AG+ Privacy Policy
Draft for legal review, not yet in force. Written from what the AG+ app and the Mental Performance Coach actually process today. Before publishing, a lawyer must confirm the lawful bases and consent wording, the retention periods and the transfer safeguards, and a DPIA must be completed (UK GDPR / EU GDPR Art. 35). Text in [square brackets] is a placeholder AG+ must fill in.
Who we are
Anders Örbom ("AnotherGear", "AG+", "we") is the controller of the personal data described here. Address: [address, country]. A company is being formed to run AG+; once it exists, this section will name it with its registered office and company number.
- Privacy contact: [privacy@anothergear.app]
- Data protection officer: [name and contact, or "not appointed"]
- Representative in the UK / EU (only if we are established outside it): [name and contact]
What this policy covers
This policy covers the AnotherGear (AG+) mobile app, the AG+ Mental Performance Coach inside it (text, voice and coaching stories) and [anothergear.app]. It does not cover third-party services you choose to connect, such as Apple Health, which have their own policies.
Our internal admin console is used only by AG+ staff and is covered by our staff privacy notice.
Information we collect
We collect what you give us, what the app records while you use it, and what you choose to connect. We do not buy data about you.
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Email, name, sign-in identifier | You, when you register (via our sign-in provider) |
| Profile and goals | Sport, experience, your "Why", goals, time zone, country | You, in onboarding and your profile |
| Training plan and events | Planned sessions, key sessions, your selected race, completed sessions | You, and the plan you build in the app |
| Workouts (optional) | Completed workouts read from Apple Health; we never write to Apple Health | Apple Health, only if you allow it |
| Location (optional) | Your approximate location, used once to suggest nearby races | Your device, only if you allow it; you can pick a country instead |
| Mental performance assessments | Your answers and scores (for example the ACSI-28 questionnaire) | You |
| Check-ins, practices and reflections | Mood and energy ratings, completed practices, whether a practice helped | You |
| Coach conversations | What you type or dictate to the coach, the coach's replies, the sources it used | You and the AI coach |
| Coach memory | Short notes the coach keeps about you (for example an upcoming race, a worry, a cue that helps), each marked confirmed, unconfirmed or temporary | Drawn from your conversations, check-ins and plan; you can see and correct them |
| Voice | Short recordings for voice-to-text, and live voice audio | Your microphone, only when you use voice |
| Coaching stories | Personal stories the coach writes for you, and their audio narration | Generated from your confirmed information |
| Race reports and files | Files you upload, such as a race report | You |
| Subscriptions and usage | Your plan (Free, Plus), purchase status from the App Store or Google Play, how much coach time you have used | App stores; our servers |
| Device and notifications | Device type, app version, push notification token, notification settings | Your device |
| Emails we send you | Delivery of service emails (for example "your data export is ready") | Our email provider |
| Sharing and referrals | Share links you create, referral codes | You |
| Technical and security logs | Request identifiers, timestamps, errors, IP address | Our servers; these logs never contain the text of your messages |
Sensitive information about your wellbeing
What you tell the coach about nerves, stress, confidence or how you feel may be health data, a special category of personal data (Article 9 GDPR). We process it only with your explicit consent, which we ask for before your first coach conversation.
- You can withdraw consent at any time in [Settings › Privacy]. The coach then stops, and we delete your coach conversations and memory as described under "Your rights".
- Withdrawing does not affect the rest of the app.
- If you mention a risk of harm, the coach shows approved support information (for example a helpline). [Confirm with counsel: whether safety alerts to AG+ staff rely on vital interests, and who receives them.]
[Legal review: confirm explicit consent as the Art. 9(2)(a) condition and the consent wording shown in the app.]
