Privacy policy

Last updated 15 October 2026.

Who holds your data

Peak Health is operated by Erik Pastor Rios, who decides everything this page describes. Write to privacy@peakhealth.es about any of it.

What an account holds

Your email address, the name you gave, a picture if you added one, whether the address has been confirmed, and the day the account was made. You sign in with Google, Apple, a passkey, or your address and a password or a code sent to it. When you pick Google or Apple, that company learns that your account signs in to Peak Health, and sends your account id there, your address and your name. A passkey stays on your device, and Peak Health keeps only its public key, its name and the day you added it. The password is stored as a hash and never as the password itself.

You can start with no account at all. The first routine you save makes a guest account so the work is not thrown away, and that account holds the same rows as any other with no address attached to them. Creating an account afterwards keeps the work and moves it across.

What a sign-in records

Every session stores the IP address the request came from, the browser or app that sent it, and when the session runs out. The browser keeps a cookie called better-auth.session_token for seven days. The phone keeps the same session in the device's own keychain.

What your training holds

Your routines: their names, their sections, and any note on them. Your workouts: when each one began and finished, the time zone it happened in, and every set in it: the load, the reps, the duration, how hard it felt, the rest you took, and which side it was on. A rating for the whole session, a note on it, and any routine you left half-built.

Over weeks and months, your training history shows what your body can do. European data protection law treats that as health data, a special category under GDPR Article 9. Peak Health treats it the same way.

Being seen by other athletes

By default, only you can see your training. Your public profile is the setting that lets other athletes find and follow you, and you alone decide to turn it on. When you turn your public profile off, your followers stop seeing your training.

Your training history is health data, so the law requires your explicit consent before anyone else sees it. Turning your public profile on gives that consent for that one purpose. Turning it off withdraws it at once.

Letting a trainer see your training

An account can hold the Trainer role. A trainer can make an invite with a name only they read. When an athlete spends that invite, the grant names both of you and when it started. The athlete reads the grant on the trainer page, and revokes it there.

Your heart rate

Peak Health keeps your heart rate during a workout only after you give the Health data consent. The phone reads it in one of two ways. It reads the heart rate that your watch saved to Apple Health on an iPhone, or to Health Connect on an Android phone. Or it reads a heart-rate sensor that you pair over Bluetooth: a chest strap, or a watch that broadcasts its heart rate. With the workout, Peak Health keeps the time and the heart rate of each reading, and the name of the device that recorded them. A workout that you trained before you gave the consent gets no heart rate. The phone remembers the sensor that you paired, and Peak Health’s server never receives its Bluetooth id.

Heart rate over a workout is health data, a special category under GDPR Article 9. Peak Health keeps it only with your explicit consent. You give that consent on its own, in the app, the first time you connect Apple Health or Health Connect or pair a sensor. Accepting the terms never gives it. Peak Health uses your heart rate only to show it to you and to the readers below: the average, the peak and the reading after each set. Peak Health never uses it for advertising or marketing, never sells it or gives it to a data broker, and never uses it to profile you.

Your followers, and anybody with a workout page link or a share card, see your heart rate only when your workouts show the whole session. A trainer that you give access to sees it, and so does that trainer’s AI assistant. Your own AI assistant sees it when you connect one. Strava gets it with a workout when its first reading is no more than five minutes after the session starts, and its last reading no more than five minutes before the session finishes. Apple Health or Health Connect gets it only when your sensor recorded it. The consent lists these readers before you agree.

When you connect Apple Health or Health Connect, the phone also saves there each workout that you finish: the kind of workout, when it started and finished, and on Health Connect the routine name. It saves the heart rate with it only when your sensor recorded the heart rate. It saves nothing when your watch already saved a workout for the same time. When you disconnect, the saved workouts stay there, and you delete them there. When you delete your account, the phone first removes each workout that Peak Health saved there.

You withdraw the consent on the phone, in Settings under Account, or on the web, in Settings. Withdrawing deletes the heart rate of every workout at once. Your workouts stay, and Peak Health keeps no new heart rate until you give the consent again. You can also remove the heart rate of one workout and keep the workout. Deleting the account deletes all of it. When you disconnect Apple Health or Health Connect, or forget a sensor, the heart rate already saved stays and no new reading comes. A copy of your data includes your heart rate. A Strava activity keeps the heart rate that Peak Health sent to it, and you delete it on Strava.

Where it is kept

One Postgres database, hosted by Neon. Accounts and training sit in it, and so does everything that keeps the service standing up: the open sessions, the consent you gave a connected assistant, and the counters that stop one account from hammering the server. The phone keeps a copy of your routines and workouts on the device so a session can open with no signal, and signing out erases that copy. Nothing else leaves that database except where this page says it does. The site itself runs on Vercel, which sees every request made to it.

What analytics sees

Product analytics goes to PostHog, on its European cloud. On the web it records the pages you open, the pages you leave, and the errors the browser throws. On the phone it records the app opening and closing, each set you complete, and each session you finish: the exercise, the load, the volume, and how hard the session felt. It also records the errors it catches and how each one happened. When Peak Health shows you round a feature, it records that it started, which feature it reached, and the step where you stopped. Once a night we send two counts of how many accounts the sweep took, with no account and no address. PostHog also makes a screen recording of what you do. On the web the recording keeps the text on the page and hides what you type into a field. On the phone it hides your address, your name, your identifier, and every comment and note you write, and keeps the rest of the screen.

While you are signed in those events carry your account id, your email address and your name, so one person’s events can be told from another’s. When you sign out, that link breaks for everything after it.

There is no switch that turns this off today. This page names that gap.

The sign-in vendor

Sign-in is built on Better Auth, an open-source library that runs on this app's own server. Better Auth is also a processor. On production it receives a browser fingerprint from the web, the IP address of the request, that IP address's geolocation, and the sign-in events the checks need. It also receives each account event: when an account is created, changed or deleted, and when a session opens, with the account's id, email address and name, the IP address the request came from, the browser or app that sent it, and when. The Better Auth dashboard can read, change, export and delete accounts through this app's own server, and it can open a session as an account. It does not receive the password. For a leaked-password check it receives the first five characters of a hash. After a failed sign-in it receives a keyed hash of that password.

That data can go to the United States under the EU Standard Contractual Clauses.

Better Auth deletes or returns the data when the contract ends. The data processing agreement says so.

Asking for Peak Health Pro

Asking for Peak Health Pro keeps your email address, the line you wrote and your language in Peak Health’s database, and sends the mails about it through Resend, a company in the United States. Nobody reads the request until you confirm it from the mail, and once we answer, the request is deleted.

Waiting for Peak Health Premium

Leaving your address on the pricing page keeps that email address and your language in Peak Health’s database, and sends the mails about it through Resend, a company in the United States. The address joins the list only after you confirm it from the mail. On the day Peak Health Premium goes on sale, the list gets one mail, and then the address is deleted. Every mail has a link to delete it sooner.

Buying Peak Health Premium

When you buy Peak Health Premium, RevenueCat, a company in the United States, keeps the purchase with your account id. On the phone, the App Store or Google Play takes the payment. On the web, RevenueCat’s checkout takes it through Stripe and also gets your email address. Your card details go to the store or to Stripe, never to Peak Health. Peak Health keeps your tier, where you bought it, when it ends, and any refund. RevenueCat sends each purchase and refund with your account id to PostHog, so Peak Health can count its revenue.

Sending a report

A report you send from the Support page or the Give feedback button goes to GitHub. GitHub is a company in the United States. There, the report becomes an issue on Peak Health’s private repository. The issue holds your words, the screen you were on and the id of your PostHog session. It holds the email address you gave, or the confirmed address of your account. It holds the feature and the language when the report has them. It holds the photos or videos you attached. A correction to an exercise goes to the public open-exercise-db repository instead. It carries only your words and your attachments.

Anthropic is a company in the United States that makes the AI model Claude. Anthropic reads each report on that private repository to sort it. It reads the issue’s title, its text, its labels and its comments. So it sees everything the issue holds, the links to your photos and videos included.

