Privacy policy

1. Controller and contact

Juraj Špindor - software solutions is the controller for personal data processed through Octalap. Registered address: Deviata 5/A, 831 01 Bratislava, Slovak Republic. Registration/tax identifier: IČO 52 716 686. Privacy requests may be sent to info@octalap.app.

2. Data we collect

• Account data such as email address, display name and authentication identifiers.
• An email address submitted to the public readiness tool, its requested saved result and the associated public card.
• An email address and timestamp when you separately ask for one notification that Pro has launched.
• When a coach separately joins the coach waitlist: email address, a coarse athlete-count range, a selected sport focus, a coarse signup-source category, consent version and timestamps. Raw UTM values, athlete identities, exact roster size and free-text coaching notes are not stored for this list.
• Athlete profile, race date and goal, fitness benchmarks, equipment, availability and optional limitation notes.
• An optional Athlete Passport containing bounded recent-volume, schedule, training-preference, data-source and heart-rate-context fields, plus a separate note for your own record.
• Training plans, workout completion, elapsed time, RPE, notes, weekly check-ins and readiness history.
• A Founding 100 award record, when applicable: account identifier, awarded position, qualification time, benefit state and applicable offer version.
• Validated plan-decision records such as an adaptation summary or an accepted, rejected or pending schedule proposal. Raw Ask Octalap questions and non-actionable answers are not retained as chat history.
• Optional Free Beta ratings, short comments, suggestions or issue reports, the product screen or saved result being reviewed, and whether you permitted one follow-up by account email.
• Subscription status, Paddle customer, subscription, transaction and price identifiers, referral records and product usage diagnostics. Octalap does not store card details or raw Paddle webhook payloads.
• Email delivery status and, when configured, cookie-less aggregate page views, referrers, approximate device/location categories and browser performance measurements. Query strings, public-share slugs, API/Auth paths, admin/export pages and workout identifiers are removed or excluded before product telemetry is sent. Octalap does not use advertising cookies.
• When offline logging is used, the last opened workout and its incomplete completion draft are stored only in that browser until cleared or successfully submitted.

3. Why we process it

We use account and training data to provide the requested plan, record progress, adapt future sessions, calculate readiness, operate subscriptions, prevent abuse and support the service. Optional Beta feedback is used to understand product quality, investigate reported problems and prioritise improvements. We contact you about a feedback item only when you selected the follow-up permission. Coach-waitlist data is used only to measure demand, understand coarse coaching needs and contact consenting coaches about relevant coach-product research or availability; it is not general athlete marketing consent. When workout reminders are enabled, we may send one factual prompt for each unfinished setup stage: email confirmation after 24 hours, plan creation after 48 hours and the first session after 72 hours. Each is attempted at most once and can be disabled with workout reminders. A public-tool email is used only to deliver the result link requested with that submission. A Pro launch email is sent only when you separately consented to that one notice; neither address is treated as general marketing or newsletter consent. These permissions may be withdrawn through Settings or the privacy contact. Contract performance is the main legal basis for core product data. Consent applies where required for optional communications; legitimate interests support narrowly scoped product-quality, security and reliability monitoring.

4. Sensitive and safety-related notes

Do not submit medical records. Optional injury or limitation notes are used only to reduce load and recommend professional consultation; Octalap does not diagnose, treat or provide medical clearance.

5. Processors and transfers

Service providers may include Supabase for authentication and database hosting, Vercel for application hosting plus privacy-filtered Web Analytics and Speed Insights, Paddle as merchant of record for billing, Resend for transactional email, Plausible only when selected instead of Vercel analytics, and the configured LLM provider for validated plan text. For Ask Octalap, the model receives a locally classified intent, validated plan facts and only the structured Athlete Passport fields you allowed for planning. It does not receive the raw question, Passport free-text note or pain/injury question. Each provider receives only the data needed for its function. International transfers must use the safeguards required by applicable law.

6. Public sharing

Training data is private by default. A public card is created only after an explicit share action and contains a minimised payload such as a first name/initial, score, overview, pacing targets or result. Public links use unguessable slugs, but anyone with the link may view or repost the card.

7. Retention and deletion

Account data and account-linked Beta feedback are retained while the account is active and as needed for legal, billing, security, product-quality and dispute obligations. Pro launch and coach waitlist interest is retained until the relevant notice or research is complete, consent is withdrawn or the list is no longer needed. A Founding 100 award remains linked to the qualifying account while that account exists and is removed with account deletion; deleting an account does not transfer or reserve its former place. Feedback review status and individual waitlist addresses are visible only to the verified service owner. Aggregate owner metrics contain counts, not Ask questions, model answers, Athlete Passport values or decision payloads. Settings provides a JSON export and permanent account deletion. The export includes coach interest linked to the account or its normalized email; account deletion removes both forms and their retry ledger. Individual decision records may be deleted without reversing a plan change already accepted; turning off Passport planning use excludes its fields from future planning context without deleting the visible record. Account deletion cancels a non-terminal subscription first, removes the authentication account and cascades through associated training, Passport, decisions, feedback, Founding 100 awards and account-linked Pro interest. Paddle may independently retain transaction records as legally required for its merchant-of-record obligations.

8. Your rights

Depending on your location, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier lawful processing. You may also complain to your data protection authority. We will verify identity before fulfilling a request.

