Privacy policy

Version of 27 July 2026.

Djok processes health data. This document states which data, where it goes, and how to retrieve or erase it.

The French version is the reference text; this translation is provided for convenience.

1. Data controller

Cédric Cecilie, Martinique, France.
Contact: djok@castlecloud.fr

Djok is a personal project, run at small scale and by invitation.

2. Data processed

Identity and sign-in

• Email address (your sign-in identifier)
• First name
• Session tokens and device tokens (notifications), stored encrypted

Training data, from Wahoo

• Activity summaries: date, duration, distance, elevation, sport, average power and heart rate
• Second-by-second series: power, heart rate, cadence, altitude, speed, temperature, respiration, left/right balance, R-R intervals
• Workouts planned in SYSTM

Data produced by Djok

• Workouts on the Djok calendar, FTP, zones, training load and form computed from your rides

The GPS trace of each ride is kept, trimmed by 200 metres around the start and the finish — the cut happens at write time, those points are never stored. It feeds the ride map, personal segments and reusable routes.

Health data, from Polar

• Heart rate variability (HRV)
• Sleep duration and its stages (light, deep, REM)
• Resting heart rate, overnight respiration
• Weight, height, date of birth

These are special category data under Article 9 of the GDPR. They are processed only on your explicit consent, and only to provide you with training and nutrition guidance.

What you enter yourself

• Your food intake: the macronutrient amounts you declare having consumed, which decrement the day's counters
• Your goals, preferences and dietary constraints
• The town you declare : its name and coordinates, used only to fetch weather and air quality at the right place. It is optional — without it, Djok falls back to your region's main town. No location is read from your phone : you pick the town from a list.
• The routes you create: a route taken from a ride, or generated from the points you drop on the map. The trace is kept trimmed by 200 metres at each end, like a ride's; the start point and the two ends of an out-and-back are not stored, only the intermediate waypoints are.

Djok gives you a macronutrient target. A meal photo or a free-text description may be sent to a model to propose a list of foods; the image is not kept, and that proposal enters no counter until you confirm it. Djok therefore knows about your diet only what you have declared — never what it might have guessed.

Conversations

• Your messages to the coach and its replies, kept so the conversation has a memory

3. Purposes and legal bases

No data is sold, rented or otherwise transferred. No advertising, no ad profiling, no trackers.

4. Who receives your data

Djok relies on technical service providers. This is the complete list, what each one receives, and where it is established.

What you choose to make public

An activity can be shared through a link. The page it opens is public : it asks for no account and no password, and anyone holding the address can read it. Sharing is a deliberate act, never enabled by default, and it applies to one activity at a time.

• The link expires by itself after 24 hours, after which the address returns nothing. Its secrecy rests solely on being unguessable : an address passed on to someone else, or published, stays readable for that period.
• The track is trimmed by 200 metres around both start and finish, and this happens when the ride is recorded, not when it is displayed : those points are therefore never stored. The rest of the route does become visible.
• The page shows distance, duration, elevation gain, and average speed, power and heart rate. It shows neither the written session analysis, nor the perceived effort you logged, nor your threshold power or any figure it could be derived from.
• That page is served by our own server, with no cookie, no analytics and no third-party map tiles : reading it tells nobody but us.

Transfers outside the European Union

Anthropic, Google and Resend are established in the United States. These transfers rely on the European Commission's standard contractual clauses and, where applicable, on the Data Privacy Framework. If those transfers are a problem for you, do not use Djok: they are inseparable from the service.

5. Retention

When you delete your account, your data is erased from the live database immediately. It disappears from backups within 14 days at most.

6. Security

• All traffic goes over HTTPS.
• Sign-in codes and session tokens are never stored in clear text: the database holds only a keyed cryptographic fingerprint, useless on its own.
• On iOS, your token lives in the system-encrypted Keychain, readable only while your phone is unlocked.
• The database is not exposed to the internet: it is reachable only from the application server.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time. Write to djok@castlecloud.fr: we respond within 30 days.

If you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority, the CNIL.

8. Minors

Djok is not intended for people under 16 and does not knowingly collect their data.

9. Changes

Any change to this policy will be published on this page with a new version date. A change affecting the recipients of your data will be notified in the application.