Riseward Privacy Policy
Last updated: 24 October 2026
This policy explains which personal data the Riseward app ("the App") and its online service ("the Service") process, why, for how long, and what your rights are, under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Privacy Code (Legislative Decree 196/2003, "Privacy Code").
In short - You need an account (email and password) to use the coach. - Data from Apple Health (iPhone) and Health Connect (Android), i.e. workouts, sleep, HRV and resting heart rate, stays on your phone: we do not receive or store it, and we do not use it for artificial intelligence. - Your training plan is generated on our server, including with an artificial intelligence model running on our infrastructure. We never send the model your name, heart rate, activity notes, race names, or Health data. - No advertising, no commercial profiling, no cross-app or cross-site tracking; we do not sell data. - Riseward does not give medical advice and is not a medical device. - You can delete your account in the App at any time (Settings → Account → Delete account): deletion is permanent.
1. Controller and contacts
- Controller: Giuseppina Dendena, private individual, Via Lago Gerundo 27, 26010 Casaletto Ceredano (CR), Italy
- Email for privacy: privacy@riseward.app
- Data Protection Officer (DPO): not appointed, because appointing one is not mandatory for this processing (Art. 37 GDPR). For any question about your data, your point of contact is the controller, Giuseppina Dendena, at privacy@riseward.app.
- EU representative (Art. 27): not required, because the controller is established in Italy.
2. Where data lives: phone and server
Riseward has two parts:
- The App on your phone (iPhone or Android). Some data is read, processed and stored only on the device. The controller has no access to it and does not receive it: it stays under your control and is deleted when you sign out, delete your account or uninstall the App.
- Our server. It stores your account, your subscription and a minimal plan registry (identifier, dates, free month and changes used during the trial). Your sports profile, goals, plans, activities, results and history live on your phone: whenever you ask to generate or adapt the plan, the App sends them encrypted to the server, which uses them for that request and does not keep them (for a background generation only until the plan reaches the phone, at most 30 days).
- Your backup (optional). If you turn it on (Settings › Backup), the App saves an encrypted copy of your data to your iCloud (iPhone) or to the App's data folder in your Google Drive (Android). The key exists only on your devices and in the recovery code you keep: neither the controller nor Apple or Google can read the file. Without a backup, losing your phone or signing out means losing your training data. Backup on Riseward systems (subscribers only, optional, off by default). If you turn on the "Backup on Riseward systems" switch (Settings › Backup), we keep on our servers a copy of your training data (profile, goals, plans, activities and results): it is the same encrypted state the App keeps on the phone, updated about 30 seconds after each change. It serves two purposes: getting your data back on a new phone even without iCloud or Google Drive (on first sign-in the App uses this copy first) and letting support see your plan to help you. Support sees the profile, goals, plans, the number of weeks, sessions and activities, and the last 20 activities; every view is logged in the administrative audit log. Legal basis: your choice (consent, Art. 6(1)(a)) and performance of the contract for the service you turned on (Art. 6(1)(b)). You can withdraw at any time by turning the switch off: the copy is deleted immediately. If the subscription ends the copy is no longer updated and is deleted automatically 90 days after the subscription ended; it is also deleted with the account.
- Anonymous statistics and errors (optional, off by default). If you turn it on (Settings), the App sends once a day how often you used a few features (opens, logged workouts, requested plans, coach questions, backup turned on) and the App's errors (text and code lines involved, scrubbed of emails, identifiers and addresses) and, for each finished plan week, how many sessions were planned and how many you did, missed or added, with level, race type, plan phase and adherence (plan quality indicators: no account, device identifier, names, dates or session content; the server only records the day the report arrived), to measure and improve plan quality. It contains no account, device, training or health data; the IP address is only used to limit submissions and is not stored. Errors kept 90 days, counters and weeks 400 days.
The table in §3 shows where data goes for each feature.
