KYDOS

Privacy Policy — Kydos Health L.L.C.

Effective Date: June 6, 2026 Last Updated: November 14, 2026 Version: 7.45

Our Position

Kydos Health L.L.C. does not sell your data. We do not share your health data with third parties for commercial purposes. We do not use your data to train machine learning models. We serve no ads, use no ad SDKs, and use no third-party behavioral analytics tools. KYDOS also contains no AI: your scores, readiness, training paces, insights, and coaching are produced by deterministic, published sports-science formulas and a fixed, human-written library of coach lines — never by an AI, large language model, or generative system, and nothing you log is sent to any third-party AI service. These are not aspirational statements — they are binding commitments reflected in how we built this product.

1. Who This Applies To

This Privacy Policy applies to all users of the KYDOS mobile application ("App"), operated by Kydos Health L.L.C. ("KYDOS," "we," "us"). Contact us at privacy@kydoshealth.com.

2. What We Collect

Account and profile information When you create an account, you provide your email address, username, and display name — either directly, or by signing in with Apple or Google. If you use Sign in with Apple or Google, we receive your name and email address (or, if you choose Apple's private relay option, a private forwarding address that reaches your real inbox without revealing it to us) directly from Apple or Google to create your account; we never receive or store your Apple ID or Google password. If you created your account with an email and password, you can change its email address from Profile after re-entering your password: we send a confirmation link to your new address and a notice to your current address, and the change takes effect only after the new address is confirmed. An account created with Apple or Google keeps the email address that provider manages. You may also provide your height, weight, body composition, sex (female, male, or "Other / Prefer not to say"; used only in the calorie and nutrient-target math), activity level, fitness goals, training preferences, and a profile photo. Your age is derived from your date of birth (see below) and is used to personalize your training and nutrition guidance.

Date of birth When you create an account, we require your date of birth. We use it solely to verify your age: to prevent anyone under 13 from creating an account (as required by the U.S. Children's Online Privacy Protection Act, "COPPA"), to apply the higher minimum age (16) for users in the EEA and UK (GDPR Article 8 / UK data-protection rules), and to determine whether an account belongs to a minor (ages 13–17). If you sign in with Apple or Google — which do not provide your date of birth to us — we ask for it in a mandatory in-app step immediately after sign-in and before any other part of the app is available; if the age you provide is under 13, the account and all of its data are deleted immediately and no further data is collected. Minor accounts are automatically set to maximum-privacy defaults (Stealth Mode on, profile photo private, community features hidden) that cannot be turned off until the account holder turns 18. Your date of birth is stored in your account profile; it is never shared with third parties, is included when you export your data, and is permanently deleted when you delete your account.

Activity data We collect the fitness data you log: workouts, food intake, sleep records, water intake, body weight entries, strength training sessions (exercises, sets, reps, weights, personal records, and estimated one-rep maxes, plus the saved routines and any custom exercises you add, which are kept on your account so they come back on a new device or after reinstalling), and hydration logs (beverage type and volume). We also collect type-specific detail for the workout you're doing: interval/HIIT sessions record the number of rounds you actually completed; pool swims record lap count and pool length; indoor rows record each distance you log during the row and the moment you logged it, so a later Ghost Row can race that row split for split (a Ghost Row race result is stored with the row; it is private to your account and earns no Glory points); other workout types record the duration and, where applicable, distance and pace appropriate to that activity. During active outdoor workouts where you have granted location permission, we collect GPS route data. An indoor workout uses no location at all: no location permission is asked, no GPS runs, and no route is recorded. While an indoor workout (including a strength session) is in progress, KYDOS takes no new location reading anywhere in the app: the weather card keeps the conditions it already showed, the live screen's map shows no location dot, and the nearby lookups described below use only a position the App already had, if any. The one exception is Guardian SOS, which reads your location when you trigger it during any workout, because your safety comes first. For a walk, run or ride, which can be done either way, KYDOS asks whether it is indoor or outdoor the first time you start one and remembers your answer for that workout type on your phone; the Start screen shows it and you can flip it there in one tap, or in Modify Workout; a hike, a trail run, a mountain-bike ride, an open-water swim, or a race against a saved route or a Ghost is treated as outdoor. Continuous location recording happens only while a workout is actively recording. Outside a workout, the App reads your location at a single moment, only when you open a feature that needs it, and only to answer "what is near me": the weather and air-quality lookup described below, and the three nearby lookups (Community Routes, Places to Train, Races Near You — see §6). Those are one-off position reads, not tracking: no route is recorded, nothing is stored against your account, and closing the screen ends it. KYDOS never tracks your location outside a workout you started. When your screen is off during an active outdoor workout, recording continues through a visible, user-initiated foreground-service notification on Android (KYDOS does not request the Android "allow all the time" background-location permission), and on iOS under the "While Using the App" location permission: KYDOS starts recording when you tap Start, iOS shows its location indicator in the status bar while the workout records, and recording ends when the workout does. KYDOS never asks for the "Always" location permission. Guardian SOS attaches your location only when you trigger an SOS during a workout or while KYDOS is open, using a single position read at the moment you trigger it; it does not use background location and cannot be started when the app is closed. Once you have triggered an SOS, KYDOS keeps trying to deliver that one alert for up to three minutes even if you leave the app, so a weak connection does not lose it; it sends only the position read when you triggered it and reads no new location afterward. Guardian Beacon, if you turn it on for a workout, shares that workout's live locations, end-to-end encrypted, with the contacts you chose; it uses the same in-workout location and nothing more (see §5c). You may optionally tag a workout's surface type (trail, road, or mixed) to enable like-for-like performance comparisons. You may also import historical activities by uploading GPX or TCX files from other apps or devices — this data is treated identically to activities recorded in the app.

Saved routes (Route Builder) Using the Route Builder, you may draw and save custom routes, storing the route name, an ordered list of GPS waypoints, the calculated distance, and the activity you chose it for (run, trail run, ride, walk, or hike), so a workout started from it records as that activity. Building and saving your own routes is free. Saved routes are private to your account. You can delete any saved route from the Route Library at any time. Build Your Glory™ (KYDOS Premium) compares your own past runs of the same saved route, on your device, to show your pace through each stretch of it, where you tend to slow, and a finish projection. It uses only the workout and route data already in your account, collects nothing new, and shares nothing with anyone. A workout recorded in Stealth Mode never leaves your device, so it is not part of it.

Community Routes (opt-in, anonymized sharing) You may choose to share a route you have run to Community Routes, so other KYDOS users can discover it. Sharing is strictly opt-in and confirmed by you each time. When you share a route, it is published anonymously and privacy-protected: your identity is not attached to the shared route (the published record itself has no author field, so no other user can tell who shared it; a single internal mapping of route-to-author is kept privately, is never exposed to any user, is used only to rate-limit publishing, and is permanently deleted when you delete your account); the start and end of the route are automatically clipped so a shared route does not reveal where you began or finished; and only the month it was shared is retained, not exact dates or times. If a route's starting point cannot be sufficiently anonymized, we decline to publish it. Browsing, searching, voting on and saving Community Routes is free: you can save another user's community route into your own library as a private copy. You may up/down-vote a route, report a route, or add fixed condition tags (for example "muddy" or "poorly lit"); those actions are tied to your account and are deleted when your account is deleted. The anonymous shared route itself has no personal identifier and remains after your account is deleted. Publishing is effectively one-way, and deleting your account makes it permanently so. While your account exists, our internal mapping still identifies you as the route's author, so you can ask us to take a specific shared route down and we can act on it. Once you delete your account that mapping is destroyed along with the rest of your data, and from that point the shared route is genuinely ownerless: it carries no identifier, nothing records that it was ever yours, and neither you nor we can trace or withdraw it. It remains in the community library as anonymous map data. Deleting the route from your own Route Library removes only your private copy and never affects the published one. Separately, any user can report a route in the App, which removes it from discovery pending review.

