Privacy Policy

This Privacy Policy explains how Highmoon Works Inc. ("Highmoon", "we", "us", or "our") collects, uses, shares, and protects personal data in connection with Train Fondo (the "Service"). It works alongside two related documents: our Consumer Health Data Privacy Policy, which governs consumer health data under US state law, and our Cookie Policy. Where this policy and the Consumer Health Data Privacy Policy both address health data, the Consumer Health Data Privacy Policy controls.

We are the controller of the personal data described here. We are not a healthcare provider and not a HIPAA covered entity.

1. Contact

Highmoon Works Inc.
131 Continental Drive, Suite 305, Newark, DE 19713, United States
Email: privacy@highmoonworks.com.

2. The data we collect

We collect only what the Service needs:

• Account data: name, email, password (stored only as a hash), and your age (we store age or birth year, not a full date of birth).
• Profile and body data: sex, height, and body-weight entries.
• Activity and fitness data: entered by you or derived from files you upload, including duration, distance, elevation, grade, speed, power, heart rate, cadence, and computed training load. When you upload an activity file we derive these metrics and discard the precise GPS coordinates; we do not store your location or routes.
• Training and nutrition data: your goals, planned sessions, logged meals and fueling, dietary preferences and intolerances, and the recommendations the Service generates.
• Check-ins and injuries: sleep, energy, soreness, stress, session feedback, and any injury notes you enter.
• Billing data: subscription status and identifiers from our payment processor. We do not store full card numbers; the processor handles payment details.
• Technical data: IP address and device or browser information, and the IP and user-agent recorded when you accept our terms and consents, for security and legal-record purposes.

We do not collect or store reproductive or menstrual health data, and we do not collect or store blood-marker or laboratory values.

3. Why we use it, and our legal bases

We use the data to provide and operate the Service: to generate and adjust your plan, create and secure your account, process your subscription, provide support, and comply with law. For users in the EEA and UK, our legal bases are: performance of our contract with you (account, plan, billing); your explicit consent (for health and health-adjacent data); our legitimate interests (security, service integrity, and improving the Service); and legal obligation (for example, billing records). You can withdraw consent at any time.

4. Automated recommendations

The Service uses automated means to generate individualized training and nutrition recommendations from the data you provide. These recommendations are general information for you to consider and act on at your discretion; they are not decisions imposed on you and are not medical or dietetic advice. You can contact us for information about how a recommendation was produced, and, where applicable law gives you the right, to request human review.

5. How we share data, and how we do not

We do not sell your personal data and do not share it for advertising or cross-context behavioral advertising. We share data only with service providers that process it on our behalf under contract, and only to run the Service:

• Hosting and infrastructure provider.
• Payment processor (billing).
• Email provider (account and service emails).
• Error-monitoring and operational tooling, where strictly necessary.
• Analytics provider (Google Analytics), on our public marketing site only and only if you accept analytics cookies. It is not used in the signed-in app, and we keep health data out of it.

We may also disclose data to comply with law or lawful requests, to protect our rights and the safety of others, and in connection with a corporate transaction (in which case this policy continues to govern the data).

6. International data transfers

We are a United States company, but we host the Service and store your personal data in the European Union (France). If you are in the EEA or UK, your data stays within the EU for storage and is not transferred out of the EU for that purpose. Some of our service providers are based in the United States (for example, our payment processor); where your data is processed by them, that transfer relies on their EU-US Data Privacy Framework certification and, where applicable, the European Commission's Standard Contractual Clauses. Because we are a United States company, United States law may in some circumstances allow United States authorities to request data we control, regardless of where it is stored.

7. Retention

We keep your data while your account is active and as needed to provide the Service and to meet legal, tax, and accounting obligations. When you delete your account, we delete your data from our active systems and instruct our service providers to delete it, and it is removed from backups within our backup rotation cycle. We may retain limited records where the law requires.

8. Security

We protect your data using commercially reasonable technical and organizational measures, including hashed passwords and encrypted connections. No method of storage or transmission is perfectly secure, so we cannot guarantee absolute security, and you are responsible for keeping your credentials confidential.

9. Your rights and how to use them

Depending on where you live, you may have the right to access, export, correct, delete, restrict, or object to the processing of your data, and to withdraw consent. You can export or delete your data in the app under Settings, then Account, and you can exercise any other right by emailing privacy@highmoonworks.com. We will respond within the time the law requires and may need to verify your identity. Deleting your data or withdrawing consent will end our ability to provide the Service, since it depends on that data.

10. Cookies

In the signed-in app we use only strictly-necessary cookies and browser storage to keep you signed in and remember basic preferences. On our public marketing site we also use Google Analytics, but only if you accept it: it is off by default, gated behind a cookie banner, and we honor the Global Privacy Control signal as a decline. Analytics never runs inside the app, and we keep health data out of it. See our Cookie Policy for details.

11. Children

The Service is for adults. It is not directed to anyone under 18, and we do not knowingly collect data from anyone under 18. If we learn we have, we will delete it. If you believe a minor has provided us data, contact privacy@highmoonworks.com.

12. Notice to California residents

This section applies to California residents under the CCPA, as amended by the CPRA.

Categories collected in the last 12 months: identifiers (name, email, IP address); customer-records data (physical characteristics such as height and weight); commercial information (subscription records); internet activity (limited technical data, and, on our marketing site with your consent, analytics); and sensitive personal information in the form of health and exercise data. We collect these from you, from files you upload, and from our service providers.

Purposes: to provide and secure the Service, process billing, provide support, and comply with law, as described above.

Sale and sharing: we do not sell personal information and do not share it for cross-context behavioral advertising.

Sensitive personal information: we use it only to provide the Service you requested and for permitted purposes, so the right to limit its use does not give you additional rights here; we do not use it to infer characteristics for other purposes.

Your rights: to know/access, delete, correct, and opt out of sale or sharing (not applicable, since we do neither), and not to be discriminated against for exercising your rights. Exercise them in the app or at privacy@highmoonworks.com. We honor the Global Privacy Control.

13. Notice to residents of the EEA and UK

If you are in the EEA or UK, the GDPR and UK GDPR give you the rights to: access your data and information about how we process it; rectify inaccurate data; erase your data; restrict processing; object to processing; data portability; and withdraw consent at any time (without affecting processing before withdrawal). Our legal bases are in Section 3, our transfer safeguards in Section 6. You may exercise your rights by contacting privacy@highmoonworks.com, and you have the right to lodge a complaint with your local supervisory authority (data protection authority).

14. Changes

We may update this policy. For material changes we will provide additional notice, such as an in-app notice or email, and post the updated policy here with a new effective date.

15. Contact

Highmoon Works Inc.
131 Continental Drive, Suite 305, Newark, DE 19713, United States
privacy@highmoonworks.com