Privacy and your data

Where your data are kept#

The privacy policy says your data are primarily stored on servers within the European Union. When something is transferred outside the European Economic Area, we rely on EU Standard Contractual Clauses or on adequacy decisions. Connections to the app are encrypted in transit (TLS 1.2 or newer), and the sign-in keys we hold for your connected devices are encrypted at rest. The backups we keep are described under deleting your account.

Your data go to a few other companies only for a defined job, all under data processing agreements:

• Stripe takes your payment. We receive only the subscription status.
• Our e-mail provider delivers the mails we send, including the weekly report with your own scores.
• Push services (Google for the Android app, the browser's own service for web notifications) deliver notifications. The short text of a notification can name a health state such as low recovery.
• Weather and place lookups use coordinates rounded to about 1 km, and only if you saved a location. No name, e-mail or health data go with them.
• Mapy.com draws the map of a workout, and only if you turned the route map on. It receives your IP address and the area on screen, and no route and no identity.
• The companies behind your devices send us the data you chose to connect. We write nothing back into your Garmin, COROS, Google Health or other accounts.

The full list, with what each one receives, is in section 5 of the privacy policy.

Who can see what#

In the app, your data are shown to you, signed in as you. We do not sell your personal data, and we do not share your health data with advertisers, insurance companies, employers or any third parties for commercial purposes (privacy policy, section 4). Data from your devices are used only to compute your own scores, and they are not used to train artificial intelligence or machine learning models (terms, section 5.3). Administrator actions on an account are logged and kept, as the privacy policy lists in section 8.

Your routes and the map#

Only you see your routes. A workout recorded with GPS carries its route, and your account keeps it only while the route map is on. You turn it on yourself, in the app when it asks or in Settings, section "Data & privacy" ("Data a soukromí"), card "Workout route map" ("Mapa tras tréninků"), with the choice "On" ("Zapnuto") and "Off" ("Vypnuto"). The map is part of Premium.

• Turning it off deletes the routes your account kept, and no new ones are kept: "The route map is off and the stored routes are deleted."
• The area around the start and the finish is cut out before a route is sent to your browser, 300 m unless you choose between 100 m and 1,000 m, and one switch covers both ends. See Activities for how the blur works.
• We do not share, publish or reuse routes for anything but your map. On its way from your device's maker to your account, a route is held for at most 7 days, only to pass it on.
• When Premium ends, the map is turned off and the routes are deleted, at the latest the following night.

The picture you share#

The button "Share" (or "Download", where the browser cannot share) on the Overview makes a picture of your Body Status and a few charts. The picture is drawn in your browser or app and goes where you send it, through your phone's share sheet or as a downloaded image file. It carries a small "aiclysm.com/mybodyai" mark. There is no link and no page on our side: what you do not send stays with you. The free plan has no share picture.

Export your data#

Open Settings, section "Data & privacy", card "Your data" ("Vaše data"). It says: "Download all your data as a JSON file, or delete your account with all its data for good." Press "Export my data" ("Exportovat moje data"). A file named mybodyai-export with today's date is downloaded, or saved by the Android app. A JSON file is plain text that any text editor opens. It works on every plan, free included. If it fails, the card says "Failed to export data. Please try again."

What the file holds#

Everything we hold about you, as the account deletion page puts it. In more detail:

• your account record (e-mail, name, language, subscription status and the like) and your profile,
• every daily value we stored, the overnight HRV, the sleep stages, your workouts and the scores we computed,
• the baselines and settings the calculations use, your check-ins and notes, and the patterns we learned from your records,
• your progress (points, badges, streaks, class) and the record of workouts you deleted,
• the list of paired devices and your first-run steps,
• the messages you sent us through Contact, with our replies.

What it leaves out is what is not yours to carry: the password hash, two-factor secrets, sign-in keys of devices, your Google sign-in identifier and the payment customer number.

Deleting your account#

Open Settings, section "Data & privacy", press "Delete account" ("Smazat účet"). The window says the action is permanent and cannot be undone. Type DELETE in the field ("Type DELETE") and press "Delete forever" ("Smazat trvale"). Before that you may answer "Mind telling us why? (optional)" by choosing a reason, and a box for a note of up to 500 characters then appears. The answer is "Stored with no link to your account", and "Rather not say" skips it.

If you cannot sign in, write to support@aiclysm.com from the address your account uses and ask for deletion. We verify that the request comes from the account owner and answer within 30 days. The same page is aiclysm.com/delete-account.html.

