on for you.
• To operate the site (hosting, anti-abuse rate limiting, error diagnosis).

4. Legal basis (GDPR)

We rely on two bases:

• Performance of a contract (GDPR Art. 6(1)(b)) — most processing is what we need to do to actually deliver the coaching service you signed up for.
• Consent (GDPR Art. 6(1)(a)) — given when you create your account. You can withdraw it at any time by deleting your account (see §7).

The fitness metrics you enter (weight, body composition, exercise baselines) are not processed as health data under GDPR Art. 9 — they are training inputs, not medical records, and PeakD is not a medical device.

5. Who else sees your data (sub-processors)

To run the service we use a small number of third-party providers. Each only sees what they need to do their job, and each is contractually bound to keep it confidential.

• Vercel Inc. (United States, with EU regions available) — hosting and serverless function execution. Sees standard request metadata (IP, user agent, route).
• Supabase (EU region) — authentication (via Google sign-in) and primary database. Stores your account, profile, and training data. Also serves the exercise photos and videos, which contain no personal data.
• Stripe (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., United States) — only if you subscribe. Stripe runs the checkout and sells the subscription to you as the seller of record: it collects your payment details, billing address and email directly, charges and refunds you, calculates and pays VAT, and sends your receipts. For that part Stripe decides how your data is used, under its own privacy policy. We receive back only the subscription details listed in §2.

We do not sell your data, share it with advertisers, or use it for marketing.

6. International transfers

Your data is stored in EU regions (Supabase). However, several of our providers are US companies, so some transfer of data outside the EU takes place. The legal basis differs by provider:

• Supabase — data is stored in an EU region, but Supabase, Inc. is a US company and may transfer data to the US. This relies on EU Standard Contractual Clauses in their data processing addendum.
• Vercel — certified under the EU-US Data Privacy Framework (including the UK Extension and Swiss-US DPF).
• Stripe — Stripe, Inc. is certified under the EU-US Data Privacy Framework and also relies on EU Standard Contractual Clauses.

7. Your rights

Under GDPR you can, at any time:

• Access and export your data. Sign in, open /account, and click "Export my data (JSON)" — you get the full dump as a downloadable file, instantly.
• Correct your data. Edit your profile inside the app at any time.
• Delete your account and everything in it. Go to /delete-account (or open /account and click "Delete account"), sign in, and confirm. This wipes every plan, workout, check-in and your auth record — across every device you have ever signed in from, not just the one you are using. There is no soft-delete and no grace period: the account is gone as soon as you confirm. Two narrow exceptions apply, and we spell them out in §8 rather than hiding them.
• Restrict or object to processing — write to hello@peakd.pro.
• Lodge a complaint with a supervisory authority. For Polish users, that is the UODO (Urząd Ochrony Danych Osobowych).

8. How long we keep your data

• Active account — we keep your data for as long as your account exists.
• Deleted account — your plans, workouts, check-ins, profile, and auth record are erased from our database the moment you confirm deletion. One exception:
  • Backups (up to 14 days). We take a nightly backup of the database so a technical failure can't destroy everyone's training history. Your data therefore also sits in those backups, and deleting your account does not reach into them. Each backup is deleted on a rolling 14-day cycle, so a deleted account is gone from our backups within 14 days at the latest. Backups are used only to restore the service after a failure — never to bring an individual account back.
• Payment records — if you subscribed, deleting your PeakD account cancels the subscription straight away, and our copy of the subscription details goes with the rest of your account. Stripe, as the seller, keeps its own record of your purchases for as long as tax and accounting law requires.
• Sub-processor backups — our providers run their own disaster-recovery backups on their own schedules (typically 7–30 days, rolling).
• Server request logs — kept short-term by Vercel for operational diagnosis, then aged out.

9. Security

Data in transit is encrypted (HTTPS everywhere). Authentication uses Google sign-in via Supabase — there is no password for us to store or for anyone to phish. Database access is restricted by row-level security so only you can read your own rows. API endpoints rate-limit aggressive clients.

No system is bullet-proof. If we become aware of a breach affecting your data, we will notify you and the relevant supervisory authority as required by GDPR Art. 33–34.

10. Children

PeakD is not directed at children. You must be at least 16 years old to create an account. If you believe a child has registered, write to hello@peakd.pro and we will delete the account.

11. Cookies and tracking

PeakD does not use advertising cookies, and we do not run any third-party analytics or tracking product — there is no Google Analytics, no advertising pixel, and no cross-site tracker of any kind. The app stores a small amount of data in your browser's localStorage so it can work offline and remember which plan you're on — this never leaves your device unless you choose to sync it via cloud sign-in.

12. Changes to this policy

When we change how we handle data, we update the "Last updated" date at the top and, for material changes, show signed-in users an in-app notice before the change takes effect.

13. Contact

Privacy questions, data-subject requests, breach reports: hello@peakd.pro.