Privacy Policy

FORM2 builds race-training plans and supports their execution with training, nutrition, sleep, recovery, body composition and longevity data. Because that data is personal and often sensitive, privacy is a first-class design constraint, not an afterthought. This policy explains what we collect, why, where it lives, and the control you have over it.

1. Who we are

FORM2 ("FORM2", "we", "us") is a mobile application, available on iOS and Android, operated by the makers of Free60. FORM2 and Free60 share a common, secured backend infrastructure. For any privacy question you can reach us at [email protected].

2. Information we collect

2.1 Information you provide

• Profile details, such as your display name, date of birth, sex, body metrics, training background, goals, equipment, and any injury or health notes you choose to enter.
• Training, nutrition and sleep entries, workouts, sets and loads, logged food and recipes, water, sleep routines and alarms, body measurements and progress photos.
• Coaching conversations, messages, photos (for example food images) and documents (for example bloodwork PDFs) you send to the in-app AI coach, Luma.

2.2 Health data (Apple Health / Health Connect)

With your explicit permission, FORM2 reads health metrics from Apple Health (iOS) or Health Connect (Android) to power recovery, fitness and sleep features. These may include:

• Heart rate variability (HRV), resting heart rate and heart rate
• VO₂ max / cardio fitness
• Steps and active energy
• Sleep stages and sleep analysis
• Workouts, weight and body fat, and logged nutrition

FORM2 may also write workout sessions back to Apple Health or Health Connect so your training is reflected across your other apps. You grant and revoke these permissions at any time in the iOS Health app, or in Android's Health Connect settings.

2.3 Race-result lookup

When you choose to search for a past race, FORM2 sends the athlete name you enter through our authenticated Firebase backend to an independent public race catalog. The search may return public event details, finish time, ranking, Roxzone, station splits and run splits. You select and review the matching result before it is added to your FORM2 history. The query is used to fulfill the lookup and is not used for advertising.

2.4 Information collected automatically

• Account identifier, when you sign in (for example with Sign in with Apple or Google Sign-In), we store an anonymous user identifier so your data can sync to your account.
• Basic diagnostics, crash and performance information that helps us keep the app stable. This does not include the contents of your health logs.

3. How your data is stored

4. AI features and how they use your data

FORM2's coach (Luma) and several intelligent features are powered by large language models provided by Anthropic (Claude).

• AI requests are sent through our own secured server-side proxy. The app does not ship with any third-party AI key, and your requests are authenticated against your account.
• To answer you usefully, the relevant context, for example your recent training, readiness, nutrition targets, a food photo, a recipe link, or a bloodwork PDF you uploaded, is included in the request to the AI provider.
• Anthropic processes this data to generate a response and, per its commercial terms, does not use data submitted through its API to train its models.
• Some features query public databases on your behalf, for example USDA FoodData Central and Open Food Facts for nutrition lookups, the independent Pyrox public catalog for race-result lookup, and a web search provider for current facts. Only the query needed for that request is sent.

5. How we use your information

• To provide and personalize FORM2's features, dashboards, insights, programs, plans, recovery scores and coaching.
• To generate cross-pillar insights and AI coaching tailored to your data.
• To sync and back up your account so you don't lose your history.
• To maintain security, prevent abuse, and enforce usage limits.
• To diagnose crashes and improve app reliability.

6. What we do not do

• We do not sell your personal data.
• We do not share your Apple Health data with advertisers or data brokers.
• We do not use your health data for advertising.

7. Sharing and third-party processors

We share data only with the service providers needed to run FORM2, and only to the extent required:

• Apple, HealthKit, Sign in with Apple, App Store and push notifications (iOS).
• Google, Health Connect, Google Sign-In, Play Store and push notifications (Android), and Firebase for secured account, sync and backend infrastructure.
• Anthropic, AI model processing for coaching and intelligent features.
• Public data and search providers, USDA FoodData Central, Open Food Facts, the independent Pyrox public race catalog and a web search provider, used to fulfill specific lookups.

We may also disclose information if required by law, or to protect the rights, safety and security of our users and our service.

8. Data retention

Your on-device data is retained until you delete it or uninstall the app. Account data held in the secured cloud is retained while your account is active. You can request deletion of your account data at any time (see below), after which we delete it from our active systems within a reasonable period, except where retention is required by law.

9. Your rights and choices

• Health permissions, grant or revoke any health-data permission in the iOS Health app or Android's Health Connect settings at any time.
• Access and deletion, request a copy of your account data or its deletion by emailing [email protected].
• Local deletion, uninstalling the app removes the data stored locally on your device.
• Regional rights, depending on where you live (for example the EEA, UK, or California), you may have additional rights to access, correct, port, restrict or object to processing. We honor these requests.

10. Children

FORM2 is not directed to children under 13 (or the minimum age required in your jurisdiction), and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

11. Security

We use industry-standard measures, encrypted transport, access-scoped storage and authenticated requests, to protect your data. No system is perfectly secure, but we work to keep your information safe and to limit access to what is strictly necessary.

12. International transfers

Our service providers may process data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards for these transfers.

13. Changes to this policy

We may update this policy as FORM2 evolves. Material changes will be reflected by updating the date at the top of this page and, where appropriate, by an in-app notice.

14. Contact

Questions about privacy? Email [email protected].