Privacy policy
Last updated: 8 October 2026
ToppedUp is a training and nutrition coach for cyclists. To do that, it works with personal data, including data about your health. We keep that data in the EU, use it only to run the app for you, never sell it and never use it for advertising. You choose what you connect, and you can export or delete your data at any time in the app.
Who we are
ToppedUp is run by Kobe Henkens in Belgium, who is the controller for the personal data described here. For anything about your data, email contact@toppedup.cc.
What we process, and why
| Data | What it includes | Why |
|---|---|---|
| Account | Your email address, how you sign in (with Apple, Google or an email link), when you created your account and last signed in, when you accepted the terms, and on which days you used the app. | To give you an account, keep it secure and see how ToppedUp is used. |
| Profile | Gender, date of birth, height, weight, optional body fat, activity level, goal, FTP, threshold and maximum heart rate, your training zones and how much carbohydrate you train your gut to take on a ride. | To calculate your targets, zones and plan. |
| Training goals | Your goal event and its date, how many hours and days a week you can train, your experience, your long ride day and what you want to achieve. | To build a plan that fits your life and your goal. |
| Training | Rides and workouts you import, sync or enter (date, time, duration, power, heart rate, cadence, speed, distance, elevation, calories and training load), your power curve, your training plan and planned sessions, how a ride felt and how your legs feel, and the private link to your ToppedUp calendar, if you make one. | To build and adjust your plan and show your progress. |
| Nutrition | Meals and foods you log, foods you create (with their barcode, if you add a product the barcode scanner didn’t find), your saved meals, favourites and meal times. | To track what you eat against your targets. |
| Health | Your weight over time, and resting heart rate, heart rate variability, sleep and sleep stages, blood oxygen, respiratory rate and wrist temperature during sleep when you connect Apple Health or another service that provides them, plus the recovery and sleep scores we calculate from them. | To adapt your targets and training to how you recover. |
| Coach | Messages, photos and files you send to the coach, its answers, what it remembers about you (what you tell it or add yourself, and the date it was added), its suggestions and whether you accepted them, and how much you use it. | To answer your questions, work on your plan and keep the coach available for everyone. |
| Subscription | From Apple: a transaction ID, the product, price and currency, and the start, renewal and expiry dates. We never see your payment details. | To unlock ToppedUp Pro for you. |
| Device | A token to send you notifications with your time zone and language, and error reports with the app version when something goes wrong. | To send the notifications you allow and to fix bugs. |
| Support | Emails you send us and feedback you send in the app. | To help you and improve the app. |
| Server logs | Your IP address, the time and the request, kept for at most 30 days. | To keep the service secure and prevent abuse. |
Where it comes from
Most of this you enter yourself. The rest comes from what you choose to connect: Apple or Google when you sign in with them, the App Store when you subscribe, Apple Health on your iPhone, ride files and Strava archives you import (we keep what we read from them, not the files), and intervals.icu or Hammerhead once you connect them.
Health data
Training, weight, nutrition, recovery and sleep data can say something about your health, which makes them a special category of personal data under the GDPR. We only process them with your explicit consent, which you give when you start using ToppedUp. You can withdraw it at any time by deleting your account.
Apple Health
If you connect Apple Health, ToppedUp reads the data you allow on your iPhone: workouts (cycling, running, swimming and strength training, with heart rate, power, cadence, distance, elevation and active energy), resting heart rate, heart rate variability, sleep and sleep stages, blood oxygen, respiratory rate, wrist temperature during sleep, weight and body fat. When you connect, it reads your workouts of the past year and your health data of the past 90 days, as far as you allow. After that it reads what is new: when you open the app, and when a new workout arrives while the app is closed, so the ride is ready when you are.
You choose which of these ToppedUp may read, and how far back, and you can change that at any time on your iPhone in Settings, then Privacy & Security, then Health. ToppedUp only reads from Apple Health and never writes to it.
We use this data only to run ToppedUp for you: to log your workouts, calculate your training load and recovery, and adjust your plan and targets, also when the coach answers you. We never use it for advertising or marketing, never sell it, never share it for any other purpose, and never store it in iCloud. If you stop sharing, what is already in ToppedUp stays until you delete it or your account.
Legal bases
- Your contract with us (GDPR article 6(1)(b)) for your account, profile, subscription and the features you use.
- Your explicit consent (article 9(2)(a)) for health data.