3. What data we process, by feature
3.1 Data processed on our server
| Feature | Data | Required? |
|---|---|---|
| Account and sign-in | Email; password (stored only as an argon2id hash, never in clear text); email verification status; preferred language; creation date; failed sign-in counter and temporary lock; session tokens and email-link tokens (stored only as SHA-256 hashes). | Yes |
| Athlete profile | Name or nickname (max 80 characters); year of birth (optional); sex (optional); sports; level (or system estimate); availability (sessions per week, maximum duration, preferred days, rest days, double sessions); available facilities (pool, indoor trainer, gym, equipment, open water); environmental conditions (cold water, heat, altitude); current training volume; preferences (conservative/ambitious volume, zone updates); weight (optional, used only for the cycling race prediction). | Only the data needed for the plan; the rest optional |
| Thresholds, results and zones | Thresholds (FTP, threshold pace, CSS, maximum and resting heart rate, optional); race and test results (sport, distance, time, date, watts, threshold or maximum heart rate, notes); computed zones. | Optional |
| Training history | Past training periods you declare (dates, minutes per week, sport split, label and notes). | Optional |
| Goals and races | Race name, discipline, type, date, target time, priority; race-plan inputs (start time, expected temperature/WBGT, carbohydrates already tested in training, expected duration). | Yes, to create a plan |
| Plan and adaptations | Generated plan (phases, weeks, sessions); change requests you write to the coach (max 500 characters) and the coach's proposals; sessions lightened at your request (see §3.3). | Yes, for the Service |
| Manually logged activities | Sport, date and time, duration, distance, average heart rate (optional), rating of perceived exertion (RPE), how it went compared to the plan ("Too easy / About right / Too hard", optional), similarity to the planned session (percentage computed on the phone from duration, intervals and pace), notes, test values; adherence score and daily comment. When the next block is generated, only the count of ratings reaches the plan, never the notes. | Optional |
| "Ask the coach" | Question (max 500 characters) and any related session. The question is not stored: it is used only to generate the answer. | — |
| Subscription | Apple transaction identifiers (originalTransactionId, transactionId) or Google Play purchase token, product, expiry, status (trial, active, grace, expired, refunded), environment, Apple signature date; free-month dates and the date of the "free month available again" reminder (sent once, 12 months after the last free month); any complimentary full-version access (end date and an internal note, e.g. "beta tester"); App Store and Google Play notification identifiers. We do not receive payment data (card, billing address): payment is handled by Apple or Google. |
Yes, if you subscribe |
| Push notifications | Device token assigned by Apple (APNs) or Google (Firebase Cloud Messaging), platform (iOS/Android), App environment (development/production), notification language, registration and update dates. Used only to tell you when the plan generated in the background is ready and, once, when the free month is available again. The notification contains a fixed text ("Your plan is ready") and an internal identifier of the generation: no training or health data. The token is not in the data export (platform, language and dates are). | Only if you use the App with an account (on the server only if the service is active) |
| Backup on Riseward systems (subscribers only, if you turn it on, §2) | Encrypted state of your training data (profile, goals, plans, activities and results); date of consent, of the last update and of the last active subscription. Every view by support is logged. | No |
| Security and operation | IP address, used for rate limiting: in memory or, with several server copies, only as a hash together with the attempt's email, deleted after 24 hours of inactivity; technical logs with method, request path (may contain pseudonymous internal identifiers), outcome and duration, without IP, email, tokens or content. Traffic passes through the Cloudflare network (§6), which sees the IP address in order to forward requests to the server. | Yes |
| Service emails and messages | Emails for address verification, codes, password recovery and email change. Important notices about the service (for example changes to the terms, end of the free launch) as a banner in the App, a push notification or an email. | Yes |
| News and offers (optional, off by default) | Date of consent and a random code for the unsubscribe link. If you turn on "News and offers" in Settings › Notifications, we occasionally write to you, by push notification or email, about new Riseward features and offers. You can turn them off in the App or with the link included in every email. | No |
3.2 Data processed only on your device (we do not receive it)
| Feature | Data | Where it stays |
|---|---|---|
| Apple Health (HealthKit) on iPhone and Health Connect on Android, only with your permission | Workouts, distances, sleep, heart rate variability (HRV), resting heart rate. Read-only: Riseward writes nothing to Health or Health Connect. | Workouts in a local App database; physiological values are used on the phone to compute adherence and daily readiness. |
| Daily readiness | Colour of the day (green/yellow/red) and score, computed on the phone from HRV, sleep and resting HR. | Phone (history of the last 14 days, colours only). |
| Personal race plan | Sweat rate, "salty sweater", checklist ticks. | Phone. |
| Strength session player | Loads and reps per exercise (last 10 sessions). | Phone. |
| Calendar and Apple Watch, only if you turn them on | Session events in the calendar you choose; workouts sent to Apple Watch (WorkoutKit); local timer notifications. | Calendar, Watch and phone. |
| Filling in a workout from screenshots or voice, only if you use it | Up to 4 screenshots of your watch or app that you choose: text is read on the phone (Apple Vision on iPhone, Google ML Kit model bundled with the App on Android); images are not uploaded or stored. Voice note transcribed on the phone (speech recognition in on-device mode): the audio is not saved and the transcript is added to the workout notes. The App extracts duration, distance, average heart rate (only with consent to health data), effort and feel to prefill the form. Permissions requested: microphone, speech recognition and photo library (iPhone), microphone (Android). | Phone. Notes stay in the phone's data and are never sent to the AI model. |
| Riseward access tokens and cache | Session tokens; offline copy of the plan; preferences. | Keychain and App storage. |
When you sign out, delete your account, or a different user signs in on the same phone, the App deletes local data (Health activities, loads, race plan, cache, preferences; only the language setting remains).
