Privacy Policy — Today's Load

Effective date: 17 October 2026 (previous version: 9 October 2026)

Today's Load is made by 14past3 d.o.o., Slovenia (14past3.com). We are the data controller for the personal data described here. Company details: 14PAST3 računalniške storitve d.o.o., Cesta na Bokalce 20 E, 1000 Ljubljana, Slovenia; registration number 9959513; VAT ID SI85358975.

Contact for anything in this policy, including exercising your rights: support@todaysload.com

Today's Load measures your heart's beat-to-beat intervals during a 12-minute morning protocol and turns them into a daily training decision. That is health data — the most protected category under the GDPR — so this policy is deliberately short, specific, and honest.

What we collect

1. A pseudonymous account identifier. You sign in with Apple. We request no name and no email address — Apple gives us only a random, stable identifier that only we receive. We could not email you if we wanted to.
2. Your measurements. The beat-to-beat (RR) intervals recorded from your chest strap during a session, and the results our analysis engine computes from them (the decision, the four signal values and the rest of the engine's result for that reading).
3. Optional context notes. If you choose to answer the pre-session questions (sleep, alcohol, illness, soreness, stress), your answers are stored with that measurement. They never affect the decision. Unanswered questions are not recorded.
4. Your training log, if you use it: the sport, duration and optional perceived intensity of sessions you record yourself.
5. Your cycle log, if you turn cycle tracking on. Only the days you record: that a period started on a given day, that one ended on a given day, and an optional flow (light / medium / heavy). Nothing else — no symptoms, no temperature, no ovulation or pregnancy tests. This is stored with your account so it survives a new phone, and it is deleted with your account. We never infer or record pregnancy, fertility or a fertile window, we never predict a future period, and we never share any of it with anyone. Your cycle never changes the engine's decision: it is shown beside your readings as context, never used to score them.
6. The AI analysis of a result, if you use that feature — the paragraph itself is stored with the measurement so re-opening a day shows the same words. See "The AI analysis" below.
7. Copies of your 12-minute measurements, only if you say yes, to find problems and improve the method. See "Improving the method" below.
8. Your messages, if you write to us. We use your email address and what you send only to answer you, and delete the correspondence once it is no longer needed for that.

What stays on your phone only: your strap pairing, the profile entries made during onboarding (age, sex, height, weight, goal), app settings, and any measurement that has not yet been uploaded. We have no access to these. Two switches are the exception and are stored with your account, because the server has to know them: cycle tracking (it decides whether the AI analysis may read your cycle log) and Help improve the method (it decides whether a copy of a measurement is kept).

What we do not collect from app users: no name, no email, no location, advertising identifiers or data from HealthKit. We do not use advertising trackers or third-party behavioural analytics, and we do not track which screens you open. We use the account and measurement records already needed to provide the service to count registrations, measurement activity and successful or refused readings, and to identify service problems. These operational reports are available only to authorised staff; this does not add an analytics SDK or app-open tracking.

Why, and on what legal basis

We process your measurements for one main purpose: to compute and show you your own daily decision and the results behind it, including your history and trends. Internal operational reporting supports delivery and troubleshooting of this same service. Research access remains subject to the separate consent below. The legal basis is your explicit consent (GDPR Article 9(2)(a)), which you give when you sign in. You can withdraw it at any moment by deleting your account (below) — withdrawal is as easy as giving it.

Only if you say yes, we also keep copies of your 12-minute measurements to find problems and improve the method. That is a separate explicit consent (Article 9(2)(a) again), asked separately, and saying no changes nothing else in the app.

We do not use your data for advertising, and we do not sell it or share it with anyone for their own purposes. Nothing you give us is used to train an AI model — not by us, and not by the AI provider described below, whose terms prohibit training on customer data. If that ever changed, we would ask you first — not update this page quietly.

Where your data lives

Everything we store is held in the European Union:

• Database: MongoDB Atlas, Frankfurt, Germany
• Application servers: Vercel, Frankfurt, Germany
• Analysis engine, and the copies kept to improve the method: Hetzner, Germany

These providers process data on our behalf under their standard EU data-processing agreements. Apple processes your sign-in under its own terms.

