Privacy Policy

Last updated: 25 October 2026

1. Who we are

CompeteCue is built and operated by Kourosh Sadr Momtaz ("we", "us"), a sole trader based in the United Kingdom and the data controller for the little we process. For anything in this policy, contact kourosh@kourosh.design.

2. The app: local-first by design

Everything you enter in the CompeteCue app — your name, photo, date of birth, measurements, activity level, dietary requirements, allergies, medical declarations, medications, equipment, races and checklist progress — is stored in a database on your device only. It is not uploaded to us, synchronised to a cloud, or shared with anyone. The app works fully offline and requires no account.

Health information (medical conditions and medications) is special category data under UK and EU data-protection law. CompeteCue asks for it solely so the app can hold back guidance that could interact with a condition or medication. None of it is ever sent to us: we have no access to it, it appears in no backup we operate, and it is deliberately excluded from the crash reports described in section 6. The app on your device processes it, at your instruction, and you can change or delete it there at any time. Every health field is optional — leave one empty and the app simply has less to go on. We built it this way so that the health information you record in the app never reaches us.

Apple Health — with your permission, the app can read your date of birth, height, weight and biological sex from Apple Health to pre-fill your profile and to tell you when the weight there differs from the one your plan uses; your workouts, so recent runs can suggest an expected finish time, a race-day workout can be offered as your result, today's logged training can suggest the session on the Meals tab, and your recent months can suggest an activity level — every one of these is a suggestion you can take or ignore, and nothing is saved without you; your sleep, so recent nights can be shown alongside the rest targets in your plan; and — behind a separate, explicit opt-in — your logged period dates and flow, which it uses to estimate where race day falls in your cycle and show supportive sleep, heat, fuelling and hydration notes. Everything read from Apple Health is processed on your device only: it is never sent to a server, never shared, and reproductive-health data is additionally never written to any cloud backup we control. You can revoke access at any time in the Health app's sharing settings, and turn cycle cues off in the app.

Because your data lives with you, it is also deleted by you: removing the app (or using your phone's app-data controls) permanently deletes everything. Two copies can exist outside the app, both made by you. A backup file you export (Account → Your data → Export data) contains everything you have entered, including any medical declarations and medications, so keep it somewhere private. A backup of the whole phone (for example to iCloud) includes the app's database, and is governed by Apple's terms, not ours.

3. What the app requests over the network

Apart from the crash reports in section 6, the app makes three kinds of request. None of them carries anything you have entered in the app, and none needs an account:

• The event catalogue — CompeteCue operates a small server, hosted by Railway, that maintains a public catalogue of fitness events. The app downloads the latest copy at most once every six hours, and uses the copy built into it when there is no signal. The request asks for public listings and sends nothing about you, but like any web server, ours receives the IP address your connection is using, and its logs record it. Railway stores those logs in the United States for 90 days and then deletes them automatically.
• Race-day weather — the app asks MET Norway for the forecast at the event venue. The request carries the venue's coordinates — a public fact about the event, not about you — plus the ordinary network metadata (such as your IP address) that any web request carries. Nothing you have entered in the app is included. Forecast data is published by the Norwegian Meteorological Institute under NLOD and CC BY 4.0.
• App updates — each time it starts, the app asks Expo's update service (u.expo.dev) whether a newer version of its code is available, and downloads it if there is one. This is how fixes reach your phone without waiting for an App Store release. The check carries your IP address, your phone's operating system, which version of CompeteCue's code it is running, and a random identifier (sent as EAS-Client-ID) that the update library creates the first time the app runs and that is deleted with the app. That identifier is not derived from your device or from anything you have entered; Expo uses it to tell whether an install has downloaded an update. Expo handles the check under its own privacy policy.

Our server keeps no user accounts and no database of personal data, and we do not combine its logs with anything else or use them to identify anyone. Where a legal basis is required for the processing above — the IP address each request carries, and the identifier in the update check — we rely on legitimate interests (Article 6(1)(f) UK GDPR): delivering the event listings, the forecast and fixes to the app you are using, in the least data-hungry way we can.

4. Notifications

Reminder notifications (carb-loading windows, packing checks, travel bookings) are scheduled locally on your device by the app. They are not sent from our servers, and we do not know whether or when they fire.

5. This website

This site sets no cookies. To understand which pages are read, it uses Vercel Web Analytics — a cookieless service that reports aggregate page views and referrers. It stores nothing on your device, builds no personal profile, and does not track you across sites; see Vercel's Web Analytics privacy statement. Our lawful basis is legitimate interests: seeing which pages are useful so we can improve them.

You can turn it off. The button below stops this browser sending page views from the next page you open, and the choice is kept in this browser only. If your browser sends the Global Privacy Control signal, analytics is off already and stays off.

The site is hosted on Vercel, whose infrastructure records short-lived server logs (such as IP address and requested page) for security and operations; see Vercel's privacy policy. We do not combine or enrich these logs.

6. Crash reports

When the app crashes or hits an unexpected error, it can send a diagnostic report so the fault can be found and fixed. It is the only request the app makes that describes what happened inside it, and it is the reason a crash on your phone can be repaired rather than guessed at.

What a report contains: the error and where in our code it happened, the app version and build number, the iOS version, and the device model (for example "iPhone 15 Pro"). A report sent after a crash that closed the app is assembled by the reporting library itself, and carries a little more: your device's language and region setting, and its screen size and memory. The reporting service also adds a rough location at its end — described below.

What it never contains: your name, email, photo, date of birth, measurements, activity level, dietary requirements, allergies, medical conditions, medications, equipment, races, results or checklist progress. The app is configured not to attach personal data to reports, and the values you type are stripped before a report leaves the device rather than filtered afterwards.

