Privacy policy

Version of November 10, 2026 [to be reviewed by a lawyer before publishing]

The French version is the reference text. This translation is provided for convenience.

Who is responsible

[KBIS_RAISON_SOCIALE], a French simplified joint-stock company with a sole shareholder (SASU) with a share capital of [KBIS_CAPITAL], registered with the RCS of [KBIS_VILLE_RCS] under number [KBIS_SIREN], whose registered office is [KBIS_SIEGE]. Contact: help@mytikapp.com.

What Mytik stores

• Your account: an account ID, created on first launch. Your email or your Apple or Google ID, if you link your account.
• Your profile: your username, your avatar or photo (if you add one), your sports, your goal and weekly target, your friend code, and the version of the terms you accepted. Your country, time zone, language and the date of your last visit.
• Your birth month and year: given at sign-up. The day is used to compute your age, then discarded. No one else sees them: they are only used to adapt Mytik to your age (protected account until 18, health and AI consents).
• Your workouts: sport, mode, times, duration, effort, note, and depending on the mode: GPS route and distance, sets and weights, score, shots, laps, rounds. Then your XP, levels, ranks, streak, leagues and records.
• Your social activity: your friends and follows, phalanxes, cheers, laurels, duels, arenas, comments, questions and answers, reports and blocks. Your messages.
• Your meals: your preferences (what you like, what you avoid, including “halal” and “no pork”) and your allergies. Allergies, “halal” and “no pork” are encrypted, and kept only with your consent.
• Your private zones: the place of each zone and the address you typed to set it, encrypted. No one else sees them.
• Your Mytik+ subscription: its plan, its dates, and whether you already had your trial.
• Your student status, if you confirm it: the end date (31 August of your academic year), the route (your school address, partly masked, or your card) and an encrypted fingerprint, so a proof works for one account only. With your “Chiron and AI” consent, your card is read by Chiron’s AI; without it, a team member looks at it. Mytik keeps no documents: the photo of your card is deleted as soon as the decision is made.
• Your phone’s notification token, if you turn on notifications.
• Mytik news by email: only if you tick the box (Settings › Notifications), and never under 18. We keep your choice and its dates. Every email has a one-click unsubscribe link.
• “How did you hear about us?”: your answer is kept with your account and only counted in totals.
• Your consents: each choice (analytics, crash reports, health, AI, emails), with its date and the version of the text, to keep proof of your consent.
• Your conversations with support, if you write to us: your message, your email, the screenshot if you add one, your phone model, the system and app versions, and the app’s technical log of the last 10 minutes.

Your health data

Mytik reads Apple Health (iPhone) or Health Connect (Android) only if you connect them. You can turn off access at any time in your phone’s settings.

• What Mytik reads: your workouts and their routes, heart rate, steps, wheelchair pushes, distances, floors, active calories and sleep. If you turn them on: resting heart rate, heart rate variability, VO2 max, weight, height, body fat, lean mass and waist size.
• What goes to our servers: your watch workouts, with their sport, times, distance, route, average and max heart rate, and calories. This is what lets Mytik count them.
• What our servers keep, encrypted, with your “Your health data” consent (from 15): a summary of your nights, your steps and daily activity, your morning readiness (kept for 12 months), your fitness age, what you enter in My body and Your body (sex, height, weight, measurements), and the discomforts you report. No one else sees them. They’re in your data export, and deleted with your account or when you withdraw your consent. Under 18: no resting heart rate or heart rate variability in your readiness, and no Your body.
• What stays on your phone: the detail of your measurements (each heart rate reading, each sleep stage, each step counted) stays in Apple Health or Health Connect.
• What Mytik writes: your Mytik workouts, so you also find them in Health.
• What goes to Chiron’s AI: nothing, except for the morning sentence of “Chiron suggests”, and only if you gave both the “Your health data” consent and the “Chiron and AI” consent: your readiness word and markers such as how long you slept or how far your resting heart rate is from usual (see “Chiron and AI”).
• Health data is never used for advertising. It is never sold or shared with other companies for marketing.

