Data Policy

1. The Commitments

These hold across every feature, and we will not change them without telling you first:

• We do not sell your data. Not to brands, not to insurers, not to advertisers, not to data brokers, not in any form that identifies you.
• We do not use your health, food, or body data for advertising, our own or anyone else's, and we do not use it for advertising measurement.
• We do not let anyone train a general-purpose AI model on your data. Our AI providers process your inputs under API terms that exclude training.
• We do not read your data out of curiosity. Administrative access to identifiable production data happens only to fix a fault, answer a support request, or meet a legal obligation.
• We do not disclose your data to your employer, insurer, medical scheme, or race organiser. Nobody gets your data because they asked nicely.
• We collect what a feature needs, not what might be useful one day.
• You can take your data out and have it deleted, without justifying the request and without being talked out of it.

2. How We Classify Data

Not everything deserves the same handling. We work to four tiers.

Routes and GPX files deserve a specific note: they reveal where you live, when you are away, and where you run alone. We treat them as identifying, we never publish them, and we never include precise coordinates in anything shared with a Brand Partner.

3. Artificial Intelligence — What We Send and What Comes Back

3.1 What leaves the platform

When an AI feature runs, we send the provider only what the feature needs. A plan request carries your athlete profile, race, and training context. A meal photo carries the image. A voice log carries the audio. A chat carries your message and the context it refers to.

We do not send your name, email address, delivery address, phone number, or payment details. Where the model needs to refer to you, it refers to "the athlete".

3.2 What providers may do with it

We use AI providers under their API terms, not their consumer terms. Under those terms, data submitted through the API is not used to train or improve their models, and is retained only briefly for abuse monitoring before deletion. We do not opt into any programme that would allow your data to be used for model training, and we will not do so without asking you first.

3.3 Our own models

Glyco's own fuelling, glycogen, pacing, and risk models are calibrated on athlete outcomes. That calibration uses de-identified data as defined in clause 5. We do not build a model that memorises or can reproduce an individual athlete's records, and no Glyco model output about one athlete is derived from another named athlete's data.

3.4 Human review of AI output

Nobody at Glyco reads your AI conversations routinely. We may read a specific exchange when you report a problem with it, when we are investigating abuse or a safety incident, or when the law requires it — and where we do, we look at the narrowest slice that answers the question.

3.5 Changing providers

We may change AI providers as models improve. Any new provider must meet the same standard: no training on your data, short retention, and a contractual data-protection commitment. We update clause 4 when a provider changes.

4. Sub-Processor Register

Every third party that processes personal information on our behalf, what it receives, and why. This table is the authoritative list; we update it when a provider is added or removed.

Services you connect yourself — Strava, Garmin Connect, Apple Health, and identity providers — are not our sub-processors. They send us data at your instruction, under their own privacy policies. Apple Health data never leaves your device except to our own infrastructure, and is subject to the specific commitments in clause 6.7 of the Privacy Policy.

5. What "De-identified" Means Here

We use the word carefully, because "anonymised" is often used to mean "we removed the name", which is not anonymisation at all. When we say a dataset is de-identified, all of the following are true:

• direct identifiers are removed — name, email, account identifier, delivery address, phone number, IP address, and any third-party account identifier;
• precise location is removed; routes are reduced to distance and elevation profile, never coordinates;
• free text you wrote is excluded, because notes routinely contain identifying detail;
• images and audio are excluded entirely;
• dates are reduced to the granularity the analysis needs, so a rare event on a known date cannot single you out;
• small groups are suppressed — we do not report a cell containing fewer than 20 athletes, because "the only 63-year-old female ultra runner in Namibia" is not anonymous;
• the recipient is contractually prohibited from attempting re-identification or combining the data with another dataset to that end.

Once data meets this standard it is no longer personal information, and we may keep and use it after you delete your account. If we cannot de-identify a dataset to this standard, we do not share it — we decline the request instead.

6. What Brand Partners Get

Brand Partners pay for insight into how athletes fuel. They receive aggregate patterns, never athlete records.

• They do get: de-identified aggregate statistics meeting clause 5 — how often a product category is used, at what race distances, with what reported gut comfort, and how those patterns move over time;
• They do not get: your name, email, or account; your health, injury, medication, or body data; your food diary; your photographs; your routes; or any figure derived from a group small enough to identify you;
• They only get identifiable data where you opt into a specific relationship with that brand — and you can withdraw, which stops future sharing;
• Purchase attribution: where you buy through a Glyco link, the brand receives the order confirmation it needs to fulfil and to pay commission.

No commercial relationship changes what the fuelling algorithm recommends. A brand cannot pay to be recommended more often, and we would rather lose the partnership than sell that.

7. Who at Glyco Can See Your Data

Glyco is a small operation. Administrative access to identifiable production data is limited to the operator and to any contractor bound by a written confidentiality and data-protection agreement, and is used only to:

• investigate a fault or a support request you raised;
• investigate abuse, fraud, or a safety incident;
• fulfil an order or a data request you made;
• meet a legal obligation.

Access is by individual account with multi-factor authentication, never a shared login. The database enforces row-level security, so ordinary Service traffic can only ever reach the signed-in user's own rows. We do not copy production data onto development machines, and test environments use synthetic data.

8. Getting Your Data Out

You can export plans, training data, and logs from within the Service in open formats — GPX, FIT, ZWO, CSV, and PDF depending on the data. For a full copy of everything we hold about you in a machine-readable format, email privacy@glyco.co.za and we will provide it within 30 days, free of charge.

Export before you delete. Deletion is not reversible and we cannot recover an account once the deletion has run.

9. What Deletion Actually Does

When you delete your account:

• your login stops working and any coach link is severed, immediately;
• your profile, plans, training and food logs, health and injury data, images, voice transcripts, connected-account imports, and AI conversations are deleted immediately when you delete the account in the app, and within 30 days if you asked us by email instead;
• encrypted backups age out within 35 days, after which the deleted records are gone from those too;
• analytics events are dissociated from your account identifier;
• we notify the sub-processors that hold data for you and instruct deletion on their side.

What survives, and why: payment and order records, kept 5 years because tax law requires it; consent records, kept 5 years as evidence that our processing was lawful; and de-identified aggregate data meeting clause 5, which is no longer personal information and cannot be linked back to you. Nothing else.

Deleting the app from your phone does not delete your account. Deleting your account does not cancel a subscription billed by an app store — cancel that in your store account.

10. If Something Goes Wrong

If we discover a security compromise affecting your personal information, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires. Our notice will say what happened, what data was involved, what we have done about it, and what you should do — in plain language, and we will not wait until every question is answered before telling you.

To report a vulnerability or a suspected incident, email hello@glyco.co.za. We will not pursue good-faith security research that is reported responsibly and does not access other users' data.

11. Changes to This Policy

We update this page whenever a sub-processor, an AI provider, or a data-handling commitment changes, and we update the "Last updated" date. Where a change weakens a commitment in clause 1, we will tell you before it takes effect, not after.

Questions about anything on this page go to privacy@glyco.co.za. If a commitment here matters to you and you think we have broken it, say so — we would rather hear it from you than from the Regulator.