Privacy policy

This translation is provided for convenience; the French version prevails. Version française

Last updated: November 7, 2026

Data controller

Who are we?

Keido is a web app for strength training adapted to your sport, available at keido.app.

Data controller: Meven Le Strat — keido.app@gmail.com

This policy describes what personal data we collect, why, and how you can exercise your rights under the GDPR (EU Regulation 2016/679).

Data collected

Account data

Email address (required to create an account)
Password (hashed, never stored in plain text — via Supabase Auth)

Usage data

Sport practiced, goals, available equipment
Generated programs, recorded sessions, exercises and sets completed
Training history (weight, reps, duration)
Discomfort and pain you report (area, intensity), how you felt after a session
What you write to Keido in the chat, and your exchanges with your coach if you have one

Payment data

Payments are processed by Stripe — Keido does not store any banking data.
We only keep the subscription status (active / inactive).

Analytics data (with consent)

Anonymized usage events via Google Analytics 4 (pages visited, key actions)
With your consent, PostHog links these events to your account and may record browsing sessions (input fields masked) to spot what gets in your way in the app
Without your consent, and in the mobile app: usage counting by PostHog with no cookie and no storage on your device, not linked to your account
No browsing data sold to third parties

Keido in English waitlist

Email address (required)
First name (optional)
Sport chosen, and the sport you typed if you choose “Other”
Country (optional)
Arrival link: UTM parameters, sport in the link, referring site and landing page

This data is used only to let you know about Keido in English and to count who wants it, sport by sport. It is never resold. You can unsubscribe from any of our emails, or write to keido.app@gmail.com to see or delete your data.

Artificial intelligence

Keido uses models from Anthropic and OpenAI to build your programs and sessions, and to answer your questions in the chat. Nothing is sent to them without your consent, asked before the first transfer, including if you don't have an account yet.

What is sent to them

Sport, goals, level, frequency, duration, equipment, training days
The area to go easy on and the discomfort or pain you report
Your sessions, done or skipped, and your assessment results, to prepare the next part of a program
What you write in the chat and the conversation history

What is not sent to them

Your name, your email address, your account identifier
Your exchanges with your coach
Apple Health data, which Keido does not read

If you decline, your program is built on your device, without AI, and the chat stays closed. You can withdraw your consent at any time in your profile, under “Sharing with AI”: nothing is sent after that. What has already been sent remains subject to these providers' policies, linked below.

Apple Health (HealthKit)

On iPhone, Keido can save your completed sessions to Apple's Health app. This sync is off by default: it only turns on if you allow it from your profile, then in the iOS permission window.

What Keido writes to Health

The activity type (strength training) and the start and end time of the session
Nothing else: no heart rate, no estimated calories — without a sensor, an approximate value would skew your other apps

What Keido does not do

Keido does not read any Health data
No health data is used for advertising or marketing purposes
No health data is passed to a third party or stored in iCloud

The data written to Health belongs to you and stays on your device, under the control of iOS. You can turn off the sync at any time from your profile, or remove the permission in Settings > Health > Data Access & Devices > Keido. Sessions already saved stay in Health — you can delete them there yourself.

Legal basis for processing

Processing	Legal basis
Account creation and management	Performance of the contract (Art. 6.1.b)
Session and program history	Performance of the contract (Art. 6.1.b)
Payment via Stripe	Performance of the contract (Art. 6.1.b)
Audience measurement (GA4, PostHog with cookies)	Consent (Art. 6.1.a)
Cookieless audience measurement (PostHog)	Legitimate interest (Art. 6.1.f)
Sending to AI providers, including discomfort and pain	Explicit consent (Art. 6.1.a and 9.2.a)
Writing sessions to Apple Health	Consent (Art. 6.1.a)
Keido in English waitlist	Consent (Art. 6.1.a)

Processors and transfers outside the EU

Provider	Role	Location
Supabase	Database, authentication	EU (Frankfurt)
Vercel	Hosting, infrastructure analytics	USA (SCCs)
Stripe	Online payment (web)	USA/EU (SCCs)
RevenueCat	In-app subscription management	USA (SCCs)
Apple App Store / Google Play	Collection of in-app purchases	USA/EU (SCCs)
Strava	Activity sync (only if you connect your account)	USA (SCCs)
Google (GA4)	Audience measurement (with consent)	USA/EU (SCCs)
PostHog	Product usage analysis	EU (Frankfurt)
OpenAI	AI: programs and sessions, as a fallback	USA (SCCs)
Anthropic	AI: programs, sessions and chat	USA (SCCs)
Brevo	Email sending and contact management	EU (France)
Resend	Delivery of authentication emails	USA (SCCs)

SCCs = Standard Contractual Clauses approved by the European Commission.

Retention period

Account data: until the account is deleted
Session history: until the account is deleted
Payment data (Stripe): 5 years (legal obligation)
Technical logs: 90 days maximum
Keido in English waitlist: until you unsubscribe, 12 months at most, then deleted

Your rights (GDPR)

Under the GDPR, you can exercise at any time:

Right of access — obtain a copy of your data
Right to rectification — correct inaccurate data
Right to erasure — request the deletion of your account and your data
Right to data portability — export your data (available from your profile)
Right to object — object to analytics processing by declining cookies
Right to withdraw consent — change your cookie preferences from the cookies page

To exercise these rights, contact us at keido.app@gmail.com. Response within 30 days maximum. You also have the right to lodge a complaint with the CNIL (French data protection authority).