Privacy Policy

1. Who we are

Split Index ("we", "us", or "our") operates the Split Index fitness analytics platform at splitindex.co.uk and the Split Index mobile apps for iOS and Android. This policy covers all of them; where something applies only to the mobile apps, it says so. We are the data controller for personal data processed through the service.

For privacy-related enquiries, contact us at privacy@splitindex.co.uk.

2. What data we collect

We collect and process the following categories of data:

• Account information: email address, authentication identifiers, and profile details such as username, display name, avatar, and country.
• Health and fitness data: workout and activity logs (including sport type, duration, distance, pace, heart rate, and gym exercise data), body metrics (such as weight and body fat percentage), recovery metrics (such as sleep, HRV, and resting heart rate), training goals, and performance scores including your Split Index.
• Alcohol intake, if you choose to record it: the drink, its volume and strength, how many, and the time you had it. It is used for one thing — estimating the effect on your recovery score and your next session — and it is never sent to an analytics service. Your individual drinks are never shown to another athlete. The single exception is the alcohol-free streak leaderboard, which shows days since your last drink and only if you explicitly opt in; it is described in full below. Recording alcohol is entirely optional; every other part of Split Index works whether you do or not, and you can delete any entry — or your whole history — from the Recovery page at any time.
• Onboarding and preferences: age, height, weight, gender, experience level, training history, and preferred sports.
• Location data (mobile apps):when you start a tracked outdoor session, we use your device's precise location, including while the app is in the background or your phone is locked, so tracking survives a pocketed phone. The individual GPS fixes stay on your device, in the app's own storage, so an interrupted run can be recovered — we never receive them. What we do receive is the session summary (distance, duration, pace and elevation gain) and a simplified route, so the run can be drawn on a map. That route is a real record of where you went, and we store it. Before it is written we remove the first and the last stretch of the run, so a stored route never begins or ends at your front door; the honest limit of that is worth stating, because it hides your start and your finish and not every moment you were near home — a loop that passes the house at halfway still shows that passage. An athlete you have accepted as a friend can see the stored route wherever they can see the activity itself. The one other thing we receive is the coordinate a session starts at, sent so we can look up the temperature at the time; it is used for that and not stored as part of your activity. We never collect location when a session is not running, and you can refuse or revoke the permission in your device settings.
• Run analysis and best efforts (mobile apps): for a GPS-tracked session we also store the per-sample series the analysis is built from — for each sample, how far into the run it was in moving seconds and cumulative metres, and the altitude, heart rate and cadence recorded at that point. It holds no coordinates: it records how far along the run you were, never where you were. From it we store your best efforts — your fastest stretch at each standard distance in that session, and when it happened — which is what lets the app tell you a run was your fastest ever. We record both for every athlete, whether or not you are subscribed, so that the analysis is there for the runs you logged before you subscribed rather than a hole in your history. Both are visible only to you: they are not shown to friends, do not appear on any leaderboard, and are deleted with the activity they belong to.
• Motion and fitness sensors (mobile apps):step counts from your device's motion sensors during a run or walk, used to show your cadence.
• Connected Bluetooth equipment (mobile apps): readings from heart-rate monitors you choose to pair, such as chest straps and armbands that use the standard Bluetooth heart-rate profile. We use Bluetooth to talk to the device in front of you; we do not use it to detect your location or nearby devices for any other purpose.
• Apple Health (iOS app):if you connect it, we read your workouts (type, time, distance, heart rate), heart rate variability, resting heart rate, sleep and weight from Apple Health, including anything a watch or another app has written there, and store them in your account as sessions and recovery inputs. We read only what you allow in Apple's permission sheet, we never write to Apple Health, and you can disconnect in Settings at any time — what was already imported stays in your log until you delete it. Separately, during a session we read your live heart rate, including from compatible headphones; the app starts a Health workout session so those sensors switch on, and that workout is not saved to Apple Health.
• Payment information: subscription status, billing history, and Stripe customer identifiers. Payment card details are collected and processed directly by Stripe; we do not store full card numbers.
• In-app purchases (mobile apps): subscriptions bought inside the apps are processed by Apple or Google, not by us. We receive the purchase and renewal status for your account through RevenueCat. We never see your card details, and Apple and Google do not give them to us.
• OAuth data:when you sign in with Google or Apple, we receive account identifiers authorised by you through that provider. If you use Apple's Hide My Email, we only ever see the relay address Apple gives us, never your real one.
• Social features and content you write: friend connections, leaderboard participation, public profile information you choose to share, and free text you enter yourself — your profile bio, and comments you leave on activities shared with you.
• Blocks and reports: if you block another athlete we store that you did, so we can hide you from each other. If you report a comment or a profile we store what you reported, the reason you chose, and anything you typed in the box. Reports name the account they are about — so a report someone files about you is data we hold about you, and you can ask us for it like any other. We do not tell the person who was reported who reported them.
• In-app notifications: the messages the app writes for you and shows behind the bell — currently a reminder that a training streak is about to end, and a welcome prompt if you have not logged a workout yet. We store the title, the text of the message, and whether you have read it. Some of that text is a fact about your training: a streak reminder names how many days your streak has run. Only you can read your notifications, and they are deleted with your account. We do not send push notifications to your device at all — the app does not ask for that permission and holds no device token.
• Technical and usage data: IP address, browser type, device information, cookies, and logs related to how you use the service.
• AI-generated content: workout analysis and coaching feedback generated from your activity data.

3. How we use your data

We use your data to:

• Provide, maintain, and improve the Split Index service;
• Calculate performance scores, analytics, and personalised insights;
• Process subscriptions and manage billing;
• Authenticate your account and secure the platform;
• Import and sync activities from connected fitness integrations;
• Measure distance, pace, splits and cadence during a tracked session, and record heart rate from Apple Health or a paired Bluetooth device;
• Enable social features such as leaderboards and shared profiles;
• Generate AI-powered coaching feedback based on your workout data;
• Communicate with you about your account, updates, and support requests;
• Comply with legal obligations and enforce our terms.

If you sign in with Google, we use the Google account information you authorise (such as your name and email address) solely to create and authenticate your Split Index account. We do not use Google user data for advertising, and we do not sell your personal data.

What we never do with health, location or sensor data

Health, location, motion and connected-device data is used to run the service and nothing else. Specifically, we do not:

• Use any of it for advertising or marketing;
• Sell it, or share it with data brokers;
• Use it to track you across other companies' apps or websites. The apps contain no advertising or cross-app tracking SDKs;
• Disclose data read from Apple Health to any third party without your consent, or use it for anything other than your own health and fitness in the app.

Location, motion, Bluetooth and Apple Health access are each asked for separately, and each is optional. You can refuse any of them, or withdraw them later in your device settings; the rest of the app keeps working without them, with the feature that needed the sensor switched off.

4. Legal bases for processing (UK GDPR)

Under UK data protection law, we rely on the following legal bases:

• Contract: processing necessary to provide the service you sign up for, including account management, scoring, and subscriptions.
• Consent: where you connect third-party integrations, enable optional features, or agree to marketing communications.
• Legitimate interests: to improve the service, prevent fraud, and maintain security, balanced against your rights.
• Legal obligation: where we must retain or disclose data to comply with applicable law.

Training data and health data are not the same thing

We treat what you log and what you tell us about your health as two separate categories, with two different legal bases.

• Your training data — contract. Sets, reps, loads, distances, times, session heart rate, bodyweight entries, age and sex. These are the inputs you give us to get the service you signed up for; the scoring engine cannot work without them. On their own they record what you did, not what condition you are in, so we do not treat them as health data.
• Your health screening — explicit consent. The PAR-Q answers, injury history, recent surgery, pregnancy or postpartum status, medication affecting your heart rate, and the low-energy-availability questions, together with the injury Risk Index. These exist to work out whether something is safe for you, which makes them special category data under Article 9. We only process them if you explicitly agree, and we keep a record of exactly what you were shown when you did.
• Your alcohol log — contract. If you choose to record what you drank and when, we use it for one purpose: estimating the effect on your recovery score and on your next training session. We are clear about why this sits with your training data rather than with your health screening — it is a record of something you did, used to predict how a workout is likely to go, and we do not use it to assess your health. Specifically, we do not screen your drinking, score it against any clinical questionnaire, or draw any conclusion about your health from the pattern of it. Your individual drinks are never shown to another athlete, never appear on a share card or a social feed, and are never sent to an analytics provider.
• The alcohol-free streak leaderboard — explicit consent. This is the one thing derived from your alcohol log that other people can see, and you are not on it unless you have separately and explicitly chosen to be. Showing other athletes how long you have gone without a drink is special category health data, so it has its own consent, its own record of exactly what you were shown when you agreed, and its own one-press withdrawal. What appears is a number of days since your last logged drink, a count of how long you have been tracking, and the username, display name and avatar already on your public profile. Your individual drinks, units, volumes, times, weekly totals and Recovery score are never part of it. Refusing costs you nothing else — you can still log drinks, still get your Recovery score and session forecast, and still view the leaderboard; you simply will not appear on it. Leaving removes you immediately, and nothing derived from it is retained, because the board is calculated on demand rather than stored.

You can refuse the health screening, and you can change your mind. Refusing switches off the Hybrid Plan and the injury Risk Index and nothing else — logging, your Split Index, predictions, the leaderboard, analytics and your subscription all work either way. You can withdraw in one action from Settings, and withdrawing deletes those answers rather than hiding them.

Recording alcohol is entirely optional in the same way, and nothing in Split Index requires it — your Recovery score is calculated and shown whether you log a drink or not. You can delete any single entry, or your entire alcohol history in one action, from the Recovery page. Deleting removes the records rather than hiding them, and it affects nothing else in your account.

