This policy explains what Aldo collects, why, who else touches it, and what you can do about it. It covers the app and website at aldo-coach.app (the "Service"). Using the Service means you accept this policy, the Terms of Use, and the Health & Safety Notice and Waiver.
Aldo is operated by River Lentil LLC, a California limited liability company ("we", "us"), based in California, United States. It is a single-member LLC with no staff — one person runs the Service day to day, and that person is the only human with administrative access to your data. Forming the LLC changed who is legally responsible for the Service; it did not change who operates it, who can see your data, or how your data is handled.
Contact: support@aldo-coach.app
The Service is offered to users in the United States, Canada, the United Kingdom, and the European Union/EEA. Data is stored and processed in the US by our providers, no matter which of those you're using the Service from. If you're in the EU, EEA, or UK, section 10 below covers your GDPR / UK GDPR rights and how we handle sending your data to the US. If you're in Canada, section 11 covers PIPEDA and Quebec's Law 25.
Your email address and password. Passwords are handled by our authentication provider (Supabase) and stored only as a secure hash — we never see or store your plaintext password. Confirming your account also triggers a one-line internal notification — your email address and the confirmation time — as an internal email to the operator, sent through our email provider (Resend), so we know a new account was created (see section 6).
What you enter in your profile: age, sex, bodyweight, sleep, and nutrition notes. This is optional and it is what lets the coach account for your situation. You can edit or clear it in the app. If you connect Apple Health and allow it, Aldo can fill in your age, sex and body weight from Apple Health instead (see section 3.5).
The substance of the app: workouts, training programs, set logs, schedules and life-schedule entries, exercise library entries, coach notes, and any files you upload (such as a program PDF or a training-history spreadsheet).
This category deserves its own heading, so it is getting one.
If you use the injury and rehab features, we collect:
Three things you should understand about this data:
It requires your explicit consent. Accepting this policy generally is not enough on its own. When you sign up, there is a separate, optional, unticked box for this — you can create an account without ticking it. If you didn't tick it, the first time you add an injury or log a pain score Aldo asks you to explicitly agree before that entry is saved. If you already had injury or pain data before this consent step existed, you're asked once, the next time you open the app. If you say no, the entry isn't saved, and pain scores stay off until you turn them on. You can withdraw your consent later with Use injuries & pain scores in coaching in Settings → Data & Backup → Sharing; after you withdraw, your existing injury and pain data stays on your device (and in your account's cloud backup) but is no longer sent to the coach or used in coaching. Withdrawing doesn't rewrite free text — anything you or the coach already wrote about an injury or a pain score (in chat, coach notes, session summaries, or your plan) stays as written, and because it is part of that chat, note or plan, it can still be sent to the coach. To remove it entirely, delete the entries in the app or delete your account (section 9).
It is sent to Anthropic's API as coaching context. To generate rehab-oriented coaching, pain interpretation, or a return-to-activity suggestion, the relevant injury entries, statuses, and pain scores are included in the prompt sent to Anthropic's models — the same way your training data is. There is no way to receive injury-aware coaching without the coach seeing your injury information. If you do not want that, do not enter it; the rest of the app works without it.
It is not medical-record data held by a healthcare provider. We are not a doctor's office, a clinic, a hospital, or a health plan, and we are not a business associate of one. Your injury and pain data in Aldo is not a medical record, is not protected health information under HIPAA, and does not carry the legal protections that apply to records your physician or physical therapist holds. It is consumer data you typed into a fitness app. We treat it carefully — it is stored under the same access controls as the rest of your account data, and we do not sell it or use it for advertising — but you should decide what to enter with that distinction in mind. What the injury features can and cannot do for you clinically is covered in the Health & Safety Notice.
The iOS app can connect to Apple Health. It is opt-in and does nothing until you turn it on in Settings → Data & Backup → Apple Health (or from the Recovery strip at the top of the Workout tab, or from the Apple Health step when you first set up Aldo). Before Aldo reads anything, it asks you in the app whether your Health data may be used in your coaching, and tells you what that means. Each data type also has its own switch you can turn off at any time.
