Privacy Notice

Ordivum is operated by TDS Software Ltd, company number 17356701, whose registered service address is 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. TDS Software Ltd is the data controller.

TDS Software Ltd is a company registered in England and Wales (company number 17356701) and is registered with the ICO (registration number ZC258649).

Privacy requests and questions: privacy@ordivum.com

We receive data directly from you, from your device when it provides technical context such as timezone, from Supabase when it authenticates and serves your account, and from Apple if you choose Sign in with Apple, and from Apple Health on your iPhone if you turn it on. If you import a Strong or Hevy file, it is read on your device and never stored; the workouts in it become part of your workout history. We do not buy personal data, sell it, build advertising profiles, or use it to train AI models. We do not make solely automated decisions that have legal or similarly significant effects on you.

AI features are not active and no account record, prompt or photo is currently sent to an AI provider. Planned paid AI for eligible users aged 13+ requires a separate explicit choice and an updated notice before processing begins. The AI Notice describes that prepared boundary.

Fitness records can reveal information about your physical health and are treated as special category data. Account terms and age confirmation are presented separately from an unticked, explicit health-data consent. If you consent, we record the wording, policy version, time, action, and whether the choice was made on web or iOS.

The consent wording of 15 October 2026 names only what Ordivum collects today. Outdoor Activity routes are not part of it: Activity is switched off, and before it is ever switched on it will ask for a consent that names routes. A consent given with the earlier wording of 20 August 2026, which also named routes, still counts.

A personal fitness ledger cannot operate without processing the fitness information you ask it to store. You may decline and sign out. You may also withdraw later in Settings → Data & privacy. Withdrawal erases the health and fitness records held in your account, including completed Activities and saved routes, clears reachable Activity drafts, cache and queued writes when the current device processes the withdrawal, and prevents new health-data entries until you make a new explicit choice. Your basic account and immutable consent history remain so we can respect and demonstrate the withdrawal. Withdrawal does not make earlier lawful processing unlawful.

Apple Health is off unless you turn it on in the iOS app’s Daily targets and allow it on Apple’s permission screen. Ordivum then reads one thing, the active calories Apple Health recorded between a workout’s start and finish, and keeps one rounded figure on that workout. It never reads anything else, never writes to Apple Health, and never estimates the figure itself. A figure you type for a workout replaces it. The figure is part of your health and fitness records: it is included in your export and erased if you withdraw consent or delete your account. Data from Apple Health is never used for advertising or marketing, never sold, never given to anyone else for their own use, and never stored in iCloud. You can stop the reading at any time in the Health app or in your iPhone’s settings.

Outdoor Activity is never passive tracking. Precise location begins only after you deliberately start a run, walk, hike or cycle and may continue while that active session is in the background or the phone is locked, until Finish or Discard. Manual pause drops incoming samples, but the saved route and metrics may bridge the last point before pause to the first after resume. Before Finish, the recoverable route draft is account-scoped, protected, excluded from backup and held only on that device for no more than seven days. Discard removes it; Finish creates a private saved Activity and queues sync when connectivity permits.

By default Ordivum removes the first and last 400 metres locally before any durable Activity row or sync payload is created. If the route is 800 metres or shorter, no map route is saved while that setting is on, although full distance, time and other non-coordinate facts remain. You may disable endpoint removal for one Activity; the result is still private to your account. There are no public links, feeds, connections, coach access or other-account route recipients, and Activity data is not used for advertising, profiling or AI.

During a programme workout, you can choose to record one of a short list of factual concerns: pain or discomfort that is sharp or increasing, numbness or tingling, instability or giving way, or pain that changes your technique. You may add a private note. This stops the affected preparation step or its linked programme item and keeps a factual safety-history entry; it does not diagnose the cause, decide whether another exercise is medically safe, prescribe treatment or rehabilitation, or replace a qualified health professional or emergency service.

This optional processing has its own unticked explicit-consent choice at the first safety interaction. It is separate from the service-wide health choice, Terms, marketing, AI and subscriptions. Refusing it leaves ordinary workout logging and the non-symptom substitution route available. Safety records are private by default, are not shared with another user or coach, and use the same high-privacy defaults for adult and teen accounts.

You can withdraw this programme-safety choice in Settings without withdrawing the wider ledger consent. Withdrawal deletes the programme safety events and optional notes held for your account, removes queued copies and the relevant cache when the current iOS device processes the change, reopens affected programme items, and blocks new safety records until you make a fresh choice. Ordinary set, session, nutrition and body records remain. A lost or offline device cannot receive the deletion instruction until it reconnects or its owner erases it. We retain the minimal consent-event evidence needed to respect and demonstrate your choice.

At the date of this notice, these two capabilities are prepared in the service but held off for general customer use behind independent server-controlled release switches. The presence of a screen or database structure does not mean either capability is active for your account. While a switch is off, Ordivum blocks new authoring, new standalone movement-check results, publishing affected programme changes and starting an affected session at the database boundary.