How we use information and why we're allowed to
We use your information only for the purposes below. We never use coach conversations for advertising, never sell personal data, and never share conversations with clubs, coaches or sponsors.
| Purpose | Information used | Lawful basis [to confirm] |
|---|---|---|
| Provide your account, plan, practices and progress | Account, profile, plan, check-ins, assessments | Contract |
| Mental performance coaching (text, voice, stories) | Coach conversations, coach memory, profile, plan, voice | Contract; explicit consent for wellbeing data |
| Remember what matters to you between conversations | Coach memory | Explicit consent |
| Adapt your mental-training plan when you confirm a lasting change | Confirmed coach memory, plan | Explicit consent; changes are only made after you confirm them |
| Proactive coach messages (for example before a key session) | Plan, events, check-ins, notification settings | Legitimate interests; you can turn them off |
| Service emails (account, data export, deletion, policy changes) | Email address, the event the email is about | Contract; legal obligation |
| Subscriptions and coach-time allowances | Purchase status, usage records | Contract; legal obligation for financial records |
| Safety support when you may be at risk | The message that triggered it | Explicit consent / vital interests [to confirm] |
| Security, fraud and abuse prevention, service quality | Technical logs, usage records | Legitimate interests |
| Answer support requests and exercise your rights | Account, the data your request concerns | Legal obligation; contract |
| Improve the service using aggregated statistics (no message content) | Usage and cost totals | Legitimate interests |
How the AI coach works
The coach's replies and stories are written by an AI model, not by a person. To answer you, it uses only a limited, labelled set of information: your profile, your upcoming plan and selected race, recent check-ins, the most relevant notes from your coach memory, and excerpts from AG+'s approved knowledge library.
- Nothing becomes fact without you. New notes start as "unconfirmed". Saving a cue, adding a session or changing your plan only happens when you tap to confirm.
- Your scores aren't changed by conversations. Assessment scores change only when you complete an assessment.
- You stay in control of memory. In [Settings › What the coach knows] you can see every note, correct it, mark it wrong or delete it. Temporary notes (for example "legs heavy this week") expire automatically.
- No automated decisions with legal or similarly significant effects are made about you (Article 22 GDPR).
- Isolation. Your information is never used in another athlete's conversation. AG+ staff cannot read your conversations; see "How we protect information".
- No training on your data. We don't use your conversations to train AI models, and our AI providers are contractually barred from doing so [confirm in each provider agreement].
Voice
Voice is optional and uses your microphone only while you are dictating or in a live voice session.
- Voice-to-text: your clip is turned into text and the recording is deleted straight away; we don't keep it. You see the text, can correct it, and nothing is sent to the coach until you tap send. Words the system was unsure about are highlighted.
- Live voice: your speech is transcribed as you talk and the coach answers in a synthetic voice. Live audio is not recorded or kept; the written transcript becomes part of your conversation, so you can carry on in text.
- Coaching stories may be narrated in the coach's synthetic voice. The audio is stored encrypted with your story.
Who we share information with
We share personal data only with service providers that process it on our instructions under a data processing agreement, and only what each needs. We do not sell personal data.
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, databases, file storage, encryption keys, document text recognition | All app and coach data | UK (London region) [confirm backup region: EU] |
| OpenAI | AI coach replies, memory notes and coaching stories; search indexing of coach memory and the knowledge library; [voice-to-text and live transcription, if chosen as provider] | Your messages and the coach's replies, short memory notes, and voice audio as needed for each request | United States [confirm EU data residency / zero data retention] |
| ElevenLabs | Synthetic coach voice for live voice, previews and story narration | Coach reply and story text (not your recordings) | [confirm] |
| Loops | Sending service emails | Your email address, first name and the details of that email (never your conversations or coach memory) | United States [confirm] |
| Supabase | Sign-in and app progress backups | Account, app progress | [confirm region] |
| Apple App Store, Google Play | Payments and subscription status | Purchase records | Per the store's policy |
| [Push provider: Apple Push Notification service / Firebase Cloud Messaging] | Delivering notifications | Push token, notification text (never your conversation) | United States |
We may also disclose information if required by law, to protect someone's life or safety, or as part of a sale or reorganisation of our business (with notice to you).
International transfers
Our main systems run in the UK (AWS London). Some providers process data in the United States. Where data leaves the UK or EEA, we rely on an adequacy decision (for example the UK-US Data Bridge or the EU-US Data Privacy Framework, where the provider is certified) or on Standard Contractual Clauses / the UK International Data Transfer Addendum, plus a transfer risk assessment. You can ask us for a copy of the safeguards. [Legal review: list the mechanism per provider.]
How long we keep information
We keep information only as long as needed for the purpose it was collected for. These are our defaults [to be confirmed in the DPIA]:
| Information | How long |
|---|---|
| Voice-to-text recordings | Deleted immediately after transcription |
| Live voice audio | Not recorded |
| Coach conversations | 12 months after your last activity |
| Temporary coach notes (e.g. "legs heavy this week") | Expire after about 7 days; deleted 30 days after expiry |
| Other coach memory and coaching stories | Until you delete them or your account |
| Account, profile, plan and progress | Until you delete your account |
| Data export files you request | 24 hours |
| Records of which policy versions you accepted, and consent given or withdrawn | For as long as we may need to show we had your consent, then deleted [confirm] |
| Purchase and billing records | [As required by tax law, e.g. 7 years], with no conversation content |
| Security logs | [90 days] |
| Backups | Overwritten within 35 days |
When you delete your account, we erase your data within 30 days. Usage and audit records are kept only in anonymised form.
How we protect information
- Encryption. All data is encrypted in transit and at rest. Your conversations, story text and story audio are additionally encrypted with a key unique to you; deleting your account destroys that key.
- No staff access to conversations. There is no tool that lets AG+ staff read your coach conversations.
- Reason-gated access to coach memory. Support staff can view your coach memory only to help with a request, after recording a reason; access lasts 15 minutes and is logged. You can see every such access in [Settings › Data access log], and we notify you if staff correct or delete a note.
- Separation. Each athlete's data is isolated at the database level, and each coach has its own knowledge library.
- Accountability. Changes to the coach's rules, knowledge and settings are reviewed by a second person and recorded in an audit log.
No system is perfectly secure. If a breach affects you, we will tell you and the regulator as the law requires.
Your rights
You can use these rights in the app or by emailing [privacy@anothergear.app]. We reply within one month.
| Right | How |
|---|---|
| See your data and get a copy (access, portability) | [Settings › Privacy › Export my data]: a download of your data in a machine-readable format |
| Correct it | Edit your profile; correct or mark wrong any coach note in [What the coach knows] |
| Delete it | Delete single coach notes, or delete your account in [Settings › Privacy] (erased within 30 days) |
| Withdraw consent | Turn off the coach or voice, or withdraw wellbeing-data consent, in [Settings › Privacy] |
| Object or restrict | Turn off proactive messages; email us to object to other processing |
| See staff access | [Settings › Data access log] |
| Complain | Contact us first if you can. You may also complain to your data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in Sweden Integritetsskyddsmyndigheten (imy.se), or the authority where you live |
Proactive messages and notifications
If you allow notifications, the coach may send short messages, for example a few hours before a key session, in the days before your race, after a session, or when a coaching story is ready. They respect quiet hours in your time zone and a weekly limit, and pause if a recent conversation needed safety support. You can turn them off, or set your own quiet hours, in [Settings › Notifications]. Notification text never includes what you said to the coach.
Children
AG+ is for people aged [18] and over. We don't knowingly collect data from younger users; if you think a child has an account, tell us and we will delete it. [Open decision: if under-18s will be allowed, add age checks, guardian consent and stricter messaging rules first.]
Changes and contact
We will update this policy when what we do changes, and tell you in the app before material changes take effect. The version and date above show the latest version.
Questions or requests: [privacy@anothergear.app] · Anders Örbom, [address].