Privacy Policy

Last updated: 13 October 2026

Aurin (formerly Loadwise; Petr Fitness Data, aurin.health) is a personal service for training, recovery and nutrition. The controller of your personal data is Petr Bouma, a private individual in the Czech Republic (the operator, “we” below). You can reach the operator at petrbouma1994@icloud.com. Aurin is currently available only by personal invitation.

In short

• We use your data only to provide the Aurin features you use.
• We do not sell your data, use it for advertising or share it with data brokers.
• You choose which services to connect. You can disconnect them, or delete your account and all its data, in the app at any time.

Data we collect

Your account. When you sign in with Google, we receive your email address and your Google account ID. We use them to recognize you and check your invitation, and we record when you last signed in. When you sign in with Apple, we receive your Apple ID user identifier, the email address Apple shares with us (it can be a private relay address) and, the first time, your name if you choose to share it.

Passkeys. When you add a passkey, we store its public key, its identifier, a random identifier of your account that the passkey keeps, the name of the device or password manager it was made in, and when it was added and last used. The private key stays on your device or in your password manager, and your fingerprint, face or screen lock never leaves your device.

Google Health, only if you connect it and allow it on Google’s consent screen:

• activity and fitness: steps, distance, floors, active minutes, active zone minutes, active energy burned, time in heart rate zones, sedentary periods and exercise sessions;
• health metrics and measurements: heart rate, resting heart rate, heart rate variability, oxygen saturation, respiratory rate, VO2 max, weight, height and body fat;
• sleep: sleep sessions and sleep stages;
• nutrition: food and drink logs.

Two optional permissions are asked for separately: reading your date of birth from your Google Account, to fill in your age, and writing your weight to Google Health.

Intervals.icu, only if you connect it with your API key: your activities and their details, planned workouts and events, wellness data and sport settings.

What you enter in Aurin: your profile (such as age, height, weight, sports, goals and the time you have for training), food and drinks, workouts and how they went, notes, and your conversations with the assistant.

On your device: a sign-in cookie valid for up to 30 days, a short-lived cookie that protects signing in, cookies with your theme and language and, in the browser’s storage, a copy of the last loaded day and a few display settings so the app opens instantly, and, once you add or use a passkey, your email with the passkey’s identifier, so this device signs you in with it instead of sending a code. We use no advertising or tracking cookies.

Technical logs: our hosting provider records technical details of requests (such as time, IP address, page and errors) to keep the service running and secure. These logs are kept for a few days.

How we use your data

• to show your daily overview, training load, recovery, sleep and calorie and macro targets;
• to plan and adjust your workouts and nutrition;
• to keep data in sync between Aurin and the services you connect, as described below;
• to answer your questions in the assistant and run other AI features when you use them;
• to keep the service secure and fix errors.

Aurin is not a medical device and does not give medical advice or diagnoses.

How Google user data is used

Google user data is used only to provide the user-facing training, recovery and nutrition features of Aurin that you use:

• We read Google Health data to show and evaluate your activity, health metrics, sleep and nutrition in Aurin.
• We write to Google Health only the food and drinks you log in Aurin and, if you allow it, the weight you record in Aurin or Intervals.icu.
• We transfer Google user data only to the services listed under “Who receives your data”, only to provide features you use and with your consent. Beyond that, only for security purposes, to comply with the law, or as part of a merger, acquisition or sale of the service after your explicit consent.
• We do not sell Google user data, do not use or transfer it for advertising, and do not transfer it to advertising platforms, data brokers or information resellers.
• We do not use Google user data to train AI models or to determine creditworthiness or for lending.
• No one reads your data unless you ask us to (for example, to help with a problem), it is needed for security purposes such as investigating abuse, or it is required by law. For internal operations we use only aggregated, anonymized data.

Aurin’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.

How Apple Health data is used

• On iPhone, Aurin reads from Apple Health only the types you allow, such as sleep, workouts, heart rate, HRV, steps, active energy, VO₂ max and weight. It uses them only to show and evaluate your recovery, training load, workouts and calorie target.
• Apple Health data goes only to our server and, for features you use, to the services under “Who receives your data”. We do not sell it, do not use or share it for advertising, and do not give it to data brokers.
• You change or remove access in the iPhone Settings → Health → Data Access & Devices → Aurin. Data already synced is deleted with your account.