If you connect it and agree, Aldo reads:
If you use the Aldo app on Apple Watch and agree, it also records your heart rate during an Aldo workout (and, for cardio, the calories burned) and saves it with that workout in your training log.
Location on Apple Watch (outdoor cardio only). When you start an outdoor run, walk, bike or row on the Watch, it asks for Location permission and uses GPS to measure your distance, pace, splits and elevation. Those measurements are saved with that workout in your training log, like the heart-rate figures above, and can be sent to the coach as context. The GPS route itself, the list of points you passed, is different: it is kept only on your phone, to draw the map in History. It is not sent to our servers, not included in your cloud backup, account mirror or data export, and never sent to the coach. Deleting the workout deletes the route. Indoor and pool workouts never use Location.
If you leave the third switch on, Aldo writes:
Four things you should understand about this data:
Most of it stays on your device. Your sleep, your heart-rate range comparison, and other apps' workouts live in local storage on your phone, as daily summaries kept for about a year. They are excluded from your cloud backup, the account mirror, and data exports — on a new phone, Aldo re-reads them from Apple Health there. Three things are different, because they become part of your training record: your profile body weight, when Apple Health keeps it current; your profile age and sex, when filled in from Apple Health; and the heart rate and calories saved with a workout your Watch recorded. Those are stored in your account like the rest of your training data, including your cloud backup, the account mirror, and data exports.
It is sent to Anthropic's API as coaching context. Like your injury data, it is included in the prompt sent to Anthropic's models when the coach plans or adjusts a session (see section 5). That can include the exact values: last night's sleep and your 7-day average, your current body weight and its trend, your age and sex when filled in from Apple Health, the type, date, minutes and distance of other-app workouts (with the pace or speed worked out from them) from the last week, and the average heart rate, peak heart rate, and calories of a workout your Watch recorded. On the Program tab, your coach can also look up your sleep, body weight, other-app workouts and whether your resting heart rate and HRV were below, at, or above your norm, for any day in the past year. Resting heart rate and HRV are sent only as below, at, or above your own norm, never the readings themselves.
If you do not agree, none of it is used. If you say no, or later turn off Use Health data in coaching on the Apple Health card, Aldo stops reading Apple Health and leaves your Health data out of everything it sends to the coach. Turning it off also leaves out the age, sex and body weight Apple Health filled in; a value you typed or edited yourself is ordinary profile data and is still used. It doesn't rewrite what the coach already wrote: a reply that mentioned one of those values stays as written in that chat.
It is never used for advertising, marketing, or data mining, and it is never sold. Apple Health data is not shared with anyone other than the model processing described above, and is not used for any purpose beyond coaching you.
You can withdraw at any time by turning off Use Health data in coaching in Aldo, by tapping DISCONNECT on the Apple Health card, or in the Apple Health app → Sharing → Apps → Aldo. Disconnecting stops all reading and writing. Deleting the app removes the Health data stored on your device; to remove what is stored in your account, delete your account (see section 9).
Your conversations with the coach — your messages and the coach's responses — are stored so your threads persist across sessions and so the coach has continuity. They may include whatever you have chosen to tell it, including health details.
App version, feature usage counts, message counts and model-usage records used to operate rate limits and monitor cost. Billing metadata is a subscription status and, if you have ever subscribed, a Stripe customer reference — Stripe, not us, holds any card details. While the Service is free, no new charges are made and no new payment information is collected; if paid plans return, billing works as described in the Terms of Use.
Limited technical information used to keep the app working: performance and request diagnostics, and a small rolling diagnostic buffer stored on your device.
