Privacy Policy

Version 2026-11-12 · Last updated: 12 November 2026

In short: We process the data you need to train with Takto. We do not sell it or use it for advertising. Your password is irreversibly hashed and your connection keys are encrypted. Your Strava data is never sent to the AI. When you delete your account, your data is deleted from our server.

This policy explains how we process personal data under the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the EU General Data Protection Regulation ("EU GDPR"). If you live in Türkiye, the Turkish version (KVKK Aydınlatma Metni) also applies.

1. Who is responsible for your data (controller)

The controller is Takto, who operates Takto. Contact: takto@teknoyuz.org. We have not appointed a data protection officer; please send any privacy request to this address.

2. The data we process and where it comes from

We collect data from what you enter in the app and on the website, from your phone's sensors and from the services you choose to connect (Apple Health, Garmin, Strava, Intervals.icu).

Category	Data
Identity and contact	Name, e-mail address
Account security	Password hash (argon2id; your password itself is never stored), session records (created and last used, device/app information), date you accepted the terms
Training and activity	Run and walk records (date, duration, distance, pace, route/location, elevation, cadence), training plan, race goal, saved routes, notes
Health data (special category)	Heart rate, heart rate variability (HRV), resting heart rate, sleep and VO₂ max from sources such as Apple Health and Garmin; also weight, height, year of birth, sex, injury history and how you feel (mood, muscle soreness)
Connection details	Garmin and Intervals.icu access keys and Strava refresh token (encrypted), athlete ID and name
Coach conversations	Messages you write to the coach and its replies, usage (token count and cost)
Technical	App version, device model, IP address (in security and abuse-prevention logs, kept for no more than 30 days)

To create an account you must give your name, an e-mail address and a password; without them we cannot open an account for you. Everything else is optional, but some features will not work without it.

Website and cookies: this website sets no cookies of its own and uses no analytics or tracking, and its font is served from our own server. When you visit it, your IP address and browser details are recorded in our server logs for security. Cloudflare may set strictly necessary security cookies to protect the site against attacks and bots.

3. Why we use your data and our lawful bases

Creating your account and providing the Service (plans, run recording, analysis, sync, backup): performance of our contract with you, Article 6(1)(b) UK GDPR / EU GDPR.
Health data (heart rate, HRV, sleep and so on): your explicit consent, Article 9(2)(a) together with Article 6(1)(a). Sharing this data is your choice, and you can remove connections and permissions at any time. Without it, related features (such as the readiness score and heart rate analysis) will not work. We use this data for training suggestions only; it is not used for medical assessment or diagnosis, and Takto does not give medical advice. Data from Apple Health (HealthKit) is not used for advertising, marketing or data mining, is never sold and is not stored in iCloud; it is shared with a third party (Anthropic) only for the AI coach and only with your permission.
AI coach (sending your messages and the relevant training summaries to Anthropic): your consent, Article 6(1)(a) and, where health data is involved, Article 9(2)(a). Using the coach is optional; if you withdraw consent, everything apart from the coach keeps working.
Security, abuse prevention and fixing faults: our legitimate interests in keeping the Service safe and working, Article 6(1)(f).
Legal obligations, where they apply: Article 6(1)(c).

We do not use your data for advertising or profiling, we do not sell it to anyone, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

4. Where your data is stored and how it is protected

Your account details, encrypted connection keys and app backups are stored on our servers in the European Union (Contabo). Most of your activities are also kept locally on your phone.
App backups contain your training records, your plan and your coach conversations. They also include your sync state and details of your Strava activities (integrations.json, which contains no access keys or tokens). Backups are encrypted in transit with HTTPS (TLS) and are stored on the server linked only to your account.
Passwords are hashed with argon2id, only a hash of session tokens is kept, and connection keys are encrypted with AES-256-GCM. All communication is encrypted with HTTPS (TLS).
Server data is backed up every night. Backups stay on the same server in the EU, are kept for 15 days and are then deleted automatically. Only an authorised administrator can access them.

5. Who we share data with and international transfers

We share data only as far as needed to provide the Service.