5. Third-party service providers

We use trusted processors to operate Split Index. They may process your data only on our instructions and subject to appropriate safeguards:

• Supabase — authentication, database hosting, and file storage;
• Vercel — application hosting and content delivery;
• Stripe — payment processing and subscription management;
• Google — OAuth sign-in (when you choose to use it);
• OpenAI — AI-generated coaching feedback based on your workout data;
• Apple and Google — payment processing for subscriptions bought inside the mobile apps. They act as the seller for those purchases under their own terms, not as our processor;
• RevenueCat — recording which subscription an account holds and when it renews, for purchases made inside the mobile apps;
• Upstash — rate limiting, which processes IP addresses to stop abuse of the service.

Each third party operates under its own privacy policy. We encourage you to review their policies when connecting external accounts.

6. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the service is used. Essential cookies are required for authentication and core functionality. Where non-essential cookies are used, we will request your consent in line with UK requirements.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features, including sign-in.

7. Data sharing

We do not sell your personal data. We may share data:

• With service providers listed above, to operate the platform;
• With other users, when you use social features or set your profile to be publicly visible;
• When required by law, regulation, court order, or to protect the rights and safety of Split Index, our users, or others;
• In connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.

People working on Split Index are not a fourth kind of sharing, but you should know what they can reach. Section 11 sets out which of us can see anything across accounts, what that view does and does not show, and what is recorded every time somebody opens it.

8. International transfers

Some of our service providers may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations, Standard Contractual Clauses, or equivalent mechanisms recognised under UK GDPR.

9. Data retention

We retain your data for as long as your account is active and as needed to provide the service. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we must retain information for legal, accounting, or fraud-prevention purposes.

You can delete your account yourself, from Settings in the app or on the website — you do not need to email us or ask permission. Deleting removes your account and the data held against it, including your activities, your health screening answers and your profile. Everything we hold about a tracked session goes with that activity — its stored route, its per-sample series and its best efforts — because each is attached to the activity and deleted with it. The raw GPS fixes are the one part we never held: they sit in the app's own storage on your device, and removing the app deletes those with it.

Deleting your Split Index account does not cancel a subscription bought through Apple or Google. Those are managed by the store that sold them — on iOS, through Manage Subscription in the app or in your Apple account settings.

Two kinds of security record outlive a deletion, and they do it by ceasing to name you rather than by being kept about you. If your account ever reached an administrator surface, or triggered a security event, those rows stay — but the reference to your account is set to empty, so what remains says that something happened and no longer says who. An account being erased must not be able to erase the record that it once read across the fleet, or that it was refused repeatedly; that is the balance we have struck between an audit trail and your right to erasure.

Reports are the one thing kept when the content they are about is gone. If someone reports a comment and the comment is then deleted, the report stays — otherwise anyone could clear their record by deleting the post, and the pattern of reports about an account is the part that matters for keeping people safe. A report is kept against the account it names, and goes when that account is deleted.

10. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data in certain circumstances;
• Restrict or object to certain processing;
• Request portability of data you provided to us;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise your rights, email privacy@splitindex.co.uk. We may need to verify your identity before responding.

11. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and row-level security on user data. No method of transmission or storage is completely secure; please use a strong, unique password and keep your credentials confidential.

Who at Split Index can see your data, and what is recorded when they look

You are entitled to know who sees your data and not only what we store, so this says so plainly. Row-level security scopes every ordinary read in the app to a single account: when the app asks the database for activities, it can only be given yours. There is one route that steps outside that, and it is worth describing exactly.

A small number of people running Split Index hold an administrator role. It gives them one thing: an operations view used to decide whether a feature being rolled out is behaving safely and whether to pause it. That view is the only place in the service that reads across all accounts rather than one. What it shows is aggregate only — counts, averages and distributions. No account identifier, email address or individual athlete's row is included in it, and the code checks its own output and refuses to return anything containing an identifier. So an administrator can see that, for example, a number of athletes recorded a particular kind of session last week. They cannot use this view to look up you.

We store who holds an administrator role: the account, which of the two roles it is, when it was granted, by whom, and a note. Nobody can give themselves the role — there is no route through the app that grants it, and it has to be done directly against the database by someone with that access.

Every attempt to reach an administrator surface is recorded, whether or not it succeeded. Administrator access is recorded as: the account that tried, the role it held, which route it asked for, whether it was a read or a change, whether it was allowed or refused, and the parameters of the request — a number of days, a rollout percentage. It never holds health data, a body measurement, a health-screening answer, an access token or an email address. Refusals are kept deliberately: one account being refused repeatedly is what tells us somebody is probing, and a record of successes alone cannot show an attempt that failed.

If you are not an administrator, none of these records are about you. If you are, they are your personal data and you can ask us for them like any other.

12. Children

Split Index is not intended for users under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the effective date. Where changes are material, we will provide additional notice where appropriate.

14. Contact

Questions about this Privacy Policy or our data practices? Contact us at privacy@splitindex.co.uk or support@splitindex.co.uk.