Privacy policy.
We sell a coach, not your data. This page explains exactly what we collect, why, where it lives, and how you delete it. Written for humans, reviewed by lawyers.
Who we are.
Ihmi Oy is a Finnish private company, registered in Helsinki, building a private AI performance coach for the App Store. We are the data controller for the personal data described below.
You can reach our data protection officer at dpo@ihmi.app for anything in this document.
What we collect.
We only collect what the coach needs to work, and we say it out loud:
- —Account: name, email, role, country, hashed password.
- —Subscription: Apple In-App Purchase receipt, plan, renewal status. We never see card numbers.
- —Health & training: anything you opt to sync from Apple Health, Oura, Whoop, Strava, Garmin. Heart rate variability, sleep stages, training load, steps, weight, workouts.
- —Coach interactions: your journal entries, voice notes, chat with the coach. End-to-end encrypted.
- —Device telemetry: app version, iOS version, crash reports. Anonymized.
We do not collect contacts, photos, location, microphone or camera unless you grant a specific permission, and we never collect them in the background.
Why we collect it.
| Data | Purpose | Legal basis |
|---|---|---|
| Account | Operate the app | Contract (GDPR 6(1)(b)) |
| Subscription | Bill, support, accounting | Contract & legal obligation |
| Health & training | Personal coaching, recovery & training plan | Explicit consent (GDPR 9(2)(a)) |
| Journal & chat | Provide AI coaching | Explicit consent |
| Telemetry | Fix crashes, improve quality | Legitimate interest |
How the AI coach works.
The coach is a large language model fine-tuned on coaching transcripts and journaling protocols. Three commitments, written into the architecture:
- —Your data never trains a public model. Not ours, not anyone else’s.
- —Per-request inference: your data is sent to the model only to answer your question, then dropped. No long-term provider retention.
- —On-device first: summarization, baseline analysis and trend detection run on your iPhone. Only the question and minimal context reach the model.
We use OpenAI and Anthropic as sub-processors under data-processing agreements with zero-retention and no-training clauses.
Where it lives.
Primary storage is in the EU — Frankfurt and Helsinki regions on Amazon Web Services. Backups are encrypted with customer-managed keys and stored in the same EU regions.
Health data is encrypted at rest with AES-256-GCM. Journal entries, voice notes and coach chats are end-to-end encrypted with a key derived from your device passcode; we cannot read them.
No transfers outside the EU/EEA except for App Store receipts handled by Apple under their own DPA.
Your rights.
Under GDPR you have the right to access, rectify, port, restrict and erase your data, and to object to processing. We also give you a one-tap export and a one-tap delete from inside the app.
- —Export — Settings → Privacy → Export. JSON archive, ready in minutes.
- —Delete — Settings → Privacy → Delete account. Health data is wiped within 24 hours; backups purge within 30 days.
- —Revoke consent for AI processing without deleting the account — Settings → Privacy → AI Coach.
You can lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) if you believe we got something wrong.
How long we keep it.
| Data | Retained for |
|---|---|
| Account | While active, then 30 days |
| Health & training | While active, then 30 days |
| Journal & chat | While active, then 30 days |
| Subscription receipts | 6 years (Finnish accounting law) |
| Telemetry & crash reports | 90 days |
Children.
Ihmi is for adults. We do not knowingly collect data from anyone under 18, and the App Store rating reflects this.
Data processing agreement.
If you are using Ihmi through a company subscription, your employer’s legal team can request a DPA at dpa@ihmi.app. We sign the SCCs and the EU Cloud Code of Conduct.
Changes to this policy.
We will tell you at least 30 days before a material change, via email and in-app notice. Old versions remain at /privacy/history.