For data that stays only on the device, the controller does not carry out processing within the meaning of the GDPR, since it has no access to it; we describe it anyway for transparency and because Apple and Google require it for HealthKit and Health Connect.
3.3 Data concerning health
Some data may reveal information about health (Art. 9 GDPR): - on the server: maximum and resting heart rate in thresholds, average heart rate of manually logged activities, heart rate in test results, weight. Rating of perceived exertion (RPE) indicates how hard a session felt to you: it is sports data, not health data. When you tap "Lighten today's session" the server receives only the readiness colour (yellow or red), never HRV, sleep or heart-rate values: it uses it to modify the session and does not keep it; the modified session only states that it was lightened at your request; - on the phone only: Apple Health and Health Connect data.
We do not collect information about illnesses, injuries, pregnancy, medication or medical clearance: the App does not ask for it and the server rejects it. Questions to the coach on these topics always receive the answer "I can't give medical advice: please see a doctor".
4. Artificial intelligence
- The overall plan, 2-week blocks, adaptations, "Ask the coach" answers and the daily comment may be generated by a large language model (LLM) running on the controller's servers in Italy, with no external artificial intelligence providers. When the model is unavailable, deterministic rules are used.
- Data sent to the model: age (derived from year of birth), sex, level, sports, weekly volume, FTP/pace/CSS thresholds, race and test results (sport, distance, time, date), race type and date and target time, availability and constraints, plan structure and adherence; for the daily comment, sport, time, duration, distance and RPE of manually logged activities; for the next block, the number of sessions rated "too easy", "about right" and "too hard"; the text you write in change requests and questions and the description of what you can do, if you don't know your times (delimited and treated as text, not instructions; a description with health information is refused); for "Why this session?", the session details including its rationale.
- Never sent to the model: name, email, heart rate, activity notes, race name, health conditions, Apple Health and Health Connect data.
- Your data is not used to train artificial intelligence models and is not sent to third parties for processing.
- The Service does not take decisions based solely on automated processing that produce legal or similarly significant effects (Art. 22 GDPR): the plan is a proposal you can change, reject or ignore. Adaptations are applied only if you accept them.
5. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Create and manage the account, authenticate you, send service emails and notices | Account, language, push token | Performance of a contract (Art. 6(1)(b)) |
| Send you news and offers (push and email) | Email, push token, language, consent | Consent (Art. 6(1)(a); Art. 130 of the Privacy Code for emails), withdrawable at any time in the App or through the link in the email |
| Generate and update the plan; compute zones, predictions, race plan, adherence; answer questions | Profile, thresholds, results, goals, activities, requests | Performance of a contract (Art. 6(1)(b)) |
| Process data concerning health on the server (§3.3) | HR, weight, readiness colour (only during the "Lighten" request) | Explicit consent (Art. 9(2)(a)), withdrawable at any time by deleting that data or the account. Consent is given through a separate request in the App, before you enter this data, and withdrawn in Settings › Privacy & AI |
| Backup on Riseward systems: restore on a new phone and plan viewing by support (§2) | Encrypted state of training data | Consent (Art. 6(1)(a)) and, for the data concerning health that the copy contains (§3.3), explicit consent (Art. 9(2)(a)): you give it by turning the switch on, after reading its description in the App, and withdraw it by turning it off |
| Manage the subscription, verify Apple and Google Play purchases, grant the free month | Subscription data | Performance of a contract (Art. 6(1)(b)) |
| Prevent the free month from being granted more than once every 12 months to the same subscription or the same email address, including after re-registration | Pseudonymous archive (§8) | Legitimate interest in preventing abuse (Art. 6(1)(f)) |
| Comply with accounting and tax obligations | Pseudonymous archive (§8) | Legal obligation (Art. 6(1)(c)) |
| Service security: prevent abuse, attacks and overload | IP (in memory), technical logs, failed attempts | Legitimate interest (Art. 6(1)(f)) |
| Establish, exercise or defend legal claims | Relevant data | Legitimate interest (Art. 6(1)(f); Art. 9(2)(f) for health data) |
We do not use data for advertising, commercial profiling or sale to third parties. We send promotional communications (news and offers) only if you have turned them on.
