Privacy policy

1. Controller and scope

AIMS Corp., a French SAS registered under number 941 923 682 RCS Paris, is the controller for the processing described here. Its full identity and postal address appear in the legal notice. For personal data: privacy@rockso.app.

This policy covers rockso.app, its demo and beta access, and the free Rockso app. The Service may be used by adults and minors under the conditions explained below and in the Terms. Rockso supports sports training; its indicators and recommendations are neither a diagnosis nor medical care.

2. Data and sources

The data processed depends on the features used and the sources you connect.

• Account and access: email address, name or identifier, authentication data, preferences, language, account creation and login dates. Supabase manages authentication.
• Sports profile: sports, goals, availability, level and information you provide, such as birth date, sex, height or weight.
• Training and wellbeing: planned and completed sessions, duration, distance, elevation, power, cadence, heart rate, load, recovery, sleep, fatigue, perceived effort and any pain or injury information you provide; some indicators are calculated from this data.
• Location: where an authorised import contains a route, GPS coordinates and activity timestamps. Source permissions and settings determine access to the route.
• AI exchanges: messages, sports context used to answer, responses, reports and conversation summaries retained for continuity of support.
• Connections: connection identifiers, permissions and tokens required to synchronise with sports platforms and, where available, Apple Health / HealthKit or Health Connect. Rockso does not ask for these platforms’ passwords.
• Support and early access: emails, requests, feedback and information submitted through forms.
• Diagnostics and security: IP address, device information, operating system, app version, technical events, error and login logs. Sentry may receive the user identifier and email address associated with an event, together with its technical context.

Sources include your entries, use of the Service, authorised platforms and Rockso’s calculations. Providing information about other people in messages or notes is unnecessary for the Service.

3. Purposes and legal bases

• Create an account, manage access, display and synchronise training, and provide requested features: performance of the contract or steps taken at your request before entering a contract (GDPR Article 6(1)(b)), for necessary data. Without essential account information, these features cannot be provided.
• Calculate indicators and personalise support: performance of the contract for necessary sports data that is not health data; explicit consent for health data and its associated uses (Articles 6(1)(a) and 9(2)(a)). Optional data enriches chosen features and is not a general condition for visiting the website.
• Answer support requests and organise requested beta access: performance of the contract or pre-contractual steps; legitimate interest in handling other requests addressed to Rockso (Article 6(1)(f)).
• Detect and fix errors, secure the Service and prevent abuse: legitimate interest in a reliable service and account protection (Article 6(1)(f)), limited to necessary data. This basis alone does not authorise processing health data.
• Handle rights, legal obligations and disputes: legal obligation (Article 6(1)(c)) and legitimate interest in defending rights for strictly necessary records (Article 6(1)(f)). Retaining health data for legal claims is limited to the conditions of Article 9(2)(f).

A new optional use requiring consent is subject to separate information and a separate choice. Accepting the Terms does not mean consenting to every processing operation.

4. Health data, permissions and withdrawal

Information about pain, injuries or physiological condition, and certain combinations or inferences from sports data, may constitute health data. Collection, analysis and transmission for the chosen features require your prior explicit consent.

A technical permission given to Apple Health, Health Connect, a watch or another platform does not by itself replace this consent. Permissions are limited to the categories required for the requested feature; you can change them in the source’s settings and disconnect the source.

You can withdraw consent at any time by contacting privacy@rockso.app, and use the available settings. Withdrawal does not affect the lawfulness of earlier processing. The relevant processing stops and data relying solely on that consent is deleted, subject to the legal exceptions below. Features depending on it become unavailable. Disconnecting a source stops new imports but does not automatically delete previously imported data: you can request its erasure.

Rockso does not use health data, including data from HealthKit or Health Connect, for advertising, selling data or training models.

Minors and parental consent

Minors are not barred from access solely because they are under 18. Required permission or representation for use of the Service depends on age, legal capacity and applicable law. It does not replace consent required for personal data processing.

In France, for processing based on consent in an online service, before age 15, joint consent from the minor and the holder of parental responsibility is required. From age 15, the minor may consent independently to such processing. Ages and conditions may differ in other countries. These rules also apply to explicit consent required for health data; age does not remove the need to obtain it.

The minor may exercise their rights. Their legal representative may contact privacy@rockso.app regarding the account or data, including a deletion request in the child’s best interests. We assess their standing and request proportionately, respecting the minor’s rights.

5. Artificial intelligence and conversations

Rockso currently uses the Mistral AI API to generate responses, activity analyses, summaries and training adaptations. These features send messages and relevant sports context to Mistral: training history or summaries, indicators, perceived effort, recovery information and conversation context. This may include health data you provided or authorised.

Transmission of personal data to this provider requires prior information and explicit permission for the relevant features; health data requirements apply in addition. This is not a model running solely on your device.