When diagnostics are enabled, we use two additional processors to keep the app working and to understand, in aggregate, how it's used:
What's never sent, structurally, not just by policy. Every property on every event and every error report is checked before it leaves your device: only a boolean, a number, or a short enum-style tag (like a status code) is allowed through. Free text is dropped, not sent. That means your messages to the coach, the coach's replies, anything you type into a note or an injury entry, uploaded file content, and your health, injury, or pain data can never ride out through Sentry or PostHog — there is no code path that reads or forwards the substance of what you write or what the coach says. Page URLs and referrers are excluded too. Session recording and automatic click/DOM capture are both disabled — nothing about how you interact with the screen is recorded.
Both ride our own backend. Your device never contacts Sentry's or PostHog's servers directly; every report and event is proxied through our own API. Their servers never see your IP address making a direct request to them, and no separate third-party connection is made from your browser.
You can turn this off — and where you are changes the starting point. Settings → Data & Backup → Sharing has a single toggle, Share error reports & anonymous usage, that governs both Sentry and PostHog together. If your device's region or time zone is set to the EU/EEA, the UK, or Switzerland, that toggle starts off, and nothing is sent to Sentry or PostHog until you turn it on yourself. Everywhere else, it stays on by default, as it always has. Either way, changing it stops or starts both immediately on your device — the app works exactly the same regardless.
The app can connect to your calendar so the coach can see what's already on your schedule. It is opt-in and does nothing until you connect it, from the calendar sync card in Schedule (Program tab → Manage Schedule, or tap any day on the calendar), and you can disconnect at any time.
Two providers, depending on platform:
If you connect a calendar, for each event in the calendars you select Aldo reads:
Three things you should understand about this data:
It is stored, not just passed through. Unlike Apple Health data, a synced calendar event becomes an ordinary entry in your Schedule — on your device and in your account's cloud backup — exactly like one you typed in yourself. You can edit its category, mark its impact on training, add a note, or delete it there.
It is sent to Anthropic's API as coaching context. Event titles, dates, times, and categories in your Schedule — calendar-synced or hand-entered, the coach's context doesn't distinguish — are included in the prompt sent to Anthropic's models (see section 5) so the coach can plan around what's on your calendar. If you don't want an event's title reaching the coach, don't sync that calendar, or edit or delete the entry in Schedule once it appears.
The Google connection itself is stored server-side. Connecting Google Calendar stores a refresh token and the granted scope with our backend (Supabase) so we can fetch your events without asking you to sign in to Google every time; the token never reaches your device. Apple Calendar has no equivalent — it is on-device only, so there is no server-side token to store.
You can disconnect at any time with Disconnect in the calendar sync card. That stops Aldo from reading or syncing your calendar going forward; events already synced stay in your Schedule as ordinary entries, the same way disconnecting Apple Health doesn't erase what it already wrote (section 3.5). To also revoke Aldo's stored access to your Google account, remove Aldo from Google's connected apps — this invalidates the stored token — or delete your Aldo account, which removes it along with everything else. On iPhone, calendar access is controlled the same way as Apple Health: iOS Settings → Privacy & Security → Calendars → Aldo.
If you email us — at support@aldo-coach.app or any other aldo-coach.app address — we keep your message, your email address, and anything you attach, so we can answer you and follow up. Our mailboxes are hosted by Google Workspace (section 6).
This part is about people who aren't necessarily users. If you're a creator, journalist, or publisher, we may contact you about Aldo using business contact details you've published yourself — your name or public handle, your public business email, and your channel or website — and we keep a note of what we sent and what you replied. We also watch public posts on sites like Reddit for mentions of Aldo and of topics we can usefully answer, using a monitoring service (Syften); that reads only what was already posted publicly. We don't buy contact lists, and we never add you to product-update emails because of this. To be left out, reply to tell us or email support@aldo-coach.app, and we'll delete your details.
Settings → Data & Backup → Sharing has a switch, Share data with the developer, which is off unless you turn it on. If you turn it on:
Turning it off stops both right away: the operator can no longer open your backups, and no more reports are filed. Your backups themselves stay in your account, as before.
The sign-up screen and Settings → Profile have an optional box for a code, such as one a creator or coach shares with you or one already in a link you tapped. You never need one, and a code never unlocks anything.