Referral program If you share a KYDOS referral link from Settings, we record that link activity when someone uses it to create an account. Specifically: your user ID is stored as the referrer, and the new user's ID is stored as the referred user. We also track whether the referred user later subscribes to KYDOS Premium, which triggers a free promotional month for you (the referrer). This data is stored privately in your account. Referral records for both you and your referred contacts are permanently deleted when your account is deleted.

Squads (invite-only groups) KYDOS Squads let you form a small, invite-only training group. You may belong to one Squad at a time. Squads are joined only via an invite code or link you receive directly from an existing member — there is no user search, no public directory, and no algorithmic suggestion of other users. When you generate a Squad invite, a short-lived code (and, if you share it as a link, a deep link containing that code) is created; using it records the joining user's account against your Squad. Once you're in a Squad, the following becomes visible to your fellow Squad members only: your username, display name, Founding Member status, your profile photo (only if you've separately opted your photo public — see §8), and your position on that Squad's private leaderboard (workout stats used to rank Squad members). Nothing about you is visible to anyone outside your Squad as a result of this feature. Minors and users in Stealth Mode are never shown in a Squad roster or leaderboard — even to their own Squad members — and a user in Stealth Mode does not see their Squad's roster or leaderboard either, in either direction. Leaving a Squad or deleting your account removes your membership and roster visibility immediately. A Squad challenge that has ended or reached its goal moves to a Past challenges list; if you dismiss one there, we record that choice on your account so it stays hidden for you only (no one else's view changes), and the record is deleted with your account. The member who started a challenge can delete it, which removes it and its shared progress for the whole Squad.

If you challenge a fellow Squad member to beat one of your past efforts, only that member can see what they need to race it: for a run or ride, that effort's GPS route, route name, distance and time; for a lift, that session's completed working sets (each exercise with its reps and weight, and the name of any custom exercise in it) and its total weight moved, never your heart rate, notes or the session's date. The outcome (whether they beat it) is shown to both of you, and sending or accepting a challenge is not available in Stealth Mode or to minors.

Challenges If you join a Challenge (a time-bound fitness goal you opt into), your participation and progress toward that Challenge's goal are visible to other participants of that same Challenge, scoped to that Challenge only. Minors and users in Stealth Mode do not appear in Challenge participant lists.

Hydration data We collect beverage logs you enter: the type of beverage, volume consumed, and time logged. On the Premium tier, we also compute a smart hydration adjustment based on your workout duration, ambient temperature, and beverage dehydration factors (coffee, alcohol). Hydration data is stored in your private account and is never shared or made public.

Weather and air quality conditions With your location permission, we fetch current weather and air quality data from Open-Meteo (an open-source weather API with no advertising or user tracking) to display temperature, wind, heat index, wind chill, Air Quality Index (AQI), and running conditions on your post-workout summary and pre-workout safety screens. Two requests are made per location lookup — one for weather, one for air quality — both to Open-Meteo's public API. Your coordinates are sent per request. No account, persistent identifier, or personal data is transmitted. This data is used solely to calculate safety alerts (extreme heat, cold, storm, air quality) and your outdoor run score.

Guest and on-device data Before you create an account, the data you log — workouts, food, daily check-in answers, strength training sessions, and hydration — is stored locally on your device using AsyncStorage. This data never leaves your device until you create an account and choose to sync it (see §5a). Guest Mode is a clean slate: it never displays referral links, Guardian SOS, Squads, or any other data or feature tied to a previously-signed-in account on the same device. In Guest Mode we do not read Apple Health or Health Connect at all — no weight, no VO2 max, no steps, nothing. Health is connected only after you create an account, and only when you choose to. If you leave Guest Mode without creating an account, the data you logged stays on your device — we do not delete it, because it is yours and it was never ours to begin with. It is still there if you come back. Daily check-in answers — energy, sleep, soreness, and nutrition — are stored locally keyed by date (and, once you have an account, by account); in Guest Mode they are kept under a local-only key so your daily readiness and coaching work before you sign up. In every case they are processed entirely on your device — never transmitted to our servers in Guest Mode — and used only to select a supportive Coach message, compute an on-device readiness read, and surface (never automatically activate) the Stand Down feature. If you later create an account, this locally-stored data is migrated into it so nothing is lost (see §5a). KYDOS is not a medical provider and does not diagnose or treat any condition — see §4a. KYDOS also keeps a count, on your device only, of how many times you have started each workout type, so the Start Workout picker can show the types you use most first. It is kept separately for each account on the device, is never sent to our servers, and is used for nothing else. The same is true of the bar weight and plates you set in the Plate Calculator: they are kept on your device for each account and used only for the plate and warm-up math.

Age confirmation in Guest Mode (no date of birth stored) Because Guest Mode does not create an account, we do not collect a date of birth there. To meet our under-13 obligation (COPPA) before any use, we ask you to confirm you are at least 13 the first time you continue without an account. We store only a single yes/no flag that this confirmation passed — never your date of birth, age, or any identifying value. A user who indicates they are under 13 is not permitted to continue in Guest Mode.

Password breach check (signup and password change) When you create an account or change your password, KYDOS performs a privacy-preserving check against the HaveIBeenPwned (HIBP) breach database. Your password is hashed on-device using SHA-1, and only the first 5 characters of that hash (out of 40) are sent to our Edge Function proxy, which forwards them to the HIBP API. Neither KYDOS nor HIBP ever receives your password or enough of the hash to identify it. If our proxy is unreachable, the check is skipped (fail-open) rather than blocking you. This check is performed for your security only; no data is retained.

Body and nutrition data You may optionally log body measurements (waist, hips, chest, arms, thighs, neck, body fat percentage) and detailed nutrition data — calories, macronutrients, and a full micronutrient panel covering vitamins, minerals, electrolytes, and a breakdown of fat types, cholesterol, and other dietary components (for example saturated, monounsaturated, and polyunsaturated fats). Food searches are sent to third-party nutrition databases as described below; results may be cached on your device to speed up repeat lookups. You may also create custom foods — your own reusable food entries — which are stored privately in your account. When you search for a food, your search text is sent to third-party nutrition databases (USDA FoodData Central and Open Food Facts) to return matching foods; those databases receive only the search text, no account information or other personal data (see §7). USDA lookups pass through KYDOS's own server, which keeps a shared cache of USDA's answers keyed only by the search text, food or barcode (never by who searched) so repeat lookups are fast and keep working if USDA is briefly unavailable. To prevent abuse, the server counts lookups per caller for a short window using a one-way hash of your account id, or of your device's network address if you are not signed in; the hash is not stored with your searches and is deleted within a day. Food search also checks KYDOS's community food list, which holds only foods that at least three different people logged independently, with typical values taken across those entries and no record of who logged them. That check sends only your search text and works the same whether or not you are signed in; your search is not stored. This data is stored in your private account and is never shared or made public.

Menstrual cycle data (strictly opt-in) If you choose to enable Cycle Tracking in the App, you may log period start dates, cycle length, and period length. This data is highly sensitive. It is stored privately in your account, is never shared with any third party, is never used in community features or public-facing surfaces, and is never sold or used to train models. You can disable Cycle Tracking and delete all cycle data at any time from your Profile. Cycle information is used solely to display your estimated current cycle phase as a training context tool, not as medical advice.

Guardian SOS contact (third-party PII) If you choose to enable Guardian SOS, you provide a name and phone number for an emergency contact. This person is not required to be a KYDOS user. Their name and phone number are stored in your profile and used exclusively to send SMS emergency alerts via Twilio when you activate Guardian SOS. You can update or remove your guardian contact at any time. Guardian contact data is permanently deleted when your account is deleted. We disclose guardian contact information only to Twilio for the sole purpose of message delivery.

