PERFORM ARC Privacy Policy

Data we process

• Account data: name, email, user role and authentication records.
• Athlete profile, competition calendar, training plans, execution logs and coach notes.
• Manual readiness data such as sleep, resting heart rate, wellbeing, fatigue, soreness, pain and body weight.
• With explicit consent: sleep, steps, heart rate and resting heart rate, workouts, distance, speed, oxygen saturation and calories available through Apple Health, Health Connect or a supported watch connection.
• Technical security and synchronization records required to operate the service.

Purpose and access

PERFORM ARC uses these data to display readiness, support training-load analysis, track plan execution and provide the coach-athlete workspace.

Athletes see their own information. A linked coach can see information needed to manage that athlete's training. Role and athlete-access checks limit workspace access.

Health-data boundaries

Health synchronization is read-only. PERFORM ARC does not write samples to Apple Health or Health Connect, sell health data, use it for advertising or cross-app tracking.

Raw health records are not sent to an external AI service. PERFORM ARC may use deterministic calculations inside the service for readiness and training-load views.

Consent and revocation

PERFORM ARC requests app-level consent before reading or uploading supported health data. System permission is requested separately by Apple Health or Health Connect.

You can revoke PERFORM ARC consent in Privacy settings. This stops new reading, background synchronization and uploads on that device. Consent on another device and the operating-system permission are managed separately. Revocation does not delete data already synchronized; use account deletion for that.

Voluntary cycle journal

An athlete may separately choose to store bleeding start/end dates, optional pain ratings and the reported impact on training. A separate choice allows currently linked coaches to view these records. Neither a coach nor an administrator can enable collection on the athlete's behalf. Declining does not limit other platform features.

Turning off sharing blocks subsequent coach requests. Turning off collection hides retained records and stops new entries; re-enable the private journal without sharing to review or delete them individually. Deleted observations are cleared from the active database; backups follow the protected backup lifecycle. The journal is not kept in offline caches or sent to external AI, advertising or model-training services. Dates do not determine a predicted cycle phase or automatically change readiness scores or training plans.

Technical error monitoring

To investigate software failures, our server sends minimized technical error records to Sentry in the EU region. These identify the error category and application component, not the athlete. Mobile and web reports use the authenticated PERFORM ARC service; they do not connect directly to Sentry.

Before forwarding, we discard original error messages, user names and identifiers, email addresses, passwords, session tokens, request contents, health data, training records and coach messages. Session recording, advertising tracking and Sentry's generative AI features are disabled. Diagnostic reporting is best-effort and does not replace your training records.

Account recovery and bot protection

When password recovery is enabled, we send account security messages from accounts@performarc.app. Reset links expire after 30 minutes, work once and are stored in the application database as hashes. A successful reset signs out previous sessions.

When enabled on registration and recovery forms, Cloudflare Turnstile processes technical browser and network signals to check for automated abuse. Our verification requests do not include passwords, recovery links, training records or health data. The application also uses request limits to protect accounts and prevent unwanted email.

Storage, retention and security

Data are sent over encrypted connections and stored on PERFORM ARC infrastructure. Account, training and synchronized health data are kept while the account is active or until a valid deletion request is completed.

Security, fraud-prevention or legal records may be retained where required. Backup copies expire through the normal protected backup lifecycle.

Account deletion and contact

An authenticated user can request deletion in the mobile app under Privacy. A public request path is also available on the account-deletion page. Requests are scheduled for completion within 30 days and can be cancelled before completion.