RDY Back to home ↗

Legal

Privacy policy

Effective date: 15 October 2026

RDY is operated by Chris Featherstone, United Kingdom ("RDY", "we", "us" or "our").

For privacy questions or requests, contact:

Email: [email protected]

1. About this policy

This Privacy Policy explains how RDY handles personal information when you use the RDY fitness app, its Apple Watch companion features, RDY Intelligence, and RDY websites that link to this policy.

It covers information stored on your device, information you choose to connect from health and fitness services, and information processed through RDY's online services.

RDY is a fitness and training product. It is not a medical service. Readiness scores, recovery information, coaching, insights and other guidance provided by RDY are intended for general fitness and informational purposes only. They are not medical advice, diagnosis, treatment, or a determination that exercise is safe or appropriate for you.

2. Minimum age

You must be at least 13 years old to use RDY, including RDY Nutrition Coach and its nutrition-planning and coaching features. Users aged 13 to 17 may use these features; additional privacy rights or consent requirements may apply depending on where they live.

RDY is not intended for children under 13. If we become aware that a person under 13 has provided personal information to RDY, we may take steps to delete that information and restrict access to the service.

If you believe that a person under 13 has provided personal information to RDY, contact [email protected].

3. Information RDY handles

The information RDY handles depends on the features you choose to use and the permissions you grant.

Information you enter or create

This may include:

Some of this information may constitute health information or other sensitive personal information.

Health and wearable information

If you connect Apple Health (HealthKit) and grant permission, RDY may access supported health and fitness information available through Apple Health. Google Health is not currently available as a user-facing RDY connection.

Depending on the provider, your permissions and your device, this may include:

RDY only receives information that the relevant provider makes available and that you have authorised RDY to access.

RDY does not control what information your wearable device records.

Where supported and enabled by you, RDY may also write completed workouts and related workout information to Apple Health.

You can revoke Apple Health permissions through Apple Health or your device settings. Revoking access prevents future access but does not automatically delete information already imported into RDY.

RDY does not currently connect directly to Fitbit accounts. Where Fitbit information is available through another supported health platform, RDY may only receive information made available through that platform and your permissions.

Location and activity routes

If you record an outdoor activity and grant location permission, RDY may use your device's location services to record information including:

Routes may be stored as part of your activity history and may be included in exports or shareable images that you choose to create.

RDY Intelligence is designed to receive relevant training summaries rather than your full recorded GPS route unless a feature specifically requires route information and you are informed accordingly.

You can disable RDY's location permission through your device settings.

RDY account and Sign in with Apple

If you use Sign in with Apple, RDY's service verifies Apple's identity token and uses an account identifier to associate supported cloud features with your RDY account.

RDY's current account system uses Apple's subject identifier to create or associate a pseudonymous RDY identifier.

RDY does not require your Apple name or email address to be stored as a general RDY profile field unless a feature specifically asks you to provide it.

RDY Intelligence

RDY Intelligence uses artificial intelligence to provide personalised fitness insights and answer fitness-related questions.

When you use RDY Intelligence, RDY may send your message together with a limited and relevant summary of information required to provide the feature.

Depending on your request and the permissions you have granted, this may include:

RDY is designed to minimise the amount of information sent and does not intentionally send your complete health history when a smaller relevant summary is sufficient. The exact date of birth saved in your profile is not included in the Nutrition Coach profile summary; an age calculated from it may be included when you use Nutrition Coach. If you type your date of birth or other personal details into an AI conversation, that message is sent as part of the request.

AI nutrition photo estimates

If the photo-scanning feature is available and you choose to use it, the selected meal image is uploaded to RDY's authenticated backend and sent to OpenAI to estimate the visible foods and nutrition. The image and your request may reveal personal information, so only submit images you are comfortable sharing for this purpose. The estimate is a proposal: it is not added to your food diary unless you review and confirm it.