Your Guardian SOS contact's text replies (STOP and START only). If your emergency contact replies STOP (or a similar opt-out word) to our Guardian SOS number, the carrier stops every later text to them, an SOS included. So that you know right away instead of finding out during an emergency, Twilio passes that reply to us and we mark your contact as opted out, and KYDOS tells you to replace them. A START reply clears it. We look only at whether the whole reply is one of these keywords; we do not store the text of any reply, and any other reply is ignored. Guardian SOS still sounds its alarm when your contact cannot be texted.

Standing down a Guardian SOS asks that it is you. Once an SOS has alerted your contact, standing it down (which stops the alarm and sends your contact a false-alarm text) asks you to confirm it is you, the way your device unlocks: Face ID, Touch ID, a fingerprint or your passcode on the phone; the watch's passcode or screen lock on a watch. This stops anyone else holding your device from silencing the alarm or telling your contact it was a false alarm. The check is done entirely by your device's operating system: KYDOS never sees, receives or stores your face, fingerprint or passcode, only whether the check passed. Canceling during the five-second countdown never asks, and a device with no passcode or biometrics set up stands down as before.

Whether your Guardian SOS texts arrived. For every Guardian SOS text (the alert, a follow-up with your location, and a false-alarm notice), Twilio tells us whether the carrier delivered it or why it did not, for example when a carrier filters the message. We keep only that delivery status, Twilio's message reference and its error code, linked to the SOS record; never your contact's number or the text itself. We use it to find and fix SOS texts that did not arrive, and a failed delivery alerts the KYDOS team through our error-monitoring provider (Sentry), which receives the status and error code only.

Guardian SOS record. For each Guardian SOS we keep a short record on our server: when the alert went out, whether it carried a location, whether it was stood down, and which control stood it down (for example the Stand Down on your watch or the one on your phone). We use it only to stop a duplicate or late alert from being sent and to confirm that standing down works; it holds no location and no contact details, and when you delete your account it is kept only in anonymized form, with nothing that identifies you. So we can confirm the SOS screen on your watch appears when it should, your watch also reports, for each SOS, whether that screen appeared, how quickly, and how the SOS ended. That report goes through your phone to our crash and error reporting (Sentry, described below) and contains no location, no contact and no phone number.

Your watch's own sign-in (Guardian on the watch) So that a Guardian SOS can be sent from your Apple Watch or Wear OS watch when your phone is out of reach, your watch keeps its own sign-in to your KYDOS account. Your phone asks our server for a one-time sign-in code for your own account (no email is sent), passes only that code to your watch, and your watch exchanges it for a sign-in of its own. That sign-in is stored only on the watch (in the Apple Watch Keychain, or in the KYDOS app's private storage on Wear OS) and is never copied from or to your phone. We keep a record of which sign-in belongs to your watch, so that setting up a new one ends the old one, plus a short record of each one-time code we issued, used to limit how often codes can be issued. Signing out on your phone also ends your watch's sign-in, and deleting your account deletes these records. The watch uses this sign-in only to send a Guardian SOS you trigger. Your watch tells your phone how setting up that sign-in went, as a short status word (for example, ready or failed) and a reason code, never the code or the sign-in itself; if setup fails, that status may be included in a crash and error report (Sentry, described below).

Push notification token and preferences When you grant push notification permission, your device's push notification token (from Apple APNs or Google FCM) is stored in your profile to deliver notifications you have enabled. We also store your notification preference settings — which types of alerts you have chosen to receive (such as streak reminders, readiness updates, weekly summaries, and coach check-ins) and, for reminders you can schedule, the time of day you've set. Neither your push token nor your notification preferences are shared with advertising networks or third parties. Both are permanently deleted when your account is deleted. If you save a workout type's start settings as its default (for example indoor or outdoor, surface, interval timings, or pool length and stroke), those settings are stored on your account so they follow you to your other devices and your watch; they contain no health data and are deleted with your account. We also record on your account whether you allowed, kept, or declined notifications and location when KYDOS asked about them during setup. Your phone grants those permissions to the app, not to an account, so this record is how the App can tell you which choices you made on this account and which were already set on your phone. It holds only the choice and its date, is never shared, and is deleted with your account.

Measurement units preference KYDOS stores a display preference for whether you see Imperial (miles, pounds, feet) or Metric (kilometers, kilograms, meters) units. This is a display setting only — it does not change what data is collected — and defaults to your device's locale unless you change it in Settings.

Device timezone KYDOS stores your device's timezone (for example, "America/New_York") in your account. This is used solely to calculate calendar-day boundaries correctly for your streaks, Daily Readiness, and Earn Your Glory points, so that "today" matches your local day rather than a fixed reference timezone.

Apple Watch and HealthKit (iOS) When you grant HealthKit permission, KYDOS reads health and fitness data from your iPhone and any paired Apple Watch. Data categories include: activity metrics (steps, active calories burned, and exercise minutes — displayed as the Activity Bars); heart rate, resting heart rate, heart rate variability (HRV), blood oxygen saturation (SpO2), and respiratory rate; VO2Max estimates; heart rate recovery after a workout; sleeping wrist temperature (used only to notice a change from your own baseline; KYDOS reads the nights Apple Health already holds, up to the past year, so that baseline can form without waiting weeks); sleep analysis; body weight and composition, including BMI; height; running-specific metrics (power, cadence, stride length, ground contact time, and vertical oscillation; for each run, KYDOS saves the run's averages of cadence, ground contact time, vertical oscillation and stride length with that workout so they can appear in its detail and in your Running Form trends); nutrition and water entries recorded by other apps; mindfulness session data; and workout sessions, with their routes, including ones recorded by other apps or devices that write to Apple Health (for example Garmin or Nike Run Club). Data collected on Apple Watch syncs through the paired iPhone and is treated identically to data recorded on the phone. So that you can pick and log a saved strength routine on your watch, a copy of your saved routines (names, exercises, planned sets, reps and weights, and the reps and weights you lifted last time for each set) is kept on your Apple Watch or Wear OS watch; it is removed from the watch when you sign out or switch accounts. When you follow a routine on the watch, each set you log there (the reps and weight you confirm) is saved to your strength history exactly like a set logged on your phone, and counts toward your tonnage, personal records and Ghost Lift history; a planned set you never log is not saved. In Stealth Mode those sets stay on your phone and are not sent to our servers. No additional data categories are introduced by Apple Watch use. When the same measurement reaches KYDOS from more than one source (for example a smart ring and a watch both recording last night's sleep), KYDOS keeps one value per measurement from the most suitable source for that kind of data, never a blend of several, and records which source each stored value came from: the name of the device or app that measured it (for example the ring, the watch, the phone, or another app's name as Apple Health or Health Connect reports it), so it can show you where each number came from. The same applies on Android. A weight is stored with the time it was measured, so your current weight is your most recent reading; a weight you log by hand for an earlier day is stored on that day and does not replace a later reading.

Phone step sensor (cadence). During a run you track with KYDOS, the app reads your phone's built-in step sensor (Motion & Fitness on iPhone, Physical Activity on Android) to measure your cadence in steps per minute. This is used for live form cues and, when enough readings are collected, the run's average cadence is saved with that workout. During a walk, the same sensor's count is also shown as your live step count when no watch is counting your steps; if a watch is, its count is shown instead (the two are never added together). That live phone count is not saved. It is not read outside a workout you start, with one exception you choose: on Android, if Health Connect gives KYDOS no step count, you can turn on phone step counting from the Steps row on Track. KYDOS then counts steps with your phone's step sensor while the app is open, shows that count labeled as such (it is not a full day), keeps it only on your phone (it is not sent to our servers or used in any score), and deletes it when you turn the feature off. On Android the same Physical Activity permission is also what lets KYDOS keep a workout running with the screen off, so KYDOS asks for it, with that reason, when you start your first workout, before the workout begins. If you deny this permission, the run still records normally without cadence (on Android, an outdoor workout then stays running through its location notification instead, and an indoor one may stop recording if Android closes the app). A workout you start on your Apple Watch counts its steps the same way, with the watch's own step sensor (Motion & Fitness), only while that workout runs; the total is saved with the workout. If you deny it, the workout records normally without steps.

