Privacy Policy

1. Introduction

Achilles ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our fitness training platform.

By using Achilles, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

Achilles uses passwordless sign-in. You enter your email address and we email you a six-digit code, so there is no password for you to choose or for us to store. Sign-in is handled by Amazon Cognito. We collect:

• Email address
• An account identifier we generate for you
• Sign-in timestamps

2.2 Workout and Training Data

We collect information you provide when using the platform:

• Workout logs (distance, duration, exercises, sets, reps, weights)
• Training goals and preferences
• Personal records and achievements
• Habit tracking data
• Chat conversations with AI coach
• Uploaded files (spreadsheets, health data exports)

2.3 Usage Information

• Device type and operating system
• Browser type and version
• IP address
• Pages visited and features used
• Timestamps of actions

2.4 Data From Services You Connect

Achilles can connect to third-party fitness and wearable services so your training is recorded automatically instead of by hand. Connecting one is entirely optional, you choose each service separately, and we read nothing until you have completed that service's own authorization screen.

Where you connect Strava, Garmin, Whoop, Oura, COROS or Fitbit, we may receive (Apple Health, which the iOS app reads through HealthKit, is covered separately in 2.5):

• Completed activities - type, start time, duration, distance, pace, elevation and calories
• Heart rate recorded during those activities, including average and maximum
• Power and cadence, where your device records them
• Daily wellness metrics - heart rate variability, resting heart rate, sleep, and readiness or recovery scores
• An identifier issued by that service, used only to match incoming updates to your Achilles account

This is health data and we treat it as such. We use it only to maintain your own training record and to inform the coaching we give you. We do not show it to other users, sell it, share it with advertisers, or use it to train machine-learning models.

The access credentials for each connected service are encrypted before storage using AES-256-GCM and bound to your account, so they cannot be reused elsewhere. You can disconnect any service at any time from Settings, including if your subscription has lapsed - this revokes our access at that provider and deletes the stored credentials. Deleting your Achilles account deletes the data received from connected services along with everything else.

2.5 Apple Health (HealthKit)

The Achilles iOS app can read from and write to Apple Health through HealthKit. Like every connection above it is optional: nothing is read until you grant access on the Health permission screen, you can allow or refuse each data type separately, and the app works fully without it.

With your permission we read your workouts and their GPS routes, heart rate, walking, running, cycling and swimming distance, and active energy, and we write the workouts you record in the app - with their route and distance - so they appear in Fitness. We use HealthKit data only to maintain your own training record and to generate your coaching. Workout summaries derived from it are processed by Amazon Bedrock, our AI sub-processor, to produce the coach's replies, on the terms in Section 4: Bedrock does not train on the requests we send it.

HealthKit data is never used for advertising, marketing or data mining, is never sold, and is never shared with third parties for those purposes. Nothing from HealthKit is shown to other users unless you turn on the public leaderboard, which publishes only your display name, workout count, total distance and current streak. Deleting your account deletes it along with everything else, and you can withdraw the app's access at any time in the Health app under Sharing.

2.6 Google Calendar

Google Calendar is the one connection that runs in the opposite direction: Achilles writes to it and never reads from it. If you connect it from Settings, we request a single permission, calendar.events, which is the narrowest one Google offers that allows an application to put an event on your calendar.

• What we do - create, update and delete the training sessions Achilles itself generates, so your plan sits alongside the rest of your commitments
• What we store - the identifier of each event we created, so we can move or remove it when your plan changes, and your access credential, encrypted
• What we never do - read, search, index, analyse or store the events already in your calendar. Nothing from your calendar reaches your AI coach, because nothing from your calendar is read at all

Achilles' use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google Calendar at any time from Settings, which revokes our access with Google immediately, or revoke it yourself from your Google Account permissions page.

3. How We Use Your Information

We use your information to:

• Provide and maintain the Achilles.fit™ platform
• Generate personalized training plans and AI coaching
• Track your progress and achievements
• Record training from services you have connected, and adjust coaching using your recovery and wellness metrics
• Send motivational messages and notifications (if enabled)
• Improve our services and develop new features
• Respond to your support requests
• Detect and prevent fraud or abuse

4. AI and Data Processing

We use Amazon Bedrock to power our AI coaching features. When you interact with our AI coach:

• Your messages are sent to Amazon Web Services for model inference
• Your workout history and goals are used to provide personalized responses
• Chat conversations are stored in our database for continuity
• We do not use your data to train, fine-tune or evaluate AI models, and Amazon Bedrock does not train on the requests we send it
• Your data is used only to answer you. It is never pooled with other users' data, and it is never shown to another user

4.1 What your AI coach cannot see

Some services we connect to do not permit their data to be shared with an AI model, even to answer your own questions about your own training. Where that is the case, we exclude those activities from your AI coach entirely, along with any figure calculated from them. Those workouts still appear in your history, stats and records as normal, and you can see which services this applies to on the Integrations screen.

