Privacy Policy

Zelos · Atlas Labs — last updated 18 September 2026

What Zelos is

Zelos is a workout tracker and AI training coach, operated by Atlas Labs (“we”). This policy explains what data we process when you use the Zelos iOS app or getzelos.app, and why. We do not run ads, do not sell your data, do not use it for advertising, and do not track you across other apps or websites.

Data we collect

• Account — email address and name (from sign-up, or from Google / Apple sign-in).
• Profile — height, body weight, gender, date of birth, units, training goal and experience.
• Training data — workouts, sets, reps, weights, programs, templates, personal records, body measurements and notes you log.
• Daily check-ins — the wellness and soreness ratings you tap in, per body region.
• Coach conversations — messages you exchange with the AI coach, and the notes it keeps about your training.
• Apple Health (optional) — see the next section.
• Location (optional) — see below.
• Strava (optional) — see below.

Apple Health, in detail

On iOS, Zelos asks once for Apple Health access. Everything in the app works without it. If you grant it, we read exactly these types and nothing else:

• Heart rate— shown live during a cardio activity, and summarised per session (average, maximum, and the number of minutes above 110 bpm).
• Heart-rate variability (HRV, SDNN) — for your Freshness and recovery score.
• Resting heart rate — for the same score.
• Sleep — hours asleep per night, for the same score. We ignore sleep stages.
• Energy burned (active energy) — the calories shown on a finished activity.
• Walking, running and cycling distance — declared so that Zelos can write distance back; the distance you see during a session is measured by GPS, not read from Health.

We do not read your workouts, steps, body measurements, or any clinical record from Apple Health.

When you finish a workout, Zelos can write it back to Apple Health: the workout itself (type, start, duration, pauses), its distance, its GPS route, the effort score derived from the intensity rating you logged, and the energy burned — the last only when the calorie figure is our own estimate, so Health is never double-counted.

What leaves your phone. Your HRV, resting heart rate and sleep hours are copied to Zelos servers so that your Freshness score is the same number on your phone and on the web (when you first grant access the app backfills 60 days of HRV and 30 days of sleep and resting heart rate; after that it keeps up as readings arrive). Session heart-rate summaries and calories are stored on the workout they belong to. Everything else derived from Health — the live heart-rate stream, the scoring itself — stays on the device. Apart from the two recovery signals named under AI processing below, Health data goes no further than Apple Health and our own servers; none of it is ever used for advertising, sold, or shared with a data broker.

Location

During an outdoor cardio activity, and only then, Zelos records your location by GPS to measure distance, pace, elevation and your route. Tracking continues in the background while an activity is running so a pocketed phone still records the whole route. The route is stored on that workout, written to Apple Health as a workout route, and — if you have turned on Strava export — uploaded to Strava. Strength workouts use no location at all.

Strava

Strava is optional and off until you connect it. Connecting sends you to Strava’s own consent screen, where we ask for three permissions: read, activity:read_all and activity:write. We store the permissions you actually granted and only do what they allow.

• What we import. Because activity:read_all covers private activities, the first sync backfills your full Strava history including activities you have marked private. For each activity we store its name, description, start and end time, sport type, duration, distance, elevation gain, average and maximum speed and pace, average and maximum heart rate, calories, and the summary route line. Imported activities become ordinary Zelos workouts.
• What we send. With activity:write, completed Zelos workouts are posted to Strava with their name, type, start time, duration, distance and a short description. A GPS cardio activity is uploaded instead as a GPX file containing its full route track, so the activity appears on Strava with a map.
• Webhook. Strava notifies us by webhook when one of your activities is created, changed or deleted, so imports stay in step. A deletion on Strava deletes only the copy we imported.
• Credentials. Strava issues us access and refresh tokens. They are held on our servers, never sent to the app, and are excluded from your data export.
• Disconnecting. You can disconnect Strava at any time in Profile. We call Strava’s deauthorize endpoint to revoke our access and delete the stored tokens. Activities already imported stay in your Zelos history as ordinary workouts — delete them individually if you want them gone.

AI processing (important)

The AI coach is powered by Anthropic’s Claude models, and is off until you turn it on for your account. While it is on, using coach chat, program generation or training insights sends your message together with training context — your profile (age, gender, height, body-weight trend), recent workouts including their heart-rate summary, personal records, supplements, your wellness and soreness check-ins, and recovery signals from Apple Health (resting heart rate with its baseline, and HRV averages) — to Anthropic for processing. Sleep hours, GPS routes and raw heart-rate series are not sent. Anthropic processes this to generate the reply and does not use API data to train its models by default. Turning AI coaching off in Profile stops all of it immediately, on every device; tracking keeps working without it.

Where data lives

• Database: Neon (PostgreSQL), hosted in the EU (Frankfurt).
• Application hosting: Render, EU (Frankfurt).
• AI processing: Anthropic (US) — only when you use coach features.
• Crash and error diagnostics: Sentry — the error itself plus your account id, so we can trace it. No email address, no tokens, and no health values are attached.
• Strava — only if you connect it, as described above.
• Sign-in: Google / Apple, only if you choose those methods.
• Exercise images and videos are served from our exercise-content provider’s CDN.

Your rights

• Export — download everything we hold about you from Settings, or via /api/auth/export with your session. The file contains your profile, workouts and sets, programs, personal records, body measurements, health vitals, coach conversations and memory, supplements, templates, sign-in identities, device sessions and your audit trail. Strava tokens are secrets rather than personal data, so the export lists your Strava connection without them.
• Deletion — you can delete your account in Settings. This permanently erases your account and the training, health, location, check-in, supplement and coach data attached to it. Audit entries are kept for integrity with your email address removed. If you have connected Strava, disconnect it first: that is what revokes our access at Strava and deletes the stored credentials.
• Access / correction — your data is visible and editable in the app itself.

Retention

Training, health and coach data is kept for as long as your account exists and is removed when you delete it. Audit-log entries are pruned after 12 months. Sign-in sessions expire after 180 days of disuse.

Contact

Atlas Labs — privacy@getzelos.app

← Back to Zelos