Privacy Policy

Last updated: 2026-10-31

SOL is built and run by Ruby Osborne in Auckland, New Zealand ("we", "us", "I"). This policy explains what personal information SOL collects, why, where it goes, and what you can do about it. It is written to match how SOL actually works, not to describe a generic app.

The New Zealand Privacy Act 2020 and its information privacy principles are the frame for this policy. SOL handles health information, which the Act treats seriously, and so do we.

Any question about this policy, or about your own data, goes to ruby.osborne@gmail.com.

1. What SOL collects

Everything below either comes from you directly or comes from Apple Health with your explicit permission. SOL does not buy data, scrape data, or collect information about you from anywhere else.

Account information

• The account identifier that Sign in with Apple gives us, plus whatever name or email address Apple passes on at sign-in. Apple lets you hide your real address behind its private relay, and if you do, that relay address is all we see.
• A session token for each device you sign in on. We store these hashed, not in plain text, and signing out revokes the session.
• There is no SOL password. We never see, hold or store one.

Onboarding questionnaire

What you tell SOL when you set it up:

• your name (or whatever you would like to be called);
• your goals;
• your current training: what you do, how often, how hard;
• how you have been feeling lately, in your own words;
• optional body facts, such as your birth year and height;
• optional menstrual-cycle preferences, including whether you want cycle-aware guidance at all.

You can skip any sensitive question. Cycle questions include a "rather not say" option, and cycle tracking is opt-in: if you do not opt in, SOL does not read or use cycle data. Skipping a question means SOL has less context, not that SOL stops working.

Apple Health data

Only the categories you explicitly grant in the iOS permission sheet. The categories SOL asks for are:

• sleep
• steps
• heart rate
• heart rate variability (HRV)
• weight
• workouts
• opt-in only cycle data, read only if you have turned cycle tracking on

If you deny a category, SOL does not receive it. See section 5 for how Apple Health data is handled and how to revoke access.

What you create while using SOL

• your chat messages with SOL, and SOL's replies;
• your training logs: sessions, loads, how they went;
• your check-ins.

What SOL does not collect

• No advertising identifiers, device fingerprints or location tracking.
• No analytics about how you tap around the app.
• No contacts, photos or camera access for data collection.
• The microphone is used only if you choose voice logging, and only while you hold the button. Your voice is transcribed on your phone by an on-device model: the audio is never stored and never leaves the device. Only the text you confirm (for example "two eggs and porridge") is sent to SOL, the same as if you had typed it.
• No payment details. SOL is currently free, and any future purchase would go through Apple, which does not pass us your card details.

2. Why SOL processes it

One reason: to run the service you signed up for. Specifically, to:

• generate your daily brief;
• generate and adjust your weekly training plan;
• answer you in chat with your own context in mind;
• show your own history back to you;
• keep your account secure and working, and diagnose problems in SOL itself.

That is the whole list. Your data is not used for advertising, for profiling you for anyone else's benefit, for market research, or for training AI models.

3. Where it is stored

SOL's backend runs on Amazon Web Services in the Asia Pacific (Sydney) region, ap-southeast-2. Your data is stored in Amazon DynamoDB in that region.

Sydney is in Australia, so your information is held outside New Zealand. AWS is contractually bound to protect it and processes it only on our instructions. Generating your briefs, plans and replies also involves sending data to Anthropic, which is based in the United States (see section 4).

4. Who else touches your data

Two providers, both acting as processors for SOL, under their own terms and on our instructions. Nobody else.

Anthropic, as the AI processor

SOL's briefs, weekly plans and chat replies are generated by Anthropic's Claude models, accessed through the Anthropic API. To do that, the data a given feature needs is sent to Anthropic for generation. That can include your onboarding answers, relevant health and training metrics, your logs and check-ins, and your chat messages.

Two things matter here:

• Anthropic does not train on it. Under Anthropic's commercial API terms, inputs sent to the API and outputs returned are not used to train Anthropic's models.
• Only what is needed is sent. Data goes to Anthropic to produce something for you, and for no other purpose.

Amazon Web Services, as the host

AWS provides the servers, the database and the infrastructure SOL runs on, in Sydney. AWS stores and transmits your data on our behalf and does not use it for its own purposes.

Who does not get your data

The one exception we have to name: if we were legally required to disclose information, for example under a valid court order, we would comply, and we would tell you unless we were legally prohibited from doing so.

If SOL were ever transferred to someone else, we would tell you before your data moved, and you would have the chance to delete it first.

4a. Sharing with friends, if you choose it

SOL may offer a friends feature. If you connect with a friend, you decide exactly what that friend can see, and the choices are per friend and per category: your training week, your readiness, your fuel. Each one is a separate switch. Everything starts switched off: becoming friends shares nothing by itself. You can switch any of them off again at any time and the change applies immediately, and removing or blocking a friend ends all visibility both ways. A friend can never see your chat, your notes, your measurements, or anything beyond the categories you switched on.

