Ridox Privacy Policy

Last updated: 22 October 2026 · Effective: 22 October 2026

At a glance

This summary is for convenience. The full policy below is what applies.

1. About this policy

This Privacy Policy explains how HolyMake sp. z o.o. ("HolyMake", "we", "us") collects, uses, shares and protects personal information when you use Ridox. Ridox means our iPhone app (the "App") and our website at ridox.app; together, these are the "Service".

Ridox is a cycling coach. It uses recovery data from Apple Health (and from Garmin, if you connect it) and the check-ins you log to give you a daily verdict: ride, go easy, or rest. It also builds you a training plan, and lets you talk to an AI coach about your training.

This policy describes what we do. It is not a contract that you accept by reading it. Where the law requires your consent for a particular kind of processing, we ask for that consent separately, and you can withdraw it at any time (see Section 13).

2. Who we are

The controller responsible for your personal information is:

support@ridox.app is our contact for privacy questions, requests and legal notices, and also for app support. We have not appointed a Data Protection Officer, because the law does not currently require us to have one.

3. The information we collect

3.1 Account information

You can start using the App before you sign in. Until you do, your data is linked to a random identifier. When you sign in, we collect:

• Sign in with Apple: an Apple user identifier, your email address (this may be a private relay address if you choose "Hide My Email"), and your name if you choose to share it.
• Sign in with Google: your Google account identifier, name, email address and a link to your profile picture. We do not use the picture.
• Email and password: your email address and password. Passwords are stored only in hashed form.

When you sign in, the data you created before signing in is linked to your account. If the account already holds Ridox data, we keep that data and delete what you created before signing in. Your subscription carries over either way.

We never receive your Apple or Google password.

3.2 Your profile and training setup (you give us)

During onboarding and in Settings, you can tell us:

• your first name
• your gender, or "prefer not to say"
• your goal, and any target event and its timing
• your riding experience and recent training
• when and how much you can train, and how you like to schedule rest and hard days
• your functional threshold power (FTP) and maximum heart rate (both optional)
• how busy or stressful life is right now
• your experience with other training apps

We also store your time zone and language settings. Most of these fields are optional.

3.3 Apple Health data (you give us, through Apple HealthKit)

With your permission, the App reads these types of data from Apple Health:

• sleep
• heart-rate variability (HRV)
• resting heart rate
• heart rate
• workouts

Health access is read-only. Ridox never writes data to Apple Health. iOS controls the permission sheet, and you choose which data types to allow. You can review or revoke access at any time in iOS Settings → Privacy & Security → Health → Ridox.

The App reads this data on your iPhone, including in the background. It sends our servers only what Ridox needs to calculate your verdict and plan:

• your sleep times and duration
• your HRV and resting heart-rate readings
• a summary of each workout, such as its type, duration, distance and heart-rate information

Detailed heart-rate samples stay on your iPhone.

We never sell your Health data, never use it for advertising, and never use it to train any AI model.

3.4 Garmin Connect data (only if you connect it)

Connecting Garmin is optional. If you connect your Garmin Connect account, Garmin sends us data from your Garmin devices, and Ridox uses it the same way as your Apple Health data. You sign in on Garmin's own page, so we never see your Garmin password. We ask for your consent in the App before you connect.

We receive:

• sleep
• heart-rate variability (HRV)
• resting heart rate and other daily heart-rate figures
• your workouts, each with its activity file. The file holds second-by-second heart rate and, if you ride with a power meter, power

Garmin's daily summaries also include figures Ridox does not need, such as steps and calories. We do not use or keep them.

Detailed Apple Health samples stay on your iPhone, but Garmin activity files are processed on our servers. We use them to calculate your training load and the time you spent in each heart-rate and power zone.

Activity files can also contain the route you rode (GPS location). Ridox does not use location, so we remove it as soon as the file arrives and never store it.

Garmin is a separate company. It handles your data in Garmin Connect under its own privacy notice (garmin.com/privacy/connect). If you ask Ridox to send a planned workout to your Garmin device, we send that workout to Garmin.

You can disconnect Garmin at any time, in the App or in Garmin Connect. When you do, Garmin stops sending us data, and we delete the access Garmin gave us and the Garmin data stored under your account. Verdicts and plans already calculated from it stay in your history.

We never sell your Garmin data, never use it for advertising, and never use it to train any AI model.

