Privacy policy

Version of 27 September 2026.

Djok processes health data. This document states which data, where it goes, and how to retrieve or erase it.

The French version is the reference text; this translation is provided for convenience.

1. Data controller

Cédric Cecilie, Martinique, France.
Contact: djok@castlecloud.fr

Djok is a personal project, run at small scale and by invitation.

2. Data processed

Identity and sign-in

• Email address (your sign-in identifier)
• First name
• Session tokens and device tokens (notifications), stored encrypted

Training data, from Wahoo and COROS

• Activity summaries: date, duration, distance, elevation, sport, average power and heart rate
• Second-by-second series: power, heart rate, cadence, altitude, speed, temperature, respiration, left/right balance, R-R intervals
• Workouts planned in SYSTM (Wahoo)
• From COROS: running, trail running and hiking activities, with the same summaries and series

Data produced by Djok

• Workouts on the Djok calendar, FTP, zones, training load and form computed from your rides

The GPS trace of each ride is kept, trimmed by 200 metres around the start and the finish. The cut happens at write time: those points are never stored. It feeds the ride map, personal segments and reusable routes.

Health data, from Polar

• Heart rate variability (HRV)
• Sleep duration and its stages (light, deep, REM)
• Resting heart rate, overnight respiration
• Weight, height, date of birth

These are special category data under Article 9 of the GDPR. They are processed only on your explicit consent, and only to provide you with training and nutrition guidance.

What you enter yourself

• Your food intake: the macronutrient amounts you declare having consumed, which decrement the day's counters
• Your body weight goal, the foods you mark as favourites or hide, and the nutrition values you correct by hand
• What you declare in the app: how a ride and your morning felt, what a ride was meant to be, planned rides and your training plan answers
• The town you declare : its name and coordinates, used only to fetch weather and air quality at the right place. It is optional: without it, Djok falls back to your region's main town. The weather uses no location from your phone : you pick the town from a list.
• The routes you create: a route taken from a ride, or generated from the points you drop on the map. The trace is kept trimmed by 200 metres at each end, like a ride's; the start point and the two ends of an out-and-back are not stored, only the intermediate waypoints are.
• Safety tracking, when you turn it on: the name and phone number of up to three contacts, and your phone's position during the ride. Positions are erased when tracking ends, and tracking stops by itself after twelve hours.

Djok gives you a macronutrient target. A meal photo or a free-text description may be sent to a model to propose a list of foods; the image is not kept, and that proposal enters no counter until you confirm it. Djok therefore knows about your diet only what you have declared, never what it might have guessed.

Conversations

• Your messages to the coach and its replies, kept so the conversation has a memory

3. Purposes and legal bases

No data is sold, rented or otherwise transferred. No advertising, no ad profiling, no trackers.

4. Who receives your data

Djok relies on technical service providers. This is the complete list, what each one receives, and where it is established.

What you choose to make public

An activity can be shared through a link. The page it opens is public : it asks for no account and no password, and anyone holding the address can read it. Sharing is a deliberate act, never enabled by default, and it applies to one activity at a time.

• The link expires by itself after 24 hours, after which the address returns nothing. Its secrecy rests solely on being unguessable : an address passed on to someone else, or published, stays readable for that period.
• The track is trimmed by 200 metres around both start and finish, and this happens when the ride is recorded, not when it is displayed : those points are therefore never stored. The rest of the route does become visible.
• The page shows distance, duration, elevation gain, and average speed, power and heart rate. It shows neither the written session analysis, nor the perceived effort you logged, nor your threshold power or any figure it could be derived from.
• That page sets no cookie and runs no analytics. Its map background comes from MapTiler, which receives the viewer's IP address and the area displayed.

Transfers outside the European Union

Anthropic, Google, Resend, Twilio and Voyage AI are established in the United States. These transfers rely on the European Commission's standard contractual clauses and, where applicable, on the Data Privacy Framework. If those transfers are a problem for you, do not use Djok: they are inseparable from the service.

5. Retention

When you delete your account, your data is erased from the live database immediately. It disappears from backups within 30 days at most.

6. Security

• All traffic goes over HTTPS.
• Sign-in codes and session tokens are never stored in clear text: the database holds only a keyed cryptographic fingerprint, useless on its own.
• On iOS, your token lives in the system-encrypted Keychain, readable only while your phone is unlocked.
• The database is not exposed to the internet: it is reachable only from the application server.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time. Write to djok@castlecloud.fr: we respond within 30 days.

If you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority, the CNIL.

8. Minors

Djok is not intended for people under 16 and does not knowingly collect their data.

9. Changes

Any change to this policy will be published on this page with a new version date. A change affecting the recipients of your data will be notified in the application.