Privacy Policy

1. Introduction

freediver.club (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our freediving tools and services.

2. Information We Collect

2.1 Personal Information

We may collect personal information that you voluntarily provide to us, including:

• Name and email address (if you create an account)
• Profile information and preferences
• Workout plans, training sessions, and related training data you create or import
• Physiological measurements you choose to record, such as heart rate and blood oxygen saturation (SpO2)
• Communications with us
• Feedback and survey responses

2.2 Automatically Collected Information

When you visit our website, we automatically collect certain information, including:

• IP address and device information
• Browser type and version
• Pages visited and time spent on pages
• Referring website
• Usage patterns and interactions with our tools

3. How We Use Your Information

We use the collected information for the following purposes:

• Provide and maintain our freediving tools and services
• Improve and personalize your experience
• Analyze usage patterns to enhance our platform
• Communicate with you about updates and features
• Ensure security and prevent fraud
• Comply with legal obligations

4. Physiological Data from Workouts and Devices

freediver.club can record heart rate (HR) and blood oxygen saturation (SpO2) during your training. This is health data, and we treat it accordingly.

4.1 Sources

It reaches us only through a source you switch on yourself:

• Dive and workout files you upload, or that sync from a wearable account such as Garmin or Suunto once you have authorized it
• Freediver, our app for iPhone, Android, and the web, or Freediver - watch on Apple Watch, when you record a workout signed in to your account
• Heart-rate straps and pulse oximeters you pair directly with the app

4.2 What We Store

Heart rate and SpO2 readings over time, the pulse rate and signal-quality values a pulse oximeter reports alongside them, and the name, model, and identifier of the recording device, so a series can be attributed to the sensor that produced it. Workout counts, lap and break times, and anything else the device manufacturer provides are stored with the workout as before.

4.3 Legal Basis

Heart rate and SpO2 are a special category of personal data under Article 9 of the GDPR. We process them on your explicit consent, given when you pair a sensor, install one of our apps, upload a file, or authorize a wearable account. You can withdraw it at any time by disconnecting that source or deleting the data; withdrawal stops all future collection and does not affect processing already carried out.

4.4 What We Do With It

We use it to show you your own training, and to show the same to a coach or buddy you have shared the workout with. We never sell or rent it, never use it for marketing, advertising, or profiling, never use it to train AI or machine-learning models, and never disclose it to insurers, employers, or data brokers. The only outside parties that touch it are the hosting and storage providers listed below, which hold it on our instructions.

4.5 Who Can See It

Instructors at a training center you have joined see the physiological data on the workouts you shared with them, and buddies see it on the workouts you share with them. Either access ends when you leave the center or remove the buddy connection. An AI assistant you have connected yourself reads it under the same rules.

Consumer heart-rate and SpO2 sensors are not medical devices, and freediver.club is not a safety or monitoring system — read our Terms of Service before relying on a reading.

5. Third-Party Services and Data Processing

We use several third-party services to operate our platform. Each service processes your data according to their own privacy policies and our agreements with them:

5.1 Auth0 (Authentication and Authorization)

Our authentication, authorization, and login credentials are handled by Auth0, a third-party identity management service operated by Auth0, Inc. When you create an account or log in to our platform:

• Auth0 processes your login credentials and authentication data
• Auth0 manages user sessions and access tokens
• Auth0 handles password security and account recovery
• Auth0 may collect additional information as outlined in their Privacy Policy

Auth0's collection and processing of your authentication data is governed by their own Privacy Policy and Terms of Service. We recommend reviewing Auth0's privacy practices at https://auth0.com/privacy.

5.2 Google Cloud Platform (Hosting and Data Processing)

Our website is hosted on Google Cloud Platform (GCP), a cloud infrastructure service operated by Google LLC. GCP processes your data in the United States and may collect:

• IP addresses and request logs
• Performance and error data
• Usage analytics for service optimization

Google Cloud's data processing is governed by their Privacy Policy available at https://cloud.google.com/terms/cloud-privacy-notice.

5.3 PlanetScale (Data Storage)

We use PlanetScale, operated by PlanetScale, Inc., for data storage and database services. Your data is stored in databases located in the United States and may include:

• User account information and preferences
• Workout data and training records
• Application settings and configurations
• Usage data and analytics

PlanetScale's data processing is governed by their Privacy Policy available at https://planetscale.com/legal/privacy.

5.4 Amplitude (Data Tracking and Analytics)

We use Amplitude, operated by Amplitude Inc., to track website usage and analyze user behavior. Amplitude may collect:

• Page views and navigation patterns
• User interactions and engagement metrics
• Feature usage and tool interactions
• Device and browser information

Amplitude uses cookies and similar technologies. Amplitude's data processing is governed by their Privacy Policy available at https://amplitude.com/privacy.