What happens#

Deletion removes the record, it does not just flag it:

• your account and sign-in details (e-mail, password, two-factor secrets, passkeys, Google sign-in link, paired devices),
• your profile and every health record, all computed scores, check-ins and notes,
• your connections: the data we hold from each provider, and the access we revoke at the provider (COROS offers no revocation, so we delete its tokens),
• an active subscription we can reach is canceled. If the payment provider cannot be reached at that moment, cancel in its receipt e-mail or write to us and we finish it.

It runs at once. The backups we keep are deleted within 30 days.

What we keep#

• Billing records of payments you made, for 10 years, because Czech tax law requires it. They hold no health data.
• A one-way fingerprint of your e-mail address, and of the device accounts you connected, so that the free trial stays one per person (see Plans). It cannot be turned back into an address. If you delete an account yourself within 24 hours of signing up and before any data arrived, it goes with the account.
• The administrator log of who touched an account.
• Anonymous statistics that can no longer be traced to you.
• An encrypted off-site backup. An archive taken before your deletion can survive there for longer than the 30 days, encrypted so that its host cannot read it, and it is used only to rebuild the service after losing a server.

Not the same as deleting#

• Uninstalling the app stops the phone reading Health Connect, but your account keeps existing. Delete the account, or revoke the permissions in Health Connect on the phone.
• Disconnecting a device stops new data. What it already sent stays until you delete the account or ask us to delete it. Two exceptions: when you disconnect Oura or the direct Garmin link, everything received through it is deleted together with everything computed from it (privacy policy, sections 6 and 8). Your device list is in Devices.
• Turning off "Use data from the phone" makes us stop accepting what the phone sends. Days it already wrote stay.

Inactive accounts#

From 1 January 2027 we may delete an account that has been inactive for 24 months, meaning no one signed in to it and no new data reached it from a connected device or app in that time. Before that we write to the account's e-mail address twice, 30 days and again 7 days before the deletion. Signing in before that date keeps the account. An account with a running paid subscription is never deleted this way, and founder accounts are not exempt (terms, section 11). The deletion is the same as when you delete the account yourself. The notice goes out even when you switched e-mails off: Settings says that the notice before an inactive account is deleted "always" comes, together with sign-in codes, security alerts and replies to your messages.

Consents#

Registration has three separate boxes, none ticked for you except the last: "I accept the Terms of Service.", "I consent to processing my health data for wellness analytics purposes." with a link to the privacy policy, and "Send me e-mails: the weekly summary, a notice when data stops arriving, and news. You can switch them off any time in Settings, or from the link in every e-mail." Signing in with Google carries the line "By continuing with Google you agree to the Terms of Service and the processing of your health data as described in the Privacy Policy."

• Health data are processed on your explicit consent (Article 9 of the GDPR). We record which version of the privacy policy you agreed to.
• When a change affects what we do with your data, the app asks again. A full-screen window, "We have updated our privacy policy and our terms", covers the app until you answer. "I consent to processing my health data" continues. "I do not agree, sign out" signs you out. Without consent we cannot process health data, so there is nothing for the app to show. The version in force is that of 24 October 2026.
• The Terms have their own box in that window, because agreeing to a contract is not the same as consenting to health-data processing.
• The route map has its own optional box, "Turn on the route map: keep the routes of GPS workouts and show them on a map (optional)", left unticked, and offered only with Premium.
• Each device connection asks once more in a window "Data processing consent" with "I agree & continue".
• You withdraw consent by deleting your account, at any time, and by turning the route map off for that one.

Changes that only add information, or take nothing from you, apply when published and do not ask again. Section 16 of the privacy policy describes this.

Sign-in, passkeys and devices#

Open Settings, section "Account & security" ("Účet a zabezpečení").

Password#

A password has at least 8 characters, no more than 128, and is checked for strength: a weak or easily guessed one is refused with the reason. To change it you enter the current password, the new one twice ("Change password"). Changing it signs out every other browser and removes the trusted devices. A phone or watch paired more than 24 hours ago stays connected.

An account created through Google has no password. "Set password" then asks for a code we e-mail you ("This account has no password yet, so the change is confirmed by email."). The code is valid for 10 minutes. To get a new one, leave the field empty and save again, after a minute. Setting the first password signs you out in every browser, this one included, so you sign in again. After five wrong current passwords or codes the check is locked for 15 minutes.

Two-factor sign-in#

Two-factor sign-in ("Dvoufázové ověření") is optional, and the card calls it strongly recommended for health data. It needs a password first. Two ways exist, and you can have both:

• A passkey, the fingerprint or face of the device ("Add fingerprint / face"). Your biometrics never leave the device, and we store only the public key. A passkey can be added only in a browser on aiclysm.com for now, not inside the Android app. You can rename or remove each one.
• An authenticator app ("Authenticator app"): scan the QR code in Google or Microsoft Authenticator or Authy and enter the 6-digit code, then "Confirm & enable".

On enabling, you get 10 recovery codes, each usable once, shown only that time: "Save your recovery codes". "Copy", "Download" and "Saved them" follow. The card shows "Recovery codes: 7 left" and "New codes" makes a fresh set. "Turn off" asks for the current password.

At sign-in, "Verify it is you" lets you choose "Fingerprint or face", "Authenticator code" or "Recovery code", and then how long to remember the device: "Always ask", "30 days" or "Permanently".

Trusted devices and signed-in devices#

• Trusted devices ("These devices skip the second step. You can remove any of them here."): each browser you chose to remember, shown as "permanent" or "until the 30 days run out" with when it was last used. There are at most 10, and the oldest go first. The one you are using is marked "this device".
• Signed-in devices ("The phone and watch that can reach your account"): the paired Android phone and Garmin watch. Signing one out takes its access away and it must be paired again.
• "Log out of all other devices" signs out every other browser, phone and watch, removes all trusted devices and stops web notifications in the other browsers. This device stays signed in.

Security notices#

We tell you by e-mail and by push notification when two-factor sign-in is turned on or off, a recovery code is used or new codes are made, a passkey is added or removed, a password is set, changed or reset, and when someone signs in from a device we have not seen. These go out whatever your e-mail and news settings are, and by push even at night. If it was not you, change your password at once.

App lock#

In the Android app only, Settings, section "Account & security", has "App lock" ("Zámek aplikace"): "Require your fingerprint, face or PIN every time you open the app." The button is "Turn on lock" or "Turn off lock". Turning it off asks for the fingerprint or screen lock too, and the account password can stand in ("Verify another way"). An account without a password can turn the lock off only with its fingerprint or screen lock, so set a password for a fallback.

Cookies and analytics#

The cookies we set ourselves are strictly necessary: a session cookie and your language preference. We set no advertising cookies and nothing that follows you between sites. Shop links on the website lead straight to the brand with no affiliate network between.

For usage statistics we use Umami, hosted on our own servers in the EU. It sets no cookies, stores no IP address and no account identifier, and does not track you across websites. It records an approximate place derived from the IP address (country, region and city), the browser, system, device type, screen size and language. Inside the app it records a few named events, such as agreeing to connect a device, without any account identifier. Its data are deleted after 13 months. The website shows a small notice, "This site uses Umami for cookie-free analytics...", with a "Got it" button.

Separately, for signed-in accounts only, we record a few first-run milestones, for example when the account was created and when the first data arrived, so we can see where people get stuck. They are tied to your account, so they are not anonymous. They are in your export and deleted with the account. See section 15 of the privacy policy.

What we do not do#

• We do not sell, license or lease your health data, in any form, and do not use it for advertising, credit assessment, insurance evaluation or employment decisions (privacy policy, section 6).
• We do not use your health data to train general-purpose AI models or shared datasets.
• We do not read the list of apps installed on your phone.
• We do not store the login credentials of your device accounts. You sign in on the maker's own page.
• We do not write anything back into your Garmin, COROS, Google Health or Health Connect data.

Frequently asked questions#

Do you sell my data?#

No. The privacy policy says we never sell, license or lease your health data, even anonymized or aggregated, and that we do not share it with advertisers, insurers or employers.

How do I get a copy of everything you hold?#

Settings, section "Data & privacy", "Export my data". You get one JSON file. It works on the free plan too. See what the file holds.

How do I delete my account and everything in it?#

Settings, section "Data & privacy", "Delete account", type DELETE and confirm. It cannot be undone. Export first if you want a copy. If you can no longer sign in, e-mail support@aiclysm.com from your account's address.

Does uninstalling the app delete my data?#

No. The account stays on our side. Delete the account in Settings, or revoke the permissions in Health Connect.

Why did the app ask me to agree again?#

Because the privacy policy or the terms changed in a way that concerns your data or your rights, and we record which version you agreed to. You can answer "I do not agree, sign out". Without consent we cannot process health data.

Can other people see where I live from my routes?#

Only you see your routes, and the area around the start and the finish is cut out before the route reaches your browser, 300 m unless you pick another radius. See the blur.

I lost the phone with my authenticator app. What now?#

Sign in with one of your recovery codes ("Recovery code" in "Verify it is you"), then make a new set under "New codes" and add the authenticator app again. If you have no recovery codes left, write to support@aiclysm.com from your account's address.

Why did deleting my account not give me another free trial?#

A one-way fingerprint of the e-mail address, and of the device accounts you connected, outlives the account so that the free week stays one per person. If you deleted the account within 24 hours of signing up and before any data arrived, the fingerprint is deleted too. See Plans.