This is a limitation of that service's API terms, not of your data or your tracking. Where it applies, your coach is told its view is incomplete, so that it does not mistake a workout it cannot see for one you did not do.

5. Data Storage and Security

Your data is stored securely on Amazon Web Services:

• Data is stored in Amazon DynamoDB databases
• All connections use HTTPS/TLS encryption
• Session data is encrypted with AES-256-GCM
• Files are scanned for malware before storage
• We implement rate limiting to prevent abuse
• Access is restricted to authenticated users only

6. Data Sharing and Disclosure

We do NOT sell your personal data. We may share your information only in these limited circumstances:

• Service Providers: Amazon Web Services for hosting, storage, email and AI model inference; Google Analytics for aggregate usage analytics
• Legal Requirements: If required by law or to protect our rights
• Business Transfer: In the event of a merger or acquisition

We do NOT share your data with advertisers, third-party trackers, or social media platforms.

Connecting a fitness or wearable service is a one-way import. We read from that service with your authorization; we do not send your Achilles training data, coach conversations or account information back to it.

7. Your Rights (GDPR & CCPA)

You have the following rights regarding your data:

• Access: Download everything we hold about you as JSON via Settings → Data Export - account settings, workouts, habits, training plans and plan history, personal records, one-rep maxes, coach conversations, uploads, achievements, bodyweight and recovery data. It is free, and available whether or not you have an active subscription
• Deletion: Delete all your data via Settings → Data → Delete Account
• Correction: Update your workout logs and profile information anytime
• Portability: The full export is machine-readable JSON. Workouts and habits are additionally available as CSV for use in a spreadsheet
• Opt-out: Disable motivational messages and notifications

For additional requests, contact us at admin@noblerworks.com

8. How Long We Keep Your Data

Your training data is kept for as long as your account exists. We do not expire workouts, habits or plans - a training history is only useful if it is complete.

When you delete your account (Settings → Data → Delete Account), your workouts, habits, training plans and plan history, personal records, one-rep maxes, coach conversations, uploads, recovery data and connected-service credentials are removed immediately. Three things deliberately survive, and you should know about all three:

• A billing record - your Stripe customer reference and whether you have already used a free trial. We keep it so that deleting and re-creating an account cannot be used to claim repeated free trials, and because payment records carry their own legal retention requirements. It contains no training data
• An audit entry recording that a deletion happened, who requested it and how many records it removed. Kept for one year, then deleted automatically. Without it we could not answer you if you later asked what became of your data
• A recovery snapshot of your account settings and profile documents, including your email address, taken immediately before deletion so that an accidental or disputed deletion can be reversed. This snapshot is currently retained indefinitely. You can ask us to destroy it at any time by emailing privacy@achilles.fit, and we will do so unless we are required to keep it

Backups. Our database keeps a 35-day point-in-time recovery window. Deleted data can therefore persist in backups for up to 35 days after you remove it, after which it ages out. We do not restore backups to recover deleted accounts except to fix a fault on our side.

Operational records we keep about the running service, rather than about you:

• Server logs - 30 days
• CDN request logs (page requested, response status, IP address, browser user-agent and referrer, with no cookies or account identifier), used to count visits and detect abuse - 90 days
• App error reports - 30 days
• Background job run records - 90 days
• Administrative audit entries - 1 year
• Sign-in links, password-reset tokens and connected-service authorisation states - minutes to hours, expiring automatically

Automatic expiry is processed in batches and can lag by up to 48 hours past the periods above.

9. Cookies and Tracking

We use the following cookies:

• Essential storage: Your sign-in tokens, held in your browser's local storage so that you stay signed in between visits. Required for the service to work
• Preference Cookies: Theme settings, language preferences
• Analytics Cookies (optional): Google Analytics, set only after you accept in the cookie banner. Until you choose, Google Analytics runs in consent mode with all storage denied - it sets no cookies and records anonymous page counts with no identifier for you or your session. Declining stops it entirely. If your browser sends a Global Privacy Control signal, we treat that as a decline until you choose otherwise in the banner.
• First-touch attribution (functional): one entry in your browser's local storage (achilles-first-touch) written on your first visit, recording the page you landed on, the site that referred you, and any campaign tag in the link. It holds no identifier for you, is never sent to a third party, and exists only so we can tell which channels bring people to Achilles.

We do NOT use advertising cookies or third-party advertising trackers, and we do not sell or share your data with advertisers.

10. Children's Privacy

Achilles.fit™ is not intended for users under 13 years old. We do not knowingly collect data from children under 13. If we discover we have collected data from a child under 13, we will delete it immediately.

11. International Data Transfers

Your data is stored in Amazon Web Services data centers in the United States. If you use Achilles from outside the United States, your information is transferred to and processed there. Where the law requires it, we rely on appropriate safeguards - including Standard Contractual Clauses - for those transfers.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

13. Contact Us

If you have questions about this Privacy Policy or want to exercise your rights, contact us:

Email: admin@noblerworks.com