Privacy Policy
Last updated: 14 September 2026
This policy explains which data WheelPower (“the app”) collects, why, and your rights. By using the app, you accept these practices.
1. Data controller
The data controller is Gillian KOHLER CHATELAIN, sole trader (French micro-entreprise) trading as “WheelPower”, located at 10 Avenue des Romains, 74200 Thonon-les-Bains, France.
SIRET: 106 933 591 00013. Publication director: Gillian KOHLER CHATELAIN.
Contact: contact.wheelpowerapp@gmail.com — see also our legal notice.
2. Data we process
Account
Email address (and name if you provide it at sign-in). Used to create and secure your account.
Training data
Your activities (power, heart rate, cadence, speed, distance, elevation, duration, location if present), your planned sessions and your athlete and personal profile (FTP, weight, sex, max HR, goal), used among other things to estimate your basal metabolic rate and nutritional needs.
Third-party connections
You can connect WheelPower to third-party services — Strava, Wahoo, Intervals.icu, Apple Health, Apple Calendar — to import your activities or health data, and to export your sessions to your calendar. Other services (Garmin, COROS) are not available yet: access depends on an approval from the manufacturer that we do not currently hold. No data is exchanged with them for as long as the connection does not exist in the app. The data exchanged is strictly that which matches the permissions you grant at the time of linking: the scope of sharing is defined when you connect each service, and you can revoke it at any time (in WheelPower or directly with the service concerned).
Strava — what we import, what it is used for, and how to withdraw it
What we import. If you connect Strava, the app requests the read, activity:read_all and profile:read_all scopes, and stores, for each imported activity: its name and type, its start date and time, its duration (elapsed and moving), its distance, its elevation gain, your average and maximum heart rate, your average, weighted and maximum power, your average cadence, your average and maximum speed, kilojoules and calories, the relative effort score computed by Strava, and the number of public kudos and comments on the activity. For rides recorded with a power meter, the app additionally retrieves the second-by-second streams of power, cadence and gradient; the heart-rate stream is read at display time and is not stored. No GPS track and no location coordinates are imported from Strava.
What it is used for. Solely to show you your own activities in your calendar and your analysis page, and to compute your personal metrics: training load (CTL / ATL / form), power and heart-rate zones, records, power curve and progression tracking. This data is never sold, never shared with other users and never used for advertising, and it is never sent to the AI coach or to any other artificial-intelligence provider (see “Conversations with the AI coach” below).
How long we keep it. An activity imported from Strava remains stored on our servers (Supabase, in the European Union) for as long as your Strava connection exists, so that your history and your load metrics stay consistent over time. It is erased as soon as any of the following happens: you delete the activity on Strava (the deletion is notified to us and mirrored), you disconnect Strava in the app, you revoke access from your Strava account, or you delete your WheelPower account.
Withdrawing your consent. Two routes, either of which is sufficient. In the app: Settings → Integrations → Strava → Disconnect — the connection and every activity imported through Strava are then erased from our servers. Or directly on Strava: strava.com → Settings → My Apps → Revoke Access — Strava notifies us of the revocation, we verify it with Strava, then we erase the connection, the activities imported through Strava and the measurements attached to them (per-interval RPE, lactate). In both cases, activities coming from other sources (Intervals.icu, file import, manual entry) are left untouched: they rest on a separate consent.
Requesting erasure. Deleting your account (Settings → Account → Delete my account) erases all of your data, Strava included. You may also request erasure at contact.wheelpowerapp@gmail.com: we act on it within the time limits set by the GDPR.
Health data (Apple Health / HealthKit)
With your permission, the app reads from Apple Health your heart rate variability (HRV), sleep, resting heart rate, weight, body fat percentage, lean body mass, VO₂ max (maximal oxygen uptake) and your wrist temperature during sleep, to compute your fitness and recovery scores, your body composition and track your cardio progression. This data — including wrist temperature — is stored on our servers (Supabase, in the European Union) to track it over time; HRV, your resting heart rate, sleep, weight and body fat percentage, as well as wrist temperature may also be sent to our AI provider (Anthropic) only when you use the Clémence coach, to personalise its advice. Your lean body mass and VO₂ max, however, are never sent to it. WheelPower does not write to Apple Health and never uses this data for advertising. This is health data, a special category of data under Article 9 of the GDPR: it is processed solely on the basis of your explicit consent, which you can withdraw at any time (by disconnecting Apple Health in the app, or via iOS Settings → Privacy → Health).
The app also reads, from Apple Health, your respiratory rate during sleep. It is read only, never transmitted: it is used solely to display your Recovery page, on your phone. It is not stored on our servers, it is never sent to our AI provider (Anthropic) nor to any other recipient, and it is not used in the computation of any score.
