Your data, governed.

01Who is responsible for your data

The data controller is Momentum Coaching · VeloIQ, Inc., a Delaware corporation. For any privacy question or request, contact hello@veloiq.pro.

02Information we collect and how

• Account — your email address, display name, role (athlete/coach), federation, and country, which you provide when creating or using your account. Passwords are handled by our authentication provider and are never stored by us in plain text.
• Training data — power, velocity (bar/pedal speed), cadence, duration, lap splits, session metadata, and VBT set/rep data, from paired hardware (power meters, VBT encoders) and from files or video you add.
• Video — footage you record or import, and the power/telemetry overlays generated from it.
• Health & recovery data — heart-rate variability, resting heart rate, blood oxygen, and a derived daily "readiness" score — only with your permission, from Apple HealthKit or a connected wearable (e.g. WHOOP, Fitbit, Apple Watch).
• Device & diagnostics — push token, app version, and crash/performance diagnostics, collected automatically to deliver notifications and keep the app reliable.
• Payment — subscription status and identifiers, via Stripe. We do not receive or store your full card number.

03How we use your data

• To provide the app's features — recording, analysing, and reviewing training.
• To let your coach and/or federation review your training and recovery when you are in a coaching relationship.
• To compute a daily readiness score from your health metrics.
• To back up your sessions and videos so they are available across your devices.
• To keep the app secure and reliable (diagnostics), and to process subscriptions.

We do not use your data for advertising, and we do not sell your data.

04MomentumAI (third-party AI)

MomentumAI is an optional feature that generates written coaching insights. If — and only if — you enable it and grant permission in the app, VeloIQ sends a limited set of anonymous performance metrics to our AI provider to produce those insights.

Nothing is sent to the AI unless you turn MomentumAI on and confirm the in-app disclosure. You can turn MomentumAI off at any time in Settings → MomentumAI & Privacy.

05HealthKit

With your permission, VeloIQ reads certain HealthKit metrics (HRV, resting heart rate, blood oxygen) to compute your readiness score and training features. In line with Apple's requirements:

• HealthKit data is used only to provide health and fitness features to you.
• HealthKit data — and anything derived from it, such as the readiness score — is never used for advertising or data mining, and is never shared with or sold to any third party, including the MomentumAI service described above.
• Your readiness score and its inputs are stored on our secure servers so you and your coach can review recovery over time and across your devices; you can delete this at any time.

06Who we share data with

• Your coach / federation — to review your training and recovery, when you are in a coaching relationship in the app.
• Supabase — secure database, storage, authentication, and hosting of your account and training data.
• AI processing provider — MomentumAI insights only; anonymous performance metrics, with your consent (see §4). Identity available on request.
• Stripe — subscription payments.
• Apple — push notification delivery (APNs).
• WHOOP / Fitbit — if you connect them, to read the wellness metrics you authorize via their secure OAuth flow. Access tokens are stored privately on our servers, never in the app.

We require our processors to protect your data with safeguards equivalent to those described here. We do not sell, rent, or trade your personal data, and we do not use it for third-party advertising — ever.

07Athlete confidentiality

Your performance data and footage are confidential to you and to the coaches or federation you explicitly authorize. We never make them public. Coaches and administrators can only access the athletes assigned to them, enforced by strict per-record (row-level) access controls.

08Storage & security

Your data is hosted on Supabase and encrypted in transit (TLS) and at rest. Video is kept in private storage reachable only through short-lived signed links. Access is least-privilege, and sensitive service keys (such as our AI provider key) live only on our servers and are never shipped inside the app.

09Legal bases (GDPR)

We process your data on the following bases: performance of our contract with you (to run the app), your consent (for example, Apple Health data, video, MomentumAI, and optional cloud backup), and our legitimate interests in securing and improving the service, balanced against your rights. Where we rely on consent, you can withdraw it at any time.

10Your rights

Under GDPR and similar laws you have the right to access, rectify, erase, restrict, port, and object to the processing of your data, and to withdraw consent. You can enable or disable MomentumAI (Settings → MomentumAI & Privacy) and grant or revoke HealthKit/wearable access at any time. EU/UK users may also lodge a complaint with their local supervisory authority. To exercise any right, contact hello@veloiq.pro.

11International transfers

We operate from the United States. If you are in the EU/UK, your data may be transferred to the US under appropriate safeguards such as the EU Standard Contractual Clauses.

12Retention & deletion

We keep your data while your account is active. You can delete your account at any time in Profile → App Info → Delete Account; this deactivates it immediately and permanently erases your data after a 30-day grace period, except where we must retain limited records for legal or accounting reasons.

13Junior athletes & children

VeloIQ is not directed to children under 13, and we do not knowingly collect their data. Where an athlete is a minor, their account is managed within a coaching/federation relationship with appropriate parental or guardian consent, in line with the age of digital consent in your country.

14Connected wearables & third-party devices

WHOOP, Fitbit, Apple Health and similar services are independent third parties. You can disconnect them at any time in Profile → Connected devices, which removes our stored access. VeloIQ is not responsible for the accuracy, availability, or performance of these devices or services, or for any changes they make to their APIs. Your use of them is governed by their own terms and privacy policies.

15Changes to this policy

We may update this policy and will revise the "Effective" date above. We will notify you in-app of any material changes.

16Contact

Privacy requests and any question about this policy: hello@veloiq.pro.