Your heart stays
on your phone.

Summary

Who we are

Zone2 Engine is developed by Darko Jovanovski, an independent developer based in North Macedonia ("we", "us"). We are the data controller for the data described here. Contact: djovanovski.dev@gmail.com.

Health data

With your permission, the app reads from Apple Health: heart rate, workouts, resting heart rate, VO₂ max, active energy, distance, steps and date of birth. It uses them to set your heart rate zones, count your weekly minutes and show your progress. It saves workouts you record back to Apple Health.

This data is processed only on your iPhone and Apple Watch. It is never sent to us, never sent to analytics or crash reporting, never used for advertising or marketing, and never sold. If you connect a Bluetooth heart rate sensor or a watch that broadcasts heart rate, its readings are handled the same way.

You can change or remove Health access at any time in iOS Settings → Health → Data Access & Devices → Zone2 Engine.

On-device AI

On iPhones that support Apple Intelligence, your weekly plan and coach messages are written by Apple's on-device language model (the Foundation Models framework). The model runs on your iPhone; the inputs (such as minutes left this week and your chosen training days) are not sent to us or to any AI service. On other iPhones, the same plan is built by the app's built-in training rules.

Usage statistics and crash reports

To understand which features are used and to fix bugs, the app uses Google Analytics for Firebase and Firebase Crashlytics, provided by Google. They receive:

• App events, such as "onboarding completed", "plan built", "workout started" (with the activity type) or "explainer opened". Events never contain heart rate, minutes, zones or anything read from Apple Health.
• Technical information: device model, iOS version, app version, language, approximate country (derived from your IP address, which Google does not store for Analytics), and a random app-instance identifier that resets if you reinstall.
• For crashes: the crash stack trace and the app's state at the time of the crash.

The app does not access the advertising identifier (IDFA), ad personalization signals are disabled, and Firebase is not linked to any advertising product. You can turn off usage statistics and crash reports separately in the app under Settings → Privacy.

Strava (optional)

If you choose to connect Strava, workouts you choose to upload are sent to Strava under your account, and Strava's privacy policy applies to them. The one-time sign-in code is exchanged for an access token through a small server we run on Cloudflare; it passes the request on and does not store or log your token. Tokens are kept in your device's Keychain. You can disconnect at any time in the app or on strava.com.

Purchases

Subscriptions and one-time purchases are processed by Apple. We do not receive your name, payment details or Apple ID. The app checks your purchase status with Apple on your device.

Notifications

Reminders (for example, a planned session or a goal reached) are scheduled locally on your iPhone. No push token or notification content is sent to us.

This website

This site is hosted on Cloudflare. It uses no cookies, no analytics and no tracking scripts. Cloudflare processes standard request data (such as IP address and browser type) to deliver the site and protect it from abuse, under its own privacy policy. If you email us, we use your email only to reply.

Legal bases

Where the EU General Data Protection Regulation (GDPR), the UK GDPR or North Macedonia's Law on Personal Data Protection apply, we rely on:

• Your explicit consent for reading Apple Health data, which you give in the iOS permission screen and can withdraw at any time. This data stays on your device.
• Our legitimate interest in keeping the app stable and improving it, for anonymous usage statistics and crash reports. You can object at any time by switching them off in Settings → Privacy.
• Performance of a contract for providing features you request, such as Strava upload.

Retention

Data on your device stays until you delete it: Settings → Delete all app data removes everything Zone2 Engine stores, and deleting the app does the same. Workouts saved to Apple Health stay in Health, where you control them. Analytics event data is kept by Google for 2 months; crash reports are kept for 90 days. Emails are kept as long as needed to answer you.

International transfers

Google and Cloudflare may process data in the United States and other countries. Where required, these transfers are covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework, as described in Google's and Cloudflare's data processing terms.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to processing, and to withdraw consent. Because we don't have accounts and can't link analytics data to you, the quickest way to exercise most rights is in the app: switch off analytics and crash reports, or delete all app data. You can also email us, and you have the right to complain to a data protection authority, such as the Personal Data Protection Agency of North Macedonia or the authority in your country.

California residents: we do not sell or share personal information as defined by the CCPA/CPRA.

Children

Zone2 Engine is a general fitness app and is not directed at children under 13 (under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has used the app and data was collected, contact us and we will help remove it.

Changes

If we change this policy, we'll update the date at the top and, for significant changes, tell you in the app before they take effect.

Contact

Questions or requests: djovanovski.dev@gmail.com.