Privacy Policy

Last updated: October 2, 2026

Overview

This Privacy Policy explains how Mavr collects, uses, shares, and protects information when you use our services. Where processing requires consent, including certain health-data processing, we ask for it separately.

Controller

Branvang, a business established in Belgium and trading as Mavr, is the data controller for your personal information. For anything about privacy, including requests about your data, contact us at info@mavr.app. You may lodge a complaint with your local data protection authority or the Belgian Data Protection Authority (www.dataprotectionauthority.be, contact@apd-gba.be).

Information We Collect

  • Account information: email, authentication identifiers, subscription status, and acceptance of Terms (version and timestamp).
  • Health, fitness, and nutrition data: body measurements, age, sex used for nutrition reference values, training plans and completed workouts, food and hydration entries, recovery check-ins, allergies and dietary restrictions, and derived nutrition, fueling, glycogen, recovery, and training-load estimates. We do not collect pregnancy or menstrual-cycle information.
  • Connected-service data: information you choose to import from services such as Apple Health, Garmin, Strava, TrainingPeaks, intervals.icu, or Runna, subject to the permissions you grant there. From Apple Health we read only workouts, active energy, heart rate, distance, steps, weight, body fat, lean body mass, and water. From Garmin we receive completed activities and, where you allow it, daily summaries (steps, calories, resting heart rate) and sleep (duration, sleep stages, and sleep score).
  • Approximate location: only if you allow it, and only while you use the app. We round it to about 1 km and use it to look up the weather for a workout. We do not store your coordinates; we keep the weather result and a general place label, such as your time zone.
  • AI feature data: prompts, conversations, files or images you submit, relevant profile context supplied to the AI feature, generated responses, and safety or quality metadata.
  • Device and usage data: IP address, device and app version, push notification token, crash reports, and basic usage counts on our website, for security, reliability, and to send the notifications you allow.

How We Use Information

  • To provide, maintain, and improve the service
  • To authenticate users, prevent fraud, and ensure security
  • To calculate personalized nutrition, hydration, fueling, training, and recovery information
  • To provide AI-assisted nutrition coaching and identify safety limitations
  • To sync data from services you choose to connect
  • To send notifications you allow; offers and discounts only if you switch them on
  • To communicate with you about updates and support
  • To comply with legal obligations

Lawful Bases (EEA/UK/CH)

  • Contract: to provide and support the service you request
  • Legitimate interests: service security, product improvement, limited analytics
  • Consent: marketing messages where required
  • Explicit consent under GDPR Article 9(2)(a): processing health, fitness, allergy, recovery, and related inferred data for personalized nutrition, training and recovery analysis, connected-health features, and AI nutrition coaching
  • Legal obligations and, where necessary, vital interests

Health Data and Consent

Health and fitness information can be sensitive. Before personalized health-data processing begins, we ask for a separate affirmative consent tied to the current Health Data Notice. You may withdraw that consent in the app under Settings, Health data, or from the paywall menu. Withdrawal stops syncs, AI features, and health notifications and signs you out. If you do not consent again within 30 days, we delete your account and its data. Withdrawal does not affect processing that was lawful before it. See our Health Data Notice for categories, purposes, sources, recipients, and consumer-health-data rights.

Garmin Data

If you choose to connect Garmin Connect, Mavr receives the Garmin user identifier and OAuth credentials needed to maintain the connection, together with completed-activity data made available through the Garmin Connect Activity API. Depending on the activity, this may include its identifier, name, sport type, date and start time, duration, distance, calories, heart-rate measurements, and Garmin device model. Where you allow it, we also receive daily summaries (steps, total and active calories, resting heart rate) and sleep data (sleep duration, deep, light and REM sleep, and sleep score).

We use Garmin data to synchronize completed activities, match them to planned Mavr workouts, display workout history, and calculate personalized nutrition, hydration, fueling, training, and recovery information. When you use AI-assisted features, the minimum relevant Garmin-derived workout context may be included in the information processed to generate your requested guidance.

Garmin data and connection records are stored in our Supabase-hosted database and processed by our Railway-hosted application services. Connection tokens are stored encrypted. Relevant workout context may be processed by Google Gemini or OpenAI when an AI-assisted feature requires it. These providers act as contracted processors and are listed on our Sub-processors page. We do not sell Garmin data or use it for advertising.

Garmin data is retained while your account is active in accordance with the retention periods below. Disconnecting Garmin removes Mavr's authorization credentials and stops new Garmin imports. You may also request deletion of stored data or delete your Mavr account; active data is then removed or de-identified within 30 days unless a longer period is legally required, while encrypted backups may persist for up to 90 additional days before cycling out.

AI and Automated Outputs

Some features use AI or rules to generate nutrition and training information. We may send the minimum relevant profile and conversation context to our contracted AI providers, OpenAI and Google Gemini. They don't use it to train their models, and we ask them not to store requests where their API allows it. Workouts that come from Strava are never sent to an AI provider. Outputs may be incomplete or inaccurate and are presented as AI-generated or automated guidance. Mavr does not use these outputs to make decisions that produce legal or similarly significant effects about you.

