Privacy Policy

Last updated: 27 September 2026

This policy explains what personal data Peak collects, why it is collected, who it is shared with, and how you can access or delete it. Peak contains no advertising and no third-party analytics, and personal data is never sold. The only record it keeps of how the application is used is an anonymous note of which screens of the initial setup were reached, described in section 2. Where the application encounters an error it sends a diagnostic report so the fault can be fixed; section 2 sets out exactly what such a report contains.

1. Data controller

Peak is operated by Facundo Iraola Dopazo, an individual developer based in Uruguay, trading as Lone Astronaut Studios. For the purposes of the General Data Protection Regulation (GDPR) and equivalent legislation, that individual is the data controller for the personal data described in this policy. No data protection officer has been appointed, as one is not required at this scale of processing.

All enquiries relating to this policy, including requests to exercise the rights set out in section 9, should be directed to support@loneastronautstudios.com.

2. Personal data collected

Peak collects only data that you provide directly or that is generated by your use of the application. No personal data is acquired from third-party sources.

Category	Purpose
Account identifiers — your email address, and your name where you sign in through Apple or Google and elect to share it	To create and secure your account and to send service communications such as password resets
Account status — the service tier your account is on and whether it is active	To determine which parts of the application your account may use. Both values are set by Peak rather than by you, and are held only on Peak's servers
Profile information — your display name and, if provided, a profile photograph	To personalise the application interface
Physical characteristics — height, weight and gender, each optional	To display measurements in your preferred units and to support body-composition estimates in future releases
Training preferences — objectives, experience level, training frequency, and available equipment	To recommend an appropriate training program and adapt the content presented to you
Content you create — training programs, workout templates, target sets, custom exercises, and application preferences	To retain your configuration and make it available across your devices
Training records — completed sessions, the exercises performed, and each recorded set, including load, repetitions, exertion ratings where enabled, and any notes you add	To provide the core function of the application and to preserve your history across devices
Support correspondence — defect reports and feature requests, including their subject, description, and any screenshots you elect to attach	To investigate and resolve the issues you report
Technical identifiers — a device identifier generated by the application, and timestamps recorded against your stored data	To distinguish between your devices and reconcile your data correctly across them
Onboarding progress — while you complete the initial setup, which of its screens were reached and whether it was finished, together with the application version and release channel, the device platform (iOS or Android), and the hour at which each screen was reached. Each run through the setup is labelled with a random identifier created for that run alone, which is never stored on your device	To learn at which point people abandon the setup, so that it can be improved. This record contains no account identifier and none of the answers you give during the setup, and it is not linked to your account
Diagnostic data — where the application encounters an error, a report comprising the technical description of the fault and the point in the code at which it occurred, the device model and its basic technical characteristics, the operating-system version, the application version, and your account identifier	To detect and correct defects. These reports contain no training records, physical characteristics or message content, and are never used to profile you or to advertise

3. Processing that does not occur

For the avoidance of doubt, Peak does not:

display advertising or incorporate any advertising network;
track you across other applications or websites, or access the device advertising identifier;
incorporate third-party analytics services, record your screen, or record your interactions with the application beyond the anonymous onboarding progress described in section 2;
sell, rent or otherwise trade personal data;
transmit a training session while it is in progress — an active session is retained solely on your device until it is completed;
access Apple Health, location data, contacts or the microphone, and does not request permission to do so.

4. Storage and international transfers

Peak operates offline: your data is written first to your device, and the application remains fully functional without a network connection. Where a connection is available, a copy is synchronised to Peak's servers so that it can be restored if you lose or replace your device.

Those servers are located in the United States. If you are resident in the European Economic Area or the United Kingdom, your personal data is therefore transferred outside your jurisdiction. Such transfers are made under the European Commission's Standard Contractual Clauses, which form part of the data processing agreements concluded with each of the providers described in section 5.

5. Categories of recipient

Peak engages a limited number of service providers, each of which processes personal data solely to deliver the service and only on documented instructions from the data controller. No provider is authorised to use your data for its own purposes.

Category of recipient	Function	Data disclosed
Cloud infrastructure and database services (United States)	Hosting of the application database, authentication, and file storage	The categories set out in section 2 that are synchronised from your device, and the onboarding progress described there
Application delivery services (United States)	Distribution of application updates	An installation identifier, application and operating-system version, and IP address, recorded on launch. Not linked to your Peak account
Error diagnostics services (United States)	Detection and diagnosis of application faults	The diagnostic data described in section 2, together with your account identifier. No training records, physical characteristics or message content
AI-assisted engineering services (United States)	Diagnosis and correction of application faults, maintenance of the application's own content and verification of releases, through access to the application database and to its diagnostic reports	The personal data described in section 2 that is held on Peak's servers, the diagnostic data described there, and the operational records referred to in section 8, such as authentication logs and the IP addresses they contain, as they are accessed in the course of that work
Email delivery services (United States)	Transmission of service communications such as password resets	Your email address and the contents of the relevant message
Email routing services	Forwarding of messages sent to the support address to the controller's mailbox	Your email address and the contents of the message you send
Website hosting services	Delivery of this website	Standard web request data arising from your visit to this site only. No data originating from within the application
Apple and Google	Authentication, where you elect to use their sign-in services	They confirm your identity to Peak and disclose your email address, or the private relay address generated by Apple where you have chosen to conceal it

The identity of the individual providers engaged in each category is available on request by email. Personal data may additionally be disclosed where required by law, such as pursuant to a valid order of a competent court or authority.