Who receives your data

• Intervals.icu, if you connect it: the workouts you plan in Aurin, nutrition notes and calorie targets in your calendar, your weight, and every hour a copy of your daily wellness from Google Health (sleep, average sleeping heart rate, steps, resting heart rate, HRV, oxygen saturation, respiration, VO2 max and body fat). Intervals.icu handles this data under its own privacy policy.
• Google Health: the food and drinks you log and, if you allow it, your weight.
• OpenAI (USA), when you use an AI feature (such as the assistant, recognizing food from a photo, label or description, plan reviews, workout reflections or exercise descriptions): the data that request needs, such as your message, the photo and related training, sleep, health and nutrition data. OpenAI processes it on our behalf, does not use data sent through its API to train its models and keeps it for up to 30 days to detect abuse.
• Cloudflare runs Aurin, stores its database in Europe and keeps the technical logs.
• Open-Meteo gets only the place you choose for the weather in your training plan: a place you search for, or your location rounded to about 1 km if you allow it. Without that the app shows no weather.
• Authorities, only when the law requires it.

When you scan a barcode or a food label without AI, the image is processed on your device; the scanning library is loaded from the jsDelivr network. Exercise videos are embedded from YouTube in privacy-enhanced mode, and YouTube receives data only when you play a video.

Food database. Food search uses a catalogue stored with Aurin (your searches are not sent anywhere else), made from open data: Open Food Facts (© Open Food Facts contributors, ODbL 1.0), USDA FoodData Central (public domain), Fineli by THL (CC BY 4.0), Ciqual by Anses (Licence Ouverte / CC BY 4.0) and CoFID by Public Health England (Open Government Licence 3.0). The catalogue as a database is available under the ODbL; values are as the sources give them and are not checked against every label.

Some of these providers are based in the United States. Where data leaves the European Union, they protect it with the safeguards the GDPR requires, such as the EU Standard Contractual Clauses.

Storage and security

• Your data is stored in Aurin’s database at Cloudflare, encrypted at rest. All connections use HTTPS.
• Access tokens and API keys for connected services are additionally encrypted (AES-GCM) with a key kept apart from the database.
• Each user sees only their own data. You sign in with Apple, Google or a passkey, and your session is a signed cookie that scripts cannot read.
• Only the operator has access to the systems that run Aurin, and does not read users’ data except as described above.

How long we keep data and how to delete it

• We keep your data while you have an account. An account nobody has signed in to for two years is deleted automatically with all its data.
• Disconnecting a service in Settings stops Aurin from reading from and writing to it and removes the stored access; for Google, Aurin also gives up its access at Google. Data imported so far stays in your account until you delete it or the account.
• Deleting your account in Settings → Account immediately deletes your account and permanently deletes all its data in Aurin (for a large account, the rest within minutes): profile, food, workouts, sleep and health data, connections, passkeys and assistant history. The record of your consents is deleted with it. Aurin also gives up its access to your Google Account and clears its copy on the device you use. Database backups are overwritten within 30 days.
• To stop using a passkey, delete it from your iPhone or password manager. Deleting your account removes all your passkeys from Aurin.
• Data that Aurin copied to Intervals.icu or Google Health stays there; you can delete it in those services.
• You can also remove Aurin’s access at any time in your Google Account under Third-party apps and services. Aurin then can no longer read or write your Google data.
• You can stop using Sign in with Apple for Aurin in your Apple ID settings, or unlink Apple in Settings → Account.
• Technical logs are kept for a few days, and OpenAI keeps AI requests for up to 30 days.

The Support page explains step by step how to manage and delete your data.

Legal bases and your rights

We process your data to provide the service you asked for (Article 6(1)(b) GDPR). Health data, from Google Health, Apple Health, Intervals.icu or entered by you, is processed only with your explicit consent (Article 9(2)(a) GDPR). You give it in the app before you first use it, and we record when and to which version of this text; syncing of your connected services in the background also runs only after it. The consent covers sending the data an AI feature needs to OpenAI, because the AI features are part of the service. You withdraw your consent by deleting your account in Settings → Account, where you can first download all your data; disconnecting a service stops new data from it. Withdrawing does not affect processing before it. Technical logs rely on our legitimate interest in a secure service (Article 6(1)(f) GDPR).

You have the right to access, correct and delete your data, to restrict or object to its processing and to receive it in a portable format. Most of this you can do directly in the app: in Settings → Account you can download all your data as a JSON Lines (NDJSON) file or delete your account. You can also lodge a complaint with the Czech Office for Personal Data Protection (uoou.gov.cz).

Children

Aurin is not intended for children under 16, and we do not knowingly collect their data.

Changes

We update this policy when Aurin or the way it uses data changes, and publish the current version on this page with its date. Before we use data you have already given us in a new way, we ask for your consent.

Contact

For questions about this policy or your data, or to exercise your rights, write to petrbouma1994@icloud.com.