Privacy Policy

Who we are

Novi Homines Software Oy, Finland, is the controller responsible for personal data processed through Athilio. This policy covers our mobile and desktop apps, website, and cloud services. Contact us at hello@athilio.com. Athilio is intended for adults aged 18 and over.

Local data and optional cloud features

Athilio stores your fitness records primarily on your device. Creating an account or buying a subscription does not by itself upload your entire health database. Data can leave your device when you connect an integration, use cloud AI, enable an available backup or sync feature, publish a dashboard snapshot, or send information to support. The sections below explain these uses. We do not sell personal data or use health data for advertising or marketing.

Information we process

Account and connected services

We process your email address, name if provided, account identifier, authentication information, preferences, and subscription status to create and secure your account and provide the services you request. Supabase provides account authentication. We also send necessary account, billing, security, and service messages.

If you connect services such as Garmin, Polar, or Oura, we process the permissions, service identifiers, and access or refresh tokens needed to maintain that connection. Depending on the integration, fitness data is downloaded directly to your device or received and stored on Athilio-managed servers for delivery and synchronization. For example, Garmin sends workout and wellness updates to server storage so the app can download them. Connecting a service gives Athilio access only within the permissions you authorize.

Fitness data and Apple Health

Depending on the sources and permissions you choose, Athilio imports workouts, activity and step counts, energy expenditure, heart rate and heart-rate variability, sleep, recovery, body measurements, and related fitness metrics. Workouts may include precise location from recorded routes. We use these records to display your history, calculate trends, and provide the analysis you request.

On iPhone and iPad, Apple Health access is optional and controlled through HealthKit permissions. You can change those permissions in Apple Health or system settings. We do not use HealthKit data for advertising, marketing, or data mining unrelated to your health and fitness experience. Granting Apple Health access does not by itself grant permission to send those records to cloud AI.

Cloud AI and chat

When you choose Athilio Cloud AI and accept its disclosure, your messages, relevant conversation history, and data returned by the tools used to answer your request are sent to Athilio servers and third-party AI providers for processing. This can include training, sleep, recovery, integration data, and other personal information in your messages or requested analysis. Running data queries on your device does not mean the resulting AI analysis stays on your device.

The AI provider depends on the model configured for the request. Cloud AI processes this information to generate replies, analyses, and dashboard widgets. Athilio may retain generated replies and technical usage records, including your account identifier, model, request identifiers, token usage, and allowance charges, for service operation, retries, metering, and abuse prevention. A generated reply can itself contain health information. Cloud processing is not a promise of zero retention by Athilio or its providers.

You can decline cloud AI and continue using other available app features. To stop future cloud AI processing, stop sending requests to that provider or select an available on-device model. Contact us to withdraw your cloud AI consent or request deletion of server-held information; deleting a local chat does not itself delete server records. If you configure your own external AI provider, the messages and tool results needed for your request are sent to that provider under its privacy terms.

Voice input

If you enable dictation, your device's speech recognition service processes microphone audio and may use the platform provider's servers. The resulting text is placed in your message; sending it to cloud AI follows the rules above. Microphone and speech recognition permissions can be revoked in system settings.

Purchases and subscriptions

Apple processes App Store payments. We use RevenueCat to validate purchases, restore access, manage subscription entitlements, and understand subscription performance. RevenueCat receives your Athilio account identifier, purchase and transaction history, product identifiers, subscription status, and related purchase metadata. These records are linked to your Athilio account.

Stripe processes purchases made through our website. We receive customer and subscription identifiers, purchase status, and billing information needed to provide access, support payments, and meet accounting obligations. Athilio does not receive your full payment card number. Apple, RevenueCat, and Stripe do not receive your fitness records for payment processing. Their privacy information is available from Apple, RevenueCat, and Stripe.

Backups, sync, and public sharing

Where available and enabled, cloud backup or sync stores the data covered by that feature outside your device. This can include preferences, dashboards, or fitness records. The destination depends on the feature you choose, such as Athilio cloud storage or Apple iCloud. The iOS app does not use its iCloud database backup feature to back up your health database; settings synchronization is separate. Files you export or back up yourself are controlled by you and your chosen storage provider.

If you publish a dashboard snapshot, its included data is uploaded so the snapshot can be viewed through its shared link. Anyone who has that link may view or copy the published information. Review the contents before sharing, especially health details or workout routes. Removing a published snapshot cannot remove copies already saved by other people.

Diagnostics and support

Our services process technical information such as IP addresses, request times, app and operating system versions, errors, and account or request identifiers to operate, troubleshoot, and secure Athilio. Release apps use Sentry for crash and error reporting, with its default personal-information collection disabled. Diagnostic records can still contain information present in an error or its context. If you contact support, we process the correspondence and any files or logs you choose to send.

Website cookies and analytics

The website uses cookies or similar storage needed for sign-in, preferences, security, and payment flows. We use Plausible for website traffic statistics, including pages visited, referral sources, browser and device type, and approximate location. Plausible does not use analytics cookies or persistent cross-site identifiers; it processes IP addresses to derive statistics without storing raw IP addresses. See Plausible's data policy.

Why we process data

Under applicable European data protection law, we process account, integration, and purchase information to perform our contract with you; accounting records to meet legal obligations; and necessary security, diagnostic, and support information for our legitimate interests in running a reliable service. Optional processing based on consent, including sharing health information with cloud AI, requires your consent. Where health data is subject to special protection, we rely on your explicit consent for that processing. Reading this policy or buying a subscription is not that consent.

Service providers and international processing

We share information with the authentication, hosting, storage, AI, payment, diagnostics, and analytics providers needed for the features described above, and when disclosure is required by law. We require providers acting on our behalf to protect personal data and use it only for the agreed purposes, with protection consistent with this policy. Providers such as Apple and Stripe also process some information for their own payment, security, or legal obligations under their policies.

Providers may process information outside Finland and the European Economic Area, including in the United States. Where a transfer requires safeguards under European data protection law, those safeguards must apply, such as an applicable adequacy decision or European Commission standard contractual clauses. Contact us for information about the recipients and safeguards applicable to your data. We use access controls and encrypted network connections to protect data, but no system is completely secure.

Retention and deletion

Local fitness records and chats remain on your device until you remove them. Server-held account information is kept while needed to provide your account and connected features. We retain technical, AI usage, and support records for the purposes described above; the retention period depends on the record's purpose, unresolved support or security issues, and legal obligations. Payment and accounting records may need to be retained after account deletion. A deletion request also covers information held by providers acting on our behalf, subject to applicable retention obligations.

You can delete your Athilio account from the app's account settings, or contact us for assistance. Account deletion removes your cloud account and associated cloud sync data. It does not erase local device data, records in Apple Health or connected services, your own backups, or copies of public snapshots saved by others. Manage those copies separately. Deleting your account does not cancel an Apple subscription: manage it in Apple's subscription settings. Other providers may retain records they independently need for legal or payment purposes.

Your choices and rights

You can disconnect integrations, revoke Apple Health or microphone permissions, and stop using optional cloud features. Revoking access stops future access but does not automatically erase data already imported or processed. You can withdraw consent at any time without affecting the lawfulness of earlier processing.

Subject to applicable law, you can request access to, correction, deletion, or a portable copy of your personal data, restrict processing, and object to processing based on legitimate interests. Send requests to hello@athilio.com. We may need to verify your identity. You can also complain to your local supervisory authority, including Finland's Data Protection Ombudsman.

Changes to this policy

We update this page when our practices change and show the revision date above. We will communicate material changes through the app, website, or email as appropriate and request new consent where required before using data for a new purpose.