Athlenote Privacy Policy

Effective date: 11 September 2026.

Athlenote is a voice-first sports journal and AI mentor for athletes. This policy explains what personal information we collect when you use Athlenote, why we collect it, who we share it with, and the rights you have over it. We have tried to write it in plain language rather than legal language.

1. Who we are

Athlenote is made by:

Duo Technology Studio (Pty) Ltd, CIPC registration number 2025/864445/07, 10 Rokewood Road, Die Boord, Stellenbosch, Western Cape, 7613, South Africa.

Duo Technology Studio (Pty) Ltd is a South African company, registered and operating in South Africa. We are not established in the European Union. Athlenote is used by people around the world, with most users so far in South Africa and Europe.

Under South Africa's Protection of Personal Information Act (POPIA), Duo Technology Studio (Pty) Ltd is the responsible party for the personal information described in this policy. POPIA requires every responsible party to appoint an Information Officer and to register that person with the Information Regulator.

For users in the European Union, we act as the controller of your personal information under the General Data Protection Regulation (GDPR), even though we are based outside the EU, because we offer Athlenote to people in the EU.

You can contact us at any time at hello@athlenote.com.

2. What we collect

We collect the following categories of personal information. We do not collect card numbers or other payment card details; see section 6.

Account information

• Your email address
• Your password, stored in hashed (scrambled, non-reversible) form by our authentication provider, Supabase Auth. We never see or store your plain-text password.
• Your name

Profile information

• Your sport
• Your date of birth
• An optional profile photo

Voice recordings and transcripts

• The audio files of the voice notes you record about your training or how you are feeling
• The text transcript generated from that audio

Journal entries

• Journal entries you type as text
• Tags you add to entries

Daily wellbeing ratings and readiness score

• Your daily self-reported ratings for sleep, fatigue, soreness, stress and mood
• A daily readiness score, which we calculate from those self-reported ratings

This category is treated as sensitive. See section 4.

Habits, goals, calendar, streaks and stats

• Habits you create and your habit completions
• Goals you set
• Calendar entries you add
• Streaks and other statistics the app calculates from your activity

AI mentor

• Which AI mentor you have chosen
• The AI mentor's replies, stored against the relevant entry

Subscription and purchase information

• Your subscription status
• Purchase data and a user identifier processed by our subscription platform, RevenueCat, to keep your subscription status in sync across the app

We do not collect or store your card details. Subscription billing is handled entirely by Apple and Google. See section 6 for details.

App usage and diagnostic data

• Basic app usage and diagnostic data, such as device type, app version, and crash or error information, which helps us keep Athlenote working correctly

3. Why we collect it, and our legal basis

We collect and use your information for these purposes:

Under POPIA and GDPR, we need a valid legal basis for each way we use your information. We rely on the following:

• Performance of a contract (POPIA section 11(1)(b); GDPR Article 6(1)(b)): most of what we do (running your account, storing your journal, calculating streaks and stats) is necessary to provide the Athlenote service you have signed up for.
• Explicit consent (POPIA sections 11(1)(a) and 27; GDPR Articles 6(1)(a) and 9(2)(a)): your daily wellbeing ratings and the readiness score derived from them are treated as sensitive information. We ask for your explicit, separate consent before processing this data. We also ask for your explicit consent before sending your voice recordings and transcripts to our AI provider for transcription and mentor replies. You can withdraw this consent at any time in the app's settings, though doing so will limit or disable the related features.
• Legitimate interests (POPIA section 11(1)(f); GDPR Article 6(1)(f)): for basic account security, fraud prevention, and keeping the app running reliably. We do not rely on legitimate interests for your wellbeing ratings, readiness score, or any other sensitive information.
• Legal obligation (POPIA section 11(1)(c); GDPR Article 6(1)(c)): where we are required by law to keep or disclose certain information.

POPIA also sets out eight conditions that we must meet for all our processing of your personal information: accountability, processing limitation, purpose specification, further processing limitation, information quality, openness, security safeguards, and your right to participate (for example by accessing or correcting your data). This policy, together with our internal practices, is intended to meet each of those conditions. Section 10 below covers your data subject participation rights in more detail.

4. Wellbeing ratings and your readiness score

Your daily sleep, fatigue, soreness, stress and mood ratings, and the readiness score we calculate from them, can reveal information about your physical and mental wellbeing. Under POPIA this is special personal information (POPIA section 26), and under GDPR it is a special category of data because it relates to health (GDPR Article 9).

Because of this, we only process this data with your explicit, opt-in consent, collected as a separate step from our general terms. You can withdraw this consent at any time in the app's settings. If you withdraw consent, we stop collecting new wellbeing ratings and readiness scores, and you can request deletion of the ones we already hold, but doing so will disable the readiness score feature.

