Privacy Policy

1. Who we are

Split Index ("we", "us", or "our") operates the Split Index fitness analytics platform at splitindex.co.uk. We are the data controller for personal data processed through the service.

For privacy-related enquiries, contact us at privacy@splitindex.co.uk.

2. What data we collect

We collect and process the following categories of data:

• Account information: email address, authentication identifiers, and profile details such as username, display name, avatar, and country.
• Health and fitness data: workout and activity logs (including sport type, duration, distance, pace, heart rate, and gym exercise data), body metrics (such as weight and body fat percentage), recovery metrics (such as sleep, HRV, and resting heart rate), training goals, and performance scores including your Split Index.
• Onboarding and preferences: age, height, weight, gender, experience level, training history, and preferred sports.
• Payment information: subscription status, billing history, and Stripe customer identifiers. Payment card details are collected and processed directly by Stripe; we do not store full card numbers.
• OAuth and integration data: when you sign in with Google or connect third-party fitness services (such as Strava or Garmin), we receive account identifiers and activity data authorised by you through those providers.
• Social features: friend connections, leaderboard participation, and public profile information you choose to share.
• Technical and usage data: IP address, browser type, device information, cookies, and logs related to how you use the service.
• AI-generated content: workout analysis and coaching feedback generated from your activity data.

3. How we use your data

We use your data to:

• Provide, maintain, and improve the Split Index service;
• Calculate performance scores, analytics, and personalised insights;
• Process subscriptions and manage billing;
• Authenticate your account and secure the platform;
• Import and sync activities from connected fitness integrations;
• Enable social features such as leaderboards and shared profiles;
• Generate AI-powered coaching feedback based on your workout data;
• Communicate with you about your account, updates, and support requests;
• Comply with legal obligations and enforce our terms.

If you sign in with Google, we use the Google account information you authorise (such as your name and email address) solely to create and authenticate your Split Index account. We do not use Google user data for advertising, and we do not sell your personal data.

4. Legal bases for processing (UK GDPR)

Under UK data protection law, we rely on the following legal bases:

• Contract: processing necessary to provide the service you sign up for, including account management, scoring, and subscriptions.
• Consent: where you connect third-party integrations, enable optional features, or agree to marketing communications.
• Legitimate interests: to improve the service, prevent fraud, and maintain security, balanced against your rights.
• Legal obligation: where we must retain or disclose data to comply with applicable law.

Health and fitness data may constitute special category data. Where applicable, we process this data based on your explicit consent and/or because it is necessary for the provision of our fitness analytics service at your request.

5. Third-party service providers

We use trusted processors to operate Split Index. They may process your data only on our instructions and subject to appropriate safeguards:

• Supabase — authentication, database hosting, and file storage;
• Vercel — application hosting and content delivery;
• Stripe — payment processing and subscription management;
• Google — OAuth sign-in (when you choose to use it);
• Strava and Garmin — activity import when you connect these integrations;
• OpenAI — AI-generated coaching feedback based on your workout data.

Each third party operates under its own privacy policy. We encourage you to review their policies when connecting external accounts.

6. Cookies and similar technologies

We use cookies and similar technologies to keep you signed in, remember preferences, and understand how the service is used. Essential cookies are required for authentication and core functionality. Where non-essential cookies are used, we will request your consent in line with UK requirements.

You can control cookies through your browser settings. Disabling essential cookies may prevent you from using certain features, including sign-in.

7. Data sharing

We do not sell your personal data. We may share data:

• With service providers listed above, to operate the platform;
• With other users, when you use social features or set your profile to be publicly visible;
• When required by law, regulation, court order, or to protect the rights and safety of Split Index, our users, or others;
• In connection with a merger, acquisition, or sale of assets, subject to appropriate confidentiality protections.

8. International transfers

Some of our service providers may process data outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place, such as UK adequacy regulations, Standard Contractual Clauses, or equivalent mechanisms recognised under UK GDPR.

9. Data retention

We retain your data for as long as your account is active and as needed to provide the service. If you delete your account, we will delete or anonymise your personal data within a reasonable period, except where we must retain information for legal, accounting, or fraud-prevention purposes.

10. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data in certain circumstances;
• Restrict or object to certain processing;
• Request portability of data you provided to us;
• Withdraw consent where processing is based on consent;
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise your rights, email privacy@splitindex.co.uk. We may need to verify your identity before responding.

11. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and row-level security on user data. No method of transmission or storage is completely secure; please use a strong, unique password and keep your credentials confidential.

12. Children

Split Index is not intended for users under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version on this page and update the effective date. Where changes are material, we will provide additional notice where appropriate.

14. Contact

Questions about this Privacy Policy or our data practices? Contact us at privacy@splitindex.co.uk or support@splitindex.co.uk.