Privacy policy

ApneaLab is a freediving app: a dive log, breath-hold training tables and a timer that speaks to you during a hold. [Company name], [Address], runs it ("we"). This policy explains what is kept about you and where, who else sees it, for how long, and what you can do about it. If anything is unclear, write to [Contact email].

1. What is kept, and where

• Your training log, on your phone: your dives and their depth charts, training sessions and tables, notes, the photos and videos you attach to a dive, and your settings. It is kept in the app's own storage on your phone. If you use the app in a web browser, it is kept only in that browser, on that computer.
• Dives you import: the figures read from a watch file you choose (Garmin FIT or Suunto), or from your Garmin account if you connect it (section 5). They are kept on your phone with your log.
• Coach notes and plans: plans a coach sends you, and notes either of you add to them.
• Safety records: a blackout, samba or other safety sign you record after a session (section 3).
• Backups, if you make them (section 2).
• Your account, if you make one: your email address (section 4).
• Crash reports, if the app crashes (section 7).

2. Backups

You choose whether to back up, and where:

• A file on your phone, or one you save or send yourself. It goes only where you put it.
• Your own Google Drive. If you connect Google Drive, the app saves backup files to your Drive. Google's own privacy terms apply there. We do not receive the files.
• Your ApneaLab account. If you sign in, you can keep a backup on our server (section 4).

A backup is a readable file unless you lock it with a password. The lock is off unless you turn it on. A locked backup opens only with its password. We do not have it and cannot recover it for you.

3. Coaches and students, and your safety records

A diver can use ApneaLab alone, or a coach can use it with their students. A coach can send a student plans, and a student can send their coach a file of their training. A coach sees only what a student sends them, and keeps what they have received. You choose what goes in the file. You send it yourself, by email, a message app or any other way your phone offers, so it goes straight from you to your coach.

Safety records are health information, and we treat them as sensitive. When you accept a plan from a coach, your safety records always go to that coach, and this cannot be turned off. That way they know when something went wrong. The app tells you this in one clear line before you accept the plan.

4. Our server and our suppliers

Some features need a server. It holds only:

• Your account: your email address. You sign in with a code we email you, so there is no password to leak.
• Coach plans sent through the app, and who they were sent to.
• Your own backup, if you keep one there. If you set a backup password, the backup is locked on your phone before it is sent.
• Your Garmin connection, if you connect one (section 5).
• A short log of what the server did (for example, that an account was created), kept to run and protect the server.

Some of these features are not available yet. This policy already covers them.

These are the companies that store or send this data for us, and only for these purposes:

• Supabase: our server and its database, in [Server region].
• Netlify: hosts this website and the browser version of the app.
• Resend: sends the sign-in code to your email address.
• Sentry: receives crash reports (section 7).
• OpenAI: only if AI reading of coach PDFs is built and you use it (section 6).

Google Drive and Garmin are used only if you connect them, and their own terms apply.

5. Garmin data, if you connect Garmin

You can connect your Garmin account so your watch's data comes into ApneaLab without copying files by hand. It is your choice: nothing is read from Garmin until you connect.

When you connect, we receive only what you allow on Garmin's own permission screen:

• Activities, including freediving and apnea dives with their depth, time, temperature and heart rate.
• Daily health data: resting heart rate, heart rate variability (HRV), sleep, stress, blood oxygen (SpO2) and respiration.

It is imported into your log on your phone. Our server keeps it only until it reaches your phone. We use it only to show your own training back to you. It goes to a coach only in a file you choose to send them. We never sell it, never share it with anyone else, and never use it for advertising.

The keys Garmin gives us to read your data (access tokens) are kept only on our server, never in the app on your phone.

You can disconnect Garmin at any time in the app's Settings, or from your Garmin Connect account. When you disconnect, we delete your Garmin tokens at once, and any Garmin data our server holds for you within 30 days. Data already in your log on your phone stays there until you delete it.

Garmin is a trademark of Garmin Ltd. or its subsidiaries. ApneaLab is not made by Garmin.

6. Reading a coach's PDF with AI (not built yet)

We plan to let the app read a training plan your coach sent as a PDF, so you do not have to type it in. If this is built, the app sends OpenAI only the file you choose, and only when you ask, so it can read the plan's tables. The result comes back to your phone. Under OpenAI's terms for this kind of use, OpenAI does not use the file to train its models. We do not keep the file on our server.

7. Crash reports

If the app crashes, it may send a crash report to Sentry. The report says what went wrong in the app's code, the app's version and the kind of phone. Crash reports are set up never to include your dives, training, notes or who you are.

8. No ads, no selling

ApneaLab is free and shows no advertising. We never sell your data, never rent it, and never share it with advertisers or data brokers.

9. Children

ApneaLab is for adults: you must be 18 or older to use it, and we do not knowingly hold an account for anyone younger. If you think a child has made an account, write to us and we will delete it.

10. How long we keep your data (retention)

• Your data stays on your phone until you remove the app. Deleting a dive hides it, so you can bring it back.
• Backups you made yourself, in a file or your Google Drive: until you delete them there.
• Your account and your backup on our server: until you delete them or your account. Then they are deleted within 30 days, including from our server's own backups.
• Coach plans on our server: until the plan is withdrawn or either account is deleted, then deleted within 30 days.
• Garmin tokens: until you disconnect, then deleted at once. Garmin data on our server: until it reaches your phone, and at most 30 days after you disconnect.
• The server's own log: a short time, to run and protect the server. Entries that name you are deleted with your account.
• Crash reports: as long as Sentry keeps them for us, at most 90 days.

11. Deleting your account

In the app, go to Settings › Account › Delete my account. Without the app, see Delete your account and data, which also says what is deleted and what stays on your phone.

12. Your rights

Wherever you live, you can:

• Access: ask what we hold about you.
• Export: take your data with you. In the app, Settings exports everything on your phone as a file. For what is on our server, write to us.
• Correct anything that is wrong.
• Delete your account and data (section 11).
• Object to how we use your data, or withdraw a permission you gave (for example, disconnect Garmin).
• Complain to your data protection authority.

We answer within 30 days. We may ask you to prove the account is yours, for example by replying from its email address.

13. Changes to this policy

If we change this policy, we post the new version here with a new version number and date. If a change affects what we do with data you have already given us, we tell you in the app before it takes effect.

14. Contact

[Company name], [Address]. Email [Contact email].