Privacy Policy

Last updated: 2026-07-13

This policy explains what nof-1 ("we", "us", the "Service") collects, why, and your choices. It applies to the nof-1 web app and, when released, the nof-1 iOS app.

1. Who we are

nof-1 is a single-subject ("n-of-1") endurance-training case-report tool. It ingests your own training and wearable data and produces a private, graded analysis and plan for you. The Service is operated by Driven Edge Limited Liability Company, a Maryland limited liability company (306 W Redwood Street, Suite 200, Baltimore, MD 21201), which is the data controller for the information described below. Contact: privacy@nof-1.net.

2. What we collect

Category	Examples	Why
Account	Email, authentication identifiers (via our auth provider)	Sign you in; keep your report private to you
Training & race	Your race, goal, target, plan, uploaded training sheets	Build and adapt your plan
Wearable / activity	Workouts, heart rate, HRV, sleep, respiration, power/pace — from a connected source (e.g. intervals.icu) or, on iOS, from Apple Health (HealthKit) with your permission	Grade your sessions and compute your analysis on your own data
Workout GPS routes	The routes of activities you record, from your connected activity source	Draw your route maps and heatmap
Photos & journal images	Photos you choose to add to share cards, and the composited images you save to your journal	Stored privately for your journal only — never visible to other users, never used for advertising, never analyzed for any other purpose. A share-card background photo you don't save never leaves your device
App usage	Which views you open, checklist completions, basic diagnostics	Operate and improve the Service
Device (push)	Push token, if you enable notifications	Send the reminders you asked for

We do not collect precise background location, contacts, or advertising identifiers. We do not run third-party ad or analytics trackers.

Apple Health (HealthKit)

On iOS, if you grant permission, we read workout, heart-rate, heart-rate-variability, sleep, and related samples from HealthKit solely to compute your report. Per Apple's requirements: HealthKit data is never used for advertising or marketing, never sold, and never shared with third parties for their own purposes. You can revoke access at any time in the iOS Health app, and you control exactly which data types are shared.

3. How your data is used

• To generate and adapt your single-subject report, plan, and graded analyses.
• To run written summaries: some narrative text is generated with the help of third-party AI processing providers. Your data is not used to train those providers' models.
• To operate, secure, and improve the Service.
• To send notifications you opt into.

We do not use your data to make decisions that produce legal or similarly significant effects about you, and we never sell your personal information.

4. Where it lives (processors)

We use a small set of infrastructure providers who process data on our behalf under contract:

• Cloudflare — application hosting, edge network, and object storage.
• Neon — managed Postgres database.
• Clerk — authentication (sign-in, including Sign in with Apple / Google if you choose them).
• intervals.icu — only if you connect it, as your activity source.
• WHOOP — only if you connect it: we read your recovery, sleep, strain, and workout data solely to build your report.
• Google Calendar — only if you connect it: we access your calendar events and free/busy information solely to schedule and reschedule your training sessions on your own calendar, and we store only an encrypted refresh token. nof-1's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Your Google Calendar data is never used for advertising, never sold, and never used to train AI models.
• Mapbox — renders the map imagery under your GPS lines. It receives a map bounding box, never your identity.
• AI processing providers — to generate written summaries from your data, without training on it.

Connection credentials (e.g. an intervals.icu API key) are encrypted at rest with AES-256-GCM. Your report data is scoped per-account with enforced isolation.

5. Your rights & choices

• Access & export — you can export your report and underlying data.
• Delete — you can delete your account and associated data; deletion removes your report, uploads, and stored credentials.
• Disconnect — you can disconnect any data source at any time; already-ingested data can be deleted on request.
• Revoke HealthKit — manage or revoke Health permissions in the iOS Health app.
• Notifications — turn push on/off anytime.

Depending on where you live (e.g. the EEA/UK under GDPR, or California under CCPA/CPRA), you may have additional rights to access, correct, port, restrict, or object. To exercise any right, email privacy@nof-1.net. We do not sell or "share" personal information as those terms are defined under CCPA/CPRA.

6. Retention

We keep your data for as long as your account is active. If you delete your account, we delete your report data and credentials promptly, except where we must retain limited records to comply with law or resolve disputes. Backups are purged on a rolling schedule.

7. Security

Data is encrypted in transit (HTTPS) and credentials at rest (AES-256-GCM). Accounts are isolated so one user cannot access another's data. No system is perfectly secure, but we design for least-privilege and data minimization.

If a security breach affects your data, we will notify you without undue delay — and within the timelines the law requires — and will notify regulators where required. By using the Service you agree that we may deliver breach notices by email or in-app notice.

8. Children

The Service is not directed to children under 16 and we do not knowingly collect their data. If you believe a child has provided us data, contact us and we will delete it.

9. International transfers

Our providers may process data in the United States and other countries. Where required, transfers rely on appropriate safeguards (e.g. Standard Contractual Clauses).

10. Changes

We'll update this page and the "last updated" date when this policy changes. Material changes will be surfaced in the app.

11. Not medical advice

nof-1 is a general-wellness and self-experimentation tool. It is not a medical device and does not diagnose, treat, cure, or prevent any disease. Its outputs are estimates and proxies graded for confidence, not clinical findings. Consult a qualified professional for medical decisions.

Template notice. This policy is written to accurately reflect how nof-1 handles data, but it is a starting template and should be reviewed by qualified legal counsel before public launch, and localized where required.