Privacy policy

1. The short version

Your training data belongs to you. Apple Health readings are processed on your device. Connected account and provider features can send workout completion summaries to Ballust servers, with or without a coach. Connecting Strava also imports activity details, including routes and heart-rate streams, to our servers. Plans and training choices can sync through your private iCloud account; body measurements, biometrics, energy estimates and cached activity details stay local. We do not sell your data or use it for advertising. You can request account deletion inside Settings.

2. What we collect

Early-access requests

If you request early access on ballust.com, we use your email address to respond with availability and next steps. Your request is delivered to our inbox through Resend, our email provider. We do not add you to a marketing mailing list. You can ask us to delete your request by emailing info@ballust.com.

The athlete app (on-device)

• Health data. Ballust reads Apple Health with your permission to compute completion, load, sleep, readiness and optional energy estimates. Raw Apple Health heart-rate, GPS and sleep samples are processed locally. Body measurements, biometric profiles and energy estimates are stored in a local-only database excluded from automatic device backup. Connected account and coaching features can send derived workout completion summaries, including duration and distance where available, to Ballust servers. A connected coach can view shared summaries. Ballust uses read-only Apple Health access and does not save workouts or body measurements to Apple Health.
• Calendar. Ballust reads your calendar events to plan training around commitments. When you enable calendar export, Ballust creates and updates training events, including during background synchronization. You can turn calendar export off in Settings.
• Identity. Sign in with Apple gives us a stable identifier, and your name and email if you allow it.
• Subscriptions. If you subscribe to Ballust Pro, the purchase, billing, and renewal are handled by Apple through your Apple Account. The app checks verified StoreKit transaction and entitlement information to unlock Pro features. Ballust does not receive your payment-card details.

iCloud sync and local recovery copies

When enabled, plans, training logs and planning choices sync through your private iCloud account. Personal body measurements, biometric profiles, energy estimates and cached activity details are excluded from that sync. Turning sync off retains existing copies; it is not account deletion. Automatic recovery copies stay on the device and are excluded from automatic device backup. If you export a backup yourself, it can include personal health records; choose its destination carefully and manage that copy separately.

Weather

When you use local weather, Ballust sends your selected location or device coordinates to Open-Meteo to request a forecast. That provider receives the request and its network address. This is used for weather functionality, not advertising. Location permission is optional; a selected city can be used instead. Open-Meteo’s privacy policy states that technical logs may include IP addresses and request coordinates and are deleted after 90 days.

Connected training account

Training records you create or submit through Ballust’s connected account features, such as plans, sessions, notes, routines and workout completion summaries, are stored on Ballust servers. You do not need a human coach for these account and provider features.

When you are coached (Ballust Coach)

• Training. The plan your coach assigns, the sessions you complete, miss, or skip (with your notes), and summary completion reports.
• Feedback. Messages between you and your coach on assigned sessions.
• Coach accounts. Coaches sign in by email link; we store the email address.

Strava connection (iOS and athlete web app)

• When you connect Strava, the authorization is handled by our backend using OAuth; tokens are stored server-side only and are never included in the iOS app.
• Your Strava activities import as completed-workout summaries together with activity detail, including laps, routes and heart-rate streams. These records are stored on Ballust servers and used in your activity views. A connected coach receives permitted workout summaries from after you connected; raw routes and heart-rate streams are not shared with the coach.
• If you enable Strava posting, completed strength and mobility workouts recorded in Ballust are sent through Ballust servers to your Strava account. Your posting setting controls whether this happens automatically, after confirmation, or only when you post a workout yourself.
• You can disconnect at any time. A successful disconnect stops future imports and removes stored Strava connection tokens, Strava-derived workout summaries and activity detail from Ballust. Workouts you recorded independently remain. If Strava cannot confirm disconnection, Ballust reports the failure so you can retry. You can also revoke Ballust in Strava’s own settings.

Garmin Connect connection (planned)

• When you connect Garmin Connect, the authorization is handled by our backend using OAuth; tokens are stored server-side only and are never included in the app. We store export metadata — workout name, publish and schedule status, and device-sync state — so you and your coach can see that a session was sent. We do not receive or store raw workout-stream or health data from Garmin.
• Ballust only claims "sent to Garmin Connect" after our backend confirms it, and "on your watch" only after Garmin’s device-sync notification confirms it.
• You can disconnect Garmin at any time; disconnecting revokes access and removes stored export records.

3. How your data is used

To provide the service: sign-in, planning, activity history, optional coach and provider connections, weather, subscription access and responses to early-access requests. We do not use your data for advertising, data brokering or sale.

Anonymous weekly usage counts. To learn whether Ballust helps people fit training into their week, the app sends four numbers once a week for the previous Monday to Sunday: sessions planned, sessions given a time, sessions done, and the number of days the app was opened. They are sent with a random identifier created on your device and the app version. They do not include your name, email, account or Apple ID, session titles, times, routes, health readings or location, and our server does not store your IP address with them. You can turn this off in Settings → Data & privacy → Share anonymous usage; turning it off deletes the identifier from your device so any later reports cannot be linked to earlier ones.

4. What your coach sees

Your coach sees the assigned plan, session states (done, missed, skipped, moved), per-session feedback, and summary cards for every workout you complete — assigned or not, including activities tracked outside Ballust and anything imported through a connection you set up. Shared summaries can include workout titles, activity type, dates, completion status, duration and distance. Workouts from before you connected, raw routes and heart-rate streams are not shared with the coach. Disconnecting coaching requires an internet connection and server confirmation; it stops future sharing and removes that coach’s access through Ballust. Your own training history remains available. Copies a coach has already made independently cannot be recalled. Use account deletion to remove the account’s server records.

5. Data retention and deletion

• Deletion. Start deletion in Settings → Your account → Delete account data. Confirm with the same Apple account and keep an internet connection. Ballust removes the account’s synced data, server relationships, plans, sessions, feedback and stored provider connections, revokes its Apple authorization, then removes its local profile. If a step fails, the app reports the failure and keeps the local profile for retry; some remote steps may already have completed. A minimal deletion marker remains in your private iCloud account to prevent older updated devices from uploading the deleted account again. Previously exported backups and data held independently by Apple Health, Strava or other apps are separate. Account deletion does not cancel an App Store subscription.
• Export. You can request a machine-readable copy of everything your account holds.
• Access. Contact us about any question or correction at the address below.

6. Third parties

We use standard infrastructure providers (hosting, email) under their own data-processing terms. We never embed third-party credentials in the iOS binary — OAuth runs against Ballust’s own backend, including for Garmin Connect.

7. Contact

Questions about this policy or your data: info@ballust.com.