HRV measured with a Bluetooth heart-rate strap
Your heart rate variability (HRV) does not come from Apple Health only: the app can also measure it itself. If you ask it to, WheelPower connects over Bluetooth to a heart-rate strap (or sensor) and reads, for the duration of the measurement only, your beat-to-beat intervals. The computation (RMSSD) is performed on your phone: the raw beats never leave it and are not kept. Only the result of the measurement and its timestamp (date, time and time-zone offset) are then stored on our servers (Supabase, in the European Union), to track your recovery over time, display it in your Analysis page and compute your daily fitness score. Like the HRV coming from Apple Health, this measurement may be sent to our AI provider (Anthropic) when you use the Clémence coach, to personalise its advice. This too is health data under Article 9 of the GDPR, processed on the basis of your explicit consent: the measurement is entirely optional and started by you, you can delete your measurements at any time, and the Bluetooth permission can be withdrawn in iOS Settings → Privacy → Bluetooth.
Daily check-in and subjective measures
The app offers a daily check-in and a post-session feedback form. Both are entirely optional: each can be skipped (“Skip for now”) or dismissed without being filled in, and the app remains fully usable if you never complete them. When you choose to answer, we process:
- your pain level (0 to 10 scale) and, if you indicate any, the body areas concerned (knee, back, neck, hands / wrists, Achilles tendon, calf, thigh, hip, foot, saddle / perineum);
- your muscle soreness, sleep, motivation and energy (1 to 5 scales);
- your rating of perceived exertion (RPE) after a session, your sensations, your enjoyment and an optional free-text comment, as well as the RPE of each interval if you enter them;
- your lactate measurements (concentration in mmol/L associated with a power output), if you record any.
This information is stored on our servers (Supabase, in the European Union) to compute your fitness score and track your recovery and progression over time; the daily check-in history is kept on a rolling basis for the last 90 days. It is also sent to our AI provider (Anthropic) only when you use the Clémence coach, in summarised form (for example “pain: 7/10 (Knee, Back)”), so that it can adapt its advice to how you feel that day. Just like the data from Apple Health, this is health data, a special category of data under Article 9 of the GDPR: it is processed solely on the basis of your explicit consent, which you give by filling in these questionnaires and can withdraw at any time by no longer completing them and deleting your data (Settings → Privacy, or account deletion).
Conversations with the AI coach (Clémence)
Your messages to the coach are sent to our AI provider (Anthropic) to generate personalized answers, together with the context needed for relevant advice: your athlete and personal profile (FTP, weight, max HR, age, city, rider type and level, weekly volume, daily activity level, unit system, goal), your recent activities and planned sessions — including, for your latest session, the detail of power, heart rate and cadence throughout the session —, your training load and fitness indicators, your race calendar, your recovery data (HRV, resting heart rate, sleep, weight, body fat percentage, wrist temperature), whether it comes from Apple Health, intervals.icu or your heart-rate strap, your daily nutrition totals as well as the carbohydrates you consumed during a session, expressed as a rate in grams per hour (never the detail of the products), and the subjective data described above (pain and body areas, soreness, sleep, motivation, energy, RPE, lactate, digestive discomfort, free-text comment). A memory summary may be kept for coaching continuity.
To prepare for a race, Clémence can also run up to three web searches per exchange, carried out by Anthropic. The query is about the race — profile, elevation, route — never about you: neither your name nor your data appears in it.
Strava exception — no Strava activity data is ever sent to the AI coach. Activities imported from Strava are excluded from everything transmitted to Anthropic: neither the activity itself, nor its name, nor its values, nor any metric derived from it (training load, records, power curve) reaches the coach, and you cannot attach a Strava activity to a message either. This exclusion is enforced twice and independently: inside the app, before the context is sent to the coach, and again on our servers when the coach queries the database — only activities coming from Intervals.icu, from Wahoo or from a file import are available to it. Consequently, this data can neither be used to generate a coach reply nor to train an artificial-intelligence model. If your only activities come from Strava, the app tells you so explicitly and the coach has nothing to analyse. This exclusion also covers the measurements you enter yourself: a rate of perceived exertion (RPE) or a lactate value attached to a step of a Strava ride is discarded along with it, and is never sent to the coach. The measurements you record outside a Strava activity do remain available to it.
Technical data
Information strictly necessary for operation (technical identifiers, error logs), as well as your push notification token (APNs) and the app language, so we can send you notifications in your language. WheelPower uses no advertising tracking and no advertising identifier (IDFA).
Food search, barcode scanning and camera
To help you log a food item, the app queries Open Food Facts, a cooperative and open nutrition database (ODbL licence), in two ways: by scanning a product's barcode, or by searching for a product by name. In the first case only the barcode read is sent; in the second, only the text you type along with the app's language. The product photos shown in the results and in your log are downloaded from Open Food Facts servers. No personal data and no information linked to your account is transmitted: neither a product's barcode nor a search term is personal data. The returned values are indicative and editable.
The camera serves two purposes. For barcode scanning, no image leaves your phone: only the barcode is sent to Open Food Facts. For photo-based nutrition estimation, the photo you take (or pick from your library) is sent to our servers and then to Anthropic, which analyses it to derive indicative nutritional values; it is neither stored nor used to train a model, and is discarded after the analysis. Both features are optional: you can decline camera access and enter the food manually, and manage this permission at any time in iOS Settings → Privacy → Camera.
