Privacy notice

The RYHUS app

This notice tells you what we do with your data. It is written to be read, not to be survived — if any part of it is unclear, that is our failure and we would like to know.

Who we are

Hussein Bahaaeldin ("we") is the data controller for the personal data described here.

• Contact for anything in this notice: privacy@ryhus.com
• Postal address: U3 14, 68161 Mannheim, Germany
• Data protection officer: none appointed. If one is appointed, this notice will name them and say how to reach them; until then, contact us directly.

RYHUS is being tested by invited friends, before a company is set up to run it. Until then it is run by the one person named above. When a company takes RYHUS over, it will become responsible for your data: you will be asked whether you agree, and if you do not, your data will be deleted.

What this app is, in one line

RYHUS takes the training and wellness records you share with it, works out your fitness, fatigue and form and your training plan on its own server, and shows you a plain-language brief and your plan on your phone. Where it has no real measurement it says so rather than estimating — that is the product's core promise, and it shapes what we hold.

1. What we collect

From a source you link — Apple Health, which your phone sends to the RYHUS server with the permission you choose on your phone, or intervals.icu, which the server reads using the API key you give us:

• Training sessions — type, name, date and time, distance, duration, average and maximum heart rate, time in each heart-rate zone, your heart-rate zone boundaries, your threshold heart rate, the training load figure, and whether power was measured or estimated. From Apple Health we also keep whether a ride carried power, whether a session was indoors, and whether a swim was in a pool or open water. For each workout we also keep when it started and ended, its distance and its average heart rate, which Today shows on your result.
• Your own words on a session. We keep any notes you wrote on your own sessions. The app reads them to work out what a session was for.
• Record-keeping that goes with a session — the session's own reference number, which app uploaded a session, when the record was created, and when a session reached RYHUS. We keep these so the same session is never counted twice, and so a question about a session your app had not yet sent is asked once it arrives, with its full time to answer; for no other reason.
• Daily wellness — heart rate variability, resting heart rate, sleep duration, sleep stages, your device's own sleep score, and weight, where your devices record them. From Apple Health these come from one app's night only, never added across apps, and we keep which app recorded your night and your night heart: the lowest steady heart rate during that sleep, which RYHUS works out.
• Figures intervals.icu works out itself — intervals.icu's own fitness figure and intervals.icu's own fatigue figure. We keep these alongside the ones this app works out, so the two can be compared and a disagreement can be shown to you rather than hidden.
• Apple Health workouts and nights, measured on the server. Your phone sends each workout once, with its heart-rate and distance readings, and the server measures it when it arrives. The readings are used in memory and not saved. Your phone reads a ride's power only to see whether it carried any, and sends only that. For a sufficiently covered workout we keep its observed heart-rate coverage, three-zone zone distributions, the training load figure, its load method, and its measurement tier, and for a workout that matches a planned session its per-step figures (each planned step's time, distance and average heart rate), so the result can be explained without keeping the readings. Your phone sends each night as each app recorded it, with the times you were asleep and the heart-rate and HRV readings inside that sleep. The server keeps one app's night, works out your night heart, and does not save the times or the readings. A workout keeps the figures it was first measured with; it is measured again only once, if its sport had no threshold heart rate then and has one now, or if you correct its sport. So that nothing is sent twice, your phone also sends a list of what Apple Health holds for the days the server reads: one fingerprint for each workout and each day, with no health value in it.

From you directly:

• About you and your training: your age, your time zone, the name the app calls you, the sports you do and when you started each, your level and experience, your recent training, the days and hours you can train, your races and goals, and your equipment.
• Your numbers: any physiological test results you record — threshold and LT1 heart rates, FTP, threshold pace, critical swim speed, your highest heart rate — with the date and method of each; your easy heart rate, pace or power; your zones; and recent race results.
• Your sessions: whether a planned session happened, how long it lasted, how hard it felt and whether it did its job, a session you missed or an extra one, and corrections to a workout — its sport, figures that are wrong, a race, two workouts that are one session, or a session that isn't yours.
• A session that isn't yours. If someone else's workout reaches your Apple Health, and so reaches us, you can mark it as not yours. We then delete it from your records at once, never count it in your figures or your plan, and never ask your phone for it again. To keep it out, we keep only its reference number and when you marked it.
• Your health: today's health check (pain, illness, or a concern that needs a professional), pain during a session, how you recovered, your injury history and the training it affects, and the reason for a break. These can hold or ease your training; they are not a diagnosis.
• Planning details you choose to give: sessions pinned to a day, dates to work around and travel, sessions you would rather not do, rules you set yourself, how you want to be coached, where you can train, your strength exercises and loads, tested carbohydrate and fluid rates, heat or altitude, a mobility need, your body mass, sex at birth, gender, racing and technique experience, and work or school stress. Identity alone never changes how much you train. A question you have not answered stays unknown.
• Your own words: why your goal matters to you, notes you leave, and the names you give things.

