YOUR DATA.
USED WITH PURPOSE.

Credo Sports provides the Credo fitness app and online Coach. This notice covers the app, its Coach service, credosports.co.uk and support enquiries. The sole-trader controller and legal contact details appear at the end of this notice. Contact [email protected] about your information.

Credo uses Sign in with Apple to authenticate subscriber accounts. The Cloudflare Worker verifies Apple identity-token signatures and checks the issuer, app audience, expiry and a one-use login challenge. It stores a hash of the Apple identifier, separated by subscription environment, and internal customer and Coach identifiers. Credo does not create or store a customer password. Apple authentication is separate from the StoreKit subscription checks described below; signing in does not by itself establish a paid entitlement or consent to online Coach.

Your ordinary programme, profile, workout history, Progress and Testing data are stored on your device. Credo V1 does not provide general cloud backup or cross-device sync. Selected context leaves the device for online Coach as described below; your whole training database is not uploaded.

Deleting the app or losing, replacing or resetting your device may permanently lose your local data. Apple subscription restoration concerns entitlement only and does not restore Credo training records. Platform-managed backups, if any, are separate from Credo and are not a Credo restoration guarantee.

Local records remain until you remove them through available controls, withdraw relevant consent, reset the app, or lose the device data. Customer access and refresh credentials and Coach access credentials are held separately in iOS secure storage. They authenticate access; they are not a training-data backup.

Onboarding asks you to confirm that you are 18 or over and to make an affirmative acknowledgement covering the Terms, this Privacy Notice and explicit consent to processing the health-related training information you provide for personalisation. The current onboarding combines those acknowledgements in one unticked control. Terms acceptance and acknowledgement of this notice do not replace the health-consent purpose stated in that control. Online AI Coach consent is requested separately and is not granted by completing onboarding. A minimal local record keeps the choice, time and wording version; online Coach also records its grant or withdrawal on the backend. It is not a record of how you browse the app.

You can withdraw health personalisation consent after onboarding; ordinary numeric workout history and programme structure remain, while health input and health estimates are unavailable without health consent. Online Coach requires separate online Coach consent and health consent because questions and selected context can include health information. A connection must confirm server consent before any Coach content is sent. A recreated account must complete fresh onboarding and consent; previous consent is not inherited.

Use Settings → Your privacy choices to withdraw online Coach consent. New Coach requests stop on this device immediately. With a connection, the backend disables Coach processing and removes its saved conversations, evidence and memory. If offline or access fails, the app shows remote cleanup as pending and provides a retry control; it does not claim that the remote deletion has happened.

Withdrawing health consent also switches off online Coach and clears local health fields, user notes, check-ins, legacy health records, generated training rationales and local Coach summaries. Numeric workout history and programme structure remain. Close and reopen Credo afterwards to discard screens and cached context before continuing local training. Stored health estimates are cleared; raw numeric test results remain. Previous health-based programme choices are not medical clearance to train.

Withdrawal does not make earlier lawful processing unlawful. It cannot recall a request a provider has already received. In-flight replies cannot restore deleted backend content. Minimal usage, security and consent records remain for the periods below. If you cannot use the controls or no longer have access, contact us.

Coach can keep up to 15 active short memories of explicit training preferences, recurring constraints, priorities, sport context or reasons for training decisions you tell it. It does not turn every conversation into a memory or mine old conversations when memory is enabled. Up to five relevant active memories may inform a request. Ad Hoc summaries do not use long-term memory.

Settings → What Coach Remembers lists active memories and lets you Forget individual items with a connection and valid access. Superseding or resolving a memory erases its old text. Minimal retired lifecycle entries are bounded and contain no retired text. Active memories expire no later than 12 months after their last update.

Forgetting one memory does not remove an earlier conversation containing it, or recall a request already received by a provider. Withdraw online Coach consent or use full reset to remove the broader saved Coach content.

Cloudflare hosts the website, Coach Worker and D1 database. It receives network requests and stores the Coach, consent, access and operational records described here. Its infrastructure also processes connection and security information.

OpenAI receives the selected Coach text and context to generate replies. Credo sets store: false so responses are not saved as retrievable Responses API application state. This does not mean zero retention: OpenAI’s standard API controls include abuse-monitoring retention of up to 30 days, subject to exceptions such as legal requirements. Credo has disabled all three optional OpenAI sharing programmes: model feedback, evaluation/fine-tuning data, and API inputs/outputs. Credo has not opted API inputs/outputs into those optional model-improvement programmes. Every Credo Coach Responses request sets store: false. That response-storage setting does not disable all provider logging or remove the separate provider retention described above. See OpenAI’s API data controls.

Apple provides Sign in with Apple, app distribution, TestFlight and StoreKit subscription/payment services under its own relationship with you. Credo receives the identity token for authentication and relevant device-verified entitlement information for subscriber access; payment-card details are handled by Apple. For support and privacy email, Cloudflare Email Routing forwards messages sent to [email protected] to an existing private Microsoft Outlook/Hotmail mailbox, where correspondence is stored and handled. The public support address is a routing address, not a separate Cloudflare-hosted mailbox. Credo may share relevant information with advisers or authorities where necessary for a legal obligation or legal claim. Credo does not sell personal information or use it for third-party behavioural advertising.

Expo libraries provide app functionality such as local notifications, secure storage and bundled media; using those libraries does not itself upload your training database to Expo. Expo’s build/distribution tooling is used to develop the app, not as a V1 training-data backup service.