Recipient	Purpose
Contabo GmbH (EU)	Server hosting (processor)
Cloudflare, Inc. (USA)	Network security, protection against attacks and traffic routing (processor). Cloudflare decrypts connections at its edge, so it processes request data, including IP addresses, as traffic passes through its network.
Anthropic PBC (USA)	AI coach: the message you write and the training and health data the coach uses to answer it (each category is listed below; never data from Strava). Anthropic does not use data sent through its API to train its models (processor).
Open-Meteo	Elevation profiles for routes you plan: the route coordinates and your IP address are sent directly from the app
Apple (Maps, TestFlight)	Map display and route guidance; through TestFlight, Apple may pass crash reports and feedback to us
Strava, Garmin, Intervals.icu, Apple Health (on your device)	Only the services you connect, with your authorisation (for example sending a workout to your watch or uploading a run to Strava). They act as separate controllers under their own policies.

International transfers: Anthropic and Cloudflare are based in the United States. Transfers to them are protected by the European Commission's Standard Contractual Clauses (SCCs) and, for UK users, the International Data Transfer Addendum to the SCCs issued by the UK Information Commissioner (the "UK Addendum"). You can ask us for more information about these safeguards at takto@teknoyuz.org.

What is sent to the AI coach (Anthropic): only when you use the coach and have given your consent, and only as far as the coach needs it to answer, the following categories are sent:

Profile values: age, sex, weight, resting / maximum / threshold heart rate, your pace zones and VDOT
Your training plan and race goal
Run summaries: including your notes and rating of perceived exertion (RPE), plus laps and splits
Health and recovery data: heart rate, heart rate variability (HRV), sleep (duration, stages and score), Body Battery, stress, VO₂max, respiratory rate, and how you rate your mood and muscle soreness
The messages you write to the coach

What is not sent: your name, your email address and your GPS routes (location tracks) are never sent to Anthropic. Data that comes only from Strava is never sent either.

Strava data: in line with the Strava API Agreement, activities that come from Strava are never sent to the AI coach, are never used to train AI models and are never shown to other users.

6. How long we keep your data

We keep your data for as long as your account is open.
When you delete your account in the app (Settings › Account › Delete account), your account details, sessions, connection keys and the backups on our server are deleted immediately; copies in our nightly system backups are deleted automatically within 15 days.
Coach conversations (your messages and the coach's replies) and usage records (token count/cost) are deleted together with your account. Anthropic keeps the content it receives through its API only for a limited period, mainly to monitor for misuse, and then deletes it, unless it has to keep it longer to enforce its usage policy or by law.
Server logs containing IP addresses are deleted automatically after no more than 30 days.
Local data on your phone is deleted when you delete the app.

7. Your rights

Under the UK GDPR and the EU GDPR you have the right to:

access your personal data and receive a copy (Article 15),
have inaccurate data corrected (Article 16),
have your data erased (Article 17),
restrict processing (Article 18),
receive your data in a portable format (Article 20),
object to processing based on our legitimate interests (Article 21),
withdraw your consent at any time, without affecting the lawfulness of processing before you withdrew it (Article 7(3)).

Your right to object (Article 21): where we process your data on the basis of our legitimate interests (Article 6(1)(f)), you can object at any time on grounds relating to your particular situation. We will then stop processing it unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.

Write to takto@teknoyuz.org, ideally from the e-mail address registered to your account, so that we can confirm it is you. We will reply free of charge within one month. If a request is complex, or you send several, we may extend this by up to two further months; if so, we will tell you within the first month and explain why. You can also delete your account and data directly in the app (Settings › Account › Delete account).

Complaints: you have the right to complain to the UK Information Commissioner's Office (ICO), ico.org.uk, or, if you live in the EU, to the data protection supervisory authority in your country. We would appreciate the chance to deal with your concern first, so please contact us.

8. Age

You must be at least 16 to use Takto. We do not knowingly collect personal data from anyone under 16. If we find out that we have, we will delete it. If you think a child under 16 has given us their data, please contact us at takto@teknoyuz.org.

9. Changes to this policy

We may update this policy. We will announce material changes in the app, and the current version is always on this page.