Privacy Policy

1. Introduction

Peakforce OÜ ("we", "us", "our") operates the Prometheus mobile applications for iOS and Android — the Prometheus member app and the Prometheus Coach app — together with the Prometheus web applications and this website (collectively, the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

• Company: Peakforce OÜ
• Address: Sepapaja tn 6, Tallinn 15551, Estonia
• Registry Code: 17389924
• Email: hello@prometheus.coach

3. Data We Collect

Account Data

Email address, name, age, gender, profile picture, and authentication tokens.

Physical & Health Data

Weight, height, body measurements (e.g. chest, waist, arms), body fat percentage, activity level, training experience, and medical conditions or injuries you voluntarily provide.

Fitness & Training Data

Workout logs, exercise performance, personal records, velocity-based training (VBT) metrics (velocity, power, force, range of motion), training goals, and AI-generated coaching data.

Nutrition Data

Food logs, meal photos, macro- and micronutrient intake, dietary preferences, food allergies, and nutrition plans.

Camera & Media

Videos recorded for exercise form analysis and VBT tracking. Progress photos (front, side, back) if you choose to take them. Media is stored in the cloud only when you explicitly save it.

Wearable & Health Connect Data

If you connect a wearable device or Health Connect, we may read heart rate, sleep data (duration, stages), weight, body fat, and VO2max. This data is used solely to personalize your coaching and recovery recommendations.

Community & Social Data

If you use community features: display name, bio, posts, comments, likes, and follower relationships. You control the visibility of your posts (public, followers-only, or private).

Device & Usage Data

Device type, operating system, app version, crash logs (on Android via Firebase Crashlytics; on iOS only through Apple's own crash reporting, if you opted in to share it with developers), and general usage analytics to improve the Service.

4. How We Use Your Data

• Provide and personalize AI-powered fitness coaching
• Analyze exercise form and velocity-based training via camera
• Track nutrition, generate meal plans, and analyze meal photos
• Sync health data from wearables, Apple Health and Health Connect for recovery insights
• Process payments and manage subscriptions via Apple In-App Purchase (iOS) and Google Play Billing (Android)
• Monitor app stability and fix crashes (Firebase Crashlytics)
• Improve and optimize the Service
• Communicate with you about your account or the Service
• Comply with legal obligations

The AI-powered features listed above are provided by a third party. Section 5 describes exactly which data is disclosed to that provider and on what basis.

Anonymized Research & Data Partnerships

We may aggregate and anonymize training data collected through the Service and share the resulting datasets with third-party partners, including research institutions, healthcare organizations, technology companies, and sports organizations. These partnerships serve purposes such as scientific research, product development, clinical studies, biomechanical analysis, and training analytics.

Health data is excluded from these partnerships. We never disclose to any partner — anonymized or otherwise — data read from Apple Health / HealthKit or Android Health Connect (including heart rate, sleep, heart rate variability, resting heart rate, VO2max, body weight and body fat), nor the health profile you provide in the app (medical conditions, injuries, allergies). Data obtained through HealthKit is used solely to provide and improve your own coaching, recovery and health-management features inside the Service. It is never sold, never used for advertising or marketing, and never shared with insurers, advertising networks, or data brokers.

All anonymization is performed within Prometheus systems prior to any external disclosure. The resulting datasets cannot reasonably be used to identify any individual and therefore do not constitute personal data within the meaning of the GDPR. Our anonymization processes follow industry-standard techniques such as aggregation, generalization, and suppression of identifying attributes.

Although the GDPR does not apply to fully anonymized data, we offer you the ability to opt out of having your data included in our anonymization and data partnership pipelines at any time by contacting us at hello@prometheus.coach. Opting out does not affect your ability to use the Service.

5. AI Features — Data Shared with Anthropic

Some features of the Service are powered by a third-party artificial intelligence provider, Anthropic, PBC ("Anthropic"), located in the United States. To provide these features we transmit personal data, including health and fitness data, to Anthropic. This section describes that disclosure in detail.

Affected Features

• Prometheus Coach — AI chat coaching based on your training profile
• Form Analysis — movement analysis of workout videos
• Nutrition Scan — meal recognition from photos

Data Transmitted to Anthropic

Depending on the feature you use, the following data is transmitted to Anthropic:

• Your chat messages and the recent conversation history with the AI coach
• Your display name, age, gender, height, weight, body measurements and body fat percentage
• Health profile data you provided, including medical conditions, injuries, allergies and dietary preferences
• Training data: workout history, exercise performance, personal records, velocity-based training (VBT) metrics, training goals, active training programs and competition history
• Nutrition data: food logs, macro- and micronutrient intake, and nutrition plans
• Health and wearable data read from Apple Health / Health Connect, where you have granted that permission: body weight, body fat, sleep duration and sleep stages, heart rate variability, resting heart rate and VO2max
• Still image frames extracted from workout videos, for Form Analysis
• Photos of meals, for Nutrition Scan

We do not transmit payment or billing data, authentication tokens, passwords, or location data to Anthropic. Requests are not sent from your device directly; they are routed through our own servers hosted at Supabase in the EU and forwarded to Anthropic's API.

