Privacy Policy

This Privacy Policy explains how Athivo (“we”, “us”, or “our”) collects, uses, and protects your personal data when you use the Athivo mobile application and website at athivo.co.uk.

We are committed to protecting your personal data and operating in compliance with the UK GDPR and the Data Protection Act 2018. If you have any questions, contact us at privacy@athivo.co.uk.

1. Who we are

Athivo is operated in the United Kingdom. For the purposes of UK data protection law, we are the data controller for your personal information. You can contact us at privacy@athivo.co.uk.

2. Data we collect

We collect personal data in the following categories:

Account and profile data

• Name, email address, and profile photo
• City, bio, training goals, activities, and availability
• Languages spoken and preferred training times
• Sign-in provider (Apple or email)

Activity data

• Workout commitments you create or accept
• Sessions attended, missed, or cancelled
• Accountability and reliability scores
• Group memberships and messages

Location data

• Your approximate city (set by you in your profile)
• Precise location, if you choose to use the “Use my location” feature when creating a group meeting spot (used only to suggest an address — raw coordinates are never stored or shared)

Payment data

• Subscription status (free or Plus)
• Payment is processed directly by Stripe — we never see or store your card details

Technical data

• Device type, OS version, and app version
• Crash reports and performance data
• Usage analytics (screen views, feature interactions) via PostHog
• Push notification tokens

3. Legal basis for processing

• Contract — to provide you with the Athivo service and your subscription
• Legitimate interests — to improve the app, detect fraud, and maintain security
• Consent — for push notifications and location access (you may withdraw consent at any time in your device settings)
• Legal obligation — where required by law

4. How we use your data

• To create and maintain your account
• To match you with compatible training partners
• To facilitate commitments, groups, and messaging
• To calculate and display your accountability score
• To process subscription payments via Stripe
• To send you notifications about commitments and matches
• To improve the app and diagnose issues
• To comply with legal obligations

5. Third-party services

We share data with the following trusted third parties:

• Supabase — database and authentication (servers in the EU)
• Stripe— payment processing (Stripe’s privacy policy governs payment data)
• PostHog — product analytics (EU-hosted; data is anonymised where possible)
• Google Maps Platform — address search and geocoding
• Apple / Google — push notifications and sign-in
• Expo — mobile app infrastructure and over-the-air updates

We do not sell your personal data to any third party.

6. Data retention

• Active account data is retained for as long as you use Athivo.
• When you delete your account, your personal data is removed within 30 days. Aggregated and anonymised analytics may be retained indefinitely.
• Payment records required for tax purposes may be retained for up to 7 years in accordance with UK law.

7. Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data (see account deletion)
• Restriction — ask us to limit how we process your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — for notifications or location access at any time in your device Settings

To exercise any right, email privacy@athivo.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

8. Security

We use industry-standard measures including TLS encryption in transit, encrypted storage at rest, and row-level security policies in our database. Access to personal data is restricted to authorised personnel only.

9. Children

Athivo is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has created an account, please contact us immediately.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via in-app notice or email. The current version is always available at athivo.co.uk/privacy.

11. Contact

Data controller: Athivo, United Kingdom
Email: privacy@athivo.co.uk
Response time: within 2 business days for general queries; within 30 days for formal rights requests.