Wombo Privacy Policy
Last updated: October 1, 2026
Introduction
Wombo is a training planning app operated by Joren van Dorp and Adriaan van den Broek, based in Gent, Belgium. This policy explains how Wombo handles personal information when you create an account, plan training, record activities, complete check-ins, or connect Polar.
Contact us at coach@wombo.be.
Some features, including Polar connection and AI-assisted suggestions, may be unavailable depending on how Wombo is configured.
Information we collect
| Information | When and why we collect it | Choice and storage |
|---|---|---|
| Account information | Your email address, password, account identifier, and authentication sessions let you register and sign in. | Required for an account. Supabase Auth processes account credentials and sessions. The app stores a refresh token in device secure storage. |
| Profile and setup | Your date of birth, time zone, confirmation that you have a heart-rate monitor, and prior training hours help set up your training. You can also provide a first and last name and resting heart rate. | Core setup fields are required to complete onboarding; names and resting heart rate can be omitted. Profile and training records are stored in Supabase. Your language choice is stored on your device. |
| Goals, plans, and training history | Race type, name and date, distances, target times, optional focus text, available days, training choices, scheduled workouts, plan approvals, and historical training information are used to build and manage your plan. | Required only when you use the related planning features. Stored in Supabase. |
| Activity and fitness information | Activities you enter or import may include sport, date and time, time zone, duration, distance, elevation, heart rate, pace, speed, power, time in training zones, perceived effort, and links to planned workouts. We use these to record progress, evaluate training, and suggest changes for your approval. | You choose whether to record an activity or connect Polar. Stored in Supabase. |
| Health-related information | Check-ins can include fatigue, injury or illness reasons, symptoms acknowledgement, exercise restrictions, and any professional advice you enter. Calibration and zone setup can include heart-rate measurements, thresholds, test results, and calculated zones. We use this information for the training and safety features you choose to use. | Some measurements are required for particular setup or check-in steps; optional text and advice can be left blank. Stored in Supabase. This information qualifies as sensitive health data under the GDPR. |
| Check-in text and other content | If you use the optional free-text check-in helper, you may enter up to 1,000 characters about your week. The server uses it to suggest fields for you to review. The submitted text is not saved as a check-in record by that helper; fields you confirm are saved. You may also enter a race focus, external activity name, or professional advice. | Optional. The text is sent to Wombo's backend and, if the AI service is enabled, to OpenAI. Confirmed fields and other content are stored in Supabase. |
| Polar connection data | If you choose to connect Polar, Wombo sends a Wombo account reference to Polar, receives your Polar user identifier and access token, and requests exercise summaries and available FIT activity files. A FIT file may contain detailed workout information, potentially including a route or location if your Polar device recorded it. | Optional. Connection details, imported activities, and private FIT files are stored in Supabase. Polar also processes the connection and activity data under its own privacy terms. |
| Beta access | If you redeem a Pioneer access code, Wombo processes a digest of the code, redemption status, time, and security/rate-limit attempts. | Optional. Stored in Supabase. |
| Technical records | Requests to the backend generate a request identifier, request path, method, error details and timestamps in server logs. Hosting and authentication services may also process network information such as IP addresses as part of operating their services. | Necessary to operate and protect the service. Backend logs are sent to Railway. |
The app does not currently include advertising, app analytics, crash reporting, push notifications, camera or photo capture, payments, or advertising-ID collection. It does not ask for Android location or camera access. We do not access your photos or files from the phone; Polar files are fetched directly by the server from Polar.
How we use information
We use the information above to create and secure your account; provide training plans, zones, activities, check-ins, and optional Polar imports; show and apply changes you approve; respond to support and privacy requests; and investigate service failures or misuse.
Wombo calculates training decisions on its own backend. If OpenAI is configured, it may receive limited plan facts to write an explanation, or optional check-in text, week and time zone to suggest check-in fields. OpenAI does not decide or apply your training plan. The OpenAI requests in our code set store to false.
Legal Basis (GDPR): We process your account and basic training data based on the performance of a contract (delivering the app functionality to you). For processing health-related data and connecting external sources like Polar, we rely on your explicit consent (Article 9 GDPR).
Third-party services and data sharing
- Supabase provides account authentication, database services and private activity-file storage. It processes account, profile, training, health and integration records on our behalf.
- Railway hosts the Wombo backend and receives requests and operational logs.
- Polar, only if you connect it, handles authorization and receives a Wombo member reference. Wombo then retrieves your Polar exercise information and available FIT files. Disconnecting stops new access and removes Wombo's stored Polar access token, but does not remove activities or FIT files already imported.
- OpenAI, if enabled on the server, receives limited training-plan facts for explanations and optional check-in text, week start and time zone for check-in suggestions.
- Expo and Google Play are used to build and distribute the Android app.
We do not use the app to sell personal information or serve targeted ads. We disclose information strictly to the services above to deliver the features described.
Data retention
We retain your personal data for as long as your account is active. When you request the deletion of your account, all your personal data (including profile info, training data, and imported FIT files) will be securely and permanently deleted from our servers within 30 days.
Account and data deletion
You can request deletion of your account and associated Wombo data by contacting us at coach@wombo.be.
Signing out or disconnecting Polar does not delete your Wombo account. Deleting your Wombo account does not necessarily delete information Polar keeps under your separate Polar account.
Data security
The app stores its refresh token in the device's secure storage. The backend verifies account access tokens; user-owned database records use strict access controls, and the Polar activity-file bucket is private. Wombo's connections to Supabase, Polar, and OpenAI are fully encrypted in transit using HTTPS. No system can be guaranteed perfectly secure, but we implement industry-standard measures to protect your data.
Children's privacy
Wombo is strictly intended for users who are 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If you believe a minor has provided information to us, please contact us at coach@wombo.be so we can delete their data immediately.
Your privacy rights
If the GDPR applies to you, you may ask to access, correct, erase or receive a copy of your personal information, and in applicable cases restrict or object to processing or withdraw consent. You may also complain to a data protection authority, including the Belgian Data Protection Authority.
Contact coach@wombo.be to exercise your rights. We will respond to your request within 30 days. We may need to verify your identity before acting on a request.
International transfers
Our primary infrastructure providers, Supabase and Railway, host data securely within the European Union. In cases where data is processed outside the European Economic Area (EEA), such as with OpenAI, we ensure appropriate legal safeguards are in place, such as Standard Contractual Clauses (SCCs), to protect your personal information in accordance with GDPR guidelines.
Changes to this policy
We may update this policy when our app or data practices change. The updated version will show a new date on this page. If we make material changes, we will notify you via an in-app message and by sending an email to the address associated with your account.
Contact
Wombo
Joren van Dorp & Adriaan van den Broek
Gent, Belgium
coach@wombo.be