Privacy policy

Version of 27 July 2026.

Djok processes health data. This document states which data, where it goes, and how to retrieve or erase it.

The French version is the reference text; this translation is provided for convenience.

1. Data controller

Cédric Cecilie, Martinique, France.
Contact: [email protected]

Djok is a personal project, run at small scale and by invitation.

2. Data processed

Identity and sign-in

Email address (your sign-in identifier)
First name, if set on your intervals.icu profile
Session tokens and device tokens (notifications), stored encrypted

Training data, from intervals.icu

Activity summaries: date, duration, distance, elevation, sport, average power and heart rate
Second-by-second series: power, heart rate, cadence, altitude, speed, temperature, respiration, left/right balance, R-R intervals
Planned workouts on your calendar, FTP and zones

GPS positions are not ingested. No route traces are stored: no feature needs them.

Health data

Heart rate variability (HRV)
Sleep duration and quality
Resting heart rate
Weight

These are special category data under Article 9 of the GDPR. They are processed only on your explicit consent, and only to provide you with training and nutrition guidance.

What you enter yourself

Your food intake: the macronutrient amounts you declare having consumed, which decrement the day's counters
Your goals, preferences and dietary constraints

Djok gives you a macronutrient target; it does not guess what you eat, analyses no meal photographs and infers nothing. It knows about your diet only what you have told it.

Conversations

Your messages to the coach and its replies, kept so the conversation has a memory

3. Purposes and legal bases

Purpose	Legal basis
Providing coaching (analysis, guidance, workouts)	Explicit consent (Art. 6(1)(a) and 9(2)(a) GDPR)
Authenticating you and securing your account	Performance of the service
Sending you training notifications	Consent (revocable in your device settings)

No data is sold, rented or otherwise transferred. No advertising, no ad profiling, no trackers.

4. Who receives your data

Djok relies on technical service providers. This is the complete list, what each one receives, and where it is established.

Provider	What it receives	Country
intervals.icu	Source of your training and health data. Writes planned workouts and your FTP, on your confirmation	South Africa
Anthropic (Claude)	Your conversations, your training context and your declared food intake, to generate the coach's replies. This is the most sensitive recipient: it sees your health data in context	United States
Google (Firebase Cloud Messaging)	Your device token and the content of notifications, therefore an extract of your training data	United States
Resend	Your email address and sign-in codes	United States
Open-Meteo	Approximate coordinates (island scale) for the day's weather. No personal data	Germany
Hostinger	Server and database hosting	European Union

What does not leave

The semantic search engine and the vector database are self-hosted on our own server. Embedding computation, the nutrition knowledge base and all of your stored activity data pass through no third-party service.

This site uses no cookies, no analytics, and loads no external fonts or scripts.

Transfers outside the European Union

Anthropic, Google and Resend are established in the United States. These transfers rely on the European Commission's standard contractual clauses and, where applicable, on the Data Privacy Framework. If those transfers are a problem for you, do not use Djok: they are inseparable from the service.

5. Retention

Data	Retention
Activities, wellness, weight, food intake, goals, conversations	As long as your account exists
Session token	90 days, or until you sign out
Sign-in code	10 minutes, and destroyed as soon as it is used
Database backups	14 rolling days

When you delete your account, your data is erased from the live database immediately. It disappears from backups within 14 days at most.

6. Security

All traffic goes over HTTPS.
Sign-in codes and session tokens are never stored in clear text: the database holds only a keyed cryptographic fingerprint, useless on its own.
On iOS, your token lives in the system-encrypted Keychain, readable only while your phone is unlocked.
The database is not exposed to the internet: it is reachable only from the application server.

7. Your rights

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to withdraw your consent at any time. Write to [email protected]: we respond within 30 days.

Cutting off access to your training data

You do not need us: the authorisation granted to Djok is revoked directly from your intervals.icu account, application by application. Revocation is immediate and Djok stops receiving your new data at once.

If you believe your rights are not being respected, you may lodge a complaint with the French supervisory authority, the CNIL.

8. Minors

Djok is not intended for people under 16 and does not knowingly collect their data.

9. Changes

Any change to this policy will be published on this page with a new version date. A change affecting the recipients of your data will be notified in the application.