Consent for health information used by RDY Intelligence

Health and fitness information may constitute special-category personal data under UK data-protection law.

RDY will ask for your explicit consent before using health or fitness information to personalise RDY Intelligence.

This consent is separate from permissions granted to Apple Health and from your choice to use an AI feature.

You may withdraw your consent at any time through RDY's privacy settings where available or by contacting [email protected].

Withdrawing consent will not affect processing that took place lawfully before withdrawal, but RDY Intelligence may become less personalised or some features may stop working.

AI service provider

RDY uses OpenAI to process requests and generate RDY Intelligence responses.

When you use RDY Intelligence, the information described above is sent from RDY to OpenAI as necessary to provide the requested feature.

RDY uses OpenAI's API services rather than consumer ChatGPT accounts.

OpenAI processes this information as a service provider to RDY in accordance with the applicable service agreement and data-processing terms.

RDY uses OpenAI's Responses API with response storage disabled (store: false) for Nutrition Coach interview and plan requests and meal-photo estimates. This prevents those responses from being saved as API application state, but does not switch off separate abuse-monitoring logs. The main RDY Intelligence feature uses OpenAI's Agents API, which creates an OpenAI-hosted session and retains session state. That session data is not covered by the store: false setting. OpenAI does not use API data to train its models by default, and RDY's OpenAI data-sharing controls are currently disabled. See Sections 7–9 for location and retention details.

RDY memories

RDY may allow you to save information that helps personalise future RDY Intelligence responses, such as training goals, preferences or relevant fitness context.

Where cloud synchronisation is enabled, these memories may be stored under your pseudonymous RDY account identifier.

You can review, change or delete supported RDY memories using the controls provided in RDY.

Google Health availability

Although RDY contains development work for a Google Health integration, that connection is disabled and is not offered to users. RDY currently receives user-connected health data through Apple Health only. This policy will be updated before any additional health-provider connection is made available.

Purchases and subscriptions

Purchases and subscriptions are processed by Apple through the App Store.

RDY may receive information such as:

RDY does not receive your full payment-card details from Apple.

Technical and service information

RDY and its service providers may process limited technical information necessary to operate, secure and troubleshoot the service.

This can include:

RDY does not currently use health or fitness information for advertising.

Analytics and crash reporting

The RDY app currently uses Google Firebase Analytics and Firebase Crashlytics in app builds configured for those services. Analytics records screen views and events about how features are used, such as onboarding, workouts and activities, readiness, AI and nutrition features, and subscriptions. Event details are generally categorical or limited counts—for example, activity type, feature, readiness-data availability, scan confidence or number of estimated food items. When you are signed in, Analytics may use a pseudonymous RDY account identifier; it also receives limited status properties such as account, subscription, health-provider and Watch-availability states.

Crashlytics collects crash diagnostics such as stack traces, app and operating-system versions, device details, timestamps and installation identifiers. RDY may attach the current screen, signed-in/anonymous state and Watch availability to a crash report. RDY does not intentionally put full AI messages, meal photos, workout notes, routes or exact health measurements into Analytics event parameters or Crashlytics custom keys. Automatic screen reporting and IDFV collection are disabled; RDY sends its own screen-view events.

Website delivery and traffic data

The RDY website is delivered through Cloudflare Pages. Cloudflare may process visitors' IP addresses, requested URLs, browser and device details, referrers, timestamps and routing or security metadata to deliver and protect the site and provide traffic analytics. The RDY website does not currently load third-party advertising or analytics scripts.

4. How RDY uses information

RDY may use personal information to:

RDY does not sell personal information.

RDY does not use HealthKit information or other health and fitness information for targeted advertising or advertising profiles.

5. Legal bases for processing

Where UK data-protection law applies, RDY relies on different lawful bases depending on the purpose for which information is processed.

Providing the RDY service

Where processing is necessary to provide features you have requested, RDY may rely on processing that is necessary for the performance of a contract or to take steps at your request before entering into a contract.

