Legal
Privacy Policy
Last updated:
This Privacy Policy explains how StemNotes Ltd (“StemNotes”, “we”, “us”, or “our”) collects, uses, and protects your personal data when you use the StemNotes mobile and watch applications and related services (the “App”). We are the data controller for your personal data.
If you have any questions, contact us at duncan@stemnotes.io.
1. Who we are
StemNotes Ltd 5 Ducket Close, Richmond, North Yorkshire, DL10 5QD Contact: duncan@stemnotes.io
We are based in England, United Kingdom and comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (and, where applicable, the EU GDPR).
2. The data we collect
Account and identity data
Email address
First and last name
Gender (optional)
Date of birth
Profile photo (optional, if you upload one)
Authentication identifiers from Apple or Google if you sign in with those providers
Fitness and training data you provide
Critical Power (CP)/FTP, training status, maximum carbohydrate intake, feed interval, power-mode and fuelling preferences
Planned and completed sessions, workout structure, and the fuelling plans we generate for you
Data from services you connect
If you connect TrainingPeaks or intervals.icu, we access your planned and completed workouts, workout structure, power/intensity data and related metrics via those services’ authorised APIs, solely to generate your fuelling recommendations.
Subscription and purchase data
Records of your subscription status and entitlements. Payments are processed by Apple through the App Store — we do not receive or store your payment card details.
Device and technical data
Basic technical information necessary to operate the App and deliver notifications (e.g. device/OS type, app version, and a push notification identifier where applicable).
We do not use third-party advertising or third-party usage-analytics SDKs in the App.
3. How we collect it
Directly from you — when you create an account, complete onboarding, enter your details, or use the App.
From sign-in providers — if you choose Sign in with Apple or Google, we receive your email and a provider identifier (Apple may provide a private relay email if you choose “Hide My Email”).
From connected services — TrainingPeaks and intervals.icu, only after you explicitly authorise the connection.
4. How and why we use your data (and our lawful bases)
Purpose | Data used | Lawful basis (UK GDPR) |
|---|---|---|
Create and manage your account | Email, name, authentication IDs | Performance of a contract |
Generate personalised fuelling recommendations | Fitness/training data, connected-service data | Performance of a contract |
Provide and sync sessions across your devices/watch | Sessions, plans, device data | Performance of a contract |
Manage subscriptions and entitlements | Subscription status | Performance of a contract |
Send you service and onboarding communications | Email, first name, date of birth | Legitimate interests / consent |
Improve and secure the App | Technical data | Legitimate interests |
Comply with legal obligations | As required | Legal obligation |
Where we rely on consent, you may withdraw it at any time (see Section 8).
5. Sharing your data — our processors and third parties
We share personal data only as necessary to run the service. We do not sell your personal data.
Google / Firebase (Google Ireland Ltd / Google LLC) — account authentication and secure storage of your account and profile data.
Apple (Apple Inc. / Apple Distribution International) — Sign in with Apple and App Store subscription processing.
Google Sign-In (Google) — if you sign in with Google.
TrainingPeaks (Peaksware, LLC) and intervals.icu — connected only at your request, to import your training data.
Make.com (Celonis / operated by Make) — when you complete signup, we send your email, first name, last name, gender and date of birth to our onboarding/CRM workflow to set up and communicate with you about your account.
Vercel Inc. — hosting for our backend service, which proxies requests to the above APIs.
Some of these providers are located outside the UK/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement/Addendum, EU Standard Contractual Clauses, or an adequacy decision.
6. How long we keep your data
We keep your personal data for as long as your account is active. If you delete your account (see Section 8) or it becomes inactive, we delete or anonymise your personal data within a reasonable period, except where we must retain certain records to meet legal, accounting or dispute-resolution obligations.
7. Security
We use technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS) and access controls. Your authentication tokens and session data are stored securely on your device. No method of transmission or storage is completely secure, but we work to protect your information.
8. Your rights
Under UK/EU GDPR you have the right to: access your data; request rectification or erasure; restrict or object to processing; data portability; and to withdraw consent at any time.
You can delete your account and associated data directly in the App via Settings → Delete account.
To exercise any other right, or to disconnect a linked service, contact us at duncan@stemnotes.io.
You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.
9. Children
The App does not impose a minimum age. However, if you are under the age at which you can consent to the processing of personal data in your country (13 in the United Kingdom), a parent or guardian must review this policy and provide their consent on your behalf. If you believe a child has provided us with personal data without appropriate parental consent, please contact us and we will address it.
10. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated version here and revise the “Last updated” date. Material changes will be notified in the App or by email where appropriate.
11. Contact us
StemNotes Ltd 5 Ducket Close, Richmond, North Yorkshire, DL10 5QD duncan@stemnotes.io