Privacy Policy — Glycogo

The short version: Glycogo collects only what is necessary to provide the service. We do not sell your data. Your nutrition and training data is yours. You can request deletion at any time. This policy explains exactly what we collect, why, and how it is used.

1 Who We Are

Glycogo is operated by GEM Performance, owned by G.E. McConnochie PhD, based in New Zealand. When this policy refers to "we", "us", or "our", it means GEM Performance.

Contact: contactgemperformance@gmail.com

2 What Data We Collect

We collect the minimum data necessary to provide Glycogo's features:

Data	Why we collect it	Stored where
Email address	Account creation, login, and transactional emails	Supabase
Password (hashed)	Authentication — never stored in plain text	Supabase
Display name	Personalisation within the app	Supabase
Nutrition logs	Food tracking, targets, and trend analysis	Supabase
Body weight & macro targets	Calculating personalised nutrition targets	Supabase
Training sessions (via Intervals.icu)	Scaling nutrition targets to training load	Supabase
Intervals.icu API key	Syncing training data on your behalf	Supabase (encrypted)
Payment information	Subscription billing	Stripe only — never on our servers
AI chat messages	Generating personalised nutrition responses	Sent to Groq, not stored by us

3 How We Use Your Data

Your data is used only to provide and improve Glycogo. Specifically:

To authenticate your account and maintain your session.
To calculate and display personalised nutrition and carbohydrate targets.
To sync training sessions from Intervals.icu and generate fuel targets.
To power the AI nutrition assistant with context about your training and food log.
To send transactional emails (account verification, password reset) via Resend.
To process subscription payments via Stripe.
To analyse anonymised, aggregated usage patterns to improve the app.

We do not use your data for advertising. We do not sell your data to any third party.

4 Third-Party Services

Glycogo uses the following third-party services to operate. Each has its own privacy policy:

Supabase — database and authentication. Data stored on Supabase servers. Privacy policy
Stripe — payment processing. Payment data is handled entirely by Stripe and never touches our servers. Privacy policy
Groq — powers the AI nutrition assistant. Your chat messages and relevant context (training sessions, food log) are sent to Groq to generate responses. Groq does not use API data to train models. Privacy policy
Intervals.icu — training data sync. Only accessed when you connect your account and only reads session data you authorise. Privacy policy
Resend — transactional email delivery (verification, password reset). Privacy policy

5 Cookies and Sessions

Glycogo uses a single session cookie to keep you logged in across visits. This cookie stores your Supabase refresh token and expires after 30 days or when you log out.

We do not use advertising cookies, tracking pixels, or analytics cookies. No third-party tracking scripts are loaded on the app.

6 Data Retention

Your data is retained for as long as your account is active. If you delete your account:

Your personal data and nutrition logs are deleted within 30 days.
Anonymised aggregate data (e.g. total number of logs) may be retained.
Stripe retains payment records as required by financial regulations.

7 Your Rights

Under the New Zealand Privacy Act 2020, you have the right to:

Access the personal information we hold about you.
Request correction of inaccurate information.
Request deletion of your account and associated data.
Withdraw consent for data processing (this will require account deletion).

To exercise any of these rights, email us at contactgemperformance@gmail.com. We will respond within 20 working days as required by law.

8 Data Security

We take reasonable steps to protect your data:

All data is transmitted over HTTPS.
Passwords are hashed by Supabase and never stored in plain text.
Your Intervals.icu API key is stored encrypted.
Payment data never passes through our servers — handled entirely by Stripe.
Access to the database is restricted and authenticated.

No system is completely secure. If you believe your account has been compromised, contact us immediately.

9 Children's Privacy

Glycogo is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

10 Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page. For significant changes, we will notify you by email. Continued use of Glycogo after changes constitutes acceptance of the updated policy.

11 Governing Law

This Privacy Policy is governed by the laws of New Zealand, including the Privacy Act 2020. Any disputes will be subject to the jurisdiction of the New Zealand courts and the Office of the Privacy Commissioner.

Questions or requests regarding your privacy?

contactgemperformance@gmail.com

GEM Performance · G.E. McConnochie PhD · New Zealand