This may include account functionality, workout storage, subscriptions, Premium features and other core RDY services.

Consent

RDY relies on your consent where you have a genuine choice about whether particular processing takes place.

This may include:

Where RDY processes health or other special-category information using consent, RDY relies on your explicit consent for the relevant special-category processing.

You may withdraw consent at any time.

Legitimate interests

RDY may process limited information where necessary for legitimate interests such as:

Where RDY relies on legitimate interests, those interests are considered against your privacy rights.

Legal obligations

RDY may process or retain information where necessary to comply with applicable legal obligations.

6. When RDY shares information

RDY only shares information where necessary to operate the service, where you direct RDY to share information, or where disclosure is legally required.

Service providers and platforms used by RDY may include:

Apple

Apple provides services including:

Apple processes information according to its own privacy terms and agreements with developers.

Google Cloud and Firebase

Google provides RDY's Google Cloud backend and database infrastructure, as well as Firebase Analytics and Crashlytics for app usage measurement and crash diagnostics. Google Health is not currently enabled for RDY users.

Cloudflare

Cloudflare provides website hosting, content delivery and security services, and may process the website request and technical information described above.

Nutrition information providers

These providers handle information under their own privacy terms.

OpenAI

OpenAI processes information necessary to generate RDY Intelligence responses.

RDY sends only the information reasonably required for the relevant AI request.

WorkoutX

RDY may use WorkoutX to retrieve exercise instruction or exercise-media content.

The integration is designed to request content using an exercise or content identifier rather than sending your health profile.

Legal requirements

RDY may disclose information if reasonably necessary to comply with a legal obligation, court order or lawful request, or to protect the rights, safety or security of RDY or others.

Sharing initiated by you

If you use RDY's sharing or export features, information you choose to share may be passed to apps, services or people you select through your device's sharing tools.

RDY is not responsible for how a recipient you choose subsequently uses information you share with them.

7. Where information is stored and processed

Much of RDY's information is designed to remain on your device.

This may include:

Apple Health records remain within Apple Health and are accessed according to the permissions you grant.

Some information required for online functionality may be stored or processed by RDY's cloud services.

RDY's primary production backend is hosted using Google Cloud in the europe-west2 region in London, United Kingdom.

Cloud information may include:

RDY Intelligence and AI nutrition requests, including meal images when you choose photo scanning, are processed by OpenAI. The OpenAI Agents API used by RDY Intelligence currently supports data residency only in the United States and does not support Zero Data Retention. Firebase Analytics and Crashlytics operate on Google's global infrastructure. Cloudflare also provides services through its global network. These providers may process information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, RDY will use applicable lawful transfer mechanisms provided through its service-provider arrangements, such as recognised adequacy arrangements or approved contractual safeguards.

8. Retention

RDY keeps personal information only for as long as reasonably necessary for the purpose for which it is being processed.

Information stored on your device

Locally stored RDY information generally remains on your device until:

Device or cloud backups controlled by your operating system may retain copies in accordance with your device and backup settings.

Cloud account information

When you request deletion of your RDY account or cloud information, RDY will delete the associated active cloud information promptly, subject to technical processing time and any information that must reasonably be retained for legal, security, fraud-prevention or dispute-resolution purposes.

Residual information may temporarily remain in secure backups until those backups are overwritten or expire through normal backup-management processes.

RDY will not keep deleted account information in active systems merely for future commercial use.

Health-provider connections

Apple Health access is controlled by the permissions you grant on your device. RDY does not currently maintain a user-facing Google Health connection or Google Health connection tokens.

Information held independently by Apple, Google or another provider must be managed through that provider's services.

Analytics, crash and infrastructure diagnostics

In the RDY Production Analytics property, event-level data is currently set to a 2-month retention period and user-level data to 14 months, with the user-level period reset by new activity. Google's retention controls do not affect most standard reports based on aggregated data, which may remain available longer.