Heart-rate zones for watch workouts. For a workout recorded on your Apple Watch or Wear OS watch, the watch sends your phone that workout's heart-rate readings (about one every five seconds). Your phone uses them to work out the time you spent in each heart-rate zone and your highest heart rate, and those totals are saved with the workout. The individual readings are not stored and are never sent to our servers. Because they come from the workout itself, this works whether or not you have given KYDOS access to Apple Health or Health Connect.

Post-workout coach line. When you finish a workout, KYDOS shows a short coach line chosen from its fixed, human-written library and filled in with that session's own numbers (for example distance, pace and average heart rate). That line is saved with the workout so the same words appear when you open it later. For a workout recorded on your Apple Watch or Wear OS watch, your phone chooses the line after it saves the workout and sends it back to the watch, together with that workout's summary and the Glory it earned, so the watch shows the same summary as your phone. It is built only from your own data, is stored the same way as the rest of that workout, is deleted with it, and is never generated by AI. Live coach lines on your watch: during a workout running on your phone, if your headphones are connected to your watch, your phone sends each coach line it chooses straight to your watch so you hear it there. The line is the same fixed, human-written text, travels only between your own phone and watch, is not stored, and never reaches our servers.

KYDOS also writes data back to Apple Health so it appears in your health record: your completed workout sessions; the nutrition data you log (calories, protein, carbohydrates, fat and its saturated, monounsaturated and polyunsaturated breakdown, cholesterol, fiber, sugar, sodium, potassium, magnesium, calcium, iron, phosphorus, copper, manganese, selenium, zinc, vitamins A, C, D, E and K, the B vitamins (thiamin, riboflavin, niacin, B6, B12, folate and pantothenic acid), and, on Android, trans fat; each only when the food you logged has that value); the water you log; the body weight you log in KYDOS, stored at the date you weighed in; and mindfulness session data when you complete a guided mind-body session in the App. These writes happen only while you have Health access turned on in KYDOS. This includes workouts you record on your Apple Watch: with Health access off, a workout recorded on your watch is kept in KYDOS only, is not saved to Apple Health, and does not count toward your Activity rings.

Standalone Apple Watch coaching: The KYDOS Apple Watch app supports phone-free workout coaching. To enable this, your coach personality selection and subscription entitlement status are cached locally on your Apple Watch when it is in range of your iPhone. This allows the Watch to deliver coached workouts independently. No additional data categories are transmitted to our servers as a result — only the same profile and subscription data already described in this policy is involved.

Watch settings: If you change your watch settings in the App (which workout figures your watch shows, whether the coach speaks from your watch, wrist vibrations, whether the watch app opens when you start a workout, and what the KYDOS watch-face complication shows), those choices are stored on your account so they follow you to a new phone, and are sent to your paired Apple Watch or Wear OS watch. They are preferences only, contain no health data, are never shared, and are deleted with your account.

You may revoke HealthKit access at any time: Settings > Privacy & Security > Health > KYDOS.

Android Health Connect On Android, KYDOS reads the following Health Connect data types: steps, heart rate, resting heart rate, heart rate variability, active calories, distance, sleep, body weight, height, body fat percentage, blood oxygen saturation (SpO2), respiratory rate, body temperature and, where your watch records it and Health Connect supports it, nightly skin temperature (both used only to notice a change from your own baseline; for skin temperature KYDOS reads the nights Health Connect already holds, up to the past year, so that baseline can form without waiting weeks), VO2Max, nutrition and hydration entries, and exercise records. Health Connect is optional: if it is not installed or you do not grant access, every part of KYDOS that does not need it keeps working. KYDOS also writes to Health Connect so it appears alongside other health data: your completed workout sessions (ExerciseSession and Distance records) and the nutrition data you log (calories, protein, carbohydrates, fat and its saturated, monounsaturated and polyunsaturated breakdown, cholesterol, fiber, sugar, sodium, potassium, magnesium, calcium, iron, phosphorus, copper, manganese, selenium, zinc, vitamins A, C, D, E and K, the B vitamins (thiamin, riboflavin, niacin, B6, B12, folate and pantothenic acid), and, on Android, trans fat; each only when the food you logged has that value, as Nutrition records); the water you log (Hydration records); and the body weight you log in KYDOS (Weight records, at the date you weighed in). You may revoke permissions at any time: Health Connect > App Permissions > KYDOS.

Health store write-back (both platforms) KYDOS writes your completed workout sessions, the nutrition and water you log, and the body weight you log to your device's health app (Apple Health on iOS and Health Connect on Android), plus mindfulness sessions on iOS. Nothing else is written to either health store. When KYDOS reads your weight back from the health app, it skips the readings KYDOS itself wrote, so one weigh-in is never counted twice.

When you delete a workout, food entry, water entry or body-weight entry in KYDOS, KYDOS also removes the copy it wrote to Apple Health or Health Connect, so your health app matches what you told KYDOS. Each copy KYDOS writes carries a KYDOS identifier for that entry, and the removal matches that identifier exactly. It removes only data KYDOS itself wrote: readings from your watch, scale, other apps or devices are never touched, and both Apple Health and Health Connect only allow an app to delete its own data. This happens only while you have Health access turned on in KYDOS; if you have turned it off, KYDOS does not touch your health app, and you can remove the copy there yourself. Copies written before this feature, and workouts your Apple Watch saved to Apple Health itself, carry no KYDOS identifier and are left in place; you can delete them in the Health app. When you edit one of these entries in KYDOS (a workout's time or distance, a food's amount, a water entry), KYDOS replaces its own copy in Apple Health or Health Connect with the edited values, at the entry's original time, under the same rules: only a copy KYDOS itself wrote, only while Health access is on, and an entry that has no KYDOS copy there does not gain one. A drink you log as food also counts toward your water for the day; that water entry is linked to the food entry, so deleting the food removes it and changing the amount updates it.

Third-party workout display Oura and WHOOP (optional direct connections) You can connect an Oura or WHOOP account from Settings > Devices & Apps. This is separate from Apple Health and Health Connect: connecting the account is your choice to let KYDOS read it, and it does not depend on Health access. Connecting uses that service's standard account sign-in (OAuth). The sign-in exchange is completed by a KYDOS server function that holds KYDOS's app credentials for the service, and the resulting access token for your Oura or WHOOP account is stored with your KYDOS account, visible only to you, so the App can keep your data up to date. KYDOS only reads from these accounts; it never writes to them and sends them none of your KYDOS data.

KYDOS stores these raw measurements in your account with your other health data, recording which source each value came from, and uses them for your readiness, trends and other insights. KYDOS does not store, display or use either service's own scores (such as readiness, sleep, recovery or strain scores); it computes its own from the raw measurements. Workouts from these services are added to your workout history attributed to their source, under the same rules as the imported sessions described below. KYDOS records the time you first connected each service so that data from before you connected is kept as history only. You can disconnect at any time from the same Settings screen: KYDOS then deletes the stored access token and stops reading the account. Data already imported stays in your account like the rest of your history until you delete it or your account. You can also revoke KYDOS's access from your Oura or WHOOP account.

Workout sessions recorded by other apps or devices (such as Garmin, Nike Run Club, or your Apple Watch's own Workout app) that were written to Apple Health or Health Connect are added to your KYDOS workout history, clearly attributed to their source, so your training load, readiness and trends reflect all of your training. With your health permission, KYDOS reads such sessions from the last 180 days and stores them in your account with their time, duration, average heart rate, and, where the source recorded them, distance, calories and step cadence (on Android these are read from the same app that recorded the session, within that session's time window). For runs, rides, walks and hikes whose source recorded a GPS route, KYDOS also stores that route in your account so you can race the session as a ghost; it is private to your account like every route you record in KYDOS. On Android, Health Connect asks you to share each such route individually, and KYDOS asks only when you choose that session as a ghost. If the same session was recorded twice, for example by KYDOS and by your watch at the same time, it is kept once. Sessions recorded before you created your KYDOS account are kept as history only: they inform your trends and training load, and never count toward Earn Your Glory points or streaks. Sessions recorded after you created your account count toward points and streaks under the same verification as workouts recorded in KYDOS (a heart-rate reading is required).