One feature can send data outside the EU: the AI analysis. It is off unless you turn it on, and it runs only when you tap it. If you do, a short summary of a single result is sent to Anthropic, who write the paragraph and act as our processor under their commercial terms; their inference may run outside the European Economic Area, and there is no way to require that it runs inside it. Exactly what is sent — and the much longer list of what is never sent — is in the next section.

We rely on your own explicit consent to that specific transfer (GDPR Article 49(1)(a)): the switch starts off, the app tells you what leaves and where before you move it, and turning it back off stops any further transfer. We are telling you plainly what this means: a country outside the EEA may not give you the same enforceable rights or supervisory oversight as EU law does. If you would rather that never happen, leave the switch alone — every other part of Today's Load works exactly the same, and your daily decision does not depend on it.

The AI analysis

Below the engine's own result, the app can write a short plain-English analysis using an AI model (Anthropic's Claude). It is available to everyone, free, and entirely optional. The decision is always the engine's — the AI only puts it into words and compares it with your own recent weeks; it never decides anything.

It runs only when you ask for it. There is a button on the Why screen, and nothing is sent until you tap it. Turning the feature on does not start sending anything on its own.

This is optional and you control it. Profile → *AI analysis*. Turn it off and the request is never made; nothing about your measurements leaves the EU. Analyses already written stay readable until you delete the measurement.

What is sent, when you tap Analyse — the derived results of your own measurements and what you logged yourself:

• the decision in plain words (Train / Reduce / Recover), its subtype, and the engine's stance
• the four signal values (Rebound, Response, Stability, Reserve) for this reading
• the engine's own coaching phrases and guardrails for that reading, and a plain-words summary of what shaped the reading
• what happened within this morning's recording: whether your heart rate rose when you stood, whether it settled, whether it held when you stood again
• the reading's quality notes — which phase of the measurement was noisy and how much it reduced confidence — without the underlying percentages
• the decisions and subtypes of your scored mornings over the last four weeks, as *"3 days ago"* rather than dates
• your own four-week typical values for the four signals, and whether today sits above, below or within them
• whether this morning's resting heart rate and heart-rate variability sat above, below or within your own recent range — as words, never as the values
• if this was your second reading of the day, the first reading's decision and signal values
• sessions you logged yourself over the last two weeks: sport, how the length compares with your other logged sessions, and your perceived intensity — never the duration itself
• the context notes you chose to log for this reading and for the last week: sleep quality and hours, alcohol, feeling ill, soreness, stress, and how they compare with your recent notes
• if cycle tracking is on: which day of your cycle this morning is, whether your own log says you were bleeding, and how many cycles the log has seen — as counts, never as dates. Turning cycle tracking off stops this being sent at all. The model is told, and automatically checked, that it may never present your cycle as the cause of anything in a reading and may never name a cycle phase — we do not estimate one

What is never sent:

• your heartbeat data. The beat-to-beat intervals are never sent to the AI provider. Our own engine processes them; separately consented research access is described below.
• any identifier. No account id, no session id, no name, no email — Anthropic receives no way to connect the text to a person.
• any date. Recent context travels as whole days back, never as a calendar date.

Legal basis. Two consents, both yours, both affirmative: Article 9(2)(a) for processing health data for this feature, and Article 49(1)(a) for sending it outside the EEA. The switch starts off — nothing is sent until you turn it on yourself, which the app asks you to do at the moment you first tap Analyse, and turning it off withdraws both. Anthropic acts as our processor and its terms prohibit training on this data.

Improving the method

After your first 12-minute measurement, the app asks you once whether we may keep a copy of your measurements to find problems and improve the method. Nothing is kept unless you say yes, and you can change your answer at any time in Profile → *Help improve the method*.

What each copy contains — for each 12-minute measurement taken while the switch is on:

• the beat-to-beat intervals as your strap recorded them
• the engine's result for that measurement, and the results of a few of your previous mornings that the engine was given with it, so the analysis can be repeated exactly
• the quality information recorded with it: the timing of the breathing pacer and the quality of the strap's connection
• the app version and your strap's model (for example "Polar H10"), without its serial number
• the week it was recorded — never the date or time

What a copy never contains: your account identifier, the measurement's identifier, your context notes, your training log, your cycle log, your profile entries or the AI analysis. Quick checks are never kept. The copies are never sent to the AI provider, never used to train an AI model, and never sold or shared.