5.5 Google Analytics (Website Analytics)

We use Google Analytics, operated by Google LLC, to collect and analyze website usage data. Google Analytics may collect:

• Page views and session duration
• Traffic sources and user demographics
• Device and browser information
• User behavior and interaction patterns
• Geographic location data (at country/region level)

Google Analytics uses cookies and similar technologies to collect this information. Google's data processing is governed by their Privacy Policy available at https://policies.google.com/privacy. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

6. Connected Services (AI, MCP, and Third-Party Integrations)

freediver.club provides integrations via the Model Context Protocol (MCP) to securely connect AI assistants (such as ChatGPT), as well as connections to third-party fitness tracking services.

6.1 AI Extension Data Boundaries & Minimization

To protect your privacy when using connected AI assistants, we strictly enforce the following boundaries:

• Data Minimization: We request and process only the absolute minimum information necessary to execute the tools or actions you authorize.
• No Chat Logging: We do not pull, reconstruct, store, or infer your full chat logs or conversational histories from any AI client.
• No Restricted Data: We never collect, process, or request Payment Card Information (PCI DSS), Government IDs, or authentication secrets via our AI integrations. Physiological training data is returned only to an assistant you have connected yourself, and only for workouts the requesting account may already see.
• Response Minimization: We return only the requested data to the AI. We do not inject unnecessary diagnostic telemetry, session IDs, or hidden tracking tags.
• No Surveillance: We do not engage in surveillance, tracking, or behavioral profiling based on your AI prompts or usage patterns.

6.2 AI Access Controls

• Explicit Authorization: Connecting an AI assistant requires completing an OAuth flow. You must review and grant explicit permission before any data is sent or received.
• Strict Scoping: Access tokens are strictly limited to your own account data.
• Revocable Defaults: You can instantly revoke all AI connections at any time via your Profile → Connected Services page. Revocations take effect immediately.

6.3 Training Center Coaching Access

A training center can only read your data through MCP if both of the following are true:

• You are an active athlete at that training center within freediver.club.
• You have explicitly enabled MCP Coaching Access for that training center in your Profile → Connected Services page.

This toggle is off by default. Turning it on grants the training center read access to your training data (workouts, dive logs, recorded heart rate and SpO2 series, and related metrics) solely for coaching purposes. You can turn it off at any time and access is revoked immediately.

6.4 User-Controlled External Service Integrations

freediver.club integrates with external services such as Garmin and Suunto to sync your workout data. All such integrations are entirely opt-in and under your control:

• You must explicitly authorize each external service before any data exchange takes place
• A full list of your currently authenticated external services is available in your Profile → Connected Services page
• You can revoke access to any connected service at any time from that same page — revoking access immediately stops all future data synchronization with that service
• We only request the minimum data permissions required to provide the integration features you have chosen to enable

Data received from external services (e.g., dive logs, heart rate and SpO2 data, workout summaries) is stored in your account and used solely for your personal workout analysis within freediver.club.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and analyze website usage. These technologies help us:

• Remember your preferences and settings
• Analyze website traffic and usage patterns
• Provide personalized content and recommendations
• Improve our services and user experience

You can control cookie settings through your browser preferences. However, disabling certain cookies may affect the functionality of our website.

8. Information Sharing and Disclosure

We do not sell, trade, or otherwise transfer your personal information to third parties, except in the following circumstances:

• With your explicit consent
• To comply with legal obligations or court orders
• To protect our rights, property, or safety
• With the service providers described above — Auth0, Google Cloud Platform, PlanetScale, Amplitude, and Google Analytics — which operate the platform under strict confidentiality agreements and may not use your data for their own purposes

9. Data Retention

Your personal data is retained for as long as you hold an active account with freediver.club. You can delete your account at any time from your Profile page. Once account deletion is initiated, all personal information — including your profile, workout records, and Auth0 authentication profile — is erased automatically.

Physiological data follows the workout it belongs to: you can delete an individual heart rate or SpO2 series, delete the workout to remove every series on it, or delete your account to erase all of it. We keep no separate archive once the workout is gone.

Anonymised usage and behaviour data (collected via Amplitude and Google Analytics) is not linked to your account and is not removed upon deletion, as it contains no personally identifiable information.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

11. Your Rights and Choices

Depending on your location, you may have the following rights regarding your personal information:

• Access and review your personal information
• Correct inaccurate or incomplete information
• Delete your account and personal data — available directly from your Profile page. See Section 9 for details on what is removed.
• Object to or restrict processing of your information
• Data portability — you can request a structured export of your data via API access. To make this request, contact us at hello@freediver.club.
• Withdraw consent at any time — including consent to record heart rate and SpO2, by disconnecting that source and deleting what it recorded

To exercise any of the above rights, contact us at hello@freediver.club.

12. Children's Privacy

Our services are not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately.

13. International Data Transfers

Your information may be transferred to and processed in countries other than your own. We ensure that such transfers comply with applicable data protection laws and implement appropriate safeguards to protect your information.

Specifically:

• Google Cloud Platform: Processes data in the United States
• PlanetScale: Stores data in the United States
• Amplitude: Processes data in the European Union (EU) for GDPR compliance
• Google Analytics:Processes data globally in accordance with Google's data processing terms

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy on this page and updating the “Last updated” date. Your continued use of our services after such changes constitutes acceptance of the updated policy.

15. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us:

Changelog