Privacy Policy

This Privacy Policy explains how Koyaro (the operator of the Koyaro service (a Danish company to be registered as an ApS; company registration details will be published here when available)) (“Koyaro”, “we”, “us”) collects, uses, and shares personal data when you use the Koyaro websites, apps, and related services (the “Service”).

It should be read together with our Terms of Service. Effective date: 15 October 2026.

Contact for privacy requests: legal@koyaro.com.

Koyaro is the data controller for personal data processed to provide the Service. When Stripe acts as merchant of record for payments, Stripe is an independent controller (or otherwise processes payment data under its own terms) for payment transactions. Device and third-party training platforms (for example Garmin, Wahoo, or intervals.icu) process data under their own policies when you connect them.

Depending on how you use the Service, we may process:

• Account data — email, display name, authentication identifiers, and account settings.
• Athlete profile & training data — physiology inputs you provide (for example FTP, weight, heart-rate markers), goals, plans, activities, streams, wellness entries, nutrition logs, equipment records, and related derived metrics.
• Integration data — data imported from connected services and uploaded files (for example FIT files), including identifiers those services provide.
• Billing data — subscription and credit status in our systems; payment card details are handled by Stripe and are not stored on our servers.
• AI interaction data — prompts and responses when you use AI features, plus credit usage metadata.
• Usage, device & diagnostics — IP address, device/browser type, approximate location derived from IP, pages and features used, performance and error logs, and similar telemetry.
• Support communications — messages you send us.
• Waitlist data — when you join a waitlist on this site: your email address, which list you joined (rider beta or club early access), the page you signed up from, and — only if you choose to tell us — the training tool you use today or the integration you want (for example Garmin). We use it to send your invite, to decide which integrations to build next, and to plan invite waves. We do not use it for unrelated marketing.

We use personal data to:

• Provide, secure, and maintain the Service;
• Compute training metrics, plans, and in-product recommendations;
• Process subscriptions, AI credit balances, and any trial or promotional period we offer on an account;
• Send transactional messages (for example account and billing);
• Analyze product usage and improve the Service — via PostHog and similar tools, only with your opt-in consent in the app (see §5);
• Detect abuse, debug errors, and ensure reliability;
• Comply with law and enforce our Terms.

Where GDPR (or UK GDPR) applies, we rely on one or more of: performance of a contract; legitimate interests (for example securing the Service and debugging errors); consent (for in-app product analytics, certain cookies, and marketing); and legal obligation.

We use PostHog (and may use similar analytics or error-tracking tools) to understand how people use Koyaro so we can fix bugs, improve onboarding and features, and prioritise product work.

Depending on configuration, PostHog may process:

• Event data (for example feature usage, funnels, and conversion steps);
• Device and browser information;
• Approximate location from IP;
• Identifiers that link events to your account (for example an internal user id) after you sign in;
• Error and performance information;
• Optionally, session replay or similar diagnostics — if enabled, we will configure privacy controls (for example masking sensitive inputs) and describe that practice here.

We do not use PostHog to sell your personal data. We use it to operate and improve Koyaro. We aim not to send unnecessary health or training stream contents into analytics properties.

PostHog acts as a processor (or equivalent) on our instructions. PostHog’s own documentation explains its security and subprocessors. Data may be processed in the EU and/or other regions depending on our PostHog project configuration; we will favour EU hosting where practical for EU users.

In the Koyaro app, product analytics are optional and off by default. Accepting our Terms and this Privacy Policy does not include consent to analytics. We only load PostHog in the app, and only record analytics events linked to your account, after you opt in — with the separate, unticked checkbox at sign-up or in Settings → Data → Privacy. The legal basis is your consent. You can withdraw it at any time in the same place; we then stop collecting analytics and clear PostHog identifiers from your browser. Withdrawal does not affect processing that happened before it, and declining has no effect on the rest of the Service. We keep a record of when you gave and withdrew consent.

On this marketing site, where local law requires prior consent for non-essential cookies or similar technologies, we request that consent via a cookie banner and honour opt-outs where required. You can change your choice later using Cookie settings in the site footer.

If you decline cookies on this marketing site, PostHog does not set cookies or store identifiers in your browser. We still record anonymous, cookieless page views and events (for example that a waitlist form was submitted). These are not linked to a persistent identifier on your device and cannot be used to recognise you across visits.

We share personal data only as needed with:

• Infrastructure providers (hosting, database, object storage, email/push) that process data on our behalf;
• Stripe for payments and related billing;
• PostHog and similar analytics/error tools (§5);
• AI model providers when you use AI features (to generate responses under our instructions);
• Notification / email providers (for example Resend) for transactional alerts;
• Professional advisers or authorities when required by law or to protect rights and safety;
• A successor entity in connection with a merger, acquisition, or asset transfer, subject to appropriate protections.

We do not sell personal data. A current subprocessor list may be published or provided on request as the production stack stabilises.

We keep account and training data while your account is active and for a reasonable period afterward (for backups, dispute resolution, and legal requirements), then delete or anonymise it. You may request deletion subject to legal retention needs. Analytics events may be retained in aggregated or pseudonymised form according to our analytics tool settings. Waitlist entries are kept separately from accounts (creating or deleting an account does not remove them) until you ask us to remove them — email us at the address in the Contact section and we will delete your entry.

Depending on your location, you may have rights to access, correct, delete, restrict, or port your personal data, to object to certain processing, and to withdraw consent where processing is consent-based. You may also lodge a complaint with your local supervisory authority (in Denmark, Datatilsynet).

To exercise rights, email legal@koyaro.com from your account email, or use in-product export and delete controls in Settings (Data & account).

If we transfer personal data outside your country (including outside the EEA/UK), we use appropriate safeguards such as Standard Contractual Clauses or an adequacy decision, unless another lawful mechanism applies.

We use administrative, technical, and organisational measures designed to protect personal data. No method of transmission or storage is completely secure; please use a strong unique password and protect your devices.

The Service is not directed to children under 16 (or a higher age of digital consent where applicable). We do not knowingly collect personal data from children below that age. If you believe we have, contact us and we will take appropriate steps.

We may update this Privacy Policy from time to time. We will post the updated version with a new effective date and provide additional notice for material changes when appropriate.

Privacy questions and requests: legal@koyaro.com.