- Our legitimate interest (article 6(1)(f)) in keeping ToppedUp secure, preventing abuse, fixing errors and seeing how the app is used.
The AI coach
When you message the coach, or the coach works on your plan, we send your message, any photos or files you attach, and a summary of your profile, plan, recent training, recovery and nutrition to our AI provider to write the answer. Our AI provider processes this on our behalf, under a data processing agreement. It does not use this data to train its models and keeps it only for a limited period.
The coach can look up the weather for a place and day you mention, plan your training, add, move, change or delete sessions, save meals to your meals, update your profile and remember things you tell it. It does what you ask, and when it suggests a change on its own, you accept or decline it. The coach gives suggestions; you decide what to do with them, and nothing it says has legal or similar effects for you.
Who processes your data
We use a small number of providers. Each only receives what it needs for its task.
| Provider | What for | Where |
|---|---|---|
| Railway | The servers and the database that run ToppedUp | EU (Amsterdam, Netherlands) |
| Our AI provider | The AI coach | United States |
| Resend | Sending the sign-in emails, and forwarding feedback you send in the app to us | United States |
| Microsoft | Our email, when you write to us | EU and United States |
| Netlify | Hosting this website (it never receives data from the app) | United States |
Apple (Sign in with Apple, the App Store, notifications and Apple Health) and Google (Sign in with Google) handle your data under their own privacy policies; Apple Health data stays on your iPhone until ToppedUp reads it as described above. When you search for a food or scan a barcode, we look it up in Open Food Facts or USDA FoodData Central with only the search term or barcode, never anything about you. When you scan a nutrition label, your iPhone reads the photo itself: the photo is not sent to us or anyone else, and only the values you save are stored. When the coach looks up the weather, Open-Meteo only receives the place and the date. If you connect intervals.icu or Hammerhead, we receive the data you choose to share from it. When you ask, in the app or through the coach, we send it a planned session (its name, date and structure, with power targets), so it shows up there and on your bike computer. If your coach later changes or cancels that session, we update or remove it there. When you disconnect, we revoke our access and remove the sessions you sent. If you add your ToppedUp calendar to Apple Calendar, Google Calendar or Outlook, that service fetches your planned sessions (their names, times, structure and fuelling advice) through your private link and handles them under its own privacy policy.
Where data leaves the EU, it is protected by the EU-US Data Privacy Framework or by the European Commission’s standard contractual clauses.
We don’t sell your data, we don’t work with advertising networks, and ToppedUp contains no analytics or tracking tools.
How long we keep it
- Your account data: as long as you have an account.
- When you delete your account in the app, we delete all your data from our database straight away: your profile, training, plan, meals, weight, recovery and sleep, coach conversations and attachments, and your connections. If you signed in with Apple, we also revoke ToppedUp’s access to your Apple ID. Copies in our backups expire within three months.
- Error reports and server logs: at most 30 days.
- A record of each change the app sends (a random key and our answer), so a change that arrives twice is saved only once: 30 days.
- The copy on your iPhone (see Security): until you sign out or delete the app.
- Emails to us: as long as we need them to help you, and at most two years.
Your rights
You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, to receive it in a portable format, and to withdraw your consent. You can do most of this yourself in the app: correct your data in Settings, download all of it as one file in Settings, then Integrations, then Export your data, and delete your account in Settings, then Delete account. What ToppedUp may read from Apple Health you change in your iPhone settings. For anything else, email contact@toppedup.cc and we will answer within a month.
You can also file a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit), Drukpersstraat 35, 1000 Brussels, dataprotectionauthority.be, or with the authority in the EU country where you live.
Security
All traffic is encrypted. There are no passwords to steal: you sign in with Apple, Google or a link that works once and expires after 10 minutes, and your session is stored in the iPhone Keychain. Access to connected services is stored encrypted, and only the person running ToppedUp can access the production systems.
So that ToppedUp also works without a connection, the app keeps a copy of your data on your iPhone, in its own storage that other apps can’t read, together with the changes you make offline until they reach us. Signing out removes that copy, and with it any change that hasn’t been sent yet.
Age
ToppedUp is meant for people aged 16 and over. We don’t knowingly process data of younger children.
Cookies
The app uses no cookies. This website uses no cookies and no analytics either; our host keeps standard server logs.
Changes
When ToppedUp starts using new data or a new service, we update this policy first. When we change it in a way that matters, we tell you in the app. The date at the top always shows the latest version.