9. Device storage, security, age and changes

The service worker caches only a public offline shell and versioned static assets, not authenticated pages or API responses. An offline workout draft stays on the device, is not treated as completed until the server accepts it, and is removed after successful submission, sign-out, account deletion or the athlete’s clear action. Octalap uses access controls, row-level database security and restricted server credentials, but no system is risk-free. The service is for adults aged 18 or older. An identified under-18 legacy account is restricted from training, AI and Coach processing while export, deletion and support remain available. Material policy changes will be communicated through the service or by email where appropriate.

Coach View

This section is version coach-view-v1. Effective date: 2026-07-28.

The controller is Juraj Špindor - software solutions, Deviata 5/A, 831 01 Bratislava, Slovakia, Business ID (IČO) 52716686. You can contact us at info@octalap.app.

Coach View is an optional, read-only feature for people aged 18 or over. It allows an athlete to share selected Octalap information with a coach chosen by the athlete. An invitation alone never gives access. The athlete must sign in, see the coach and requested scopes, and actively accept before access begins. The athlete can refuse without losing unrelated account functions and can revoke access at any time. Revocation stops access immediately.

The athlete can separately allow access to: (1) the training plan, (2) a readiness summary, and (3) the decision log. Depending on the selected scopes, the coach may see the athlete's bounded display name, scheduled sessions, minimized readiness scores and source labels, factual decision type, status and time, and bounded roster signals such as days to a race, last check-in, missed-session streak and readiness trend.

Coach View does not disclose the athlete's account email, password, authentication secrets, invitation tokens, payment details, private notes, raw AI prompts or responses, raw injury or limitation free text, or an unrestricted database record. A coach cannot edit the athlete's plan, sessions, check-ins, benchmarks, readiness results or account settings in Phase 1.

We process account and access-control data that is necessary to provide Coach View at the athlete's request under Article 6(1)(b) GDPR. We rely on the athlete's consent under Article 6(1)(a) to disclose selected information to a coach. Readiness, injury, limitation, fatigue and inferred physical-status information can constitute data concerning health. Where a selected scope may reveal such information, we additionally rely on the athlete's explicit consent under Article 9(2)(a). Consent is optional, recorded by scope and coach, and can be withdrawn by revoking access. Withdrawal does not affect the lawfulness of processing before withdrawal.

We use minimized relationship and security audit records under Article 6(1)(f) for our legitimate interests in preventing unauthorized access, proving consent and protecting accounts. We do not include health content, raw prompts, invitation tokens or unrestricted free text in those records. We use coarse account-linked product milestones under Article 6(1)(f) to understand whether the beta works. Irreversibly anonymous aggregate counts are not linked back to an account. We do not use Coach View data for advertising.

Invitation links are random, single-use and valid for seven days. New links are shared manually and are not pre-bound to or stored with a recipient email. The first eligible authenticated intended recipient who expressly accepts is bound to the invitation. We delete an unused or revoked invitation, any legacy recipient address previously collected and its token digest no later than 30 days after expiry or revocation. We normally retain an active Coach relationship while it remains active. We delete a revoked or expired relationship and its ordinary lifecycle audit within 90 days. We retain content-free security events for 12 months. Account-linked funnel milestones are retained for no longer than 13 months or until account deletion, whichever comes first. Irreversibly anonymous aggregate counts may be retained without a fixed end date.

A coach may separately opt in to a weekly service digest. The email contains only a generic count of available updates and a link to the authenticated Coach workspace; it does not contain an athlete's name, readiness score, training status or health information. We retain operational delivery metadata for 90 days and operational preference data for up to 30 days after opt-out or the end of the last relationship. We retain minimized evidence of the email consent and withdrawal for four years after withdrawal or the last consented send. The evidence does not contain the message body or athlete data. The coach can unsubscribe at any time.

Octalap is the controller for operating Coach View. A coach is an authorized recipient when viewing information in Octalap and will normally be a separate controller for the coach's independent professional use. Before first access, the coach must accept confidentiality, purpose limitation, security, no onward-sharing, deletion, incident and rights-cooperation obligations. If a coach exports or otherwise processes a copy outside Octalap for an independent coaching service, the coach is responsible for an appropriate legal basis, privacy information, security, retention and data-subject rights.

We use contracted service providers only within documented boundaries. Supabase provides authentication and database services. A Vercel-hosted frontend must not receive health or training values unless a written contractual arrangement expressly permits them. Resend receives only the recipient address and generic service-email content. Google OAuth is an optional independent identity provider. Google Gemini may receive only minimized permitted inputs through a paid EEA configuration under the applicable data-processing terms; it is not used for Coach View unless that configuration is verified. Plausible may process sanitized, cookie-less aggregate analytics when enabled. Paddle is an independent merchant-of-record/controller for billing and never receives Coach, training, readiness or health content. The main Privacy Policy describes the current enabled providers and international-transfer safeguards.

Your authenticated account export includes your own minimized Coach relationships, scopes, states, times, consent versions, digest preference and applicable portable data. It excludes another person's stable identifier, email, tokens, provider IDs and private data. The self-service export is not a substitute for every Article 15 request. You may request access, correction, deletion, restriction, objection, portability or withdrawal at info@octalap.app. We assess another person's rights and security case by case and respond within the periods required by law. You may also lodge a complaint with the Office for Personal Data Protection of the Slovak Republic.

Coach View is not a medical service. Readiness and training information is not a diagnosis, medical clearance or medical advice. Do not use Coach View for emergency or medical communication.