If you're a coach who gives us rules for a code, we keep your name, your rules, any program file you gave us and a private note about the code, only to run it. Ask at support@aldo-coach.app and we'll delete them.
Coaches can apply for a code with the form at aldo-coach.app/coaches. We collect what you type there: your name, your email, the platform where you coach or post and your handle or link there, how you coach in your own words (including anything you paste in, such as a description an AI chat wrote for you), anything else you add, the code you'd like, and, if you choose to attach one, a program file (PDF, Excel, Word or text). The form is run by our web host, Netlify, which stores the application and emails it to us (section 6), so a copy is also kept in our business email. An attached program file is held by Netlify with the application. We use it only to review your application, write your rules with you and set up your code. Nothing goes live until you OK the final rules. If your code goes live, your name and rules are kept as described in section 3.14, and an approved program file is also stored privately on our server (Supabase) and given to athletes who use your code, as described there. If it doesn't, we delete your application within 90 days of answering you. You can ask us to delete it sooner at support@aldo-coach.app.
We do not sell your personal information, we do not share it for advertising or cross-context behavioral advertising, and we do not use your data to train AI models.
Aldo is powered by large language models from Anthropic. To generate a response, the relevant parts of your data — profile, current and recent sessions, programs, notes, injury entries and pain scores, and the conversation — are sent to Anthropic's API through our backend.
Under Anthropic's API terms, data submitted through the API is not used to train its models. Anthropic processes it to return a response and retains it only as its terms and policies allow.
We send what the coach needs for the request at hand rather than your entire history, but assume that anything you enter in the app may be sent as coaching context.
We share data only with providers that operate parts of the Service on our behalf:
Two other companies are involved only when you use a feature that needs them: Google, if you connect Google Calendar (section 3.10), and Apple, if you use Sign in with Apple, push notifications, or Apple Health. Each handles that data under its own terms with you. We may add or change providers; when we do, we will update this list.
We may also disclose information if required by law, to enforce the Terms of Use, or to protect the safety of a person or the Service.
Outbound links are links, not embeds. When Aldo shows a "watch tutorial" button, or the coach includes a video or article link, the app is not loading that content inside itself. We do not embed third-party video players, so nothing about you is sent to YouTube, Google, or any other site until you tap the link and leave — and those sites set no cookies on you through us. Once you follow a link you are on their site, under their privacy policy, and we have no visibility into or control over what they collect.
When you file a bug report from inside the app, it is filed as an issue in a private GitHub repository that only the operator can see. The issue carries your report's description and basic diagnostic details, plus your account's opaque user id (never your email) so we can look you up if we need to follow up. You will also see a checkbox offering to attach a snapshot of your app data — training data, chat transcripts, and settings — so the bug can actually be reproduced.
How it works:
Ask at support@aldo-coach.app if you want a snapshot you submitted deleted.
We keep your account and data for as long as your account is active.
When you delete your account, your data is removed from our active systems, including any bug-report snapshots and screenshots you attached. Copies may persist for a limited period in our database provider's encrypted backups, which are kept for 7 days, and in provider logs (for example, hosting and error-monitoring logs) until they expire on their normal schedule.
A working copy for the Program tab. So that Program-tab messages stay quick on a weak connection, our backend keeps a compressed working copy of the records your coach can look up there: your sessions and set logs (including pain scores), programs, coach notes and chat threads. Where you have consented, that includes the injury details in those records and the heart rate and calories saved with a workout your Watch recorded; your daily Apple Health summaries are never part of it. It is the same data your account already holds, stored with our database provider (Supabase). It can't be reached from the app or by any other account, and it is used only to answer your Program-tab messages. Parts that go out of date are deleted within 30 days at most. The whole copy is deleted as soon as you withdraw your Apple Health or injury consent, and when you delete your account. While you are chatting, the server answering you may also keep it in memory for up to 30 minutes after your last Program-tab message; once you withdraw consent, that copy is not used again.
