Privacy Statement

1. Who we are

kyuflow is operated by Geode Solutions Pty Ltd (ABN 48 167 312 398), an Australian company based in Queensland ("we", "us", "our").

We are responsible for the personal information described in this statement. For the EU and UK General Data Protection Regulations, we are the controller.

Contact us about privacy, including requests to use any of your rights, at info@gogeode.com.

2. What this statement covers

This statement explains how we handle personal information when you use the kyuflow website and app. It is written to meet:

• the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs), which are our home law;
• the EU General Data Protection Regulation (EU GDPR);
• the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR);
• US state privacy laws, including the California Consumer Privacy Act as amended by the CPRA (CCPA).

Our use of cookies and on-device storage is explained in more detail in the Cookie and Storage Notice.

3. Information we collect

Account information. Your email address and the display name and preferences you add in Profile. If you use email and password, our authentication provider stores your password in hashed form, and we never see it. If you sign in with Google, Google shares your name, email address, Google account ID, and profile-picture URL when available. Supabase stores these details with your authentication account. We use them to identify your account and let you sign in with Google.

Training information. The workouts, sessions, sets, programs, exercises, equipment, and training locations you create or log. This includes runs you log yourself or import from a file, which can include heart rate and calories if you provide them. Training locations are places you name yourself. We do not collect GPS location.

Health and body information. Body measurements, nutrition entries, recovery and readiness information, and other health observations you choose to record. It also includes running activity you import from Apple Health (HealthKit). This is sensitive information under the APPs and special category data under the GDPR. See section 5.

Content you send to AI features. When you use features that interpret a program you paste in, or that generate a program, the text you submit is processed to produce the result.

Support requests. The subject, message, and category of requests you send us. Requests that indicate a safety concern are flagged for priority handling.

Billing information. If you subscribe, Stripe processes your payment. We receive and store your subscription status, plan, and Stripe customer and subscription identifiers. We do not receive or store your full card number.

Device and technical information. A device identifier generated by the app, your general device and browser type, sync and reliability diagnostics, and timestamps with your time zone. Our hosting and database providers process IP addresses in their service logs. To limit abuse of the Apple Health import, we keep a one-way hash of your IP address for up to 2 days.

Usage analytics. Only if you allow product analytics: a limited set of events about how the sign-in and sign-up screens and core features are used, such as a screen being viewed or a workout being completed. These internal usage events are stored in our own database and linked to your account when you are signed in. When allowed, we also use Vercel Web Analytics to measure anonymous page visits and navigation without cookies or persistent cross-site tracking. We never share your information with advertising companies. Product analytics are off until you choose to allow them, and you can change your choice at any time in the Cookie and Storage Notice or in Profile. If you are signed in, we record your choice on your account so it applies on all your devices.

4. How we use information and our legal bases

We record your acceptance of our Terms of Use and this statement, and your consent choices, with the document version and time. This lets us show what you agreed to.

We do not use your information for advertising, we do not build advertising profiles, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Health and body information

We store health and body information only with your explicit consent. You can give it when you create an account or later, and we record when you gave it. Without consent, kyuflow does not save new measurements, nutrition entries, recovery check-ins, health observations, or Apple Health imports for your account.

We use this information only to provide the features you use. We do not use it for advertising and we do not sell it.

You can withdraw consent at any time in Profile, under Privacy and legal. When you do, we stop saving new health information. Records you already saved stay viewable in your account until you delete them. You can delete individual entries in the app, or email us to delete all of your health information.

kyuflow is not a medical service, and nothing in it is medical advice.

6. AI features

When you use an AI feature, the text you submit and the instructions needed to complete the task are sent to an AI model provider acting on our behalf: Google (Gemini), OpenAI, or Anthropic, depending on the feature and our configuration. We use these providers to return a result to you, not to train their models on your content, subject to their commercial terms. We keep a record of generated results in your account so you can return to them.

7. Who we share information with

We share personal information only as needed to run kyuflow. We host our fonts and images ourselves, so your browser does not contact font or image services when you use kyuflow.

• Service providers (processors) that host, store, or process information for us under contract:
  • Supabase (database, authentication, file storage, and account emails such as sign-up and password reset, sent through Supabase's built-in email service; hosted in Sydney, Australia);
  • Vercel (application hosting and web analytics; our application servers run in Sydney, Australia, with content delivered through Vercel's global network);
  • Stripe (payments and subscriptions);
  • Google (Gemini), OpenAI, or Anthropic, depending on the feature and our configuration (AI features).
• Google sign-in. If you choose it, Google authenticates you and shares the account information described in section 3 with Supabase.
• Legal and safety. Where required by law, or to protect the rights, safety, or property of our members, us, or others.
• Business transfers. If our business is reorganized or sold, information may transfer to the new owner under this statement.

We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined in the CCPA. We do not knowingly sell or share the personal information of anyone under 16.

8. International transfers

We are based in Australia. Your account, training, and health information is stored in Sydney, Australia, and our application servers run there too.

Some of our service providers — including Google, OpenAI, Anthropic, Supabase, and Vercel, as applicable — may process personal information outside Australia, including in the United States and other countries. When we transfer personal information overseas, we take reasonable steps to ensure the recipient protects it consistently with the APPs. We rely on those providers' standard contractual terms and data processing agreements to protect it.

9. How long we keep information

• Account, training, and health information: while your account is active. When you delete your account, we delete it from our live systems, subject to the limited exceptions below.
• Expired invitation accounts: removed automatically.
• Apple Health import records: import event logs for 30 days; hashed IP rate-limit records for up to 2 days.
• Usage analytics: deleted automatically 13 months after they are recorded. They are also deleted when you delete your account.
• Billing records: for as long as tax and accounting laws require.
• Backups: deleted information may remain in encrypted backups for a limited period until those backups expire.

10. Security

We use encryption in transit, access controls including database row-level security, and restricted administrative access. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulators as the law requires.

11. Your choices and rights

Wherever you live, you can ask us to:

• access the personal information we hold about you, and receive it in a portable format;
• correct information that is inaccurate or incomplete;
• delete your account and personal information;
• withdraw consent you have given, at any time, without affecting processing that happened before you withdrew it.

If you are in the EU or UK, you also have the right to restrict processing and to object to processing based on our legitimate interests.

If you are a California resident or live in another US state with a comprehensive privacy law, you have the right to:

• know what personal information we collect, use, and disclose;
• delete it;
• correct it;
• opt out of the sale or sharing of personal information. We do not sell or share it, and we treat a Global Privacy Control signal as a valid opt-out request.

We will not discriminate against you for using these rights. You may use an authorized agent.

How to make a request. Email info@gogeode.com from the address linked to your account. We may need to verify your identity. We respond within the time the law requires: generally within 30 days, and within 45 days for some US requests.

12. Complaints

Please contact us first at info@gogeode.com so we can try to resolve your concern. You can also complain to a regulator:

• Australia: the Office of the Australian Information Commissioner (oaic.gov.au).
• UK: the Information Commissioner's Office (ico.org.uk).
• EU: the data protection authority in your country of residence.

13. Children

kyuflow is not intended for anyone under 16. If you believe someone under 16 has given us personal information, contact us and we will delete it.

14. Changes to this statement

We will update this statement when our practices change. The version and effective date are shown at the top of this page. If we make a material change, we will ask signed-in members to review and acknowledge the updated statement in the app.