3.5 Check-ins, ride feedback and coach memories (you give us)

• Daily check-ins: how you feel, for example your energy, soreness, motivation and stress, whether you are sick or in pain, and any notes.
• Ride feedback: how hard a ride felt, and any notes about it.
• Coach memories: facts you confirm the coach should remember, for example an old injury.
• Plan changes that you accept.

Because this information can reveal things about your health, we handle it with the same care as your Apple Health data.

3.6 Your verdicts, baselines and training plan (calculated by us)

From the information above, we calculate your personal baselines, training load, daily verdict and training plan. We store them, along with the details needed to explain your verdict, so you can see your history.

3.7 AI coach conversations

When you chat with the coach, we store your messages and the replies so you can see your conversation history.

The coach is powered by large language models from third-party AI providers. To generate a reply, we send the provider:

• your message and your recent conversation
• a summary of your training: your verdict, recent rides and check-ins (which can include whether you reported being sick or in pain), your plan and your goals

We do not send your name or email address.

We may change AI providers over time. Under its contract with us, any provider we use must:

• use your information only to generate replies for us, and never to train its models
• keep it only for a limited period, no longer than 30 days for abuse monitoring, and then delete it
• protect it with appropriate security, and with lawful safeguards for international transfers

We do not use your conversations or your health data to train any AI model.

The coach may suggest a change to your plan, or a fact to remember. Nothing is applied unless you accept it. Your daily verdict is calculated by Ridox's own methodology; it is not written by the AI coach.

3.8 Subscription and purchase information

Ridox is sold through Apple's In-App Purchase system. Apple processes your payment, and we never receive your card or bank details.

Our subscription management provider receives purchase information from the App Store:

• the product you bought
• your purchase, renewal and expiry dates
• whether you are on a trial
• the price and currency
• the App Store country
• transaction identifiers

We use this information to check whether you have an active trial or subscription.

3.9 Usage analytics, crash reports and session recordings

We use a product analytics provider to understand how the App is used and to find and fix problems. While you use the App, it collects:

• Usage events, such as the screens you visit and actions like signing in, viewing the subscription screen or making a purchase. These record what you did, not what you wrote: they never contain your health values, check-in answers or coach messages.
• Device and app information, such as device model, iOS version, App version, language and time zone.
• Your IP address, and an approximate location derived from it.
• Identifiers: your account ID, and a random identifier stored on your iPhone.
• Crash and error reports.
• Session recordings: a visual reconstruction of the screens you see and how you interact with them. We hide the text you type, your coach conversations, your account details and the health figures on certain screens. Recordings can show other information on screen, such as your daily verdict and plan. We use recordings only to find bugs and improve the App's design.

Analytics, crash reporting and session recordings are part of how the App works, and there is currently no in-app switch for them. You can object at any time (see Section 13).

3.10 Communications with us

When you email us, we receive your email address, your message and anything you attach. We use them to answer you.

3.11 Technical logs

Our servers and our website host keep technical logs. These include IP address, account ID, the time of each request and browser type.

3.12 What stays on your iPhone

Some information is stored only on your iPhone:

• your sign-in session, kept in the iOS Keychain
• cached data, so the App works offline
• your preferences

The Home Screen widget shows today's verdict and session, so anyone who can see your Home Screen can see them. Reminders are scheduled on your iPhone itself (Section 17).

3.13 What we do not collect

• No GPS location or routes. Garmin activity files can contain your route; we remove it as soon as the file arrives (Section 3.4).
• No contacts, photos, camera or microphone. Spoken ride cues are generated on your iPhone, and nothing is recorded.
• No tracking: we do not collect your device's advertising identifier, and we do not track you across other companies' apps or websites.
• No ads in the App, and no sale of personal information.
• No use of your health data, check-ins or coach conversations for advertising, or to train AI models.

4. How we collect information

• From you: when you sign in, set up your profile, log check-ins and ride feedback, chat with the coach, or contact us.
• From your iPhone: through Apple HealthKit, with your permission, and automatically through the App (usage data, crash reports, session recordings and technical logs).
• From third parties: Apple or Google when you sign in with them, the App Store when you buy, renew or cancel a subscription, and Garmin, if you connect it (Section 3.4).

5. How we use information

We do not use your information to show you advertising, and we never use your health data, check-ins or coach conversations for marketing.