Coach conversation text and evidence expire no later than 12 months after the relevant thread’s most recent request. Active and retired memory records expire no later than 12 months after their last update, with earlier Forget, resolution and withdrawal controls. Daily backend cleanup enforces these limits with an early cutoff to allow for the scheduled run.

AI request, token/cost and usage-window records, consent-event records and Weekly Coach eligibility metadata have an approximately 12-month operational retention ceiling under the existing scheduled cleanup. Account deletion removes Weekly eligibility claims immediately; withdrawing online Coach consent retains them so withdrawal does not create another review allowance. Current consent state is retained while needed to control access. Deleted Coach identities and their associated state are removed when dependent accounting and credentials permit cleanup; the longer-lived ownership relationships below are separate.

Customer access and Coach session credentials last no more than 15 minutes; a customer refresh credential lasts no more than 24 hours from fresh Apple login and cannot be extended merely by refreshing. Login challenges last two minutes. Expired or consumed challenges, expired refresh credentials and expired or revoked sessions are removed by scheduled cleanup. Deletion revokes access and removes customer credentials; a hashed deletion-retry receipt may remain only until the original refresh credential expires. Temporary V1 entitlement assertions are removed when expired or when the customer is inactive. Expiry of an assertion does not establish that the historical ownership relationship can safely be erased.

Where an AI provider outcome is unknown or a request was interrupted, Credo preserves the reserved amount as conservative accounting exposure rather than inventing an actual provider charge. After 31 days from the original request time, scheduled cleanup terminally classifies unresolved exposure; late settlement cannot overwrite that finalisation. This does not restart retention or a spending allowance. Known usage and confirmed no-dispatch outcomes retain their existing settlement treatment, and accounting remains shared across account generations.

After account deletion, minimal historical Apple identifier hashes, customer-generation/deletion relationships and subscription ownership links remain to recognise the same Apple identity, validate a subscription carrying a previous customer token, prevent reassignment to another account and connect any retained financial accounting. These records are pseudonymous, not anonymous, and contain no restored workout or Coach content. They are retained for those operational purposes while necessary; an expired entitlement assertion alone is not a safe retirement condition. The current implementation has no fixed expiry or automatic retirement criterion for these historical links, and no completed periodic ownership-retention review process. The precise retirement criteria and supporting legal justification remain to be settled. This is not a claim that indefinite retention is automatically lawful. Contact us to request a review of information retained about you.

Support correspondence is held in the destination Outlook/Hotmail mailbox for as long as needed to respond to the enquiry, handle data-rights requests, resolve complaints or disputes, and meet applicable legal obligations. Retention is assessed against those needs; correspondence should be deleted when no longer needed, subject to applicable rights and legal exceptions. This is not an automatic fixed mailbox deletion period. Provider-held infrastructure/security records and provider backups follow their own service rules; deleting Credo’s live database records does not promise instant erasure from every provider system. Cloudflare’s D1 recovery history is separate from live records, so a recovery operation must reapply deletion and consent restrictions before serving users.

The website is informational and uses active Cloudflare Web Analytics to understand visits, page views and performance, including Core Web Vitals and browser, device, operating-system and country-level statistics. Cloudflare describes its analytics beacon as not using cookies or browser storage. See Cloudflare’s Web Analytics beacon documentation. The site has no contact form, embedded third-party media or advertising trackers. Contact links open your email application. Cloudflare hosting and security features operate separately from Web Analytics and may use necessary security cookies.

Cloudflare Security Analytics is also active and analyses incoming HTTP requests. Cloudflare-hosted sampled security logs use adaptive sampling and can show request timestamps, source IP addresses, host, request and security information, alongside aggregate device, operating-system and request statistics. We use website performance and security information for our legitimate interests in understanding, maintaining and protecting the site (Article 6(1)(f)). These analytics and logs remain subject to Cloudflare’s service retention rules. No owner-configured Logpush job or external Cloudflare log destination is enabled; Credo does not operate a separate external traffic-log archive. This does not mean Cloudflare keeps no logs. Emailing us shares your address, message and any attachments you choose to send. An email enquiry does not create a Credo account or send the message to Coach. Please remove unrelated personal information from support screenshots.

Apple distributes the iPhone app and handles payment information. Credo does not collect card details. Purchase-enabled iOS builds use Apple StoreKit to display the monthly subscription and any eligible introductory offer, request purchases, restore subscription access and check Apple-verified entitlement. Designated test builds may instead use operator-approved test access; that is not an Apple purchase.

Native StoreKit checks Apple-verified transaction and subscription status on the device. The app sends relevant entitlement information to the authenticated Cloudflare Worker: active state, configured product identifier, Production/Sandbox environment, expiry and the subscription app-account ownership token. The Worker checks that information against the signed-in customer and, for recreation, permitted historical customer generations. The V1 Worker relies on this client-verified StoreKit entitlement; it does not independently verify Apple subscription receipts or signed subscription transactions. Sign in with Apple identity-token verification is a separate authentication check. Credo does not collect payment-card details or include these subscription tokens or authentication credentials in OpenAI prompts. These checks support the subscription service you request under Article 6(1)(b). Restore Purchases recovers eligible subscription access, not Credo programmes, workouts, Progress or Testing. Losing subscription access does not itself delete local training records. Account deletion, removing or resetting the app does not cancel an Apple subscription; cancellation is managed through Apple.

Backend requests use HTTPS, authenticated access and user-scoped records. Credentials are stored securely on the device; the backend stores credential/token hashes. Provider API secrets stay on the server. Programme changes remain under the app’s supported controls and your approval. These measures reduce risk but do not guarantee absolute security.