Diagnostics KYDOS uses Sentry for crash and error monitoring. Crash and diagnostic data is linked only to an anonymous internal account identifier (your account's UUID) — never to your name, email address, phone number, or IP address, which are actively stripped before any report is transmitted. Health measurements and GPS data are also removed before transmission. For users in EU/EEA/UK/Switzerland, Sentry is initialized only after you grant analytics consent via the in-app consent screen.

Glory metrics and Founding Member status Your Glory Index score, tier, earned point history, and Founding Member status (if applicable) are derived from your activity and stored in your account. These power the Earn Your Glory feature, your profile display, and the Apple Watch glance.

Subscription status Your KYDOS subscription status (active, trial, canceled) is stored in your account and shared with RevenueCat to manage entitlements. RevenueCat receives your anonymous user identifier (Supabase UUID) only — no email address, payment details, or health data. Apple and Google process your subscription payments directly under their own terms and privacy policies.

Music playback control KYDOS can optionally show and control the music playing during your workout — pause, resume, skip, and display the track title and artist. If you use a paired watch, its Now Playing page can also show and control what is playing outside a workout, read only when that page asks for it while KYDOS is open.

On Android, this works with whatever music or podcast app you're playing, without requiring any specific app's SDK. It requires you to grant Android's "Notification access" permission, which is the only way Android exposes another app's active media session. KYDOS does not read notification content: the permission is used solely to query playback metadata (title, artist, album artwork, play/pause state) and send standard transport commands. Before Android's Notification access screen opens, KYDOS tells you what the permission is for and that it never reads or stores your other notifications, and you can choose Not now. Granting this permission is optional — if declined, you can still use every other workout feature. You can revoke it at any time in Settings > Apps > Special app access > Notification access > KYDOS.

On iOS, this works with the Music app (Apple Music and your local library) via Apple's MediaPlayer framework. No account connection is required, and this data never leaves your devices (your phone and, if you use one, your paired watch).

You can also optionally connect your Spotify account from Settings > Devices & Apps for the same playback control and now-playing display. Connecting uses Spotify's standard account sign-in (OAuth); completing that sign-in, and later renewing the session (about once an hour while connected), relays the exchange through a KYDOS server function, which forwards it to Spotify and does not retain your Spotify credentials, tokens or listening history — it is not stored in our database. The resulting Spotify session token is stored only on your device and is used to show the current track and send play/pause/skip commands to the Spotify app. To show the current track on your watch outside a workout, KYDOS also uses that token to ask Spotify's own servers what is playing (Spotify's standard playback-state request). That request goes directly from your phone to Spotify, and nothing from it is sent to KYDOS. Where Spotify makes it available to your account, so that your watch can control Spotify while KYDOS is in the background, KYDOS also sends Spotify's standard play, pause and skip requests from your phone directly to Spotify's servers when you tap a control on your watch. If Spotify answers that playback control needs a Spotify Premium account (Spotify allows it for Premium accounts only), KYDOS remembers that answer on your phone and stops offering the control. Neither the requests nor that answer are sent to or stored by KYDOS. You can disconnect your Spotify account at any time from the same Settings screen.

Except for the Spotify sign-in and session-renewal exchanges described above, this data stays on your phone and your paired watch and is never transmitted to, stored, or logged by KYDOS.

What we do not collect Device permissions on Android. KYDOS asks only for what a feature you are using needs, at the moment you use it: location (during an outdoor workout), Physical Activity (during a workout, or when you turn on phone step counting, as above), notifications, and the camera (only when you take a progress photo). It does not request Bluetooth, nearby devices, microphone, body sensors, or access to your photos, videos, music or audio files: barcode scanning uses Google's scanner, which never gives KYDOS the camera feed, and choosing a photo uses Android's photo picker, which shares only the photo you pick.

We do not collect advertising identifiers, cross-app tracking data, background health data, or microphone data, and we never record or store your location outside a workout you started, a Guardian Beacon you turned on, or a Guardian SOS you trigger (the one-off "what is near me" lookups described in §2 send a position to answer the question and are not kept). We do not collect any data for advertising purposes. We do not use any third-party behavioral analytics SDKs — no Amplitude, Mixpanel, Segment, Firebase Analytics, or similar product exists in this app. We do not track you across other apps or services.

3. How We Use Your Data

We use your data solely to operate the App:

4. Health Data

Your health data is used only to power the features you have enabled. We do not sell it, license it, or share it with insurers, employers, or data brokers. We do not use it to train artificial intelligence or machine learning models.

You may revoke health data access at any time:

Glory Points earned through sleep and active energy require Apple Watch as the verified data source. Manually entered health data does not qualify.

Your most recent body-weight reading from Apple Health or Health Connect is saved to your weight history (one entry per day) so your trends and nutrition targets can use it, and a height recorded there fills your profile height only if you have not entered one. If you delete a body-weight reading that was automatically imported from Apple Health or Health Connect, KYDOS keeps a small record of that deletion (the calendar date only, with no weight value) so the reading is not re-imported the next time your health data syncs. This record contains no health measurement, is visible only to your account, and is permanently deleted when you delete your account.

When you delete a workout, KYDOS deletes it everywhere it is used: the workout itself, its route, a lift's sets and the personal records it set, the Glory points it earned, and its contribution to your streak, leaderboard stats, Squad challenges and today's readiness. A lift is also removed from the copy of your lift history kept on your device. KYDOS keeps one small record of the deletion: the workout's identifier and the app or service it came from, with no time, measurement or other workout data. It exists only so that a workout imported from Apple Health, Health Connect, Oura or WHOOP is not imported again on the next sync, and so another of your devices does not restore its own copy. It is visible only to your account, is included when you export your data, and is permanently deleted when you delete your account.

4a. Daily Check-In

The optional daily check-in (energy, sleep, soreness, nutrition) is a physical-training-readiness tool only. Your answers are stored locally on your device and are used only to select a supportive Coach message, compute an on-device readiness read, and optionally surface (not activate) the Stand Down feature, all processed locally. In Guest Mode they are never transmitted to our servers; on an account they are also used server-side to compute your Daily Readiness. If you begin in Guest Mode and later create an account, your locally-saved check-ins are migrated into it (see §5a). KYDOS is not a medical provider and does not diagnose, treat, or assess any physical or mental condition. Mental-health monitoring is not a feature of KYDOS today.

4b. Information About Other People

Your emergency contact. If you enable Guardian SOS you provide a name and mobile number for a person you choose. That person is not a KYDOS user, so we process their information on the basis of our legitimate interest in operating a safety feature you have asked for, and on your representation that you have their permission to designate them. We use it for one purpose only: to deliver a Guardian SOS message when you trigger one. We do not market to them, build a profile of them, enrich their record, or use their number for any other purpose. It is stored with your profile, is visible only to you, and is deleted when you remove them or delete your account. You are responsible for obtaining that person's consent before designating them. If you are an emergency contact and want your number removed, contact privacy@kydoshealth.com and we will remove it.

Your Guardian Beacon contacts. If you use Guardian Beacon, the names and phone numbers of the people you share with stay on your device and are never sent to us; our servers hold only a one-way hash of each person's link and whether they agreed (see §5c). A Guardian Beacon contact who no longer wants to view can simply stop opening the link, and the person who sent it can remove them at any time.

Referrals. If you share a referral link, we record that the invitation was accepted so the reward can be credited. We do not ask you for, and do not collect, the contact details of anyone you invite.