Whether data is required: email and password are required to create an account; profile data marked as required is needed to generate the plan. All other data is optional: without it the plan uses conservative estimates.
6. Recipients and processors
Server data may be processed by providers acting as processors (Art. 28 GDPR), under contract and only on the controller's behalf:
| Provider | Role | Location / transfer |
|---|---|---|
| Cloudflare, Inc. | Network and security: forwards traffic between the App and the server in encrypted form (Cloudflare Tunnel) and hosts the riseward.app website; processes the IP address and requests in transit, without storing their content on our behalf | USA and global network: EU-U.S. Data Privacy Framework and standard contractual clauses |
| Sendinblue SAS (Brevo) | Sending emails (verification, codes, notices and, if you turned them on, news and offers): receives the email address and the message text. Opens and clicks are counted only anonymously, without linking them to the recipient (this is why links go through a Brevo address) | France (EU) |
The server, the database, the artificial intelligence model and the backup copies run on the controller's own hardware in Italy: there are no hosting, artificial intelligence or backup providers. Cloudflare only forwards traffic.
Independent controllers (under their own privacy policies): - Apple (Apple Distribution International Ltd., Ireland): App distribution, payments and subscription management, HealthKit, Apple Watch, delivery of push notifications on iPhone (Apple Push Notification service). Apple sends us the transaction data needed to verify the subscription. Privacy policy: https://www.apple.com/legal/privacy/ - Google (Google Ireland Ltd., Ireland): App distribution on Google Play, payments and subscription management on Android, Health Connect. Google sends us the purchase data needed to verify the subscription. Privacy policy: https://policies.google.com/privacy - Push notifications on Android: when turned on, they go through Google's Firebase Cloud Messaging, which receives the device token and the fixed text of the notification. For this service Google acts as a processor under the Firebase terms; data may be processed in the USA on the basis of the EU-U.S. Data Privacy Framework.
Data may also be disclosed to authorities where required by law.
7. Transfers outside the European Economic Area
Data stored on the server stays in Italy. Cloudflare (traffic in transit) and Google (push notifications) may process data outside the EEA: in these cases, and if another provider processes data outside the EEA, the transfer will rely on an adequacy decision (e.g. the EU-U.S. Data Privacy Framework for certified providers) or on the European Commission's standard contractual clauses (Art. 46 GDPR), with supplementary measures where needed.
8. How long we keep data
| Data | Retention |
|---|---|
| Account, profile, thresholds, results, declared history, goals, plans, sessions | Until the account is deleted. Accounts not used for 24 months are deleted automatically, with a warning email 30 days before (using the App cancels the warning) |
| Never-verified accounts (with no profile) | Deleted after 7 days |
| Manually logged activities, adaptations, daily comments | 24 months from their date, then deleted automatically (check every 6 hours) |
| Access tokens (15 minutes) and refresh tokens (30 days) | Deleted 1 day after expiry |
| Email-link tokens (verification 24 hours, reset 30 minutes) | Deleted 1 day after use or expiry |
| "Ask the coach" questions, IP for rate limiting | Not stored (in memory only for the duration of the request or the rate-limit window) |
| Subscription data linked to the account | Until the account is deleted |
| Email fingerprint after account deletion: SHA-256 hash of the address (aliases removed), with the start date of the last free month; it cannot be turned back into the address, only used to recognise it if it registers again | 13 months from the start of that free month, then deleted automatically |
| Pending Google Play cancellation: if Google Play does not respond when the account is deleted, we keep only the purchase token and the product in order to cancel the renewal | Until cancelled (retried every day) |
| Pseudonymous archive after account deletion: Apple original transaction id, product, archive date, start date of the last free month, with no link to email, name or profile | 10 years, then deleted automatically, for accounting obligations and to avoid granting the free month again to the same subscription |
| App Store and Google Play notification identifiers | 1 year |
| Consent to news and offers | Until you withdraw it or delete the account |
| Admin panel messages (notice texts and send counts, without recipients) | Deleted 1 year after the end of their visibility |
| Device token for push notifications | Until you sign out on the device or delete the account; deleted earlier if Apple/Google report it is no longer valid (e.g. App uninstalled) or after 6 months without updates |
| Server technical logs (without IP, email or content) | Automatic rotation: only the latest files are kept, about 50 MB in total (in practice a few weeks) |
| Backup copies of the server database | Encrypted; each copy is deleted after 14 days |
| Backup on Riseward systems (only if you turn it on) | Until you turn the switch off (immediate deletion) or delete the account; deleted automatically 90 days after the subscription ended |
| Anonymous plan quality indicators (optional statistics) | 400 days from the day of arrival |
| Screenshots and voice-note audio | Not stored (read or transcribed on the phone, then discarded) |
| On-device data | Until sign-out, account deletion or App removal |
The Apple transaction id identifies a subscription rather than directly a person; it is nevertheless pseudonymous, and therefore personal, data.
