1. Who operates Actlytix
Actlytix is operated by Thomas Bullock, who is responsible for how personal information is used by this service. In data-protection terms, this is the data controller.
Privacy contact: privacy@actlytix.app.
Before publication: create and test this monitored mailbox and confirm any additional controller contact particulars required for the service.
This notice covers the public website and the private beta at beta.actlytix.app. The coming-soon website has no signup form: its beta button opens the separate account-registration page.
2. Information we use
- Website visits: technical information needed to serve and protect the website, including IP address, requested address, browser information and request time. Cloudflare processes technical information when delivering and protecting the site.
- Your account: name, email address, password hash, email-verification records, preferences and login/session records. Passwords are not stored as readable text.
- Connected accounts: identifiers and authorisation credentials, activity dates and types, distance, duration, pace, heart rate, elevation, laps, GPS routes, shoes/equipment and other fields returned by integrations you connect.
- Health and nutrition: available daily readings, such as steps, sleep, stress, heart-rate variability, weight and hydration; nutrition totals and food details from reports you import or forward.
- Information you enter: planned races, targets, plans, effort/fatigue/soreness check-ins, Coach messages, feedback and problem reports. Messages may contain sensitive information, such as illness or injuries, if you choose to share it.
- Support payments: payment identifiers, payer email, amount, currency, date and whether a payment is one-off or monthly, when supplied by Ko-fi. Card details are handled by the payment service, not collected in Actlytix.
Activity, nutrition and recovery records can reveal information about your health and may be special-category personal data. Only connect or submit information you want Actlytix to process.
3. Why information is used
Information is used to create and secure your account, sync integrations you request, display your history and trends, manage shoes and races, save plans and feedback, deliver optional AI features and administer beta access and premium entitlements.
Connected data is stored on the Actlytix server and linked to your account; it is not held only in your browser. Signing out or changing display dates does not delete history. Syncing and email importing can continue in the background while the service is running.
Authorised administrators can access information needed to operate, troubleshoot and secure the service. Connecting an integration does not make your dashboard a public profile.
4. Lawful grounds and sensitive information
Operator confirmation required. Confirm a UK GDPR Article 6 ground for each purpose and a separate Article 9 condition where records reveal health information. A draft proposal is contract necessity for requested account functions, legitimate interests for proportionate security, and consent for optional processing where appropriate. These grounds are not established merely by displaying this notice.
If relying on explicit consent for health information, verify that the beta obtains, records and supports withdrawal of valid explicit consent before making that claim in the final notice. Authorising Garmin or Strava access alone must not be presented as proof of that consent.
5. Services that may receive information
Services used depend on your integrations, administrator configuration and enabled features.
- Cloudflare
- Delivers and protects the public website and provides the beta’s connection through Cloudflare Tunnel. Traffic passes through Cloudflare; this does not make all application traffic end-to-end encrypted from Cloudflare.
- Garmin and Strava
- Supply connected activity, health or equipment data. Authorisation and sync requests go to the relevant provider, which also handles information under its own terms and privacy notices.
- BigDataCloud
- When configured, receives activity start coordinates rounded to roughly 100-metre precision for town/country lookup. This is not a full route upload.
- Mapbox or OpenStreetMap tile services
- May receive your IP address and the map areas/zoom levels your browser requests. Routes are drawn in the browser; a full route track is not included in map-tile requests.
- OpenAI or Google Gemini
- If you enable AI, the selected provider receives relevant summaries. Depending on the feature, these can include activities and laps, health and nutrition, shoes, goals, races, plans, check-ins and saved conversation context. Some features run automatically, including enabled run reviews. Disabling AI stops new requests, but does not recall information already sent or delete saved conversations.
- AI web-search services
- May receive search queries for public information. Questions and messages are sent as written, so information you type can be transmitted even when structured location or coordinate fields are excluded. The provider may use its own tools to process requests.
- Email delivery and report importing
- Resend delivers account emails when configured. If nutrition email importing is enabled, reports and attachments pass through the dedicated mailbox and its mail provider before being parsed and assigned to your account. Manual importing is separate.
- Ko-fi and payment services
- Handle support payments. Ko-fi can send notifications to match a payment with an Actlytix account and apply premium access.
Before publication: confirm live providers, processor contracts, processing locations and international-transfer safeguards. Do not describe processing as UK-only without checking these services.
6. Cookies and browser storage
The static coming-soon page contains no advertising scripts, analytics scripts or cookie-setting JavaScript. Cloudflare may process technical information or use security mechanisms when protecting traffic.
The beta uses necessary session/security cookies and browser storage for functionality and preferences. Some preferences and results are also saved in the account database. This notice must be updated if non-essential tracking is introduced.
7. Security and storage
Integration credentials are encrypted before database storage. Passwords are hashed. The app includes account-specific access checks and administrative security controls. These measures reduce risk, but no internet service can promise absolute security.
Application records, operational logs, forwarded reports and backups may have different storage locations and deletion schedules.
8. How long information is kept
Account-linked history and saved conversations are retained to provide the features you use until you remove the relevant records or delete your account. Clearing Coach conversations and deleting nutrition records are separate actions from signing out.
Deleting an account removes account-linked records from the live application database. Copies may remain temporarily in backups, provider systems or records kept for applicable security or legal purposes.
Retention periods to confirm: backup expiry after account deletion; security/API-log retention; forwarded-mail retention; support/payment records and legally required records. Specify actual periods or clear criteria before publication. Account deletion must not be described as immediate erasure from every backup and third-party system.
9. Your choices and rights
You can choose integrations, turn AI off, disconnect Strava, export your data and delete your account in Settings. Disconnecting an integration does not necessarily delete previously synced history. You can also revoke permissions through the external provider.
Depending on the circumstances, your rights may include access, correction, erasure, restriction, portability, objection to certain uses and withdrawal of consent where consent is the applicable ground. Withdrawal does not affect processing that was lawful before withdrawal.
Send privacy requests to privacy@actlytix.app. We may need enough information to verify your identity before releasing or changing account records.
You can also complain to the UK Information Commissioner’s Office.
10. AI advice and changes to this notice
AI outputs can be inaccurate. Training estimates and suggestions are not medical diagnoses or professional medical advice. They do not independently determine access to employment, insurance, credit or other legal entitlements.
This notice should be updated as the beta changes. Material changes to how information is used should be explained before the new use begins, with additional consent obtained where required.