Skip to content
roxduo

Last updated: [DATE]

Privacy Policy

Draft — to be reviewed and approved by a legal specialist before launch. Text in [square brackets] still needs to be filled in.

This policy explains what personal data RoxDuo collects through this website and the RoxDuo app, why, and what your rights are. We wrote it to be readable. If anything is unclear, email us at [PRIVACY EMAIL].

1. Who we are

RoxDuo is provided by [COMPANY NAME], [LEGAL FORM], registered at [ADDRESS], [COUNTRY], Chamber of Commerce (KvK) number [KVK NUMBER] ("RoxDuo", "we", "us"). We are the controller of the personal data described in this policy.

Contact for privacy questions: [PRIVACY EMAIL]. [If appointed: Data Protection Officer: NAME, EMAIL.]

2. The waitlist on this website

When you join the waitlist we collect:

  • Your name and email address.
  • Your target race, division (Men / Women / Mixed), whether you already have a doubles partner, and optionally a rough finish time.
  • Your choices on the two consent checkboxes, when you gave them, and which version of the wording you agreed to.
  • Which page you signed up on (for example a race page).

3. Why we use waitlist data, and our legal basis

  • To email you about the RoxDuo launch and early access — based on your consent (GDPR art. 6(1)(a)). You can withdraw it at any time via the unsubscribe link in every email or by emailing [PRIVACY EMAIL].
  • To understand which races and divisions our future users train for, so we know which race pages and features to build — based on our legitimate interest in developing RoxDuo (art. 6(1)(f)). We look at this in aggregate.
  • Partner matching (optional, separate checkbox): if you tick it, we may share your first name and email address with one other waitlist member racing the same event who also opted in, so you can get in touch. Based on your consent (art. 6(1)(a)). We never share your data with a match without this opt-in, and you can withdraw it at any time.

4. Data in the RoxDuo app

When you use the app (once launched), we process:

  • Account data: email address, your display name, your chosen character, and a hashed password or your Sign in with Apple identifier.
  • Training data: your race date and race, your training plan, which sessions you completed, how hard they felt (RPE), your daily check-in answers (sleep quality, soreness, stress, drive), station times you log, and station splits.
  • Partner data: if you link with a doubles partner, your partner can see your completed sessions, check-in status, streak, character, display name and messages you send them. If you turn on readiness sharing, your partner also sees your daily readiness score and label — this is off by default.
  • Coaching conversations with Roxy, our AI coach: the messages you send and Roxy's replies.
  • Subscription status (free or premium). Payments are handled by Apple through the App Store; we never see your card details.

5. Apple Health data

If you connect Apple Health, the app reads — and only reads — sleep, heart rate variability, resting heart rate, respiratory rate, wrist temperature, VO2 max and body weight. RoxDuo never writes to Apple Health.

Health data is processed on your iPhone to show your recovery insights. It is not stored on our servers and is never used for advertising or sold.

Health data is only sent to Roxy (and therefore to our AI provider, see section 7) if you switch on "Share Health data with Roxy" in the app. This is a separate, explicit consent (GDPR art. 9(2)(a)) that you can switch off at any time in the app. Health data is never shared with your partner.

You can revoke the app's access to Apple Health at any time in the iPhone's Settings › Health › Data Access & Devices.

6. Legal basis for app data

  • Providing the app and your training plan: performance of our contract with you (art. 6(1)(b)).
  • Sharing data with your linked partner and readiness sharing: performance of the contract, at your request; readiness sharing on your consent.
  • Health data and check-in data that says something about your health: your explicit consent (art. 9(2)(a)).
  • Security, abuse prevention and fixing bugs: our legitimate interest (art. 6(1)(f)).

7. Who processes data for us

We use these service providers (processors). Each processes data only on our instructions under a data processing agreement:

  • Supabase — database, accounts and storage. Data stored in the EU (Ireland).
  • Vercel — hosting of this website. [CHECK: hosting region and transfer safeguards.]
  • Anthropic — the AI model behind Roxy. Receives the coaching messages and training context needed to answer. [CHECK: data retention terms and transfer safeguards.]
  • Apple — Sign in with Apple, App Store payments, and notifications.
  • Resend — sending the waitlist welcome email and launch emails. [CHECK: data region and transfer safeguards.]

8. Transfers outside the EU

Some providers (such as Anthropic and Vercel) may process data in the United States. Where that happens, we rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's Standard Contractual Clauses. [CHECK per provider.]

9. How long we keep data

  • Waitlist data: until you unsubscribe, or at the latest [12] months after RoxDuo launches, whichever comes first.
  • Account and training data: for as long as you have an account. When you delete your account we delete your data within [30] days, except where we must keep it longer by law.
  • Coaching conversations: [PERIOD].

10. Cookies

This website does not use advertising or tracking cookies. We only use what is strictly necessary for the site to work. If we add analytics later, we will update this policy and, where required, ask for your consent first.

11. Your rights

You have the right to access, correct and delete your data, to restrict or object to processing, to data portability, and to withdraw consent at any time (without affecting processing before the withdrawal). Email [PRIVACY EMAIL] and we will respond within one month.

You also have the right to complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

12. Age

RoxDuo is intended for people aged [16] and over. We do not knowingly collect data from younger children.

13. Security

We protect your data with access controls on every database table, encrypted connections, and on-device secure storage for your login. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

14. Changes

We will update this policy when how we handle data changes. For material changes we will let you know by email or in the app.