Purpose

The sole purpose of this disclosure is to generate the AI output you requested: coaching responses, movement feedback, or recognition of the food in a photo. We do not disclose your data to Anthropic for advertising, profiling, or any purpose unrelated to the feature you invoked.

Your Consent — AI Features Are Optional

No personal data is sent to Anthropic unless you have first granted explicit, separate consent in the app. Before the first use of any AI feature, the app presents a consent screen naming Anthropic, the data categories involved and the purpose, and you must actively accept it. If you decline, no data is sent to Anthropic and you can continue to use every other part of the Service.

You may withdraw this consent at any time, as easily as you gave it: open the app and turn off Account → Settings → AI Features. No email, no request, no waiting period. You can also contact us at hello@prometheus.coach if you prefer. Withdrawal takes effect immediately, disables the AI features and stops any further disclosure to Anthropic; it does not affect the lawfulness of processing carried out before the withdrawal.

Anthropic's Role and Retention

Anthropic acts as our processor and is bound by Anthropic's Commercial Terms of Service and its Data Processing Addendum. Under those terms, Anthropic does not use data submitted through its commercial API to train its models, and retains such data only for a limited period for abuse monitoring and operational purposes before deleting it. Anthropic's own privacy policy is available at anthropic.com/legal/privacy.

International Transfer

Anthropic processes this data in the United States. The transfer takes place on the basis of your explicit consent pursuant to Art. 49(1)(a) GDPR and is additionally covered by Standard Contractual Clauses (SCCs). Health data is special category data under Art. 9 GDPR; we process and disclose it solely on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR.

6. Legal Basis for Processing

• Contract: Processing necessary to provide the Service you signed up for
• Consent: For health/fitness data processing and camera usage
• Explicit Consent (AI features): Art. 6(1)(a), Art. 9(2)(a) and Art. 49(1)(a) GDPR for the disclosure of your data, including health data, to Anthropic in the USA (see section 5)
• Legitimate Interest: Analytics, security, and Service improvement
• Legal Obligation: Tax records, fraud prevention
• Data Partnerships: Data shared with third-party partners is fully anonymized within Prometheus systems before disclosure and does not constitute personal data under the GDPR. No legal basis under Art. 6 or Art. 9 GDPR is required for these datasets.

7. Third-Party Services

We share data with the following processors, all of whom are contractually bound to protect your data:

• Supabase (EU) — Database hosting, authentication, and file storage
• Anthropic, PBC (USA) — AI engine for the Prometheus Coach chat, Form Analysis and Nutrition Scan features. Receives chat messages, your training and health profile, health and wearable data, workout video frames and meal photos. Disclosed only with your explicit prior consent — see section 5 for the full description.
• Apple (USA / EU) — iOS app distribution via the App Store, In-App Purchase and subscription billing, HealthKit (read access to the health data you approve), and push notifications via the Apple Push Notification service. Apple receives purchase and device data under its own privacy policy; HealthKit data is read on your device and is not passed to Apple by us.
• Google (USA) — Sign in with Google (both platforms), and on Android: Play Store services, Google Play Billing (payments), ML Kit (on-device pose detection, barcode scanning, text recognition), Firebase Crashlytics (crash reporting), and the Health Connect API
• USDA FoodData Central (USA) — Public nutrition database for food lookups
• Meta (USA) — Instagram Story sharing, only when you explicitly share content. On Android this uses the Facebook SDK; on iOS the image is handed to the Instagram app through the operating system and no Meta SDK is embedded in our app.

For transfers outside the EU/EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent legal mechanisms to ensure adequate data protection.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. After account deletion, your data is permanently removed within 30 days, except where retention is required by law (e.g., tax records for up to 7 years).

9. Your Rights (GDPR)

Under the GDPR, you have the right to:

• Access — Request a copy of your personal data
• Rectification — Correct inaccurate or incomplete data
• Erasure — Request deletion of your data ("right to be forgotten")
• Restriction — Restrict processing in certain circumstances
• Portability — Receive your data in a portable format
• Objection — Object to processing based on legitimate interest
• Withdraw Consent — Withdraw consent at any time without affecting prior processing

To exercise any of these rights, contact us at hello@prometheus.coach. We will respond within 30 days.

10. Data Security

We implement industry-standard security measures including encryption in transit (TLS), encryption at rest, access controls, and regular security audits. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

11. Children's Privacy

The Service is not intended for children under 13 years of age, and we do not knowingly collect personal data from them. When an account is created we establish the user's age; accounts identified as belonging to someone under 13 cannot access the community features, and that restriction is enforced on our servers, not only in the app.

In the EU and EEA the age at which you may consent to online services on your own behalf is set by each country and ranges from 13 to 16. If you are older than 13 but below that age where you live, a parent or guardian must give or authorise consent for you to use the Service.

If you believe a child has provided us with personal data, contact us at hello@prometheus.coach and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Your continued use of the Service after any changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Email: hello@prometheus.coach
• Company: Peakforce OÜ
• Address: Sepapaja tn 6, Tallinn 15551, Estonia

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority.