Privacy Policy

Basecurve ("the app", "we", "us") is a personal cardio training tracker operated as a non-commercial personal project by an individual based in Sweden. This policy explains what data we collect when you use basecurve.app, why we collect it, and the rights you have over it.

We are the data controller for the personal data described below. Because Basecurve is run by a private individual rather than a registered company, we ask for your understanding that some formal contact channels are limited. You can always reach us at privacy@basecurve.app.

What we collect

• Account data: your email address and a securely hashed password, handled by our backend provider (see "Where your data lives").
• Fitness data you log: activities you record (sport, date, duration, distance, heart rate, perceived effort, notes) and profile preferences (max heart rate, heart-rate zones, week start day, unit system).
• Minimal technical data: session tokens, basic request metadata, and server logs needed to keep the service running and secure.

We do not use third-party analytics, advertising trackers, or tracking cookies. We do not build profiles about you and we do not sell or share your data.

Why we use it

• To create and authenticate your account.
• To store your activities and preferences so you can see your training over time.
• To keep the service secure and operational (e.g. preventing abuse, debugging errors).

Under the GDPR, our legal bases are: contract (Art. 6(1)(b)) for running the app you signed up to, legitimate interests (Art. 6(1)(f)) for basic security and operations, and your explicit consent (Art. 9(2)(a)) for any health-related data such as heart rate that you choose to log.

Where your data lives

Basecurve runs on Lovable Cloud, our backend and hosting provider. Your data is stored in a managed Postgres database, encrypted at rest and in transit. Access is enforced at the database level so that one user can never read or modify another user's rows. Lovable Cloud is our only sub-processor.

Depending on the Lovable Cloud region, your data may be processed inside or outside the EEA. Where data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

How long we keep it

We keep your data for as long as your account exists. When you delete your account from the Profile screen, your account and all associated activities and preferences are removed from our systems immediately and permanently. There is no grace period and we cannot recover deleted data.

Backups maintained by our hosting provider may retain a copy for a short additional period before they roll over.

Cookies and local storage

We only use storage that is strictly necessary for the app to work: an authentication token so you stay signed in, and small preferences such as your theme. We do not set analytics or advertising cookies and we don't use a cookie banner because there is nothing to opt out of.

Your rights in the EU/EEA (GDPR)

• Access a copy of your data.
• Rectify inaccurate data — most fields are editable directly in the app.
• Erase your data — use "Delete account" in your Profile, or contact us.
• Restrict or object to certain processing.
• Portability — request an export of your activities.
• Withdraw consent at any time, without affecting prior processing.
• Lodge a complaint with your local supervisory authority. In Sweden this is the Swedish Authority for Privacy Protection (IMY) — imy.se.

Your rights in California (CCPA/CPRA)

If you are a California resident you also have the right to:

• Know what personal information we collect and how it is used.
• Request deletion of your personal information.
• Correct inaccurate personal information.
• Receive a copy of your personal information in a portable format.
• Not be discriminated against for exercising any of these rights.

We do not sell or share personal information as those terms are defined under California law, and we do not use it for cross-context behavioural advertising.

Children

Basecurve is not directed to children under 16 and we do not knowingly create accounts for them. If you believe a child has signed up, please contact us and we will delete the account.

Security

We rely on our backend provider's industry-standard security: TLS in transit, encryption at rest, hashed passwords, and row-level access policies. No system is perfectly secure — please use a strong, unique password.

Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top reflects the most recent change. Material changes will be communicated in-app before they take effect.

Contact

Questions, requests, or concerns? Email privacy@basecurve.app.