Biometric identifiers. KYDOS does not collect, capture, or store biometric identifiers or biometric information as those terms are defined under laws such as the Illinois Biometric Information Privacy Act. We do not perform facial recognition, fingerprint or voiceprint matching, retina or iris scanning, or hand or face geometry analysis. Progress photos you upload are stored as images for your own review and are never analyzed to identify you. Heart-rate and related physiological readings are health measurements used to compute the metrics described in §3, and are not used to identify you.

5. Stealth Mode

When Stealth Mode is active:

5a. Using KYDOS Without an Account

KYDOS offers a "Continue Without an Account" option on first launch. Choosing it does not create an account of any kind, anonymous or otherwise — no request is sent to our servers at all. It sets a flag stored only in your device's local app storage, so the app knows to keep working without you signing in. No email, password, or any identifying information is collected, transmitted, or stored anywhere but your device.

While using KYDOS this way, your workouts and all other activity stay entirely on your device — nothing syncs to our servers, no server-side record of any kind is created, and no Glory accrues, for the same reason described in Section 5 above: Earn Your Glory points, Glory Index, and streaks are computed from data on our servers, and nothing reaches our servers in this mode. You can still see your own workout history within the app at any time — it's simply read from your device instead of from our servers.

If you later create an account (email, password, and username), the data you accrued on-device is migrated into that new account so nothing is lost — your workouts, food logs, daily check-ins, strength training sessions (including personal records and saved routines), and hydration logs. Each store is uploaded and then cleared from the device only after its upload succeeds, so a partial failure never silently drops data. This is the only path by which any of this locally-stored data ever reaches our servers, and it happens only when you actively choose to create an account. This is different from Stealth Mode on an account you already have: Stealth Mode workouts are never retroactively synced even after Stealth Mode is turned off, because that data was deliberately kept private on an account that already existed at the time. Using KYDOS without an account has no existing account for anything to be private "on" — creating one afterward simply brings your data with you, rather than exposing something that was previously protected.

5b. The Notification Center

The Notification Center (the bell at the top of the app) is where KYDOS keeps everything it has told you: app and feature updates, notices that these documents have changed, the reminders you turned on, and notices about your account or Guardian. It exists so that a message does not disappear the moment its banner does.

What is stored on your device. When KYDOS delivers a notification to you, the App records its title, body and time in your device's local app storage, under your account, so you can read it again later. This record never leaves your device, and it is separate per account on a shared device.

What is stored on our servers. Two kinds of message come from us rather than being generated on your device: an occasional announcement sent to everyone, and a notice addressed to you specifically (for example, something about your account). We store which messages you have read, and when, and which ones you have cleared from your list, so a message you removed stays removed on another device or after a reinstall. We do not store whether you opened the Notification Center, how long you looked at it, or anything else about how you use it.

How long notices are kept. You can remove any notice, or clear them all, at any time. Otherwise, how long a notice stays depends on what it is. App updates and notices about changes to these documents are removed automatically after a set period, and a reminder is removed once it is no longer relevant. Notices about your account or about Guardian are never removed automatically, because you may need to find one later; they stay until you remove them yourself or delete your account.

Notices about changes to this Policy and to the Terms are produced by your own device, by comparing the version it has against the version it last saw. We are not told that your device showed you one.

What this channel will never be. The Notification Center is informational. It will not be used to pressure, guilt, or repeatedly prompt you into upgrading, re-subscribing, or anything else, and it carries no advertising. This is enforced in the product itself, not only as a policy: copy that uses urgency, scarcity, or guilt phrasing is rejected by our own systems before it can be sent.

5c. Guardian Beacon (Live Workout Location You Share)

Guardian Beacon ("Beacon" where space is short) is an optional, free feature for adult accounts that lets you share your live location during a workout you start with up to five people you choose. It is separate from Guardian SOS, the other half of KYDOS Guardian. It is off until you set it up, it runs only during a workout you start (or until you stop it, and never longer than six hours), and it is switched off while Stealth Mode is on.

How your contacts get access. For each contact, KYDOS creates a private link on your device and you send it yourself, from your own phone: in a text from your own messaging app, in an email from your own email app, or by copying it or using your phone's share sheet and sending it any way you choose (useful when your phone has no cell service). KYDOS never receives the link however you send it: it goes only to your phone's own messaging, email, clipboard or share features, and on from there through whatever service you pick, which carries it like any other message you send. A copied link sits on your phone's clipboard like anything else you copy, until you copy something else. KYDOS sends no texts for Beacon and uses no SMS provider for it. It sends no emails for Beacon either. Your contacts' names and phone numbers stay on your device: they are never sent to our servers. Before a contact is saved, the app asks you to confirm that you choose to share your live location with that person, and checks that the phone number is complete (a 10-digit US number, or the full number with its country code), so a link is not sent to the wrong person. A contact opens their link in a web browser (no KYDOS account needed) and taps to agree before they can see anything. If you choose to send a "started" message when a Beacon begins, it is also sent from your own phone, and only if you send it.

End-to-end encryption. Your locations are encrypted on your device (or on your watch) before they are uploaded, with keys that exist only on your devices and in the links you sent. The key part of a link sits after the "#", which web browsers never send to any server. KYDOS cannot decrypt your Beacon locations, and neither can our hosting providers.

The key on your watch. When your phone gives your watch the key it needs to start a Beacon, that key is never sent in readable form over a connection that could pass through anyone else's servers. On Apple Watch it is encrypted to a key held in your watch's Secure Enclave, which never leaves the watch. On Wear OS it is sent only over a direct connection between your phone and watch, such as Bluetooth.

What our servers store, and for how long. A one-way hash of each contact's link (not the link itself), whether and when each contact agreed, the times each Beacon started and ended, the type of device that recorded it, how many locations were shared, the encrypted locations and encrypted keys, and, as with any web request, the IP addresses of the devices that upload and view. We cannot read the locations. Encrypted locations and keys are deleted 24 hours after a Beacon ends; the record that a Beacon happened (its times and count) is deleted after 30 days; a contact you remove is deleted after 30 days.

What a contact sees. While a Beacon is live: your latest location on a map, its accuracy, your speed, and when it was last updated. The link stops showing any location the moment the workout ends, the moment you turn Beacon off, and on its own if your phone or watch stops checking in for about two minutes (for example, if it dies or loses its connection). Our servers enforce this, so it holds even if your device never says the Beacon ended. After that the page says only that the Beacon ended: no map and no last position, not even where you stopped. The encrypted locations are then deleted on the schedule below.

The map. To draw the map, your contact's web browser loads map images directly from OpenStreetMap's tile servers. That means OpenStreetMap receives your contact's IP address and which map area is being shown, which is roughly where you are. It does not receive the link, your name, or anything from KYDOS, and KYDOS never sees the location: it is decrypted only in your contact's browser. OpenStreetMap's own privacy policy applies to those requests. The page says this under the map. Anyone who has a contact's link can view that page until you reset or remove that contact, so share links only with people you trust. Removing a contact stops their link working immediately.

Beacon data is included when you export your data (the locations and keys in their encrypted form, since we cannot decrypt them) and is deleted when you delete your account. Beacon is not an emergency service; see the Terms of Service, section 10a.

6. Community Routes, Places to Train and Races Near You

Community Routes is available in this version of KYDOS. Sharing a route is strictly opt-in, confirmed by you each time, and published anonymously with the start and end of the route clipped — the full description of what is shared and what is stripped is in §2 above ("Community Routes"), and that description governs.

Three features show things near you (Community Routes in the Arena tab; Places to Train and Races Near You in the Train tab), and only the first involves any data of yours:

What leaves your device for all three: to show you what is nearby, the App sends your approximate coordinates to our own server, which returns the matching routes, places, or events. These lookups are coordinates only — they carry no workout, no health data, and nothing about what you searched for is retained as a search history. See §2 ("Location") for how this differs from workout location collection.