6. Legal bases for processing (EEA, UK and Switzerland)

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we rely on the following legal bases under the GDPR (and the equivalent UK and Swiss law):

Withdrawing consent. You can withdraw consent to health-data processing at any time, in any of these ways:

• turn off Health access in iOS Settings
• disconnect Garmin
• stop entering check-ins and notes
• ask us to delete your health data
• delete your account

Withdrawal does not affect processing that happened before you withdrew. Without health data, Ridox can only give you lower-confidence verdicts.

Do you have to give us your information? You need an account and a subscription (or trial) to use Ridox, and we need the related information to provide them. Health access, check-ins and most profile fields are optional. If you leave them out, your verdicts and plan will be less personal and less confident.

7. How we share information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We share it only as described below.

7.1 With our service providers

We use service providers to run the Service (Section 8). They process information only on our behalf.

7.2 With Apple, Google and Garmin, as independent companies

• Apple runs the App Store, processes payments as the merchant of record, provides Sign in with Apple, and controls the HealthKit permission system.
• Google provides Sign in with Google, if you choose it.
• Garmin, if you connect your Garmin account, sends us your Garmin data, and receives any workout you ask us to send to your Garmin device (Section 3.4).

Each acts under its own privacy policy for these functions: apple.com/legal/privacy, policies.google.com/privacy and garmin.com/privacy/connect.

7.3 In a business transfer

If we are involved in a merger, acquisition, financing, reorganization, insolvency or sale of assets, your information may be transferred to the new owner. We will tell you, by email or in the App, before your information becomes subject to a different privacy policy.

7.4 For legal reasons

We may disclose information if we believe in good faith that this is necessary to:

• comply with the law or a valid legal request
• enforce our Terms of Service
• detect or prevent fraud or security problems
• protect the rights, property or safety of our users, the public or us

7.5 With your direction

We may share information with others when you ask us to, or otherwise consent.

8. Our service providers

We use service providers in these categories:

Every provider we use is bound by a written contract. Under it, the provider must:

• process your information only on our instructions
• keep it confidential and secure
• give it at least the same level of protection described in this policy

We may replace a provider with another one in the same category that meets these requirements. We will update this policy before we share personal information with a new category of recipient.

9. Advertising and analytics

• Ridox shows no advertising, and we do not let advertising networks collect data in the App.
• We do not sell personal information or share it with data brokers.
• We do not track you across other companies' apps or websites, and we do not collect your advertising identifier. If that ever changes, we will update this policy and ask for your permission first.
• We use a product analytics provider for analytics, crash reports and session recordings (Section 3.9).

10. International data transfers

We are based in Poland, in the European Union. Most of our service providers are in the United States, so your information, including your health data, is stored and processed there.

When we transfer personal information out of the EEA, the UK or Switzerland, we rely on one of these safeguards:

• the EU–U.S. Data Privacy Framework (and its UK Extension and Swiss–U.S. counterpart), for providers certified under it
• Standard Contractual Clauses approved by the European Commission, with the UK International Data Transfer Addendum and the Swiss adaptations where relevant, for all other transfers

We also apply technical measures such as encryption and access controls. To get a copy of the safeguards for a particular transfer, contact support@ridox.app.

11. How long we keep information

When we no longer need information, we delete it or make it anonymous.

12. Information security

We use industry-standard measures to protect your information. These include encryption in transit and at rest, access controls that limit who can see your data, and secure storage of sign-in credentials on your device.

No system is perfectly secure. If a breach of your personal information creates a risk to you, we will notify you and the relevant authorities as the law requires.

13. Your rights and choices

Wherever you live, you can ask us to:

• Access: give you a copy of the personal information we hold about you, and tell you who we have shared it with
• Correct: fix information that is inaccurate or incomplete
• Delete: erase your information. The quickest way is Settings → Delete account in the App
• Export (portability): send you your information in a structured, machine-readable format
• Restrict: limit how we use your information while a concern is resolved
• Object: stop processing based on our legitimate interests. If you object to analytics, we will delete the analytics data and session recordings linked to your account, and stop collecting them for it
• Withdraw consent: for health data, at any time (see Section 6)

You can also make these choices on your iPhone at any time:

• Health access: iOS Settings → Privacy & Security → Health → Ridox
• Garmin: disconnect in the App or in Garmin Connect
• Reminders: in the App's settings, or in iOS Settings → Notifications → Ridox

How to make a request. Use Settings → Privacy → Request my data in the App, or email support@ridox.app. To protect your account, we may need to confirm that the request comes from you; we will ask only for what we need, usually the email address on your account. We answer within one month. If a request is complex, we may extend that by up to two more months, and we will tell you if we do. Making a request is free, unless it is clearly unfounded or excessive.