Notifications

The phone's rest timer schedules its notifications on the phone itself. When you are signed in on the phone and notifications are on, the phone sends Peak Health its push token. A push token is a code that lets a server send a notification to that one phone. A server sends you a notification only to answer an exercise request where you turned on “Notify me”. It sends one notification for each request to each phone where you are signed in. “Notify me” is off until you turn it on. Peak Health stops sending to a phone when you sign out on it or turn its notifications off. Deleting the account deletes every push token. Refusing the permission costs you the locked-phone notification and the notification about a request, and nothing else.

The notification goes from Peak Health to Expo, and from Expo to Apple for an iPhone or to Google for an Android phone. All three are companies in the United States. Expo keeps the push token so that it can deliver the notification. The notification says only that an exercise you asked for is now in Peak Health. It never names the exercise, so none of the three companies learns which one you asked for.

Language

On the web the language is part of the address, /en or /es, and the phone reads the language and the time zone from the device. Your account keeps the language we last saw you reading, so that a mail about your own account arrives in it; the time zone is not kept. It is not a setting, and no screen offers one.

An assistant you connect

You can connect an AI assistant to your account through the MCP server. Once you approve it, that assistant can read and write your routines and read your workout history, notes and ratings included, until you disconnect it in Settings. You choose which assistant, and what it does with what it reads is between you and whoever runs it.

Strava and Hevy

When you connect Strava, Peak Health sends each strength workout that you finish to Strava as an activity. The activity has the workout’s name and a description: each exercise, the load, reps or duration and effort (RPE) of each set, the effort of the whole session, and a link back to the workout. It also has your heart rate, when its first reading is no more than five minutes after the session starts, and its last reading no more than five minutes before the session finishes.

When you connect Hevy with your Hevy key, Peak Health sends to Hevy each strength workout that you finish and each routine that you save: the exercises, and the load, reps or duration and effort (RPE) of each set. A workout also carries the effort of the whole session, your notes and a link back. Hevy gets no heart rate. Peak Health also reads the workouts that you recorded in Hevy, and adds them to your history.

Strava and Hevy are separate companies. Each one keeps its copy under its own privacy policy, and Peak Health cannot delete a copy, or take the heart rate out of one, after it sends it. You disconnect each of them in Settings.

The exercise catalogue

Asking for a movement the catalogue does not hold opens a public issue on the open-exercise-db repository. It carries the movement (the name, the muscles, the equipment, the instructions), and carries nothing about you: not your name, not your address, not a set you have done.

Peak Health also saves that you asked, so it can show you the exercise when it is added. When you ask, you agree to that. That record links your account to the exercise you asked for, and keeps whether you turned on “Notify me”. Peak Health deletes the record when you first open or pick the exercise. It also deletes it when you remove the request from “Your requests”, when open-exercise-db refuses the request, or when you delete the account.

Peak Health also reads how many accounts matched the same imported name to the same exercise. That count carries no account: not your name, not your address, not which account matched it.

What is never done

Your data is not sold, not rented and not handed to a data broker. There is no advertising in the product, and no advertising network is told anything about you. Nobody is profiled for anyone else's purposes.

What you can ask for

You can read, correct, export and delete everything held about you. Deleting the account is in Settings on the web and in Settings on the phone, and it takes your routines, your workouts, your drafts and your preference with it. For a copy of your data, a correction, an objection or a complaint, write to privacy@peakhealth.es.

You can also complain to your country’s data protection authority. In Spain that is the Agencia Española de Protección de Datos.

How long it is kept

Your training is kept for as long as the account exists, because a history that expires is not a history. A session runs out after seven days. Once a night we delete two kinds of account that hold nothing: a guest account older than thirty days that holds no training and nobody is using, and a named account older than thirty days whose address was never proved. An account that holds training is never swept, whatever its age, and you no longer have to ask. An account that holds an address receives a mail recording the deletion after it happens.

When this page changes

This page changes when the code it describes changes. The date at the top is the last time that happened.