# Privacy Policy

**Last updated**: 28 August 2026

## What we collect

- **Account data**: email, name (you provide)
- **Training data**: activities, recovery metrics (you provide or sync from third-party services)
- **Usage data**: aggregated, anonymous analytics

## What we DON'T do

- We never sell your data
- We never share with third parties (except OAuth providers you connect)
- We never train AI models on your personal data

## Where data lives

- **EU-hosted** infrastructure
- Encrypted in transit (HTTPS) and at rest
- You can **export** your data anytime
- You can **delete** your account and all data anytime

## Third-party services

When you connect Strava/Garmin/etc., you authorize KYNER to read your data from those services. You can disconnect at any time. We only read what's necessary to provide the service.

## Cookies

KYNER uses **only essential cookies** for authentication. No tracking cookies. No third-party analytics.

## Your rights (GDPR)

- **Access**: download all your data
- **Rectification**: edit your profile anytime
- **Erasure**: delete your account, all data gone within 30 days
- **Portability**: export to CSV/JSON
- **Object**: opt out of any data processing

## Contact

For privacy questions: privacy@kyner.fit
Data Protection Officer: dpo@kyner.fit