Generated by us about you:

• Fitness, fatigue and form figures; zone distributions; load ratios; and a record of the coaching sentences you were shown.
• Your plan, every change made to it with the reason and an Undo, the changes waiting for your OK, and what the app has learned about you with how sure it is. Where a starting amount of training has to be assumed, it is labelled as an assumption and never stored as something measured about you.

About your account and your phone:

• Your sign-in. You sign in with Apple. RYHUS receives from Apple an identifier for your link with RYHUS. RYHUS asks Apple for your name, but never your email. If Apple does not provide a name, we ask what to call you. It also receives a token the server keeps locked, so that it can ask Apple to forget the sign-in when you delete your account.
• Before you agree. You sign in first, to save your season. Until you agree to us using your data, your account holds only the name the app calls you and your link with Apple, and the answers you have given stay on your phone. They are sent only after you agree, and if you never do, nothing of yours is read.
• Your phone's key. Your phone makes a key for RYHUS, and Apple confirms it belongs to the real RYHUS app on a real iPhone (App Attest). The server keeps the key's public half and a counter, so it knows each request comes from your phone.
• Your intervals.icu key, if you connect it, locked with the server's own key.
• Receipts of your last answers sent while your phone was offline, so an answer sent twice counts once.

Operational: a record of every read and change of your data on the server — when, which request, who asked (your phone, the person who runs RYHUS, or the server's daily housekeeping), how it ended, and which records it read or changed, by name — never what they hold. And the server's own logs: which requests ran, how long they took and whether they failed, with your account's number and never your data.

Help improve RYHUS. Sharing app usage is optional and off by default. If you turn on ‘Help improve RYHUS’, we keep counts of screens reached and changes kept or undone. Crash reports contain only a failure code, screen and app build. No health data is included. These reports stay with your account on our server in France until you turn sharing off or delete your account. Turn it off in Profile to delete the reports we hold and stop new reports.

Most of this is health data. Under the GDPR it is "special category" data with extra protection, and we treat it that way.

2. Why, and on what legal basis

Why we ask for consent as well as relying on the agreement. The law requires a separate, explicit permission before anyone processes health data. The agreement makes the service lawful; your consent is what allows the health data inside it. You can withdraw that consent at any time — see §7.

We do not use your data to make automated decisions with legal or similarly significant effects. The app gives training guidance you are free to ignore, and a big change to your plan waits for your OK.

3. Who else sees it

• Scalingo — a French company that runs the RYHUS server and its database for us, in France. It may use your data only to run the server, on our instructions, under our contract with it. Your data is kept in France. Scalingo's contract allows it to transfer data outside the European Economic Area for technical reasons; we have not obtained a promise that it never will, and we do not make one.
• The person who runs RYHUS (named above) can look at your plan, its changes, your answers, your settings and the record of who read and changed your data, in a private view on the server that only they can open, with a passkey. They look to keep your service working and to find and fix mistakes in your coaching. Every look is written in your record of reads and changes, which is part of your copy of your data.
• Apple — you sign in to RYHUS with Sign in with Apple, Apple's own service to you under Apple's terms. When you delete your account, RYHUS asks Apple to forget the sign-in. Apple Health stays on your phone: your phone reads it with the permission you choose, and sends the server only what §1 lists.
• intervals.icu, if you connect it, remains a separate service you use. It controls the records in your intervals.icu account under its own privacy policy. The RYHUS server reads from your account with the key you supply, and writes nothing there. We do not send your Apple Health workouts or readings to intervals.icu. Your intervals.icu account terms do not replace this notice or RYHUS's health-data permission.

We do not sell your data or share it with advertisers or analytics providers. Nothing of yours is sent to an AI or language-model provider. RYHUS has no AI coach at present; if it offers one, it will ask your permission for it on its own form, and you can refuse it and keep everything else.

Where your training data lives: on the RYHUS server, in France. Your phone keeps a copy of the plan the server last sent, so you can see it offline, and any answers waiting to be sent; signing out, withdrawing your consent or deleting your account removes them from your phone.