If enabled later, programme preparation can store an author’s ordered title, explanation, movement, side, repetitions, time, distance or load target and whether you manually completed, skipped or stopped a step. A performed exercise-specific ramp can create one linked warm-up set. Preparation remains skippable, is excluded from working-set progression, volume, personal records and adherence penalties, and does not use an Apple sensor or infer that a movement was performed.

Manual movement checks can store a private reusable label, dimension, side rule, written method, method version, repeatability conditions, entered value and unit, canonical conversion, measurement time and optional note. A comparison is shown only for the same method version, dimension and side. It is a factual comparison of values you entered, not a normal range, diagnosis, injury assessment, treatment recommendation or sensor-derived measurement.

Revoking a release switch does not hide or silently discard existing records. An already-started frozen session remains finishable. Existing definitions and results remain readable, exportable and erasable: individual results can be deleted, definitions can be archived, wider health-consent withdrawal removes the authored preparation, checkpoints, manual results and runtime preparation records, and account deletion removes the remaining live rows. Minimal feature-access metadata contains only the account identifier, two release decisions, check time and source revision; it contains no movement or measurement content.

You must be at least 13. Signup asks for your exact date of birth and an affirmative statement that it is yours and accurate. We do not ask for an ID document or use a third-party age-check provider. This reduces data collection and friction but cannot prove that a stated DOB is true. If you believe an under-13 has an account, contact us so it can be investigated, restricted and removed where appropriate. Your strength ranks take your age into account if you’re under 23 or over 40. We work this out from the date of birth you gave at sign-up.

The service applies the same high-privacy defaults to everyone: records, photos and saved Activity routes are private; Activity is off until the user starts it; endpoint removal is on by default; and there is no advertising, behavioural profiling, public profile, route sharing, feed or marketing messaging. Activity requires the authoritative 13+ record and current wider health-data consent. We assess the risks to children before each change to the service (a Children’s Code impact assessment) and keep that assessment under review.

If a signup date of birth is under 13, an email signup is refused without creating an account or a durable email restriction. Sign in with Apple creates the account before the date-of-birth step, so an under-13 date deletes that account at once, and an account that never finishes the step is deleted after a day. Eligible signup uses a one-use authorization grant that expires within minutes and is bound to the declared email and platform. The grant stores a token digest and keyed email binding rather than the raw token or raw email. Routine provider security logs and short-window abuse controls may still process request metadata under their stated retention.

Planned AI uses the same 13+ boundary, recent reauthentication, a separate AI consent and conservative safeguards for all users. Teen accounts are not used for advertising, public profiles or behavioural targeting. Date-of-birth correction is bounded so changing a date cannot silently bypass the age gate.

If you’re 13 or over, you can buy Plus on the website. If you pay with a parent’s or guardian’s card, their card details go to Stripe, not yours, and we see only the card brand, last four digits, expiry and issuing country.

The iPhone app is in beta on Apple’s TestFlight, for ages 13 and over. While the public TestFlight link on ordivum.com/beta is open, you can use it to join, up to a limited number of places. When you join through the link, Apple shows us only an anonymous tester: no name or email address, just the date you installed, the app version, sessions and crashes, and any feedback you choose to send. We use this only to improve the app, never to identify you, and we do not link it to your Ordivum account. Apple handles your TestFlight details under its own privacy policy. Using the app needs an Ordivum account, which the rest of this notice covers.

When the link is not open, ordivum.com may offer a form to ask to join instead. If you use it, we keep your first name, last name and email address, the time of your request and your confirmation that you are 13 or over. We use them only to review your request and, if there is a place, to add you as a tester in Apple’s TestFlight. Apple then emails you the invite. Each request is also sent to our support inbox through Resend so it can be reviewed. You do not need an Ordivum account, and we do not use a request for marketing.

Our legal basis is our legitimate interest in running a small beta that we can manage, UK GDPR Art. 6(1)(f). Each request is deleted 90 days after you make it. A copy of the email can stay in the support inbox until it is deleted there. To withdraw your request or have it deleted sooner, email privacy@ordivum.com. If you are added as a tester, Apple handles your name and email under its own privacy policy.

Providers may also disclose data where law requires it. We do not disclose personal data for advertising. We will name and assess a new processor before it begins handling user data.

The website uses authentication and short-lived security-flow cookies, a recovery-proof cookie, and a timezone cookie. It also uses device storage for choices such as theme and rest-timer settings and for active-workout timing state. The iOS app keeps an offline account cache on the device so the ledger can work without a connection. If you add the home-screen widget, the app keeps the names of your next routine and its exercises on the phone so the widget can show them; they are removed when you log out, delete your account, withdraw health-data consent, or remove data on the device. During an unfinished Activity it also keeps the protected, backup-excluded local route draft described above; it is not part of the server export because it has not been uploaded. There is no advertising, analytics, or cross-site tracking. The Cookie Policy gives durations, purposes, and controls.

Account and ledger data is kept while your account remains open. You can export a machine-readable copy from Settings, including completed Activities and their saved routes, and delete an individual Activity. Deleting the account starts permanent removal of its live database rows and private files, including Activities, and instructs the current device to remove reachable drafts, cache and queued writes; if a provider step fails, the deletion can be retried safely. Short-lived security and operational logs may remain under provider retention schedules where necessary for security, legal claims, or compliance.

