Privacy Policy

1 Data Controller

Your data is managed by:

2 Data We Collect

2.1 Apple HealthKit Data

With your explicit consent, we read the following health data from Apple HealthKit:

Activity Data:

• Step count
• Active energy burned
• Apple exercise time
• Apple stand time
• Walking/running distance
• Cycling distance

Heart Health:

• Heart rate
• Resting heart rate
• Heart rate variability (HRV)
• Walking heart rate average
• VO2 Max
• Blood oxygen saturation

Body Measurements:

• Body mass
• Body fat percentage
• Lean body mass
• Height

Sleep & Recovery:

• Sleep analysis
• Mindfulness sessions

Workouts:

• Workout history (type, duration, distance, calories, heart rate)

Characteristics:

• Biological sex
• Date of birth

2.2 User Profile Data

Information you provide directly:

• Training goals
• Personal notes
• Training plan
• AI personality preferences
• Preferred language
• Activity level

2.3 Technical Data

• Anonymous installation identifier (randomly generated)
• Subscription and purchase information
• Diagnostic logs (no personal data)

3 How We Use Your Data

3.1 Primary Purposes

• AI Coaching Personalization: Analyzing health data to generate personalized training advice
• Progress Tracking: Monitoring your progress over time
• Report Generation: Creating health and training summaries
• Subscription Management: Processing payments and entitlements

3.2 HealthKit Data

3.3 Advertisements

For free plan users:

• We display ads via Google AdMob
• AdMob may collect data per Google's Privacy Policy
• Paid plan users (Plus, Pro, Trainer Pro) see no banner ads (rewarded ads may still be available)

4 Third-Party Services

4.1 AI Providers

4.2 Apple Services

5 Device Verification & Credits System

5.1 App Attest (Device Verification)

To prevent fraud and ensure legitimate use, we use Apple's App Attest framework:

• Device authenticity is verified using Apple's Secure Enclave
• Verification occurs during TWAI backend connection setup
• A cryptographic key is generated and stored securely in the iOS Keychain
• Attestation data is sent to our server for verification

5.2 Credits System

Free tier users receive credits for AI queries:

• 3 free credits granted daily (refreshed automatically)
• Each AI query consumes 1 credit
• Additional credits can be earned by watching rewarded ads
• Credits balance is stored on our server (linked to anonymous device ID)

5.3 Server-Side Verification (SSV) for Rewarded Ads

When you watch rewarded ads to earn credits:

• Google AdMob verifies ad completion via server-to-server callback
• Credits are granted only after successful verification
• This prevents fraudulent reward claims

AdMob SSV data processed includes: anonymous user ID, reward amount, and verification signature. No personal data is transmitted.

6 Data Storage

6.1 On-Device Storage

• User profile: stored locally in UserDefaults
• Chat history: stored locally (limit depends on subscription plan)
• API keys: securely stored in Apple Keychain

6.2 Server Storage

On our servers (api.prima-software.eu) we store:

• Anonymous installation identifier
• Usage statistics (daily query count)
• Subscription plan information
• Credits balance (for free tier users)
• App Attest verification status

6.3 Retention Period

• On-device data: Until app deletion
• Server data: 90 days from last activity
• Diagnostic logs: 30 days

7 Data Security

We implement the following security measures:

• Encrypted communications (HTTPS/TLS)
• Secure API key storage in Apple Keychain
• Anonymous installation identifiers
• No permanent health data storage on servers
• App Attest device verification for fraud prevention
• Server-Side Verification (SSV) for rewarded ad integrity

8 Your Rights

Under GDPR and other data protection laws, you have the right to:

• Access: Request a copy of your data
• Rectification: Correct inaccurate data
• Erasure: Request data deletion ("right to be forgotten")
• Restriction: Limit how we use your data
• Portability: Receive data in machine-readable format
• Objection: Object to certain types of processing

To exercise these rights, contact: twai@prima-software.eu

9 Children's Privacy

TWAI is not intended for users under 17 years of age. We do not knowingly collect data from children.

10 Policy Changes

We may update this Privacy Policy. Significant changes will be communicated via:

• Updated date at the top of this document
• In-app notification (for material changes)

11 Contact

For privacy-related questions:

12 Apple App Store Compliance

This app complies with:

• Apple HealthKit Guidelines
• App Store Review Guidelines
• Apple Developer Program License Agreement