Privacy Policy

Last updated: September 2, 2026

1. Introduction

12345 Boom ("we," "our," or "us") builds an AI training app. This policy explains what we collect, why, who we send it to, and how to get it back or delete it.

We are based in the European Union and your data is stored in the EU. Where this policy says data leaves the EU, it says so explicitly and names where it goes.

2. Information We Collect

2.1 Account information

You sign in with Google, Apple, or a link sent to your email address. We do not store passwords — we never receive one. We keep:

  • Your email address
  • Your name, if your sign-in provider shares it and you allow it

2.2 Training and performance data

  • Workouts: type, duration, distance, date and time
  • Performance metrics: pace, speed, heart rate, power, cadence, elevation
  • GPS routes, where your device or a connected service recorded one
  • The original activity files (FIT, TCX, GPX) from your devices, kept so we can re-analyse a workout in more detail later
  • Your goals, target events, available training days, equipment and sports
  • Your own notes and how you rated a session

2.3 Health data from connected devices

If you connect a service or grant Apple Health access, we may receive:

  • Heart rate variability and resting heart rate, used to judge recovery
  • Body weight and height, used for power-to-weight and calorie estimates
  • Sleep and recovery metrics, where a device provides them

2.4 Menstrual cycle data — special category, and opt-in only

Menstrual cycle information is special-category data under Article 9 of the GDPR, which means we may only process it with your explicit consent and for a stated purpose. We treat it differently from everything else here.

We store nothing unless you ask us to. The only thing that turns this on is you creating a cycle-based training rule in the app — for example, "first two days of my period: no intervals". Creating that rule is your consent, and its purpose is exactly what the rule says: placing your training on the right days. If you never create one, cycle information sent by a connected device is discarded on arrival and never written down, even if your device offers it.

When a rule does exist, we store only:

  • The date a period started
  • A typical cycle length, derived from recent starts, so a rule can be projected forward

We do not store pregnancy status, fertility windows, cycle phase or symptoms. Where a connected device sends a pregnancy-related summary, we detect it and discard it rather than record it.

Deleting the rule stops all further collection. You can also delete the stored data itself at any time without deleting your account.

2.5 Device and usage data

  • Device type and operating system version
  • Crash reports and error diagnostics
  • IP address, and the approximate region it implies

2.6 Location

Only with your permission, and only for weather-aware workout suggestions and recording an activity you started in the app. You can withdraw it in your device settings; the app keeps working without it.

3. How We Use Your Information

  • Generating and adapting your training plan
  • Estimating your fitness — threshold, FTP, training load, fatigue, form
  • Writing the coaching feedback you see after a workout
  • Tracking progress toward a goal and detecting personal records
  • Adjusting for weather, and for anything you have told the coach
  • Sending reminders and notifications, if you allow them
  • Managing your subscription
  • Diagnosing crashes and faults

We do not sell your data, and we do not use it to advertise to you.

4. AI Processing

Your plans and coaching feedback are generated by AI models operated by Anthropic. To do that, a summary of your training is sent to Anthropic for processing. This leaves the European Union — see section 7.

What is sent: your recent workouts and their metrics, your fitness estimates, your goals and schedule, and any notes or rules you have written for the coach.

What is not sent: your email address, your name, and your period start dates. Where a cycle rule affects your plan, the calculation of which days it lands on happens on our servers, and the model is told only "this rule applies to day 3 and day 4 of the plan" together with the sentence you wrote. The underlying dates never reach it.

Anthropic processes this data to return a result to us. Under our agreement with them, it is not used to train their models.

5. Third-Party Services

5.1 Services you connect

You choose whether to connect these, and what they may share. You can disconnect any of them at any time in the app, which stops further data arriving.

  • Strava — activity history, workout detail, athlete profile
  • Garmin Connect — activities, activity files, health metrics
  • Wahoo — workouts and training history
  • Apple Health — only the categories you approve in Apple's own permission screen. Health data obtained through Apple Health is never used for advertising or sold, and is not shared with third parties except as described here.

We read from these services and write workouts you asked us to send to a device. We do not delete or alter your data on their systems.

5.2 Providers we use

  • Amazon Web Services — hosting and storage, EU (Frankfurt)
  • Firebase (Google) — sign-in and push notifications
  • Anthropic — AI processing (see section 4)
  • Resend — sending your sign-in link by email
  • RevenueCat — subscription management
  • Sentry — crash and error diagnostics
  • OpenWeatherMap — forecasts for weather-aware suggestions

6. Storage and Security

  • Your data is stored in the EU (AWS Frankfurt)
  • The database is not reachable from the public internet
  • All traffic is encrypted in transit (TLS)
  • Stored data is encrypted at rest
  • Access tokens for services you connect are encrypted with authenticated encryption, separately from the rest of your data

7. International Transfers

Your data is stored in the EU. Two things leave it:

  • AI processing by Anthropic, in the United States — the training summary described in section 4
  • Push notifications and sign-in via Google Firebase, which may process outside the EU

These transfers rely on the European Commission's Standard Contractual Clauses and the data-processing agreements we hold with each provider.

8. Retention and Deletion

We keep your data while your account exists. You can delete your account from inside the app, at any time, without contacting us.

  • Deletion has a 60-day grace period. Nothing is erased during it, and simply signing in again cancels it — so an accidental deletion is recoverable.
  • You can skip the grace period and erase immediately. Erasure is a right, not an offer.
  • When erasure runs, we delete your account, your training history, your activity files and your connected-service tokens, and we deauthorise those services first so they stop sending us anything.
  • We keep a one-way fingerprint of your email address so a deleted account cannot be silently recreated by a stale login. It cannot be used to reconstruct your address.
  • Encrypted backups may retain data for a short period after erasure before rotating out.

Deleting your account does not cancel your subscription. Apple and Google own that relationship and we cannot cancel it for you — do it in your device's subscription settings, or you will keep being charged.

9. Your Rights

Under the GDPR you have the right to:

  • Access your data — the app can export everything we hold as a file
  • Correct anything inaccurate
  • Delete your data, as described above
  • Take your data elsewhere, in a machine-readable format
  • Object to processing, or ask us to restrict it
  • Withdraw consent — disconnect a service, revoke a permission, or delete a cycle rule. Withdrawing does not undo processing that already happened.
  • Complain to your national data protection authority

Export and deletion are both in the app. For anything else, email privacy@12345boom.com.

10. Children's Privacy

The Service is not intended for anyone under 16. We do not knowingly collect their data, and we delete it if we find we have.

11. Changes to This Policy

We will tell you in the app or by email before a significant change takes effect. Where a change affects special-category data, we will ask for your consent again rather than assume it.

12. Contact

  • Email: privacy@12345boom.com
  • Web: https://12345boom.com/support