Last updated: 2026-07-23 — Privacy notice prepared under Turkish Personal Data Protection Law (KVKK) art. 10, mirroring GDPR
1. Data controller
Sedat Küçükbay, Alsancak Mah. 1476/1 Sk. No:9 D:16 Kordon Kule Apt., Konak/İzmir, Türkiye
Contact: procoach0@gmail.com
2. Categories of personal data processed
• Your email address (account identity — register/login)
• Garmin OAuth token (your password is never stored, only the token)
• If you connect it, Strava OAuth token (cycling/running/swimming/walking/strength activities)
• If you connect it, Google Health OAuth token (Fitbit/Pixel activities + sleep, resting heart rate, HRV, steps)
• If you connect it, Apple Health data (read on your device, sent to the server)
• Training activities, heart rate, sleep, stress and similar health/fitness metrics fetched from Garmin/Strava/Apple Health/Google Health (special category data — see also "Health Data Processing")
• Threshold values such as threshold power and threshold heart rate
3. Purposes of processing
• Delivering personalized training coaching and health analysis
• Account authentication and account security
• Maintaining service quality and preventing abuse (e.g. rate limiting)
4. Collection method and legal basis
• Email/password: performance of the service contract (KVKK art. 5/2-c) and your explicit consent given at registration.
• Garmin/Strava/Google Health activity data: once you connect it, automatically via the provider's API, based on your explicit consent (KVKK art. 5/1).
• Apple Health data: read on your device, with your permission, and sent to our server through the app with your explicit consent.
• Health data is considered special category personal data (KVKK art. 6) and is only processed with your separate, explicit consent.
5. Data transfers
• Domestic/EU: Your data is hosted on Fly.io infrastructure in a Frankfurt, Germany data center; NEVER shared with third parties for marketing/advertising.
• International: To generate AI analysis, numeric metrics (WITHOUT name/location) are sent via OpenRouter to various AI providers — under KVKK art. 9 this constitutes an international data transfer, based on the separate "AI-Powered Analysis" consent you give at registration (see that section for details).
6. Retention period
Your data is kept for as long as your account is active. All data is permanently deleted upon account deletion.
7. Security measures
Your password is stored irreversibly hashed (scrypt) and is never stored in plain text. Garmin/Strava/Google Health access tokens are stored encrypted on the server. All communication is encrypted via HTTPS/TLS.
8. Your rights (KVKK art. 11 / GDPR)
Under KVKK article 11 you have the right to:
a) Know whether your personal data is being processed
b) Request information about it if it has been processed
c) Know the purpose of processing and whether it's used consistently with that purpose
ç) Know the third parties, domestic or abroad, to whom your data is transferred
d) Request correction if it has been processed incompletely or incorrectly
e) Request erasure or destruction under the conditions of KVKK art. 7
f) Request that corrections/erasure under (d) and (e) be notified to the third parties your data was transferred to
g) Object to a result that is to your detriment arising from analysis exclusively by automated systems
ğ) Request compensation for damage suffered due to unlawful processing
Under GDPR you additionally have the right to: receive your data in a portable format, restrict processing, and withdraw consent at any time.
9. How to exercise your rights
You can write to procoach0@gmail.com or act directly in the app (Settings → Log out → delete account). We respond within 30 days at the latest. If unsatisfied with our response, you have the right to lodge a complaint with the Turkish Personal Data Protection Authority (kvkk.gov.tr) or your local supervisory authority.
10. Cookies and ads
ProCoach AI is a native mobile app; it does not use web cookies. The free (Basic) tier may show ads via Google AdMob. These ads are NOT personalized — only non-personalized ads are requested, and App Tracking Transparency / cross-app tracking is NOT used on iOS. No ads are shown with a Pro subscription. To serve ads, AdMob may process limited technical data subject to Google's own privacy policy, not for personal profiling/tracking. Your health and fitness data (heart rate, sleep, activities, etc. from Garmin/Strava/Apple Health/Google Health) is NEVER used for advertising and is NEVER shared with ad networks — ads are completely independent of this data.
11. Minimum age
The service is not designed for users under 13; if we learn a user is under this age, we delete the account and its data.
12. Changes to this policy
We may update this policy; we announce significant changes by updating the "Last updated" date.
13. Contact
procoach0@gmail.com