Complaints. You can complain to a data protection authority (see Section 21). We would appreciate the chance to sort out your concern first, at support@ridox.app.

14. Children's privacy

Ridox is not intended for anyone under 16, and we do not knowingly collect personal information, including health data, from anyone under 16. If you are under 16, please do not use Ridox. If you are a parent or guardian and believe your child has given us personal information, contact support@ridox.app and we will delete it promptly.

15. Automated decisions and AI

• The daily verdict is training guidance, not a decision with legal or similarly significant effects on you. You always decide whether and how to train.
• The coach's replies are generated by AI and can be wrong (see our Terms of Service).
• No ad profiling. We do not use your data to profile you for advertising.

16. Our website and cookies

ridox.app sets no cookies, runs no analytics and loads no third-party trackers. Our website host keeps technical logs (Section 3.11) to operate the site and protect it from abuse.

17. Notifications and the widget

Ridox can remind you when your morning verdict is ready, and before rides. These reminders are scheduled on your iPhone. We do not send push notifications from our servers.

You can change the reminder time or turn reminders off in the App, or turn off notifications in iOS Settings. The Home Screen widget shows information stored on your iPhone (Section 3.12).

18. Account creation and deletion

You can sign in with Apple, with Google, or with an email address and password (Section 3.1).

You can delete your account at any time in the App, in Settings → Delete account. When you do:

• Straight away: we delete your account and the data stored under it, including your profile, Health and Garmin data, check-ins, verdicts, plans and coach conversations. The App then signs you out and erases its data on your iPhone.
• Within 30 days: copies held by our subscription management and analytics providers are deleted.
• Within 35 days: backups containing your data are overwritten.
• What we keep: subscription records we are required to keep for accounting or tax, or that we need to handle a dispute (Section 11).

Deleting your account does not touch the data in your own Apple Health app or Garmin Connect account, which stays under your control. If you delete the App without deleting your account, your account and data stay on our servers so you can restore them later. To remove them, delete your account in the App first, or email us.

19. Notice to California residents

This section applies if you are a California resident. It supplements the rest of this policy, as required by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA), and by the California Online Privacy Protection Act (CalOPPA).

Information we collected in the last 12 months:

• Sources: you, your iPhone, Apple, Google, the App Store and, if you connect it, Garmin (Section 4).
• Purposes: as described in Section 5.
• Retention: as described in Section 11.

Sale and sharing. We do not sell personal information, and we do not "share" it for cross-context behavioral advertising, as the CCPA defines those terms. This has been true for the past 12 months. We have no actual knowledge of selling or sharing the personal information of consumers under 16.

Sensitive personal information. We use sensitive personal information only to provide the Service you ask for, and for the other purposes the CCPA permits (Cal. Code Regs. tit. 11, § 7027(m)). We do not use it to infer characteristics about you. For that reason, we do not offer a separate "limit the use" link.

Your rights. You have the right to:

• know what personal information we collect, use and disclose, and access a copy of it
• delete it
• correct it
• opt out of the sale or sharing of personal information (although we do neither)
• limit the use of sensitive personal information (although we use it only for permitted purposes)
• not be discriminated against for exercising any of these rights

To exercise your rights, use Settings → Privacy → Request my data in the App, or email support@ridox.app. We will confirm receipt within 10 business days and respond within 45 days. If we need more time, we may extend that once by another 45 days and will tell you why.

You may use an authorized agent. We may ask the agent for proof of your signed permission, and may ask you to confirm your identity directly with us.

Shine the Light (Cal. Civ. Code § 1798.83). We do not disclose personal information to third parties for their own direct-marketing purposes.

Do Not Track. See Section 23.

20. Notice to residents of other US states, and our consumer health data policy

20.1 State privacy rights

Several US states give you rights similar to California's, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Kentucky, Rhode Island, Maryland, New Jersey, New Hampshire, Delaware, Nebraska and Minnesota.