Location and weather
If you allow it, the app uses your approximate location to show the weather where you ride (temperature, wind) and to adapt your hydration target to the day's temperature. The coordinates — or, failing that, the city name set in your profile — are sent to the third-party service Open-Meteo, which returns the matching weather data. No identifier and no information linked to your account accompanies this request, and your location is neither stored on our servers nor kept in any history. Location is optional: you can decline it (the app then uses your profile city, or shows no weather) and manage this permission at any time in iOS Settings → Privacy → Location Services.
Nutrition and personal profile
Your goal, your activity level, your dietary preference, your height, your age, the detail of your food diary and your personal food library are stored on our servers (Supabase, in the European Union), so that you find them again on your other devices and in our other apps if you use them with the same account. The Clémence coach does not receive this detail: only your daily totals (calories, carbs, protein, fat, fibre) are sent to it and, for a session, the carbohydrates expressed as a rate in grams per hour. All of it is erased along with your account.
3. Purposes & legal basis
- Provide the service (analysis, coaching, planning) — performance of the contract.
- Read your health data from Apple Health — your explicit consent (Art. 9(2)(a) GDPR), revocable in iOS Settings.
- Process your daily check-in and subjective measures (pain and body areas, soreness, sleep, motivation, energy, RPE, lactate, digestive discomfort) to compute your fitness score and personalise coaching — your explicit consent (Art. 9(2)(a) GDPR), given by filling in these optional questionnaires and revocable at any time.
- Send this health data to the AI coach when you use it — your explicit consent, using the coach constituting a request to process it.
- Manage your subscription — performance of the contract.
4. Recipients & processors
- Supabase — hosting and database.
- Anthropic — processing of AI coach conversations, of the training and recovery data submitted to it (HRV — whether it comes from Apple Health or from your Bluetooth heart-rate strap —, resting heart rate, sleep, weight, body fat percentage, wrist temperature during sleep, as well as your daily check-in and subjective measures: pain and body areas, soreness, sleep, motivation, energy, RPE, lactate, digestive discomfort, free-text comment; your respiratory rate during sleep, your lean body mass and your VO₂ max, however, are never sent to it), of food photos sent for nutritional estimation (no retention, no model training) and of the web searches it carries out on the coach's behalf. Activities imported from Strava are excluded from everything transmitted to Anthropic.
- Connected services (Strava, Wahoo, Intervals.icu, Apple Health, Apple Calendar) — only if you connect them, and according to the permissions granted at linking.
- Bluetooth heart-rate strap / sensor — a device you own, paired directly with your phone: it provides the measurement and receives no data from you. No third party is involved in that link.
- Apple — payments and subscription management, and delivery of push notifications (APNs).
- Open Food Facts — open nutrition database (ODbL), queried when you scan a barcode or search a food by name, and which provides the product photos; no personal data is transmitted to it.
- Open-Meteo — open weather service, queried to show the weather for your ride and adapt your hydration target; receives an approximate location or a city name, with no identifier or account data.
We never sell your data.
5. Transfers outside the EU
Some providers (e.g. Anthropic, Apple) may process data in the United States. These transfers are governed by appropriate safeguards (standard contractual clauses).
6. Retention
Your data is kept as long as your account is active. You can delete your account at any time from the app (Settings → Account → Delete my account): all your data (activities, sessions, health, daily check-in and subjective measures, conversations, profile, account) — including the AI coach's memory (coaching summary) — is then erased. In addition, the daily check-in history is permanently limited to the last 90 days: older entries are deleted automatically.
Local copy for offline use. So that your Analysis page stays readable without a network connection, the app keeps on your phone a copy of the recovery data it has already downloaded (HRV, sleep, resting heart rate). This copy never leaves the device, is never shared with anyone, and is erased automatically when you sign out, when you switch accounts, when you disconnect Apple Health (for the data coming from it) or when you delete the app.
Activities imported from Strava additionally follow the specific rules described in § 2 (“Strava — what we import, what it is used for, and how to withdraw it”): they are erased from our servers as soon as you disconnect Strava, as soon as you revoke access from your Strava account, or as soon as the activity is deleted on Strava — without waiting for your account to be deleted.
7. Your rights (GDPR)
You have the rights of access, rectification, erasure, portability, restriction and objection. You can exercise them directly in the app (export and deletion in Settings → Privacy) or by writing to contact.wheelpowerapp@gmail.com. You may also lodge a complaint with your local data protection authority (in France, the CNIL — cnil.fr).
8. Security
Communications are encrypted (HTTPS) and access to data is restricted. No system is infallible, but we implement reasonable measures to protect your information.
9. Minors
The app is intended for people aged 13 and over. For minors, data processing may require the authorization of a parent or guardian, in accordance with applicable law (in France, under 15).
10. Changes
This policy may evolve. The date at the top of the page indicates the latest update.