Minors and Stealth Mode: users under 18 and users with Stealth Mode enabled cannot publish a route and are not shown Community Routes. This is enforced on our server, not only in the App, so it holds regardless of the device or app version. Places to Train and Races Near You are public reference data and are available to everyone, including Stealth users — there is nothing about you in them to protect.

7. Data Sharing

We share your data only as follows:

Recipient Purpose Data
Supabase Database, authentication, storage, and edge functions (data hosting) Encrypted account data
RevenueCat Subscription management — entitlements only; never receives payment or bank data Anonymous user identifier (UUID), subscription status
Twilio Guardian SOS SMS alerts, their delivery status, and passing on the contact's STOP / START replies Guardian emergency contact's phone number
Resend Transactional email Email address
Sentry Crash and error diagnostics (PII-scrubbed, EU-consent gated; any user can turn it off in Settings under Consent & Analytics, and that choice holds across restarts) Anonymous crash reports
Expo Push notification delivery Device push token only (no health data)
Google Sign in with Google (account creation/login); Android push (FCM); Health Connect data sync, and workout/nutrition write-back if granted Name and email address, if you sign in with Google; push token; health data you authorize
Apple Sign in with Apple (account creation/login); HealthKit data sync — KYDOS writes completed workout sessions, logged nutrition, water and body weight, and mindfulness session data to Apple Health Name and email address (or Apple's private relay address), if you sign in with Apple; health data you authorize; completed workout sessions, nutrition, water and body weight data, mindfulness session data
Spotify (only if you connect it) Completing the Spotify sign-in and renewing the session (relayed through a KYDOS server function, which keeps nothing), then showing and controlling what is playing The authorization code and session-renewal token, relayed and not stored; playback requests go from your device to Spotify directly
Oura, WHOOP (only if you connect them) Reading the health data you authorize from your Oura or WHOOP account (read-only, OAuth) Your authorization only; KYDOS sends them none of your KYDOS data and receives the measurements listed in §2
USDA FoodData Central Nutritional food database lookup, through KYDOS's server Search query text, food id or barcode (no user PII transmitted)
Open Food Facts Food search and barcode lookup Search text and scanned barcode (no account, no PII)
HaveIBeenPwned Password breach check (k-anonymity) 5-char SHA-1 hash prefix only — no password, no full hash
Open-Meteo (weather) Weather on post-workout summary and pre-workout safety screen Latitude/longitude (no account, no tracking)
Open-Meteo (air quality) AQI, UV index for pre-workout safety alerts Latitude/longitude (no account, no tracking)
Law enforcement Legal obligation Minimum required by law

Apple and Google process subscription payments directly under their own terms and privacy policies.

Food data returned by Open Food Facts is made available under the Open Database License (ODbL); Open Food Facts is a collaborative, non-commercial database.

Content we import, rather than data we send. Two of these features (Places to Train and Races Near You) show public reference data that we imported once into our own database. These are sources, not recipients — the App does not contact them, and nothing about you is ever sent to them:

Both credits are also shown in the App, on the Legal screen and on the screens where the data appears.

We do not share data with advertisers, data brokers, or third-party analytics services.

8. Data Security and Breach Notification

We implement reasonable technical and organizational measures to protect your data, including encryption in transit and at rest and access controls that ensure each user can only access their own records. However, no system is completely secure, and we cannot guarantee absolute security. You provide your data at your own risk.

We are not responsible for the independent privacy or security practices of the third-party services listed in §7. Each provider named there operates under its own security program and terms.

Breach notification. KYDOS is a direct-to-consumer health and fitness app. We are not a HIPAA-covered entity, but we do handle personal health information, and we hold ourselves to the applicable breach-notification law. In the event of a breach of security involving unsecured personally identifiable health information, we will notify affected users and the U.S. Federal Trade Commission — and, where a breach affects 500 or more residents of a state or is otherwise large enough to require it, prominent media — as required by the FTC Health Breach Notification Rule (16 C.F.R. Part 318), and we will comply with all applicable state data-breach-notification laws. Notice will be provided without unreasonable delay and no later than the deadlines those laws require (for the FTC Rule, within 60 calendar days of discovery). Notice will describe what happened, the information involved, the steps we have taken, and what you can do to protect yourself.

Profile photos are stored in private storage and delivered via short-lived signed links. By default your profile photo is visible only to you. You may opt in to make it visible to other signed-in KYDOS users in Settings > Privacy & Data, the one place this choice is made; uploading a new photo never changes it. If you enable Stealth Mode, your photo reverts to private regardless of this setting. Minor accounts (under 18) can never make their photo public — this restriction is enforced at the database level and cannot be overridden.

Body photos (progress photos) are always private — visible only to you, regardless of any setting.

Social profile information. When you're in a Squad, the app reads your fellow Squad members' profile fields — username, display name, Founding Member status, and (if they have separately enabled the public-photo toggle) their profile photo — to display your Squad roster and Squad leaderboard. This read is performed through a SECURITY DEFINER database function that enforces the same privacy guards used elsewhere in the app: minors are never exposed, stealth users are never exposed, and users who have not opted in to public photo visibility never have their photo returned. If you are in Stealth Mode, you see no Squad roster/leaderboard data and no one sees yours, regardless of anyone's settings.

9. Your Rights

Export Export all your data at any time: Settings > Privacy & Data > Export My Data. The export is a single JSON file you save or share from your device. It includes your account details (email, sign-in methods, account dates), every section of data you logged or synced, the Readiness scores and Glory records KYDOS stored for you, and your photo files, plus a plain-language guide to every section and field. It never includes credentials (sign-in tokens for services you connected, or your device's push token), and it never includes information about other people: for example, it records that you sent a referral or a challenge, but not whether the other person subscribed or how their race went. To deliver it, KYDOS prepares the file in private server storage that only you can reach, through a download link that expires after 10 minutes; the stored file is deleted as soon as your device has downloaded it, and in any case within 30 minutes. The file is deleted from KYDOS's app storage on your device once the share sheet closes.

Deletion Delete your account: Settings > Danger Zone > Delete Account (Settings opens from your avatar at the top of any tab). Deletion is immediate, covers all tables, and is permanent — workouts, routes, food logs, body measurements, strength history, hydration logs, referral records, push tokens, notification preferences, and your profile are all deleted. We also ask RevenueCat to delete the customer record it holds for your account identifier. Deleting your account does not cancel a subscription you bought through Apple or Google Play: they bill it, so cancel it in your subscription settings to stop being charged. The app reminds you of this before you delete.

Two narrow exceptions are retained in de-identified form only, with the link to your account removed: (1) if you gave data consent, a record containing only the timestamp and consent version is retained for GDPR Art. 5(2) / Art. 7(1) accountability — no personal data remains; (2) if you ever triggered Guardian SOS, a record containing only the send timestamp is retained to meet legal accountability obligations — no personal data, no guardian phone number, no location data remains. These anonymized records cannot be linked back to you after deletion.

EU, UK, and California users EU/UK/CA users have additional rights — including access, correction, erasure, portability, and the right to object to processing. Submit requests to privacy@kydoshealth.com with subject: "Data Rights Request."

Data retention. We keep your data only as long as we need it to provide the Service, then delete it. Specifically:

Data Retention
Account, profile, and all logged data (workouts, health metrics, nutrition, body, hydration, strength, routes) Retained while your account is active. Deleted immediately and permanently when you delete your account — a hard delete across all data tables, not a soft "deactivation."
Encrypted database backups Deleted data may persist in encrypted, access-controlled disaster-recovery backups for up to 30 days after deletion, on a rolling basis, after which it is permanently purged as backups age out. Backups are never used to repopulate a deleted account.
Crash and diagnostic reports (Sentry) 90 days, then automatically deleted.
Guardian Beacon (§5c) Shown to no one once the Beacon ends (workout end, turned off, or about two minutes without the device checking in). Encrypted locations and keys: deleted 24 hours after the Beacon ends. Beacon times and counts: 30 days. Removed contacts (link hash only): 30 days. All of it deleted with your account.
Anonymized accountability records (consent log, Guardian SOS send log) Retained only in de-identified form — the link to your account is removed and no personal data, guardian phone number, or location remains — kept no longer than needed to meet our legal-accountability obligations (GDPR Art. 5(2)/7(1) and equivalent) and never re-linked to you.
Authentication session tokens Expire automatically; not retained after expiry.
Guest / on-device data (no account) Stored only on your device, never on our servers; removed when you uninstall the app or clear its data.