A few things are kept apart from your account, and deleting it doesn't remove them by itself:
Aggregate, de-identified usage counts that cannot be tied back to you may be retained.
Washington, Nevada and Connecticut residents. Our separate Consumer Health Data Privacy Policy explains how we handle health-related data under those states' consumer health data laws, and the rights you have under them.
California privacy rights. California residents have rights under the California Consumer Privacy Act (CCPA/CPRA), including rights to know, delete, correct, and limit the use of sensitive personal information, and the right not to be discriminated against for exercising them. We honor access and deletion requests sent to support@aldo-coach.app regardless of whether the statute applies to us at our current size. We do not sell or share personal information as those terms are defined by the CCPA.
If you're in the European Union, the EEA, or the United Kingdom, the GDPR and the UK GDPR give you rights beyond what's described above, and this section covers them.
Who's responsible for your data. River Lentil LLC (section 1) is the controller — the entity that decides what's collected and why. There's no separate EU or UK entity, and no shared controllership arrangement.
What lets us process it. For the data categories in section 3, we rely on one of these:
Your rights. You can:
To exercise any of these, email support@aldo-coach.app. We respond within one month.
Sending your data to the US. Your data is processed in the US (section 2), so it leaves the EU/EEA or UK whenever we or our providers handle it. Where a provider is certified under the EU-US Data Privacy Framework (and its UK Extension and Swiss-US framework), we rely on that. Where it isn't, we rely on Standard Contractual Clauses (and the UK's International Data Transfer Addendum and the Swiss equivalent) in our contract with that provider. Provider by provider:
Our representative in the EU, EEA and UK. River Lentil LLC, trading as Aldo and Aldo Coach, has appointed DataRep (Data Protection Representative Limited, trading as DataRep) as its data protection representative in the EU and EEA under GDPR Article 27, and in the UK under the UK GDPR. If you're in the EU, EEA or UK, you can contact DataRep instead of us about your personal data or your rights:
If you write, address your letter to DataRep, not to Aldo or Aldo Coach, or it may not reach them.
Mention Aldo Coach clearly in what you send. We may ask you to confirm your identity before we act on a request, so your data only goes to you. How DataRep handles your own details is covered in its privacy notice.
DataRep handles personal-data questions only. For anything about the app itself, email support@aldo-coach.app.
No decisions about you are made by algorithm alone. The coach suggests workouts, loads, and adjustments; it doesn't make any decision about you with a legal or similarly significant effect, and nothing in the Service works the way GDPR Article 22 describes automated decision-making. You decide what to do with what it suggests.
If you're in Canada, the Personal Information Protection and Electronic Documents Act (PIPEDA) applies to how we handle your personal information, and if you're in Quebec, Quebec's Law 25 applies as well. Both give you rights similar to the ones above: to know what we hold about you, to access and correct it, and to have it deleted.
The person responsible for our compliance with these laws, and the person to contact about them, is the operator of River Lentil LLC, reachable at support@aldo-coach.app.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affects your data, we will notify you as required by law.
The Service is for adults. You must be 18 or older to use it, and we do not knowingly create accounts for or collect personal information from anyone under 18. We do not knowingly collect any information from children under 13, consistent with COPPA.
When you create an account, the app asks for your date of birth and checks it on your device. Your date of birth is not sent to us or stored — we record only the date and time you confirmed you are 18 or older. The same holds for a date of birth read from Apple Health: only an age worked out on your phone is kept.
If you believe someone under 18 has created an account, email support@aldo-coach.app and we will delete it and the associated data.
We may update this policy. When we do, we update the "Last updated" date and version number at the top. Material changes will also be announced in the app, and where they affect your agreement with us, you may be asked to re-accept the updated Terms of Use.
Questions about this policy, your data, or a deletion request: support@aldo-coach.app. In the EU, EEA or UK you can also contact our representative, DataRep (section 10).
Related documents: Terms of Use · Health & Safety Notice and Waiver