6. Legal bases for processing

Where the GDPR or the UK GDPR applies, Peak relies on the following legal bases:

Performance of a contract (Article 6(1)(b)) — establishing and operating your account, and storing and synchronising the data required to provide the service.
Explicit consent (Article 9(2)(a)) — processing of the health-related data you elect to provide, namely your physical characteristics and training records. Consent is given when you create an account and enter that data, and may be withdrawn at any time by deleting the relevant data or your account. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Legitimate interests (Article 6(1)(f)) — responding to support correspondence, maintaining the security and integrity of the service, and learning where the initial setup is abandoned so that it can be improved.

7. Retention

Personal data is retained for the duration of your account. Peak does not apply a separate retention period and does not archive inactive accounts.

The current version of your synchronised data and up to four previous versions are retained, so that an unsuccessful synchronisation can be reversed. Earlier versions are discarded automatically.

Onboarding progress is the one exception. It is not linked to any account, so deleting an account does not affect it, and it is deleted automatically twelve months after it is recorded.

8. Deletion of your account

You may delete your account at any time from within the application, at Settings → Account → Delete Account. Confirmation and re-authentication are required before the request proceeds.

Deletion is immediate and irreversible. It terminates all active sessions and then deletes the account itself, which erases your configuration, your training records and all retained versions of your data. Your profile photograph and any screenshots you attached are removed immediately afterwards. The local database on your device is cleared at the same time. No account, and no data belonging to an account, is retained on the server in a deleted state. Because the stored images are removed after the account rather than before it, a file may in rare cases outlast it; any such file belongs to no account, is put to no use, and is erased as soon as it is identified.

Two limitations apply:

Service providers maintain their own short-term operational records, including routine infrastructure backups, authentication logs, message delivery logs and any diagnostic reports already transmitted under section 2. These expire according to each provider's own schedule and are not retrievable as account data. Diagnostic reports carry your account identifier and can be erased on request in advance of that schedule.
Where you signed in through Apple, deletion of your Peak account does not itself terminate the authorisation held by your Apple ID. To revoke it, select Settings → [your name] → Sign in with Apple → Peak → Stop using Apple ID on your device.

9. Your rights

Subject to the conditions of applicable law, you have the right to:

access the personal data held about you;
rectify inaccurate data — most of which may be corrected directly in the application;
erase your data, which is available in the application as described in section 8;
receive your data in a portable format;
restrict or object to processing;
withdraw consent in respect of the health-related data identified in section 6.

Erasure is available immediately within the application. All other requests should be submitted by email to support@loneastronautstudios.com from the address registered to your account, and will be answered within 30 days. No fee is charged.

If you are resident in the European Economic Area or the United Kingdom and consider that your data has been processed unlawfully, you have the right to lodge a complaint with your national supervisory authority. In Uruguay, where the controller is established, the competent authority is the Unidad Reguladora y de Control de Datos Personales (URCDP).

10. Children

Peak is not intended for use by persons under 13 years of age, or under 16 in those European Economic Area member states that specify a higher age of consent. Peak does not knowingly collect personal data from children. If you believe that a child has registered an account, please contact support@loneastronautstudios.com and it will be deleted.

11. Notice to residents of California and other United States jurisdictions

Peak does not sell personal information and does not share it for the purposes of cross-context behavioural advertising. Accordingly, no opt-out mechanism is provided, as no such processing takes place.

You have the right to know what personal information is collected, to request its deletion or correction, and not to be subject to discrimination for exercising those rights. The categories collected are set out in section 2, the purposes in the same section, and the retention position in section 7. Requests may be submitted to the email address given above.

12. Security

Personal data is encrypted in transit and at rest. Access controls are applied at the record level, so that data belonging to one account cannot be read from another. Support screenshots are stored privately and are served only through short-lived, individually issued links. A profile photograph is stored at an address that is not published and is not linked to your account anywhere else, but which does not itself require authentication: anyone who is given that address can view the photograph.

No system can be guaranteed secure. If you identify a security vulnerability, please report it to support@loneastronautstudios.com rather than disclosing it publicly; all such reports are investigated.

13. Amendments

This policy may be amended from time to time. The date shown above records the most recent revision, and material changes will additionally be notified within the application. The current version is always published at this address.

14. Contact

Facundo Iraola Dopazo, trading as Lone Astronaut Studios
support@loneastronautstudios.com