Your data is here to coach you. That’s all.

Your account: your email address and your age at sign-up (ZAVO is for ages 16 and over).

Your training profile: measurements, goal, level, frequency, equipment, and your answers to the medical questionnaire (PAR-Q). They are used solely to calibrate your plan and the health guardrails.

Your menstrual cycle and, if you declare it, your menopause status: optional, only if you turn them on or declare them (Settings → Cycle). The menopause status may come with three self-reported bone-screening answers (diagnosis, fracture, recent fall), used solely for your program's guardrails. You can simply never mention them, and change or erase them at any time.

Your activity: the sessions you log and your conversations with the coach, so your plan can evolve with you.

The contract (our Terms of Use): your account, your plans, your sessions, the chat and the coach’s weekly email. Without this data, the service simply doesn’t exist.

Your explicit consent for health data (see the next section) and for cycle tracking, which you turn on yourself.

Our legitimate interest for the minimized audience measurement described below: understanding what works so we can improve the app, nothing more.

Your PAR-Q answers and, if you turn them on or declare them, your menstrual cycle, menopause status and bone screening are health data under article 9 GDPR. We only process them with your explicit consent, collected through a dedicated checkbox during onboarding, never pre-ticked. They are used solely to calibrate your plan and the health guardrails — never for advertising, never passed to audience measurement.

You can withdraw this consent at any time: by deleting your account (Settings → Account) or by writing to privacy@zavo.fit. Without this data, ZAVO cannot generate a safe plan: withdrawing therefore closes your account.

Your data is stored with Supabase (database) on servers located in the European Union. The application itself is served by Vercel.

Some providers are located outside the European Economic Area: Vercel (application hosting), Anthropic (AI), Voyage AI (scientific search) and Resend (emails) in the United States, and Supabase’s contracting entity in Singapore (data remains stored in the European Union). These transfers are safeguarded by the European Commission’s standard contractual clauses, incorporated into the data processing agreements (DPAs) in place with each provider and, where the provider is certified, by the EU-U.S. Data Privacy Framework. You can obtain a copy of these safeguards by writing to privacy@zavo.fit or by consulting these providers’ public DPAs.

To generate your plan and answer you in the chat, your messages and the relevant parts of your profile are sent to Anthropic’s Claude API. Under the terms of that API, this data is not used to train their models. When you ask a scientific question, the text of your question is also sent to Voyage AI to search our library of studies — never your profile.

We use PostHog (hosted in Europe) to count technical events: sign-up, session completed, message sent. PostHog works without cookies (in-memory persistence), and never any cycle, health or weight data in those events. Separately, the site keeps a few functional markers in local storage (your theme, your session in progress) and, for 30 days, the channel you arrived through, never shared with advertising networks.

The coach writes you a weekly recap (sent through Resend). You can turn it off in Settings → Preferences, or through the unsubscribe link in every email. If your week is empty, it doesn’t write to you at all: no guilt-tripping, ever.

For as long as your account exists, with a cap: after 24 months without a single sign-in, we email you, and without an answer your account and all its data are deleted. When you delete your account, everything goes immediately: profile, plans, sessions, conversations, performance data. Audience measurement events (tied to a technical identifier, not to your email) are purged on request at privacy@zavo.fit.

Settings → Account → Delete my account. It is immediate and final: account, profile, plans, sessions, conversations — all of it goes.

For any question or request about your data (access, rectification, deletion): privacy@zavo.fit.

Access, rectification, erasure, portability, restriction, objection, withdrawal of consent: write to privacy@zavo.fit, answered within one month at most. If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).