⚠️ Draft scaffold — not legal text. This page is a placeholder that lists the sections and points real counsel needs to cover. Do not ship it as-is. Replace each section with lawyer-reviewed copy before any public launch or app-store submission.
Last updated: [DATE — replace before launch]
Who we are
TrainPlan is operated by [COMPANY NAME], registered at [REGISTERED ADDRESS], company number [NUMBER]. You can reach our data team at privacy@trainplan.app.
What this policy covers
This policy explains what information we collect when you use the TrainPlan mobile app or visit this website, how we use it, who we share it with, and what rights you have over it. It doesn’t cover third-party services you connect to TrainPlan (Garmin, Polar, Strava, Apple, Google) — those have their own policies and we link to them from the relevant setting.
What we collect
[TODO: list by category — account details, training data, device data, usage analytics, support contact history.] For each category, state what’s collected, why, the legal basis (GDPR Art. 6), and how long we keep it.
Health data
Training load, heart-rate, HRV, and sleep data are treated as health data under GDPR Art. 9. Full handling is in our health data policy. The short version: it stays on your account, we never sell it, it’s encrypted at rest, and you can delete it at any time from the app.
Who we share it with
[TODO: sub-processor list. Typically: hosting provider, database provider, email relay, analytics. For each: name, country, purpose, and a link to their DPA.]
International transfers
[TODO: SCCs / adequacy decisions if data leaves the EEA. Name the transfer mechanism used per sub-processor.]
Your rights
Under GDPR you have the right to access, correct, export, and delete your data, and to object to some processing. Email privacy@trainplan.app and we’ll reply within 30 days, free of charge.
Complaints
You can lodge a complaint with your national data-protection authority if you think we’ve mishandled your data. [TODO: link to the authority in the user’s country; for NL that’s the Autoriteit Persoonsgegevens.]
Changes to this policy
We update this policy when our data handling changes. Material changes get an in-app notice and an email to active subscribers. The “Last updated” date at the top always reflects the most recent revision.