How a copy is labelled. Each copy carries only a coded key, computed from the measurement's identifier with a secret that only our server holds. We use it for finding a copy for authorised research access and when it has to be deleted. Because a copy holds the same heartbeat intervals as the measurement in your account, it stays connected to you for as long as that measurement exists, and we treat it as your personal data until then.

Who can see them. Only the people who work on the measurement method at 14past3 d.o.o., or on our behalf under a written data-processing agreement. They are stored with the analysis engine, in Germany.

Authorised method researchers may inspect and download eligible contributed recordings into their private research workspace in the EU. JSON downloads contain the retained inputs, original result, software versions, capture week and an export reference/checksum. Downloads can also contain heart rate calculated from the recorded intervals and phase summaries, clearly identified as derived values. CSV downloads contain intervals and derived heart rate. Neither includes account identifiers, measurement identifiers, sensor serial numbers, context notes, training or cycle logs, or AI text. Research files are not published or sent to an AI provider. Downloads are logged so copies can be located and removed following withdrawal. Removing downloaded copies requires action by the authorised researcher; the app cannot remotely erase files from their computer. The five-year maximum also applies to downloaded research copies.

How long. At most five years from the measurement, then deleted.

Your control:

• Turning *Help improve the method* off deletes every copy you have contributed and stops new ones.
• Deleting a single measurement deletes its copy too.
• If you delete your account, the copies you contributed stay, but nothing connects them to you any more: your account, your measurements and their identifiers are gone, so the key can no longer be traced to anything we hold. From then on they are anonymous. If you want them deleted as well, turn the switch off before you delete your account.

Legal basis. Your explicit consent (GDPR Article 9(2)(a)), given by tapping *Yes* in the app and withdrawn by turning the switch off.

How long we keep it

Until you delete it. Each measurement can be deleted individually in the app (History → swipe), and your entire account with every measurement can be deleted in the app (Profile → Delete account & data). Deletion is immediate and permanent: the AI analysis stored with a measurement goes with it, so does its kept copy if you said yes to improving the method, and a deleted measurement also stops informing the analysis of your future measurements. There is no "deactivation" — deleted means gone.

When you delete your account, the app asks you to confirm with Apple, and we then ask Apple to end Sign in with Apple for Today's Load, so the app no longer appears under Sign in with Apple in your Apple ID settings.

The one exception is described above: copies you chose to contribute to improving the method stay after your account is deleted, with nothing that connects them to you.

Your rights

Under the GDPR you can ask us for access to your data, correction, deletion, restriction, portability (a machine-readable export), or object to processing. Deletion you can do yourself in the app, instantly; for everything else, write to support@todaysload.com and we will respond within one month. You also have the right to complain to a supervisory authority — in Slovenia, the Information Commissioner (Informacijski pooblaščenec, ip-rs.si), or the authority of your own country.

Security

All traffic is encrypted in transit (HTTPS). In the app, access requires a signed token tied to your Apple sign-in; every request is isolated to your own account. The analysis engine requires server credentials and is not directly accessible to app users.

The private operations dashboard is restricted to two named administrators using individual accounts. It shows pseudonymous user codes, measurement activity, software and sensor models, and original quality checks. The app does not automatically collect names or email addresses. Administrators may add an optional custom name and a short private note to a user code for support and research follow-up. These annotations are shared only between the authorised administrators, stored separately from measurements, and excluded from research exports and AI processing. They can be edited or cleared in the dashboard and are removed when the dashboard next refreshes its account list after an account is deleted. Raw research traces and downloads require an eligible contribution, current consent and no pending withdrawal. Administrator email addresses and password hashes are separate from app accounts. Passwords are managed in deployment configuration, not through public registration or password-reset pages.

Access logs are retained for up to 90 days. Research download logs, containing an administrator reference, export reference/checksum and the coded link needed to locate a contributed copy, are retained for up to five years to support withdrawal and deletion. These logs contain no heartbeat intervals or context notes.

Children

Today's Load is not directed at children and is not intended for anyone under 16.

Changes

If this policy changes in any way that matters, the app will tell you before the change applies to you. The current version always lives at this address.