1 Who we are

The data controller for Horma is Guillaume Lafforgue, an individual operating under UK law. If you have any questions about how your data is used, contact us at lafforgue.guillaume1@gmail.com.

Horma is an AI-powered training app available on iOS, Android and the web. It lets you generate personalised training plans, log workouts, and chat with an AI coach.

2 What data we collect

We do not collect location data, device identifiers, or payment information. Biometric fields (age, weight, biological sex) are entirely optional and are used solely to improve the personalisation of training plans and AI responses.

3 How we use your data

• Providing the service — creating your account, generating and storing training plans, logging workouts, and running the AI coaching chat.
• Personalisation — tailoring plan difficulty, exercise selection, and AI coach responses to your profile and history.
• Safety and abuse prevention — rate-limiting API requests and detecting misuse.
• Service improvement — anonymised, aggregated usage patterns to understand how Horma is used. We do not build individual profiles for advertising.

Legal bases (UK GDPR Article 6)

• Contract performance (Art. 6(1)(b)) — processing your account, profile, training and chat data is necessary to provide the service you signed up for.
• Legitimate interests (Art. 6(1)(f)) — aggregate analytics and rate-limiting are in our legitimate interests and do not override your rights.
• Explicit consent (Art. 9(2)(a)) — biometric data (age, weight, biological sex) is special-category data; we process it only when you voluntarily provide it, which constitutes your explicit consent. You may delete these fields at any time.

4 Third-party services and processors

We use the following sub-processors. Each has access only to the data necessary to perform its function.

We do not sell your data to any third party and do not share it with advertisers or data brokers.

5 International data transfers

Your primary data is stored by Supabase on servers in Frankfurt, Germany (EU), which benefits from an adequacy decision under UK GDPR — no additional safeguards are required for this transfer.

Anthropic (US) and Google (US) process data outside the UK. These transfers are covered by Standard Contractual Clauses (SCCs) approved under UK law (the International Data Transfer Agreement, or IDTA), which provide appropriate safeguards for your data.

Vercel may cache static assets globally via its CDN. No personal data is stored on Vercel's infrastructure beyond standard web server access logs.

6 Data retention

• Account and training data — retained until you delete your account. When you delete your account, all associated data is permanently erased from our database within 30 days.
• AI coach chat messages — stored as a rolling conversation history (up to 50 messages per conversation thread). Older messages are automatically purged as new ones are added.
• Vercel access logs — retained according to Vercel's standard policy (typically 30 days).

You can request deletion of your account and all associated data at any time by emailing lafforgue.guillaume1@gmail.com.

7 Your rights

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data ("right to be forgotten").
• Restriction — ask us to limit how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Withdraw consent — withdraw consent for biometric data at any time by removing those fields from your profile. Withdrawal does not affect the lawfulness of prior processing.
• Lodge a complaint — complain to the Information Commissioner's Office (ICO) if you believe we are not handling your data lawfully.

To exercise any of these rights, email lafforgue.guillaume1@gmail.com. We will respond within one calendar month.

8 Cookies and local storage

The Horma web app uses browser localStorage to persist your authentication session (provided by Supabase Auth) and your language preference. No third-party tracking cookies are set by Horma itself.

Vercel may set a cookie for routing purposes. Google may set cookies if you use Google OAuth sign-in; these are governed by Google's Privacy Policy.

We do not use analytics cookies (e.g. Google Analytics) or advertising pixels.

9 Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the effective date at the top of this page. Continued use of Horma after a change constitutes acceptance of the revised policy. For significant changes we will notify you by email.

10 Contact us & how to complain

If you are not satisfied with our response, or if you believe we are processing your data in breach of UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF