Privacy Policy

Last updated: 3 August 2026

Kracey (kracey.com) provides an AI training coach that talks to you on Telegram and reads the training data you connect. This page explains, per Art. 13 GDPR, what we store, why, where it lives, and how you stay in control. The short version: we store only what the coaching needs, your identity never enters the AI pipeline, your data is never sold and never used to train AI models, and you can export or erase everything yourself, anytime, from the chat.

Who is responsible

Kracey is the data controller for the processing described here. For any privacy question or request, contact hello@kracey.com.

What we collect and why

Account data (email, name, avatar from Google sign-in): to create and secure your account and to reach you about your service.
Training data (activities, wellness and recovery metrics from intervals.icu, using the API key you provide): so the coach can actually see your training. Your API key is encrypted at rest with AES-256-GCM.
What you tell the coach (chat messages, intake answers, race results you paste): to build and adapt your plan. This can include health context such as injuries, which we treat as special-category data and only process because you chose to share it (see lawful bases below).
Billing data (handled by Stripe): to run your subscription. We never see or store your card number.

Lawful bases

Contract (Art. 6(1)(b)): everything needed to deliver the coaching you signed up for: your account, your training data, your plan, the chat.
Consent (Art. 6(1)(a), and Art. 9(2)(a) for health context): the injury and health details you choose to share at intake or in chat. We tell you this at the moment you connect and in the coach's first message, and we record when you proceeded. Withdraw anytime with /delete.
Legitimate interest (Art. 6(1)(f)): service reminders while you finish setting up, abuse prevention, and the small suppression marker that stops our bots from messaging you after you erase your account. Marketing email, if we ever send it, will be consent-based.
Legal obligation (Art. 6(1)(c)): keeping invoices for bookkeeping.

How the AI handles your data

The coach's replies are generated by Anthropic's Claude API. The request carries your first name and training context only: your email, account id, and payment identity never enter the AI pipeline, and this is enforced by an automated test in our build. Anthropic does not use API data to train models, and we contractually commit in our Terms of Service that your personal data is never sold and never used to train AI models.

What we store, and for how long

The table below is the actual storage map of the product, including what our /delete command removes.

Data	Where	Kept	Removed by /delete
Account: email, name, avatar, Telegram chat id, intervals.icu credentials (API key encrypted with AES-256-GCM), onboarding state, intake quiz answers, trial and subscription status	Postgres (Supabase)	While your account exists	Yes
Race results, including the raw pasted text	Postgres (Supabase)	While your account exists	Yes
Coach working state: your plan, training profile, coaching mode, intake transcript	Redis (Upstash)	While your account exists	Yes
Coach memory: standing preferences and a recent-context summary (can include injury and health context you share)	Redis (Upstash)	Capped: 15 preferences, 900-character summary	Yes
Chat context (rolling conversation window)	Redis (Upstash)	Last 24 turns, expires after 6 hours	Yes
Small operational caches: timezone offset (2 days), approximate location from a recent activity for weather advice (14 days), duplicate-message and reminder markers (up to 14 days), monthly usage meters	Redis (Upstash)	Mostly self-expiring	Yes
A one-value marker that stops our legacy bot from messaging you again	Redis (Upstash)	Durable	No: kept as a suppression record so no bot re-engages you after erasure
Billing records (invoices, the Stripe customer object)	Stripe	Statutory bookkeeping periods	Partially: subscriptions are canceled and stored payment methods detached; invoices are kept (legal obligation)
The Telegram chat itself	Telegram	Per Telegram's own terms	Not ours to delete: Telegram is the messaging channel you chose; you can delete the chat in your Telegram app

Who processes data for us

We use a small set of processors, each under a data processing agreement. Where a provider processes data outside the EEA, the transfer is covered by Standard Contractual Clauses.

Provider	Role	Region	Safeguards
Anthropic	AI processing (the coach's replies). Receives first name and training context only, never your email, account id, or payment identity.	United States	DPA with Standard Contractual Clauses (SCCs); API data is not used to train models
Stripe	Payments and subscriptions	United States and global	DPA with SCCs, incorporated in Stripe's terms
Vercel	Application hosting	Global edge, provider-managed	DPA with SCCs, incorporated in Vercel's terms
Supabase	Postgres database (account, race results)	European Union (Frankfurt)	DPA with SCCs, incorporated in Supabase's terms
Upstash	Redis store (coach memory, plan, short-lived chat context)	European Union (Frankfurt)	DPA with SCCs, incorporated in Upstash's terms
Resend	Transactional email (onboarding reminders)	United States	DPA with SCCs, incorporated in Resend's terms
Google	Sign-in (and calendar sync if you enable it); Google Analytics, only after you accept the cookie banner	United States and global	DPA with SCCs, incorporated in Google's terms
Meta	Meta Pixel for ad measurement, only after you accept the cookie banner	United States and global	Consent-based; governed by Meta's business tools terms
Microsoft	Clarity for anonymized usage replays, only after you accept the cookie banner	United States and global	Consent-based; DPA incorporated in Microsoft's terms
PostHog	Cookieless web analytics: no cookies, no persistent identifiers, runs without consent because it cannot track you as an individual	European Union (Frankfurt)	DPA with SCCs; EU data residency

Telegram is not a processor for us: it is the messaging channel you chose. Your chat with the coach travels through Telegram under Telegram's own terms, like any other Telegram conversation. We do not claim end-to-end encryption for bot chats, because Telegram bot chats do not have it.

Your rights, and the buttons for them

You have the GDPR rights of access, rectification, erasure, portability, restriction, and objection, plus the right to withdraw consent and to complain to your supervisory authority. The first two you can exercise yourself, instantly, in the chat:

/export sends you a JSON file with everything we store about you: account, race results, coach memory, and recent conversation.
/delete permanently erases your account, coach memory, plan and race history, and cancels any subscription, after one explicit confirmation. Invoices are kept for bookkeeping only.
Everything else (rectification, restriction, objection, or any question): hello@kracey.com. We respond within one month.

Cookies and analytics

Analytics and measurement tools that use cookies (Google Analytics, Meta Pixel, Microsoft Clarity) load only after you accept the cookie banner. Before you choose, and if you decline, none of them load and no tracking cookies are set; the site works exactly the same either way. Your choice is stored in your browser; clear this site's data to be asked again. Separately, we measure aggregate traffic with PostHog in cookieless mode, hosted in the EU: it sets no cookies, stores no persistent identifier, and cannot follow you across visits, which is why it runs without a consent prompt. We do not sell or share your personal information for advertising.

California residents

We do not sell or share your personal information as defined by the CCPA/CPRA, and you can exercise your access and deletion rights via /export, /delete, or hello@kracey.com.

Changes and contact

When this policy changes materially, we update the date above and tell active users in the product. Questions, requests, or concerns: hello@kracey.com.