9. Your rights
At any time, by writing to privacy@riseward.app, you can exercise the rights of: - access to your data and a copy (Art. 15); - rectification (Art. 16): most data can be edited directly in the App; - erasure (Art. 17): also directly in the App, Settings → Account → Delete account. Deletion is permanent and immediate for the user, sessions, profile, goals, plans, workouts, activities, results, history, adaptations, comments, subscription and the copy on the Riseward server, except for the pseudonymous archive in §8. Backups are overwritten according to their rotation; - restriction (Art. 18); - portability (Art. 20) of data you provided, in a structured format: directly in the App (Settings › Account › Export my data) or by writing to us; - objection (Art. 21) to processing based on legitimate interest; - withdrawal of consent at any time, without affecting the lawfulness of prior processing: you can delete health data from your profile and activities and revoke Health access in iOS Settings → Privacy & Security → Health or Health Connect access in Android settings.
Cancelling the subscription does not delete the account. When you delete the account on Android we also cancel the Google Play subscription. On iPhone Apple does not let apps cancel the subscription: cancel it in iOS Settings → [your name] → Subscriptions (the App reminds you and takes you there).
We reply within one month (extendable in the cases set out in Art. 12). You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the EU country where you live or work.
10. Children
Riseward is intended for people aged at least 18 (you confirm this when you register). We do not knowingly collect data from people under this age. If you believe a minor has provided us with data, write to privacy@riseward.app and we will delete it.
11. Security
Main measures: - encrypted communications: HTTPS/TLS between the App and Cloudflare and an encrypted tunnel between Cloudflare and the server, which has no ports open to the Internet; - passwords protected with argon2id and an individual salt; random 256-bit session tokens stored only as hashes; refresh tokens rotated on each use with automatic revocation on reuse; sign out of all devices; sessions revoked when the password is changed or reset; - rate limiting on sign-in attempts and requests; responses that do not reveal whether an email is registered; - each piece of data is accessible only to its owner (ownership checks on every request); - cryptographic verification of Apple transactions and notifications, and verification of Google Play purchases with Google; - minimisation of data sent to the AI model and filters against medical content; - database reachable only from the server itself, not exposed to the Internet; encrypted backup copies; - on the phone: tokens in the system's secure storage (Keychain on iOS, Keystore-encrypted storage on Android), Health and Health Connect data never sent to the server, local data deleted on sign-out.
No system is 100% secure. If a personal data breach is likely to result in a risk to you, we will inform you and the Garante within the legal deadlines (Arts. 33-34 GDPR).
12. Third-party integrations
- Apple Health (HealthKit). Read-only access, only with your permission, revocable in iOS settings. Health data is not sent to our servers, is not used for advertising, profiling or data mining, is not sold or shared with third parties and is not used by the AI. It is used only for adherence and readiness on the phone.
- Health Connect (Android). Same rules: read-only access and only with your permission, revocable in Android settings; the data stays on the phone, is not sent to our servers or used by the AI, and its use complies with Google's policies on Health Connect data.
- Apple Watch and Calendar. Optional; data stays on your Apple devices.
- Screenshot reading and voice transcription. They use the phone's own features (Apple Vision and iOS speech recognition in on-device mode; Google ML Kit with a model bundled with the App and Android speech recognition in on-device mode). Images and audio are not sent to our servers and the audio is not saved.
Riseward is not affiliated with, sponsored or endorsed by Apple or Google. Trademarks belong to their respective owners.
13. Cookies and tracking
The App uses no cookies, advertising SDKs, or third-party analytics or crash-reporting tools, and does not track you across third-party apps and websites (Apple's App Tracking Transparency). The only statistics are the anonymous, optional ones described in §2.
14. Changes
We may update this policy. For material changes we will notify you in the App or by email before they take effect. The date at the top shows the latest version.