Depending on your state, you may have the right to:

• confirm whether we process your personal data, and access it
• correct it
• delete it
• get a portable copy of it
• opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. We do none of these
• receive a list of the third parties we disclosed your data to, where your state law provides this right

We process sensitive data (health data) only with your consent.

To exercise your rights, email support@ridox.app. If we decline your request, you can appeal by replying to our decision with the subject line "Appeal". We will respond within the time your state's law requires. If you disagree with the result, you can contact your state attorney general.

20.2 Consumer health data privacy policy (Washington, Nevada and similar laws)

This subsection is our consumer health data privacy policy under Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), and similar state laws.

• Consumer health data we collect: the Apple Health data in Section 3.3, the Garmin data in Section 3.4, the check-ins, ride feedback and coach memories in Section 3.5, the health-related content of your coach conversations (Section 3.7), and the verdicts, baselines and plans we calculate from them (Section 3.6).
• Why we collect and use it: to provide the Service you asked for, meaning your daily verdict, training plan and coach replies, and to keep the Service secure and working (Section 5).
• Sources: you, your iPhone through Apple HealthKit, and Garmin if you connect it, always with your permission.
• Who we share it with: only the service providers that process it on our behalf to run the Service: our cloud hosting and database provider, our AI model providers, and our analytics provider (where it appears in session recordings). We do not sell consumer health data, and we do not share it with third parties for their own purposes. We have no affiliates that receive it.
• Your rights: you can confirm whether we collect, share or sell your consumer health data; access it, together with a list of the third parties and affiliates we have shared it with and their contact information; delete it (including in the App via Settings → Delete account); and withdraw your consent. To do any of this, use the options in Section 13 or email support@ridox.app. You can appeal a refusal as described in Section 20.1.
• No geofencing: we do not set up virtual boundaries around health-care facilities.

21. Notice to EEA, UK and Swiss residents

If you are in the EEA, the UK or Switzerland, you have the right to:

• access your personal information (Art. 15 GDPR)
• rectify it (Art. 16)
• erase it (Art. 17)
• restrict its processing (Art. 18)
• data portability (Art. 20)
• object to processing based on our legitimate interests (Art. 21)
• withdraw consent at any time (Art. 7(3))
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects (Art. 22). We make no such decisions
• lodge a complaint with a supervisory authority (Art. 77)

We are established in Poland, so our lead supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You can also complain to the authority in the EU country where you live or work, or where you believe the problem happened.

• UK residents can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint.
• Swiss residents can contact the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch.

22. Notice to residents of other countries

The rights in Section 13 are available to everyone. In addition:

• Brazil (LGPD): you have the rights in Article 18 of the LGPD, including confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about who we share data with, and revoking consent. We process your health data (sensitive personal data) with your specific and highlighted consent. You can contact the ANPD (gov.br/anpd).
• Canada (PIPEDA and Quebec Law 25): you can access and correct your information and withdraw consent. Our person in charge of the protection of personal information can be reached at support@ridox.app. Your information is stored outside Canada, mainly in the United States, where it may be accessible to courts and authorities there. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.
• Australia and New Zealand: we handle personal information in line with the Australian Privacy Principles and the New Zealand Information Privacy Principles. Your information is stored overseas, mainly in the United States. You can complain to the Office of the Australian Information Commissioner (oaic.gov.au) or the New Zealand Privacy Commissioner (privacy.org.nz).
• Japan, South Korea, India and other countries: your information is processed in Poland and the United States as described in this policy. We transfer it to our service providers under contracts that require them to protect it, use it only on our instructions, and delete it when the service ends. You can exercise the rights your local law gives you by emailing support@ridox.app.

23. Do Not Track and Global Privacy Control

• Do Not Track: there is no common standard for how to respond to browser "Do Not Track" signals, so we do not respond to them.
• Global Privacy Control: we do not sell or share personal information, so a Global Privacy Control signal does not change how we process your information. We treat it as a valid opt-out request where the law requires us to.

24. Changes to this policy

We may update this policy from time to time. Each time, we will change the "Last updated" date at the top.

If a change is material, especially a change to how we handle health data, we will tell you in the App or by email before it takes effect. Where a change requires your consent, we will ask for it.

25. How to contact us

For any privacy question, request or complaint:

• Email: support@ridox.app
• Post: HolyMake sp. z o.o., ul. Hoża 86 lok. 410, 00-682 Warszawa, Poland

26. About this policy and legal disclaimer