If you’ve paid for a subscription on the website, deleting your account removes your billing records from Ordivum’s database. Tax and accounting records of each payment, refund and dispute (the amount, date, invoice, Stripe references, and the billing name, email and country) are kept in Stripe for 6 years after the end of the company’s financial year, because UK company and tax law requires it. Our accounting system (Zoho Books) records sales as totals only, without your name or email. Your right to erasure doesn’t apply to records we must keep by law. They’re kept only for that purpose, then deleted or anonymised in our systems. Stripe also keeps its own records under its privacy policy.

An eligible signup authorization grant expires within minutes and is then deleted by retention cleanup; it cannot be used again after account creation. An under-13 attempt creates no durable person-level block. An account started with Sign in with Apple that never finishes the date-of-birth step is deleted after a day. Age-declaration evidence attached to an eligible account is retained with the account and deleted through the account-deletion process, subject to any narrow legal evidence requirement.

The current Supabase plan does not include automatic database backups, so Ordivum makes its own. Once a day an encrypted copy of the database is saved to a computer controlled by Ordivum, and each copy is deleted after 7 days. Information you delete, including everything deleted with your account, is therefore gone from every backup within 7 days. Backups are used only to restore the service after data loss. If one is ever restored, deletions made since that copy are carried out again before the service reopens.

An ordinary iOS sign-out may retain that account’s encrypted-at-rest, OS-protected local cache for offline continuity. Settings provides a control to remove cached and unsynchronised data from the device. Account deletion and health-consent withdrawal also instruct the current app to remove the relevant local cache; data on an offline or lost device cannot receive that instruction until it reconnects or is erased by its owner.

Programme safety records remain until you withdraw the separate programme-safety choice, delete the account, or another applicable deletion request is completed. A separate withdrawal removes the safety content but retains minimal, content-free consent evidence for compliance or claims only while that remains necessary.

If programme preparation or manual movement checks are enabled, their authored and runtime records are kept with your account until you erase the relevant result, withdraw the wider health-data consent, delete the account, or another applicable erasure request is completed. The account export includes these records and the minimal feature-access metadata. Feature-access metadata is refreshed when access is checked and otherwise ends with account deletion.

Depending on the circumstances, UK data-protection law gives you rights to be informed; access; correction; erasure; restriction; data portability; objection; and withdrawal of consent. You can edit much of your data, export it (including completed Activities and saved routes), delete an individual Activity, withdraw the separate programme-safety choice, withdraw the wider health consent, delete individual manual movement-check results, archive their reusable definitions, and delete the account in Settings. You can also contact us. We may need to verify your identity and normally respond within one month. An under-13 signup attempt creates no durable person-level registration block to challenge.

Your account data is stored in the United Kingdom. Some providers handle limited data in other countries. For each one, this is what protects it:

• Supabase (database and sign-in) is based in Singapore and stores Ordivum’s data in London. Its support staff in the United States and Singapore can reach it only to support the service, under the EU standard contractual clauses with the UK Addendum in Supabase’s data processing agreement.
• Cloudflare (website hosting) and Upstash (abuse counters) are in the United States and are covered by the UK-US data bridge (the UK Extension to the EU-US Data Privacy Framework). Cloudflare’s data processing agreement also includes the UK Addendum to the standard contractual clauses.
• Resend (account emails) processes emails in the United States under the UK-US data bridge and the UK Addendum to the standard contractual clauses in its data processing addendum.
• Stripe (website payments) processes payment data in the United States and other countries where it operates. Its data processing agreement, part of our contract with Stripe, relies on the UK-US data bridge and the UK Addendum to the standard contractual clauses.
• Apple hosts our mailboxes in iCloud Mail under its standard iCloud terms, and may handle emails you send us in the United States. We have no separate safeguard for this yet, and we are moving these mailboxes to a business email provider.
• Anthropic (Claude, used by our team): Anthropic Ireland Limited provides Claude to UK users, and UK law approves transfers to Ireland. Anthropic says it uses standard contractual clauses when it processes data in the United States.
• Open Food Facts is in France, and UK law approves transfers to the European Economic Area.

To get a copy of a safeguard, email privacy@ordivum.com. If paid AI is ever switched on, the locations and safeguards for Amazon Web Services and Anthropic will be added here before any user data is sent.

We use HTTPS, private storage, per-user database row-level security, rate limits, security headers, and one-use recovery proof. No service can promise absolute security. Read the Security page for controls and responsible reporting. If a personal-data breach creates a risk to you, we will assess notification duties and contact affected people and the ICO when legally required.

Tell us by email at privacy@ordivum.com, or by post to 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. You don’t need to use any special words. We will acknowledge a data-protection complaint within 30 days, investigate it without undue delay, keep you updated, and explain the outcome. You may complain to the Information Commission (ICO) at any time; you do not have to contact us first.

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

We will update this notice before a new feature changes how personal data is used. Material changes will be explained in the service. Where a change needs a new consent, continued use will not be treated as consent: you will receive a new, specific choice. Previous consent events are retained as an audit record.

Email privacy@ordivum.com for a privacy request, complaint, or question.