4b. Training together, if you choose it

You can ask to train with a friend towards their training goal. If they accept, everyone training for that goal can see your progress towards it, and nobody else can. That is a separate choice from the switches above: asking to join gives it, and so does accepting someone's request.

What the others in the goal see: your name; how you are doing against your own plan this week and towards your own target, as percentages; and a notification when you complete a significant session, such as your hardest session of the week, a personal best on the goal, a race or test day, or a milestone towards your target. For a run that notification can include the distance and pace, for example "completed a 10 km run at 5:30 pace". People in the same goal can see this even if they are not your friends. If you choose to follow the owner's weekly pattern, SOL uses only the kinds of sessions on each day of their week, never their numbers.

Your plan is always built from your own data, and nobody's numbers are copied into anyone else's account. You can leave at any time, the goal's owner can end it, and removing or blocking someone takes them out of any goal you share, both ways. You can also mute any one person's notifications without leaving.

5. Apple Health data, specifically

Health data from Apple Health gets its own rules, both under Apple's HealthKit requirements and under this policy:

• Only what you grant. SOL reads only the categories you allow in the iOS permission sheet, and nothing else in Apple Health.
• You can revoke it at any time, in Settings › Privacy & Security › Health › SOL on your iPhone, per category. SOL stops receiving that data straight away. Revoking does not delete what SOL already holds, so email us if you want that removed too.
• Never used for advertising or marketing. Apple Health data is never used for advertising, marketing, re-targeting or any similar purpose, and is never sold or shared with data brokers.
• Used only to provide SOL's health and fitness features, which is what you granted it for.
• Cycle data is opt-in. If you have not opted in, SOL does not request or use it.

6. How it is protected

• Sign in with Apple only, so there is no SOL password to be guessed, reused or breached.
• Session tokens are stored hashed, and signing out revokes them.
• Data moves between the app, the backend and our processors over encrypted connections (HTTPS/TLS).
• Data at rest in DynamoDB is encrypted by AWS.
• Access to the backend is limited to the owner, and your data is only ever processed to run your own account.

Being straight with you: SOL is a small product run by one person. We take this seriously and have deliberately kept the number of parties who touch your data as small as possible, which is itself a security decision. But no system is perfectly secure, and we cannot guarantee that nothing will ever go wrong. Section 8 says what we will do if it does.

7. How long it is kept, and deletion

Your information is kept while your account is active, because SOL's whole value is continuity: your plan next week depends on your weeks before it.

We will delete your account and your data on request. Email ruby.osborne@gmail.com from the address linked to your account, or tell us enough to identify it, and ask for deletion. We will confirm, delete your account and the personal information held against it, and confirm again when it is done. We aim to do this within 30 days of verifying the request. If a copy remains in a routine system backup, it is removed as those backups cycle, and it is not used for anything in the meantime.

You can also ask us to delete a specific part of your data, for example your cycle data or a particular conversation, without closing your account.

If you ask us to delete information we are legally required to keep, we will tell you what and why, and delete the rest.

8. If something goes wrong

If there is a privacy breach that has caused, or is likely to cause, serious harm to you, the Privacy Act 2020 requires us to notify the Office of the Privacy Commissioner and the people affected as soon as practicable. We commit to that, and specifically:

• we will tell you what happened, what information was involved and when;
• we will tell you what we are doing about it and what you may want to do;
• we will not wait for certainty to warn you if waiting would leave you exposed;
• we will notify the Privacy Commissioner where the Act requires it.

9. Your rights

Under the New Zealand Privacy Act 2020 you can:

• Access your information. Ask for a copy of the personal information SOL holds about you, and we will provide it.
• Correct it. If something is wrong, ask us to fix it. If we disagree, you can ask us to attach a statement of your requested correction, and we will.
• Have it deleted. As described in section 7.
• Withdraw permissions. Revoke Apple Health categories in iOS Settings, turn cycle tracking off, or stop using SOL entirely.
• Complain. Email us first and we will try to sort it out. You can also complain to the Office of the Privacy Commissioner at privacy.org.nz, and you do not need our permission to do that.

All requests go to ruby.osborne@gmail.com. We will respond as soon as we can and within 20 working days, as the Act requires. We may need to confirm you are who you say you are before releasing or deleting health information, which protects you.

10. Children

SOL is not directed at children and is not intended for anyone under 16. We do not knowingly collect personal information from under-16s. If you believe a child has created an account, email ruby.osborne@gmail.com and we will delete the account and its data.

11. Changes to this policy

SOL is still being built, so this policy will change as the app does. When it changes we will update this page and the "Last updated" date at the top. If a change materially affects how your personal information is collected, used or shared, for example a new processor or a new data category, we will tell you in the app or by email before it takes effect, and where consent is needed we will ask for it rather than assume it.

Older versions are available on request.

12. Contact

Ruby Osborne, Auckland, New Zealand.
ruby.osborne@gmail.com