Sharing of Information

We do not sell your personal information. We share it with service providers that process it on our behalf under contract (hosting, database, AI, crash reports, push notifications, and subscriptions). Services you connect (such as Garmin or Strava) receive data only when you ask for a sync or feature that needs it. A few services receive only limited technical data: Open-Meteo gets rounded coordinates to return the weather; Open Food Facts gets the barcode or search you look up, and your device loads food photos from it; and on our website, map tiles on race course pages load from Esri, which sees your IP address. We may disclose information if required by law or to protect rights, property, and safety.

Our current sub‑processors are listed at /legal/subprocessors.

Data Retention

We keep account and health-feature data while your account is active, with these exceptions: a Coach Kai conversation is deleted 12 months after its last message, and an account whose health-data consent was withdrawn is deleted 30 days later unless you consent again. When you delete your account in the app, we delete it and its data straight away, disconnect your connected services, and delete your photos and feedback screenshots. After a deletion request by email, we do the same within 30 days. Encrypted backups may keep a copy for up to 90 more days before they cycle out. Records of your consent and Terms acceptance are kept while your account exists and are deleted with it. Payment records are kept by Apple, and by us only where tax law requires it. You may ask us how long a specific category is kept.

Security

We use reasonable administrative, technical, and physical safeguards to protect information. No method of transmission or storage is completely secure.

Your Rights (EEA/UK/CH)

  • Access, rectification, erasure, restriction, and portability (you can delete your account in the app; for a copy of your data, email us)
  • Object to processing based on legitimate interests and to direct marketing
  • Withdraw consent at any time where processing is based on consent
  • Lodge a complaint with your supervisory authority

Cookies and Tracking

Our website does not use advertising or tracking cookies, so it shows no cookie banner. We count visits with cookieless analytics (Vercel Web Analytics). On our calculators we may also count anonymous usage events without cookies, using a random ID that lasts for one page visit, with the IP address removed. We may store small, strictly necessary settings in your browser, such as whether you have seen a notice. If we ever add non-essential cookies, we will ask for your consent first where the law requires it.

Your Choices

  • Access, update, or delete your account data
  • Turn notifications on or off in your iPhone settings, and offers and discounts in the app
  • Connect or disconnect services such as Apple Health, Garmin, or Strava at any time

Regional Notices

United States (state privacy and consumer-health laws): We collect identifiers, commercial information, internet activity, health and fitness information, and inferences to operate and secure the service and provide requested features. We disclose information to processors for those purposes. We do not sell personal or consumer health data and do not share it for cross-context behavioral advertising. California residents may request access, deletion, and correction; Washington and Nevada residents may exercise consumer-health-data rights described in our Health Data Notice. Contact info@mavr.app.

Brazil (LGPD): We process data under LGPD legal bases including contract performance, legitimate interests, legal obligations, and consent where required. You may request confirmation, access, correction, anonymization/blocking/deletion of unnecessary or excessive data, portability, information on sharing, and revoke consent.

Canada (PIPEDA): We collect, use, and disclose personal information for specified purposes with your knowledge and consent, except where permitted by law. You may request access and correction.

Other regions (e.g., Australia, New Zealand, Singapore, South Africa, Japan, India): You may submit access/erasure/objection requests to info@mavr.app. We apply appropriate safeguards for international transfers where required.

International Data Transfers

We may store and process your personal information in the United States and in other countries where we or our service providers operate. If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, we will ensure that any transfer of your personal information outside of your jurisdiction complies with applicable data protection laws and includes appropriate safeguards.

These safeguards may include:

  • Where the U.S. recipient participates in the EU–U.S. Data Privacy Framework (and, as applicable, the UK Extension and Swiss–U.S. Data Privacy Framework), relying on that certification for the transfer.
  • Entering into the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) with recipients, together with the UK International Data Transfer Addendum or IDTA (for UK transfers) and appropriate Swiss-approved clauses or adaptations (for Swiss transfers).
  • Implementing supplementary technical and organizational measures, such as encryption in transit and at rest, access controls, and data minimization, where appropriate.

In limited cases and only where permitted by law (for example, to perform a contract at your request), we may rely on GDPR Article 49 derogations for specific transfers.

You can request a copy of the relevant transfer safeguards by contacting info@mavr.app.

Children

Mavr is for adults. You must be 18 or older to create an account, and we do not knowingly collect personal information from anyone under 18 for a new account. If we learn that an account belongs to someone under 18, we may limit or delete it. Contact us if you believe this has happened.

Changes

We may update this policy from time to time. If we make a material change, we tell you in the app before it takes effect, and we ask for your consent again where the law requires it.

Contact

Questions? Contact info@mavr.app.