4. How long we keep it

In short: while you use the app, and not long after you stop.

If processing is restricted, we keep the records and stop ordinary processing; you can still request export or erasure. Consent evidence and deletion receipts are removed by the server's daily housekeeping when their three years end.

5. Where it is stored, and how it is protected

Your data lives on the RYHUS server in a separate storage area per person — not a shared table with name labels — so one person's data is not reachable from another's, and deleting yours removes it in one action. The database is encrypted where it is stored, and your data travels encrypted between your phone, the server and its database.

Your phone signs every request with its own key, and the server answers only a phone registered to your account. Your intervals.icu key is locked with the server's own key, opened only while your training is read, and never shown or handed back — not even in your copy of your data. Nothing that could carry your data is written to the server's logs. Every read and change of your data is recorded, and each line is sealed to the one before it, so a line removed or edited afterwards shows.

Before an intervals.icu pull writes data, we check the account it came from against the one you declared and refuse on any disagreement. RYHUS writes nothing to your intervals.icu account. It only reads, and the server is built so that it cannot write there.

No athlete's data is ever kept in our source code repository, and an automated check fails our build if any appears. RYHUS is built and tested with made-up athletes, never with yours.

6. Your rights

You have the right to:

• Access — a copy of what we hold about you.
• Rectify — correct anything wrong. Note: records that came from intervals.icu are corrected there, not here; we re-read them each time.
• Erase — have everything deleted. See §7.
• Restrict or object to processing.
• Portability — receive your data in a machine-readable form.
• Withdraw consent at any time, without giving a reason.
• Complain to a supervisory authority — ours is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (LfDI Baden-Württemberg), because that is where we are established. You may complain to the authority where you live, where you work, or where the problem happened — it does not have to be ours.

How to use any of them: in the app, or contact privacy@ryhus.com. We answer within one month (Art. 12(3)), and will tell you if we need longer and why. It is free; we would only charge for a request that is manifestly excessive, and we would explain first.

7. Withdrawing consent, and being erased

These are two different things and you can ask for either.

• Withdrawing consent stops us processing your health data going forward. We stop reading new records and stop computing anything from what we already hold, and what we hold is deleted 30 days later. What we already did stays lawful — withdrawal is not retroactive.
• Erasure removes what we hold, at once.

It is as easy to withdraw as it was to give (Art. 7(3)): in the app, or one message to privacy@ryhus.com.

You can do both from the app. Saving a copy gives you what the server keeps about you, with the record of who read and changed your data and when, to save to Files or send wherever you choose. It leaves out only your intervals.icu key, which stays locked, and what is made again from your records anyway: the untouched replies from intervals.icu and each day's figures. Deleting asks you to type DELETE under a list of exactly what will go. Then Apple is told to forget your sign-in, your data and your account are deleted from the server at once, and your phone forgets its copy.

What erasure cannot reach, stated plainly because you should know before you rely on it:

• your intervals.icu account and everything in it — that is yours and theirs, and we cannot delete it. Ask them, or delete it yourself.
• any copy of your data you saved yourself, wherever you put it.
• the record of reads and changes, until each line's 12 months end: when, which request and the names of the records, never what they held.
• the server's own logs at Scalingo, kept 12 months: lines naming your account's number, never your data, and nothing links that number to you any more.
• Scalingo's backups of the server's database, until each one expires. If one is ever restored, your deletion is made again before RYHUS answers anyone.
• your sign-in with Apple, if Apple could not be told: the app says so, and you can remove it yourself in your iPhone's Settings, under your name, then Sign in with Apple.

Everything else goes: your records, your reports and your plans, deleted in full. We keep a receipt — your account number, the date, and what was removed — because we have to be able to show we did it.

8. Do you have to give us this data?

Not by law, and there is no contract obliging you. But RYHUS plans from your training records, or from what you tell us when you are just starting, and both need your permission. If you decline, your season stays saved and nothing of yours is read; if you withdraw consent, the service stops.

9. Children

This service is not for anyone under 18. We do not knowingly hold a child's data. If you believe we do, tell us and we will erase it.

10. Changes

If we change what we do with your data, we will update this notice and its version number. If the change materially affects health data processing we will ask for your consent again rather than treating silence as agreement — as we will when a company takes RYHUS over.

This notice covers processing by RYHUS only. intervals.icu, Apple and your device maker each have their own.