The code we removed: crash reports used to carry a code the reporting library derives from your device and this app — the same code each time, so in principle it distinguished one phone's crashes from another's. An earlier version of this policy said we could not remove it without losing the reports; we have since found the way, and the app now clears it before a crash can be recorded. One narrow gap remains, and we would rather say so than claim otherwise: a crash in the first moments of launch, before the app has finished starting, can still carry it.

A rough location we never ask for: every request sent over the internet carries the IP address your connection is using — the ordinary network metadata described in section 3. The reporting service turns that address into a rough area: your country, region and nearest town or city, never a street and never a precise position. It stores that alongside the report. The app does not have location access and never asks for it, and nothing read from Apple Health is involved — this is worked out at the service's end, from the connection itself. We have told them not to store the IP address and they no longer do, but the rough area derived from it stays, and no setting available to us removes it.

Reports are processed on our behalf by Sentry under a data-processing agreement. We keep them only while they are useful for diagnosing the fault: Sentry deletes each report automatically after 30 days, and we neither extend that period nor copy reports anywhere else.

Your choice: the app asks before anything else whether to send crash reports, and the switch stays in Account → Privacy, where turning it off stops reports at once. If you have not chosen, reports start switched off in the European Economic Area (the EU, Iceland, Liechtenstein and Norway), where reading device details for them needs your consent, and wherever the app cannot tell your region; elsewhere, including the UK, they start switched on. In the UK our lawful basis is legitimate interests — keeping the app working for the people using it — which we consider proportionate because a report carries nothing you entered and nothing that identifies you as a person; in the European Economic Area it is your consent, which you can withdraw with the same switch.

7. Emails you send us

If you email us — for support, to report a problem, to join the test group or for any other reason — we receive your email address, your name if you give it, and whatever you write or attach. We use it only to reply and to fix what you report, which is our legitimate interest and, where you ask for something, yours. The inbox is hosted by Microsoft under its business data-processing terms. We keep correspondence while we are dealing with it and for up to two years afterwards, in case the same problem returns, then delete it. Please do not send medical details we have not asked for: we cannot advise on them, and we would rather not hold them.

8. Where processing happens, and what leaves the UK

What you enter does not travel at all: it stays in the database on your phone, so there is no transfer of it to disclose. This section covers the six services that do receive something.

• Sentry receives the crash reports in section 6 and is a US company, so those reports are transferred outside the UK and the EEA. Our data-processing agreement with them incorporates the European Commission's standard contractual clauses together with the UK Information Commissioner's International Data Transfer Addendum, which is the safeguard relied on for that transfer.
• Expo (650 Industries, Inc.) receives the update check in section 3 and is a US company, so that check is transferred outside the UK and the EEA. Expo participates in the EU–US Data Privacy Framework and its UK Extension, which is the safeguard relied on for that transfer.
• Railway hosts our catalogue server and is a US company, so the request logs described in section 3 are held outside the UK and the EEA. They record the IP address a request for public listings came from, and nothing you have entered.
• Vercel hosts this website and provides the cookieless analytics in section 5, and is likewise a US company; the same clauses and Addendum apply to the short-lived server logs described there.
• Microsoft hosts the inbox in section 7 and is a US company. It participates in the EU–US Data Privacy Framework and its UK Extension, which is the safeguard relied on for any transfer of your emails outside the UK.
• MET Norway receives the weather requests in section 3. Norway is in the EEA and covered by the UK's adequacy regulations, so no additional safeguard is needed. The request carries the venue's coordinates, not you.

9. Your rights

Under UK GDPR and EU GDPR you have rights of access, rectification, erasure, restriction, portability and objection. Because we hold no account and no copy of what you enter, most of these are exercised directly on your device — your data is already in your hands, and deleting the app erases it. What we do receive — the crash reports in section 6 and our server's request logs in section 3 — carries nothing that identifies you as a person, so we cannot look yours up from your name or email; you can stop crash reports at any time in Account → Privacy. The update check goes to Expo rather than to us, and Expo's privacy policy explains how to exercise your rights with them. For emails you have sent us (section 7), every right applies in the ordinary way: ask, and we will send you a copy, correct it or delete it.

If you are unhappy with how we have handled your personal data, tell us first at the address in section 1. We will acknowledge your complaint within 30 days and tell you what we are doing about it. You also have the right to complain to a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk); in the European Union, the data protection authority of the country where you live.

We make no automated decisions that produce legal or similarly significant effects about you. The app tailors a plan to what you tell it, but that happens on your phone, to guidance you are free to ignore, and no profile of you is built anywhere.

If you are a resident of a US state with a consumer-privacy law (such as the CCPA/CPRA in California), the same picture applies. We do not sell personal information or share it for advertising, the app contains no advertising or tracking code, and it sends us nothing you have entered — only the requests in section 3 and the crash diagnostics in section 6. If your state has a consumer health data law, such as Washington's, see our Consumer Health Data Privacy Policy.

10. Children

CompeteCue is not directed at children and is intended for adults aged 18 and over. We do not knowingly process children's data — by design, we process almost no data at all. If you are under 18, please do not use the app.

11. Changes

If the app ever gains features that change this picture (for example, optional cloud backup or a community service), this policy will be updated first and the change will be dated. Where a feature would send anything you have entered — anything in the section 2 list — the app will ask you first. The requests in section 3 are sent without asking, and crash reports follow the choice described in section 6; both are described here precisely because they carry none of it.

If paid plans are introduced, purchases will go through Apple, and the app will use a service to check what you have bought. Before anything is on sale, this policy will say exactly what that service receives.