The readiness score is a wellness estimate generated from your own self-reported ratings. It is not a medical assessment, and Athlenote is not a medical device or diagnostic tool. See the Athlenote Terms of Use for the full disclaimer about the nature and limits of the AI mentor and the readiness score.

5. How the AI mentor and transcription work

When you record a voice note, the audio is sent to our transcription and AI provider, OpenAI, so it can be converted to text using OpenAI's Whisper model. That transcript is then sent to OpenAI to generate the AI mentor's reflective reply using a GPT model.

OpenAI processes this data on our behalf as a service provider. OpenAI's own privacy and data usage terms, which we encourage you to read, describe how long OpenAI retains data submitted through its systems and how that data may be used.

The AI mentor is an artificial intelligence, not a human being. See the Athlenote Terms of Use for the full disclaimer about the nature and limits of the AI mentor and the readiness score.

6. Who we share your data with

We share your information with a small number of service providers who help us run Athlenote. We do not sell your personal information to anyone.

We may also disclose information if required to do so by law, or to protect the rights, property or safety of Duo Technology Studio, our users, or others.

7. Sending data outside South Africa

Duo Technology Studio is based in South Africa, but our service providers (Supabase, OpenAI, and RevenueCat) may process and store data on servers located outside South Africa, including in other countries. This means your personal information may cross borders.

POPIA section 72 says we may only send personal information outside South Africa if at least one of these applies: the recipient country has an adequate data protection law, the recipient is bound by binding corporate rules or a contract that provides an adequate level of protection, you have consented to the transfer, or the transfer is necessary to perform our contract with you. We rely on contractual protections with our service providers, together with your consent where we rely on consent under this policy, as the basis for these transfers.

For users in the European Union, transfers of your data outside the EU (including to South Africa and to any other country where our providers operate) are made using safeguards intended to meet GDPR's rules on international transfers, such as the European Commission's Standard Contractual Clauses or an equivalent mechanism with our providers.

8. How long we keep your data

We keep your personal information for as long as your account is active, so that Athlenote can keep working for you. If you delete your account, we delete your associated data as described in section 11, subject to a short period during which the data may remain in backups before those backups are overwritten.

Data held by our processors, such as data OpenAI retains for its own safety and abuse monitoring, follows the retention periods described in section 5 above.

9. How we protect your data

We take reasonable technical and organisational measures to protect your personal information, including:

• Storing passwords in hashed, non-reversible form
• Using Supabase's authentication and storage infrastructure, which includes encryption and access controls
• Limiting access to personal information to what is needed to run the service

No system is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at hello@athlenote.com.

10. Your rights

If you are in South Africa, POPIA gives you the right to:

• Be told what personal information we hold about you and why (access)
• Ask us to correct or delete personal information that is inaccurate, out of date, incomplete, misleading, or that we collected unlawfully
• Object to the processing of your personal information on reasonable grounds
• Withdraw consent, where we rely on your consent, at any time
• Lodge a complaint with the Information Regulator of South Africa if you believe we have not handled your personal information properly

If you are in the European Union, GDPR gives you the right to:

• Access the personal information we hold about you (Article 15)
• Rectification of inaccurate or incomplete information (Article 16)
• Erasure of your personal information in certain circumstances (Article 17)
• Restriction of how we process your information in certain circumstances (Article 18)
• Data portability, to receive your data in a portable format or have it sent to another provider (Article 20)
• Object to certain processing of your data, including processing based on legitimate interests (Article 21)
• Withdraw consent at any time, where we rely on consent to process your data
• Lodge a complaint with your local data protection supervisory authority

Wherever you live, you can exercise these rights by emailing us at hello@athlenote.com, or by using the account deletion feature in the app described in section 11.

11. Deleting your account and data

You are in control of your data. You can delete your account and all associated data at any time, directly inside the app, from the Settings screen.

Deleting your account removes:

• Your account and profile
• Your journal entries
• Your voice recordings and their transcripts
• Your profile photo
• Your wellbeing ratings, readiness scores, habits, goals, calendar entries, streaks and stats
• Your AI mentor replies

You can also request deletion by emailing hello@athlenote.com from the email address linked to your account.

12. Minimum age and parental consent

Athlenote is intended for users who are at least 13 years old. We do not knowingly collect personal information from anyone under 13.

If you are between 13 and 18 years old, you need your parent or guardian's consent to use Athlenote. We collect that consent as a step during signup.

If you believe a child under 13 has provided us with personal information, please contact us at hello@athlenote.com so we can delete it.

13. Changes to this policy

We may update this policy from time to time, for example if we change how the app works or if the law changes. If we make significant changes, we will let you know inside the app or by email. The effective date at the top of this page shows when it was last updated.

14. Contact us

If you have any questions about this policy or how we handle your personal information, please contact:

Duo Technology Studio (Pty) Ltd, 10 Rokewood Road, Die Boord, Stellenbosch, Western Cape, 7613, South Africa. Email: hello@athlenote.com.