Privacy Policy.

Jordi Espanyol ("I", "me", or "Developer"), operating as an independent developer, is the controller of the personal data collected through the Project Summit iOS application ("the App").

The App is an adaptive cycling training platform for iOS.

Contact email: legal@projectsummit.app

The App collects data in the following categories:

Data is used solely to provide and improve the App's core functionality:

• Generate and adapt personalised cycling training plans
• Calculate training load, fatigue, and recovery readiness
• Estimate eFTP and power curve via the CP2 model
• Push structured workouts to connected platforms via intervals.icu
• Detect skipped sessions and cascade plan adjustments
• Diagnose and fix application errors
• Email you about Summit itself — see below

Emails about Summit. If you have registered an account, we send you emails about Summit itself: the science behind the model — how your fitness, fatigue and form actually move, how a taper works — how the App's own features work, and what is new as it ships. Only ever about Summit: never a third party's product, never affiliate content, never advertising. We rely on our legitimate interest in explaining our own service to the people using it (GDPR Art. 6(1)(f); in Spain, LSSI-CE Art. 21.2, which lets a business write to its own registered users about its own similar services). We are not asking for your consent for this, and we do not rely on it — instead, you can object at any time: turn the emails off in the App under Settings › Legal, or use the one-click unsubscribe in any email we send you. Either takes effect immediately.

Your training, activity and health data are never used to decide who receives these emails or what they say. We select recipients by language and by how long ago you finished onboarding, and nothing else.

We do not use your data for advertising, profiling for commercial purposes, or sale to third parties.

Project Summit connects to the following external services. Each operates under its own privacy policy.

You may disconnect any integration at any time from the App's settings or directly from the third-party platform.

Your data is stored on Supabase infrastructure hosted in the EU (West Europe) region. Data in transit is encrypted using TLS 1.2+. Data at rest is encrypted at the storage layer by Supabase.

Access to backend services is protected by row-level security policies. Only your authenticated user account can read or modify your personal training data.

Apple Health data is queried locally on-device and transmitted to the backend only as a unique aggregated recovery metric. Raw biometric samples are never uploaded.

Your data is retained for as long as your account is active. If you request account deletion:

• Your personal data will be permanently deleted within 30 days
• Anonymised, aggregated training statistics that cannot be re-linked to you may be retained for product improvement
• Backup copies are purged within 90 days of account deletion

To delete your account, open the App and go to Settings › Account › Delete account permanently, then confirm twice. You can also ask us to do it by writing to team@projectsummit.app.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — request a copy of the data held about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Portability — receive your data in a machine-readable format
• Restriction — limit how your data is processed
• Objection — object to certain types of processing, including our emails about Summit (see section 3). For direct marketing this right is absolute: we act on it immediately, with no questions asked
• Withdraw consent — where we rely on your consent, withdraw it at any time

To stop receiving our emails you have two routes, and both take effect immediately: turn them off in the App under Settings › Legal, or use the unsubscribe link in any email we send you (or your mail app's own "Unsubscribe" button). Neither deletes your account or your training data.

To exercise any of these rights, contact us at legal@projectsummit.app. Requests will be responded to within 30 days.

If you are located in the European Economic Area, you have the right to lodge a complaint with your local data protection authority (DPA).

Project Summit is not directed at children under the age of 13 (or 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided personal data to the App, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated via in-app notification at least 7 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.

Continued use of the App after the effective date constitutes acceptance of the updated policy.

This section covers projectsummit.app itself, separately from the data the App collects (sections 1–9 above).

We use PostHog, an EU-hosted analytics provider, to understand how visitors use the site. Traffic is proxied through our own domain (projectsummit.app/ingest) rather than sent to PostHog directly. Analytics cookies are opt-in: nothing is loaded or set until you choose "Accept" in the cookie banner shown on your first visit.

You can change your choice at any time using the "Cookie settings" link in the footer.

For privacy-related questions, requests, or complaints: