RoxDuo — Privacy Policy

Last updated: 18 July 2026

The short version

Your training data lives on your device. Creating an account is optional; if you do, we store only your name, email and consent choices on our EU servers. No tracking, no third-party analytics, nothing is ever sold.

What stays on your device

Your profile, training plan, logged station times, and any partner data you import are stored locally on your iPhone. "Start over" in Profile (or deleting the app) deletes them.

To help us keep the app stable, if the app crashes it reports an anonymous count ("build N crashed M times") to our server — no identifiers, no stack traces, no personal data.

What is sent to our AI provider

To generate your training plan, your training profile — age, sex, height, weight, sport background, fitness level, current running volume, equipment, training days, injuries or limitations, race goal, the race you are training for and its date, station baseline times, the names, dates and finish times of past races you have added or imported, and — only if you choose to sync Apple Health — your resting heart rate, VO2max estimate, heart-rate variability, average sleep hours, daily active energy and recent running and cycling volume — is sent securely to our AI provider (Anthropic) via our server. Your name and identity are never included. This data is used only to generate the plan, is not stored together with your identity, and is never sold. You are asked for consent inside the app before the first generation.

Importing official results

If you choose to import your race results, the surname you type and your search filters are sent directly from your device to the public HYROX results website (results.hyrox.com, operated by the race organiser's timing partner) — exactly as if you searched that website in your browser. RoxDuo has no server in this path and does not see your search. Search results show the same public data the website shows, which can include other athletes with the same surname; RoxDuo only stores, on your device, the result you explicitly choose to import. RoxDuo is not affiliated with HYROX® or its timing providers.

Optional account

You can use every RoxDuo feature without an account. If you choose to create one (Sign in with Apple), we store your name, your email address (or Apple's private relay address if you chose "Hide My Email"), a random account identifier, and your consent choices, on servers operated by our processor Supabase in the European Union (Frankfurt). We use this data to operate your account and — only if you separately opt in — to send you occasional RoxDuo updates by email. You can withdraw that consent at any time with the toggle in Settings. To be able to disconnect Sign in with Apple when you delete your account, we also store the Sign in with Apple token Apple issues at sign-in — it is used only for that disconnection. You can delete your account at any time in Settings → Account → Delete account: this removes your data from our servers and disconnects Sign in with Apple. Your training data is not uploaded and stays on your device.

Device identifier

An anonymous device identifier is sent to our server with plan-generation requests, used only to limit the number of daily requests per device. It is not linked to your identity and is not used for tracking.

Partner data

Sharing times with your doubles partner happens through files you exchange yourselves (e.g. via WhatsApp or AirDrop). RoxDuo has no server that stores or relays partner data.

Notifications

Training reminders are local notifications scheduled on your device. Nothing leaves your phone.

Where processing happens and how long data is kept

Our AI provider (Anthropic) processes plan-generation requests in the United States. API inputs are not used to train models and are retained by the provider for a limited period (around 30 days) for abuse prevention, without your identity attached.

Your rights (EU/GDPR)

Your training data lives on your device, so you can view or delete it yourself at any time (Profile → Start over, or delete the app). Account data can be deleted in-app (Settings → Account → Delete account). For any access, export or deletion request — including server-side request logs — or any other privacy question, email us and we will respond within 30 days. The data controller is Filippo Terzi (contact below).

Age

RoxDuo is not intended for users under 16.

Contact

Questions about privacy: filippo3terzi@gmail.com