Privacy Policy

1. Information we collect

The Company collects the following to provide the Service.

• Account & identifiers: email, social login identifiers (Google, Apple), name (optional), device push token (FCM)
• Health (sensitive) data: heart rate, heart-rate variability (HRV), resting heart rate, sleep, and steps that you permit us to read from Apple Health (HealthKit) or Android Health Connect; heart rate, pace, cadence, and power from uploaded .fit workout files; and RPE, pain, and meal logs you enter
• Location: GPS route, distance, and pace during a workout (foreground-service location for the duration of the session). We do not collect always-on background location.
• Sensor readings: values received from Bluetooth heart-rate, speed, cadence, and power sensors
• Usage records: access IP, in-app activity logs, and conversations with the Ara AI coach

2. Purposes of use

• Providing AI coaching for movement, nutrition, and recovery; generating weekly plans; and delivering analysis and insights
• Computing training intensity and recovery, and applying safety guards (injury and overtraining prevention)
• Improving service quality and refining models (using statistical, anonymized processing)
• Responding to notices and inquiries, and meeting legal obligations

3. Health data principles

The Company complies with the health-data policies of Apple and Google.

• Health data is used only for coaching, never for advertising or marketing.
• We do not sell health data to third parties.
• We do not store health data in iCloud or other third-party backups.
• Original HealthKit / Health Connect data is owned by your device and operating system; the Company processes only a server-side copy needed to provide the Service.

4. Retention and deletion

The Company destroys personal information without delay once its purpose is fulfilled or you delete your account, except where retention is required by law as set out below, after which it is destroyed.

Anonymized data retained after account deletion is governed by Section 7 and the Account Deletion notice.

• Login and access logs (Protection of Communications Secrets Act): 3 months
• Processing-system access records (Standards for Securing the Safety of Personal Information): 2 years (processing of sensitive data such as health)
• Records confirming the collection, use, and provision of location data (Act on the Protection, Use, etc. of Location Information): the period prescribed by applicable law

5. Processors and third parties

The Company does not provide personal information to third parties without your consent, except where required by law or lawfully requested by an investigative authority.

To provide a reliable service, the Company entrusts some processing to: cloud infrastructure (Google Cloud, Amazon Web Services), push notifications (Firebase Cloud Messaging), email delivery, and AI inference. Processors handle data only within the scope of the entrusted purpose under our supervision.

5-1. Cross-border transfer of personal information

To generate Ara (AI) coaching responses, the Company transfers certain personal information overseas as set out below. You may refuse consent to this transfer, in which case related features such as Ara (AI) coaching may be limited.

• Recipients and destination countries: Anthropic, PBC (United States); Google LLC (United States)
• Items transferred: Ara (AI) coaching conversation content and the health/activity context needed for coaching
• Purpose: generating coaching and analysis responses via AI inference
• Timing and method: transmitted over the network at the time of service use
• Recipient’s retention and use period: for the time needed to process the inference request (destroyed after processing)
• How to refuse and its effect: you may refuse via in-app settings or by emailing our privacy officer; refusal limits use of AI coaching features

6. Your rights

• You may request access, correction, deletion, suspension of processing, and withdrawal of consent at any time.
• You can make requests through in-app settings or by emailing our privacy officer, and we will act without delay.
• We do not accept registration from children under 14.

7. Account deletion and disposal of data

You may request account deletion in the app or via the web (Account Deletion notice page).

On deletion, the Company immediately destroys identifying information (email, name, phone number, social login identifiers, push token, free-text conversations, raw GPS coordinates).

Anonymized data kept for statistics and research (e.g., heart-rate-zone, pace, and recovery metrics processed so that an individual can no longer be identified) is retained only in that form, and we do not keep any reverse-mapping that would allow re-identification.

To evidence that a deletion request was carried out, a minimal record (registered email, request and completion timestamps) is kept separately for three years for dispute resolution and then destroyed; this record contains no information for re-identification.

Information contained in backup media is destroyed when that backup’s retention period expires, and if a backup is restored, the deletion is re-applied.

Because original HealthKit / Health Connect data is owned by your device and OS, the Company deletes only the server-side copy.

8. Security measures

• Encryption in transit (TLS) and protection of stored data
• Access controls and the principle of least privilege
• Access logging and monitoring for abnormal access

9. Privacy officer

Privacy officer: Jaehyun Shin

Contact: jh.shin@lifegmap.com

You may direct privacy inquiries, complaints, and remedy requests to the contact above.

10. Changes to this policy

We will announce any additions, deletions, or changes through an in-service notice at least 7 days before they take effect (30 days for material changes).

Operator information

• Entity: ABSquad Inc. (주식회사 에이비스쿼드)
• Representative: Jaehyun Shin
• Business registration no.: 694-87-02463
• Address: B1, 24 Singal-ro 138beon-gil, Giheung-gu, Yongin-si, Gyeonggi-do, Republic of Korea
• Contact: jh.shin@lifegmap.com · jh.shin@ab-squad.com