Privacy Policy

Last updated: 1 August 2026

This policy explains what personal data Peak collects, why it is collected, who it is shared with, and how you can access or delete it. Peak contains no advertising and no analytics, and personal data is never sold.

1. Data controller

Peak is operated by Facundo Iraola Dopazo, an individual developer based in Uruguay, trading as Lone Astronaut Studios. For the purposes of the General Data Protection Regulation (GDPR) and equivalent legislation, that individual is the data controller for the personal data described in this policy. No data protection officer has been appointed, as one is not required at this scale of processing.

All enquiries relating to this policy, including requests to exercise the rights set out in section 9, should be directed to [email protected].

2. Personal data collected

Peak collects only data that you provide directly or that is generated by your use of the application. No personal data is acquired from third-party sources.

Category	Purpose
Account identifiers — your email address, and your name where you sign in through Apple or Google and elect to share it	To create and secure your account and to send service communications such as password resets
Profile information — your display name and, if provided, a profile photograph	To personalise the application interface
Physical characteristics — height, weight and gender, each optional	To display measurements in your preferred units and to support body-composition estimates in future releases
Training preferences — objectives, experience level, training frequency and duration, available equipment, and areas of focus	To recommend an appropriate training program and adapt the content presented to you
Content you create — training programs, workout templates, target sets, custom exercises, and application preferences	To retain your configuration and make it available across your devices
Training records — completed sessions, the exercises performed, and each recorded set, including load, repetitions, exertion ratings where enabled, and any notes you add	To provide the core function of the application and to preserve your history across devices
Support correspondence — defect reports and feature requests, including their subject, description, and any screenshots you elect to attach	To investigate and resolve the issues you report
Optional feedback — free-text comments submitted in response to an in-app prompt	To identify areas for improvement. This field may be left blank
Technical identifiers — a device identifier generated by the application, and timestamps recorded against your stored data	To distinguish between your devices and reconcile your data correctly across them

3. Processing that does not occur

For the avoidance of doubt, Peak does not:

display advertising or incorporate any advertising network;
track you across other applications or websites, or access the device advertising identifier;
incorporate analytics or crash-reporting services;
sell, rent or otherwise trade personal data;
transmit a training session while it is in progress — an active session is retained solely on your device until it is completed;
access Apple Health, location data, contacts or the microphone, and does not request permission to do so.

4. Storage and international transfers

Peak operates offline: your data is written first to your device, and the application remains fully functional without a network connection. Where a connection is available, a copy is synchronised to Peak's servers so that it can be restored if you lose or replace your device.

Those servers are located in the United States. If you are resident in the European Economic Area or the United Kingdom, your personal data is therefore transferred outside your jurisdiction. Such transfers are made under the European Commission's Standard Contractual Clauses, which form part of the data processing agreements concluded with each of the providers described in section 5.

5. Categories of recipient

Peak engages a limited number of service providers, each of which processes personal data solely to deliver the service and only on documented instructions from the data controller. No provider is authorised to use your data for its own purposes.

Category of recipient	Function	Data disclosed
Cloud infrastructure and database services (United States)	Hosting of the application database, authentication, and file storage	The categories set out in section 2 that are synchronised from your device
Application delivery services (United States)	Distribution of application updates	An installation identifier, application and operating-system version, and IP address, recorded on launch. Not linked to your Peak account
Email delivery services (United States)	Transmission of service communications such as password resets	Your email address and the contents of the relevant message
Website hosting services	Delivery of this website	Standard web request data arising from your visit to this site only. No data originating from within the application
Apple and Google	Authentication, where you elect to use their sign-in services	They confirm your identity to Peak and disclose your email address, or the private relay address generated by Apple where you have chosen to conceal it

The identity of the individual providers engaged in each category is available on request by email. Personal data may additionally be disclosed where required by law, such as pursuant to a valid order of a competent court or authority.

6. Legal bases for processing

Where the GDPR or the UK GDPR applies, Peak relies on the following legal bases:

Performance of a contract (Article 6(1)(b)) — establishing and operating your account, and storing and synchronising the data required to provide the service.
Explicit consent (Article 9(2)(a)) — processing of the health-related data you elect to provide, namely your physical characteristics and training records. Consent is given when you create an account and enter that data, and may be withdrawn at any time by deleting the relevant data or your account. Withdrawal does not affect the lawfulness of processing carried out beforehand.
Legitimate interests (Article 6(1)(f)) — responding to support correspondence and maintaining the security and integrity of the service.

7. Retention

Personal data is retained for the duration of your account. Peak does not apply a separate retention period and does not archive inactive accounts.

Up to five previous versions of your synchronised data are retained so that an unsuccessful synchronisation can be reversed. Earlier versions are discarded automatically.

8. Deletion of your account

You may delete your account at any time from within the application, at Settings → Account → Delete Account. Confirmation and re-authentication are required before the request proceeds.

Deletion is immediate and irreversible. It terminates all active sessions, removes your profile photograph and any attached screenshots, and erases your configuration, your training records and all retained versions of your data, before deleting the account credentials themselves. The local database on your device is cleared at the same time. No data is retained on the server in a deleted state.

Two limitations apply:

Service providers maintain their own short-term operational records, including routine infrastructure backups, authentication logs and message delivery logs. These expire according to each provider's own schedule and are not retrievable as account data.
Where you signed in through Apple, deletion of your Peak account does not itself terminate the authorisation held by your Apple ID. To revoke it, select Settings → [your name] → Sign in with Apple → Peak → Stop using Apple ID on your device.

9. Your rights

Subject to the conditions of applicable law, you have the right to:

access the personal data held about you;
rectify inaccurate data — most of which may be corrected directly in the application;
erase your data, which is available in the application as described in section 8;
receive your data in a portable format;
restrict or object to processing;
withdraw consent in respect of the health-related data identified in section 6.

Erasure is available immediately within the application. All other requests should be submitted by email to [email protected] from the address registered to your account, and will be answered within 30 days. No fee is charged.

If you are resident in the European Economic Area or the United Kingdom and consider that your data has been processed unlawfully, you have the right to lodge a complaint with your national supervisory authority. In Uruguay, where the controller is established, the competent authority is the Unidad Reguladora y de Control de Datos Personales (URCDP).

10. Children

Peak is not intended for use by persons under 13 years of age, or under 16 in those European Economic Area member states that specify a higher age of consent. Peak does not knowingly collect personal data from children. If you believe that a child has registered an account, please contact [email protected] and it will be deleted.

11. Notice to residents of California and other United States jurisdictions

Peak does not sell personal information and does not share it for the purposes of cross-context behavioural advertising. Accordingly, no opt-out mechanism is provided, as no such processing takes place.

You have the right to know what personal information is collected, to request its deletion or correction, and not to be subject to discrimination for exercising those rights. The categories collected are set out in section 2, the purposes in the same section, and the retention position in section 7. Requests may be submitted to the email address given above.

12. Security

Personal data is encrypted in transit and at rest. Access controls are applied at the record level, so that data belonging to one account cannot be read from another. Profile photographs and support screenshots are stored in private locations and served only through short-lived, individually issued links.

No system can be guaranteed secure. If you identify a security vulnerability, please report it to [email protected] rather than disclosing it publicly; all such reports are investigated.

13. Amendments

This policy may be amended from time to time. The date shown above records the most recent revision, and material changes will additionally be notified within the application. The current version is always published at this address.

14. Contact

Facundo Iraola Dopazo, trading as Lone Astronaut Studios
[email protected]