Rockso does not reuse your personal data or conversations to train models. The provider’s technical processing is governed by its commercial terms and data processing agreement. The Mistral configuration selected for Rockso excludes use of conversations to train its models. Generating a response and training a model are distinct operations.

Summaries and responses may be inaccurate; you can check them and request correction of personal data. Rockso does not make decisions with legal or similarly significant effects on you based solely on automated processing. Its sports recommendations remain suggestions.

6. Recipients

Internal access is restricted to authorised AIMS Corp. staff for operation, security and support. We use the following providers:

• Supabase: authentication, database and storage for accounts, profiles, activities, conversations and files. See its data processing agreement and subprocessor list.
• Mistral AI: processing the context sent for AI features, as described in section 5.
• Sentry (Functional Software, Inc.): diagnostic events and errors to understand and fix incidents. See its privacy policy and processing terms.
• GitHub: hosting the website and web demonstrations, including processing technical connection information. See its privacy statement.
• Email and technical delivery providers: delivering account or support emails and libraries required by some pages, including the jsDelivr CDN.

Connected sports platforms also process your data under their own policies. Exchanges depend on selected permissions and features. Where sharing with a coach or another user is available and enabled at your initiative, only categories covered by that access are shared; extended access may include health information and routes.

Disclosure may also be required by law or a valid authority request. If the business is transferred to a new operator, affected people are informed and retain their rights. Rockso does not sell your data or share it for targeted advertising.

7. Hosting and international transfers

Rockso’s Supabase project is hosted in Sweden, in the European Union. The primary database’s location does not mean that every provider operation takes place in Sweden. Sentry events are stored in its European Union region. GitHub and Sentry are US providers; website hosting, support operations or subprocessors may nevertheless involve processing or access outside the European Economic Area, including in the United States.

Transfers must be governed by applicable processing agreements and a GDPR safeguard: an adequacy decision where it actually covers the recipient and processing, or European Commission standard contractual clauses with supplementary measures where necessary. The agreement and subprocessor links above explain this framework. You can request details and a copy of relevant safeguards at privacy@rockso.app, subject to protected confidential information.

8. Retention and deletion

• Account and training data: retained while the account exists to provide history and requested features, as long as processing remains necessary and required consents remain in place. Stopping use of the app does not delete the account.
• Support or early access requests: retained while handling the request and its necessary follow-up; only records required for a legal obligation or evidence of a right are then retained for the applicable limitation period.
• Account deletion: acknowledged within 7 calendar days; account and associated data deleted within 30 calendar days from receipt of the request. This includes activities, files, tokens, conversations, summaries and analyses linked to the account, and necessary deletion requests to processors.
• Residual technical backups and security logs: expire, are deleted or overwritten within 90 days after deletion, without reuse for training support. If technical restoration is required during this period, deletion requests must be reapplied.
• Legal exceptions: strictly necessary records may be retained for a legal obligation or dispute, with restricted access, for the legally required period or the duration of proceedings and applicable limitation period. This does not justify retaining the entire sports profile.

The account deletion page explains the process accessible without reinstalling the app. Deactivation or loss of access alone is not data deletion.

9. Security

We protect data through encrypted communications, authentication and access restrictions. Technical logs help detect and correct incidents. No system provides absolute security. If a personal data breach occurs, we apply notification requirements for authorities and, where the risk requires it, affected people.

10. Your rights

Under the GDPR’s conditions, you may request access, rectification, erasure, restriction and portability of your data. You may object to processing based on our legitimate interests for reasons relating to your situation, and withdraw consent where used. Under French law, you may also give instructions about your data after your death.

Contact privacy@rockso.app or the postal address in the legal notice. Additional identity evidence is requested only when there is reasonable doubt, proportionately. We respond without undue delay and within one month of receiving a request. An extension of two months may be necessary due to complexity or the number of requests; you are informed of the extension and reasons within the first month.

You may complain to the CNIL or the competent authority where you live, work or where an alleged infringement occurred, without first having to contact us.

11. Website, local storage and external services

The website currently uses no advertising cookies or dedicated audience measurement tool. Authenticated demo or beta access may use local or session storage to maintain login and necessary preferences. You can clear it in your browser; doing so may log you out.

Connections to the website and technical resource providers, including GitHub and jsDelivr, transmit request information such as IP address and browser characteristics. Links to stores, sports platforms or Discord take you to external services governed by their own terms. Participation in Discord is voluntary.

Any future optional tracker requiring consent will be presented with a prior choice, including refusal and withdrawal.

12. Updates and contact

This dated policy may change, including when providers change. Material changes are announced appropriately before the new processing starts. Fresh consent is requested where required; continued use alone does not constitute consent.

Personal data: privacy@rockso.app. Support and account deletion: support@rockso.app. AIMS Corp. identity and address: legal notice. If data has been processed without permission required for a minor, contact us so we can assess the situation and deletion where necessary.