Firebase Crashlytics keeps crash stack traces and associated identifiers for 90 days before starting removal from its live and backup systems. Google Cloud Logging in RDY Production is configured for 30 days in its default log bucket and 400 days in its required audit-log bucket. These logs may contain request, security, operational and error metadata; RDY's backend is configured to redact request bodies and authentication credentials from application logs.

OpenAI's standard abuse-monitoring logs may retain API prompts, responses and related metadata for up to 30 days, subject to legal or security exceptions. For Nutrition Coach and meal-photo requests, RDY uses store: false so response objects are not saved as API application state; this does not prevent abuse-monitoring logs.

RDY Intelligence uses the OpenAI Agents API, which retains session state so a session can be continued and is not eligible for Zero Data Retention. The OpenAI documentation reviewed does not specify a fixed automatic expiry for this session state, and RDY's current backend does not implement a call to delete these sessions. RDY therefore cannot currently provide a fixed retention period or guarantee deletion of RDY Intelligence session content through its account-deletion controls.

Cloudflare's website analytics may retain traffic and security analytics for at least 31 days, depending on the dataset and account plan. Cloudflare says detailed HTTP request logs are not retained by default; retention can differ if account settings or products enable it.

9. Deleting your information

You can delete locally stored RDY information through RDY's privacy and data controls.

Where available, you may also use RDY's Delete Account / Delete RDY Data controls to request deletion of cloud information associated with your account.

You can also request deletion by contacting:

[email protected]

RDY may need to verify that the request relates to your account before deleting cloud information.

Deleting your RDY account does not currently delete OpenAI Agents API sessions created by RDY Intelligence. RDY does not currently provide an automated way to identify and delete those session records. See Section 8.

You can revoke Apple Health permissions through Apple's settings. RDY does not currently offer a Google Health connection to disconnect.

Deleting RDY information does not automatically delete information independently held by Apple, Google or another service provider.

10. Your privacy rights

Depending on where you live and the law that applies, you may have rights regarding your personal information.

These may include the right to:

In the United Kingdom, you have the right to complain to the Information Commissioner's Office (ICO).

You can exercise your rights by contacting:

[email protected]

We may need to verify your identity before responding to a request.

Withdrawing consent does not affect processing that occurred lawfully before consent was withdrawn.

11. Security

RDY uses reasonable technical and organisational measures designed to protect the information it handles.

Measures may include:

No electronic system can be guaranteed completely secure.

Users should also protect their device, Apple account, Google account and other connected accounts.

12. Health information and RDY Intelligence

RDY Intelligence is designed to support fitness, training and recovery decisions.

It should not be relied upon as a replacement for advice from a doctor or other qualified healthcare professional.

Do not use RDY Intelligence to diagnose or treat a medical condition.

If you experience symptoms that concern you, feel unwell, or believe you may require medical attention, seek appropriate professional healthcare advice.

13. Children and younger users

RDY's minimum age is 13. People aged 13 to 17 may be treated as children under applicable data-protection laws, so RDY aims to present privacy choices and permissions in clear, understandable language.

The minimum age of 13 applies to nutrition, coaching and other RDY features. Users aged 13 to 17 may use RDY, but may be treated as children under applicable data-protection laws. RDY does not knowingly permit children under 13 to create or use an RDY account.

If RDY learns that it has processed information relating to a user under 13, RDY may delete the information and take appropriate steps to prevent further use.

14. Changes to this policy

RDY may update this Privacy Policy when its features, service providers, technology or legal obligations change.

The current version will be made available through RDY and at:

https://rdyfitness.app/privacy

The effective date at the top of this policy will be updated when changes are made.

Where required by law, RDY will provide additional notice or obtain consent before making a material change to how personal information is used.

15. Contact

The data controller for RDY is:

Chris Featherstone
Operator of RDY
United Kingdom

Email: [email protected]