United States — CCPA/CPRA and other state privacy laws. We extend the following rights to all U.S. users, not only California residents (we chose to apply one consistent, higher standard rather than gate rights by state):

We do not "sell" and do not "share" your personal information as those terms are defined under the California Consumer Privacy Act, as amended by the CPRA — and we have not done so in the preceding 12 months. Because we never sell or share, there is no "Do Not Sell or Share My Personal Information" action to take — the outcome that right protects is our default for every user. Sensitive personal information (such as your health data and workout location) is used only to provide the features you have enabled; we do not use or disclose it to infer characteristics about you, so the CPRA right to limit the use of sensitive personal information is honored by default. Residents of states with their own consumer-privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others) have the same core rights described above. To exercise any right, or to use an authorized agent, contact privacy@kydoshealth.com with subject "Data Rights Request"; we may need to verify your identity through your account before acting.

Opt-out preference signals. We honor the Global Privacy Control (GPC) and comparable browser- or device-level opt-out preference signals where they reach us. Because we do not sell or share personal information and do not serve advertising, such a signal requires no change to how we treat your data — the protection it requests is already our default for every user.

Automated decision-making and profiling. KYDOS computes scores and suggestions from your own logged data — including your Readiness Score, Training Load, Glory Index, and coaching cues. These are produced by fixed, deterministic formulas published in the App, not by artificial intelligence, machine learning, or any model trained on user data. They are informational only. They do not produce legal effects or similarly significant effects concerning you, are never used to make decisions about your eligibility for credit, insurance, employment, housing, or any other benefit or service, and are never disclosed to any third party for such purposes. You may stop the processing at any time by disabling the relevant feature or deleting your account. Where you are subject to the GDPR, you may also contact us to request human review of, or to object to, any such processing.

9a. Consumer Health Data — Washington, Nevada, and Comparable State Laws

This section is our consumer health data privacy notice for residents of states with dedicated consumer-health-data laws, including the Washington My Health My Data Act, Nevada SB 370, and comparable laws as they take effect. It supplements, and does not replace, the rest of this Policy.

Consumer health data we collect. Data you log or connect that relates to your physical condition: workouts and their duration, distance, pace, and route; heart rate, heart-rate variability, and resting heart rate; sleep duration and stages; respiratory rate; body weight, body measurements, and progress photos; nutrition and hydration logs; daily check-in responses; menstrual-cycle information if you choose to log it; and the scores derived from these, such as your Readiness Score. Sources are listed in §2: your own entries, the App's sensors during a workout, Apple Health or Health Connect where you have granted access, and an Oura or WHOOP account if you connect one.

How we use it. Solely to provide the features you have enabled — to display your data back to you, to compute the metrics described in §3, and to sync your data across your own devices. We do not use consumer health data for advertising, marketing, or profiling, and we do not use it to train artificial-intelligence or machine-learning models.

Who we share it with. We do not sell consumer health data, and we have never done so. "Sell" includes the exchange of such data for anything of value, as those laws define it. We do not share consumer health data with advertisers, data brokers, analytics networks, or social platforms. The only parties who process it are the infrastructure providers listed in §7, each bound by contract to process it solely on our instructions, and any recipient you yourself direct — for example, the emergency contact you designate for Guardian SOS.

Your rights. You may confirm whether we collect, share, or sell your consumer health data; access that data; withdraw consent to its collection and sharing; and have it deleted. Exercise any of these at Settings > Privacy & Data, or contact privacy@kydoshealth.com with subject "Consumer Health Data Request." We will respond within the period the applicable law requires. On a deletion request we delete the data from our live systems and direct our processors to do the same; encrypted disaster-recovery backups age out on the rolling schedule in §9. If we deny a request you may appeal by replying to our response, and we will explain the basis for any denial in writing.

Consent. Where these laws require your affirmative consent before we collect or share consumer health data, we obtain it separately from any other terms, and you may withdraw it at any time without losing access to features that do not depend on it. Withdrawing consent does not affect processing that already occurred.

No geofencing. We do not operate, and will not operate, any geofence around a health care facility, and we do not use location to identify or infer that you have sought health care services.

10. EU / EEA / UK / Switzerland

Data controller: Kydos Health L.L.C. — privacy@kydoshealth.com

In-app consent screen: Users whose device locale indicates an EU/EEA/UK/Switzerland region are presented with a consent screen on first launch. This screen covers our one optional data practice — crash analytics (Sentry) — which you may grant or decline. You can update your analytics preference, and exercise your data-export and deletion rights, at any time from Settings > Privacy & Data (available to all users, not only EU regions). Coaching personalization is not a separate consent category: tailoring coaching and readiness to your own logged data is part of the core service you sign up for, processed under Art. 6(1)(b) — see the legal-bases table below.

Legal bases:

Activity Basis
Account and workout data Contract (Art. 6(1)(b))
Subscription processing Contract (Art. 6(1)(b))
Glory Points and streaks Contract (Art. 6(1)(b))
Hydration and strength tracking Contract (Art. 6(1)(b))
Push notifications Consent (Art. 6(1)(a))
Transactional email (welcome, signup confirmation, password reset) Legitimate interest (Art. 6(1)(f))
Crash monitoring (Sentry) Consent (Art. 6(1)(a)) — optional, controlled via consent screen
Coaching personalization (tailoring to your own logged data) Contract (Art. 6(1)(b)) — core service, not a separate consent
Legal compliance Legal obligation (Art. 6(1)(c))

Health data (HealthKit / Health Connect, and Oura or WHOOP if you connect them) is processed under Art. 9(2)(a) — explicit consent granted when you enable HealthKit or Health Connect, or connect an Oura or WHOOP account. You may withdraw at any time in device settings, or by disconnecting the Oura or WHOOP account in Settings > Devices & Apps. Withdrawal does not affect prior processing.

Your rights (Art. 15–22): You have the right to access, rectify, erase, restrict, and port your personal data, and to object to its processing. You may also withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise any right, contact privacy@kydoshealth.com or use the in-app tools at Settings > Privacy & Data.

Retention: Personal data is retained only as long as necessary to provide the Service and is deleted when you delete your account, subject to the limited, de-identified accountability records described below. See the full retention schedule in §9 ("Data retention") for specific periods, including the up-to-30-day rolling backup window and the 90-day crash-report period.

International transfers: Data is stored on servers in the United States. Transfers from the EEA or UK are governed by Standard Contractual Clauses. Contact privacy@kydoshealth.com for documentation.

Supervisory authority: You may file a complaint with your local data protection authority. EU: edpb.europa.eu. UK: ico.org.uk.

11. Children

KYDOS is not intended for users under 13 (under 16 in the EEA/UK). We actively enforce this both before any use (Guest Mode) and at account creation:

If you believe a child under 13 has created an account, contact privacy@kydoshealth.com and we will delete it immediately. The EEA/UK minimum age is 16; users who indicate they are 13–15 and whose device locale indicates EEA/UK are blocked from account creation.

12. Changes

We will notify you of material changes via in-app notice before they take effect. Continued use after the effective date constitutes acceptance.

13. Contact

Kydos Health L.L.C. Privacy inquiries and data subject requests: privacy@kydoshealth.com General inquiries: contact@kydoshealth.com Website: kydoshealth.com

KYDOS · Kydos Health L.L.C. · Privacy Policy · Terms of Service