Privacy policy

CATALYX AI, David Vrieze, Albert-Einstein-Straße 9H, 14473 Potsdam, Germany. Email: hello@catalyx-ai.com.

Latu is a training coach for cycling and running. To advise you, the app processes data about you and your training. This page explains what that data is, why we need it, who else sees it and what you can do about it.

There is no corporation behind Latu, just me, David. If anything here is unclear, write to me. I answer myself.

We do not sell data and we show no ads. There is no tracking across other apps or websites, and nobody but you gets a profile of you.

Account. Email address, password (as a hash), name. Purpose: sign-in, access to your data. Legal basis: contract (Art. 6(1)(b) GDPR).

Profile. Date of birth, sex, weight, height, thresholds (such as FTP or threshold heart rate), health conditions, the location of your training area. Purpose: computing training zones, judging load, adapting plans. Legal basis: for health data, your explicit consent (Art. 9(2)(a) GDPR), which you give when you fill in your profile and withdraw at any time by deleting the entries; otherwise contract.

Training. GPS recordings of your rides and runs, sensor data (heart rate, power, cadence), planned and completed sessions, how they felt, nutrition entries, photos you attach to a session. Purpose: analysis, training control, navigation, recap. Legal basis: contract; for heart rate and similar health data, the consent you give when you connect a sensor.

Background location. During an outdoor recording, the iOS app records your location even with the screen locked so the recording does not break. This happens only while a recording is running. You can revoke the permission in iOS settings at any time.

Conversations with the coach. What you write to the coach, its replies and the summaries it keeps as memory. Purpose: advice, planning. Legal basis: contract.

Technical data. IP address, device type, browser, error reports. Purpose: operation and debugging. Legal basis: legitimate interest in a stable service (Art. 6(1)(f) GDPR).

Push notifications. Only if you switch them on. We then store the address your device receives messages at. Legal basis: consent, revocable at any time in settings.

We do not run Latu alone. These providers process data on our behalf and only on our instructions:

• Supabase (database, sign-in, file storage) for everything stored.
• Vercel (hosting, Frankfurt data centre) for delivering the app.
• Anthropic (language model) for the coach's replies. Anthropic receives the conversation and the training data the coach needs for an answer, and does not use it to train its own models.
• OpenAI (embeddings) for the coach's memory: short summaries are converted into a searchable form.
• Microsoft Azure (speech, EU data centre) for the coach's spoken cues. Only the text to be spoken is transmitted.
• MapTiler (maps) for the map tiles in navigation. MapTiler sees which map areas your device loads.
• BRouter (route calculation, brouter.de) for computing routes. Start, destination and waypoints of a route are transmitted.
• Open-Meteo (weather and place search) for the forecast around your training and for finding your training area. The coordinates or the place name you typed are transmitted.
• Sentry (error reports) for debugging. Error reports contain no names and no IP addresses.

Anthropic, OpenAI and Sentry are based in the United States. Transfers rely on the EU Commission's standard contractual clauses and, where certified, on the EU-US Data Privacy Framework.

If you switch on push notifications, delivery runs through your device maker's push service (Apple or Google). It sees that a message arrives, not its content.

For as long as your account exists. If you delete your account, all data is permanently deleted after 30 days. Within that period you can undo the deletion. Error reports are deleted after 90 days.

At any time you can:

• export all your data (under Settings, Account & data, Export your data),
• delete your account (under Settings, Account & data, Delete account),
• request access, correction, restriction of processing or transfer of your data,
• withdraw a consent you have given,
• object to processing based on legitimate interest,
• complain to a data protection authority. The authority responsible for us is the State Commissioner for Data Protection of Brandenburg.

Write to me at hello@catalyx-ai.com. You get an answer from me, not from a form.

Latu sets only the cookies needed to run: one for your sign-in, one for your chosen language. No advertising or analytics cookies.

If something changes, we update this page and the date at the top. For material changes we tell you in the app.