Privacy policy

Last updated 15 October 2026

Mistress ("the app") is provided by Kodwerk AB, Altartorpsvägen 6, 141 70 Segeltorp, Sweden ("we"). Contact: hello@kodwerk.se. This policy explains what data the app uses, why, and where it goes.

Data we access

• Google Health (Fitbit) — with your permission, read-only access to activity and fitness data, health metrics and measurements (for example heart rate, heart-rate variability, resting heart rate, VO2 max, weight) and sleep data.
• Apple Health — with your permission, read access to workouts, sleep, heart rate, HRV, resting heart rate and related metrics, and write access for workouts the app records. Apple Health data stays on your devices and in your own iCloud.
• intervals.icu — activities, wellness data, sport settings (FTP, zones) and your training calendar; the app writes planned workouts to your intervals.icu calendar.
• Strava — activities, shown back to you only.
• Calendar — start and end times of busy events, read on your device to find training windows. Event titles are not sent anywhere.
• Your settings — the time you allow per day, preferred training times and goals.

How we use it

Only to provide the app's coaching: computing readiness and training load, merging duplicate activities, finding training windows, and generating and delivering your training plan. We do not sell data, use it for advertising, or build profiles for anyone else.

Where data is stored

• On your devices and in your own iCloud account (Apple CloudKit private database). We cannot read it.
• Access tokens for connected services are stored in your device Keychain (iCloud Keychain).
• Our server (a Cloudflare Worker, EU storage) stores no health or activity data. It keeps only an invite list and per-user usage counters, and relays requests that need a server-side secret.

AI processing

To write your training plan, the app sends a compact summary — readiness metrics, recent training load, available time windows and your goals — through our server to Anthropic's Claude API. Anthropic processes it to return the plan and, under its commercial terms, does not use API data to train its models. Data from Strava is never sent to any AI service.

Google user data — Limited Use

Mistress's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is used only to provide the coaching features described above, is not transferred to others except as needed to provide those features (the AI processing described above), for security, or to comply with law, is never used for advertising, and is not read by humans unless you ask us to for support or it is required for security or by law.

Sharing

We share data only with the processors needed to run the app: Cloudflare (hosting), Anthropic (AI planning) and the services you choose to connect. We do not share it with anyone else.

Retention and deletion

Data on your devices and iCloud is deleted when you delete the app's data or the app. You can revoke access at any time in your Google account, Apple Health settings, intervals.icu and Strava. To have your invite and usage counters removed from our server, email hello@kodwerk.se.

Your rights

Under the GDPR you may request access to, correction of, or deletion of your personal data, and you may complain to the Swedish Authority for Privacy Protection (IMY). Contact us at hello@kodwerk.se.

Changes

We will update this page if anything changes and note the date above.