Privacy Policy

This policy explains how Domestiq handles your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It is written in plain English. If anything is unclear, email us at hello@domestiq.cc.

1. Who we are (data controller)

Domestiq is a cycling and endurance sports training platform. The data controller is:

• Contact: hello@domestiq.cc
• Company registration number: 17126849
• ICO registration reference: C1982523

2. Data we collect

• Account data: email address, username, display name, avatar
• Profile and physiology: weight, FTP, heart-rate and power thresholds, training zones and preferences, gender (optional)
• Activity and GPS data: routes, power, heart rate, cadence, elevation, imported from devices or uploaded as files
• Connected-service data: activities and profile details you choose to sync from third-party providers (see section 6)
• Payment data: subscription status, processed by Stripe. We never store your card number
• Special-category health data: see section 3
• Usage data: pages visited and features used, only if you consent to analytics (see section 8)

3. Special-category health data (Article 9)

Some of the data you can choose to record is special-category health data under Article 9 of the UK GDPR. This includes:

• Menstrual-cycle tracking
• Menopause-related data
• Mental-health and journal entries
• Wellbeing and mood
• Heart-rate variability (HRV) and recovery data

We process this data only on the basis of your explicit consent, which you give when you choose to record it. It is used to personalise your coaching. You can withdraw your consent, stop recording it, or delete it at any time (see sections 7 and 9), and doing so does not affect the rest of your account.

4. Why we use your data and our lawful basis (Article 6)

• To deliver coaching and run your account, performance of a contract. Generating training plans, analysis (PMC, power curve, insights), AI coaching recommendations, syncing activities, processing payments and sending transactional emails (verification, password reset, receipts).
• Security and product improvement, legitimate interests.Keeping the service secure and abuse-free, and understanding how the product is used so we can improve it. We have weighed these interests against your rights (a balancing assessment) and use the minimum data needed; product-analytics cookies additionally require your consent.
• Consent. Analytics cookies (section 8), special-category health data (section 3), and any marketing email. You can withdraw consent at any time.

We do not sell your personal data, and we do not use your activity data for advertising.

5. AI coaching

To generate coaching prose we send a limited set of training facts to our AI processor, Anthropic (Claude). This includes facts such as your first name, FTP and weight, and an inferred general home area. It does not include your gender. See section 6 for details.

6. Processors and sub-processors

We use the following trusted providers to run the service. Each acts on our instructions as a processor, except the connected activity providers, which are separate controllers you authorise directly.

• Anthropic / Claude (US), AI coaching prose. Receives training facts, first name, FTP/weight and inferred home area; not gender.
• Stripe (US), payment processing.
• Supabase (EU, eu-north / Stockholm), database and file storage.
• Fly.io (EU, Stockholm), hosting and compute.
• Resend (US), transactional email delivery.
• PostHog (EU), product analytics, only if you consent (section 8).
• Sentry (US), error tracking so we can find and fix crashes. Error reports are scrubbed before they leave your device: no account identification, email addresses redacted, URLs stripped of query strings, and no cookies set. Used under our legitimate interest in keeping the service secure and working.
• MapTiler and MapLibre (EU), maps.
• Open-Meteo (EU), weather data.
• OpenRouteService and GraphHopper (EU), routing.
• Connected activity providers (Strava, Garmin, Wahoo, WHOOP, Google, Hammerhead, Ride with GPS), activity sync. These are separate controllers and process your data under their own privacy policies, based on the OAuth consent you grant to each.

7. Where your data is stored and international transfers

Your personal data is stored in the EU (Supabase, eu-north / Stockholm). A few of our processors are based in the US (Anthropic, Stripe, Resend), so some data is transferred there. Where data leaves the UK or EU, it is protected by an appropriate safeguard: the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, otherwise the UK International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses (SCCs), as incorporated into that provider's data processing agreement.

8. Cookies

We use strictly-necessary cookies for authentication and security, and, only with your consent, analytics cookies (PostHog). Analytics stay off until you allow them, and you can change your choice at any time. Full details are in our Cookie Policy.

9. How long we keep your data (retention)

We keep your personal data for as long as your account is active. When you close your account, we delete or anonymise your data, except where we are required to keep records (for example, Stripe may retain transaction records to meet financial regulations). For specifics on deletion, see our account deletion page.

10. Your rights

Under UK GDPR you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate data (update your profile in Settings at any time)
• Erasure: delete your account and associated data
• Portability: export your activities as FIT/GPX files
• Restriction: ask us to restrict how we process your data
• Objection: object to processing based on legitimate interests
• Withdraw consent: for analytics, health data, or marketing, at any time

To exercise any right, email hello@domestiq.cc, or use the in-app export and account-deletion tools in Settings.

You also have the right to complain to the Information Commissioner's Office (ICO) if you think we have handled your data wrongly:

11. Contact

Questions about this policy or your data: hello@domestiq.cc