Your location

• During a workout with a route (running, cycling, hiking, water sports…), including with the screen locked, to draw your route and count your distance.
• At arenas, to check you in when you’re there.
• To search near you, if you allow it: routes, arenas, pitches and open workouts you can join. Your location is only used for the search.
• “Today’s sky”: the weather uses your location rounded to about 1 km, without your identity, sent to the Open-Meteo weather service.
• Live location sharing, only if you turn it on for a workout: with up to 3 people, until the end of the workout (4 hours max by default). The 200 m around your workout’s starting point stay hidden. Someone without Mytik gets a web link that only opens the map. Shared location is deleted 24 hours after sharing ends.
• Your private zones: the address you type to set a zone is only used to find the place, through an address search service (Apple’s on iPhone, OpenRouteService on Android).
• Your location is never tracked outside these moments.

Chiron and AI

Some features send Chiron’s AI provider (Anthropic, in the United States) figures from your sessions, exercise names, a text you write or the photo of your student card, without your name or email, except what is written on your card. Anthropic does not use them to train its models and deletes them within 30 days, except content flagged as breaking its usage policy, which it may keep for up to 2 years. Nothing is sent under 18.

Nothing is sent without your consent. It is asked for separately, never pre-ticked, the first time a feature needs it (the “Chiron and AI” card), from 18. You can say no: the rest of Mytik works without it. You can withdraw it at any time in Settings › Privacy. With it, only these:

• the description of an exercise you create (“Create my exercise”), to fill in its sheet;
• the exercise names in a file you import, to match them with Mytik’s exercises;
• the figures of a session (sport, duration, distance, sets…), to write its summary with Mytik+;
• the figures of your week, for the “Your progress” analysis with Mytik+;
• for the morning sentence of “Chiron suggests”: your readiness word, markers such as how long you slept or how far your resting heart rate is from usual, and the name of the suggested workout, only if you also gave the “Your health data” consent;
• the photo or PDF of your student card, with what is written on it (including your name), to read the school, year and number. Without your consent, a team member looks at it instead. The photo is never kept: it is deleted as soon as the decision is made.

A text written by the AI is marked as such, and you can report it. A session summary and the analysis of your week are kept with your account; the morning sentence, 90 days.

Crash reports and analytics

Only if you agree, on the consent screen or in settings. You can change your mind at any time.

• Crash reports (Sentry): phone model, system and app version, and the error trace, without your name, email or location.
• Analytics (PostHog): screens viewed and buttons tapped, without your username, email or location.

Mytik+ and purchases

Mytik+ is a subscription offered in the app. Payments go through the App Store or Google Play: Mytik never sees your payment details. The RevenueCat service receives your Mytik account ID and the subscription status sent by Apple or Google, to know whether Mytik+ is active.

Your consents

You can withdraw each consent at any time, in Settings › Privacy: analytics, crash reports, your health data (it is then deleted from our servers) and Chiron’s AI. Withdrawing applies from then on; what was done before remains valid.

Why

• To run the game: compute your XP on the server, keep your ranks, streak and leaderboards, show your workouts to your friends, and manage your subscription. This is needed to provide the service (terms of use).
• With your consent: Apple Health and Health Connect, your health data kept on our servers, your allergies and your “halal” and “no pork” choices, Chiron’s AI, location sharing, notifications, Mytik news by email, crash reports and analytics.
• To protect players: handle reports, enforce blocks, protect the accounts of under-18s, keep leaderboards fair.

Mytik shows no ads, does not sell your data and does not track you across other apps or websites.

Who sees what

• Your friends see your username, avatar, level, your workouts with their notes, and when you’re working out.
• Your profile is public by default: your workouts (without GPS route) can show up in For you, and anyone can follow you without a request. You can make it private in Settings, “What others see”: then only your friends see your workouts.
• Your GPS route is visible to your friends and the followers you accepted, without your private zones, and with the start and finish hidden if you chose so. You can turn it off in Settings › What others see › “My GPS route”.
• Players in your league and in an arena see your username, avatar and points.
• Your email, birth date and health data are never shown to other players.
• A protected account (under 18) stays private: it cannot be made public, its GPS route is shown to no one, its photo only to its friends, and only friends can message it.

Services that help us

• Supabase (Supabase Pte. Ltd., Singapore): server and database, hosted in the European Union, in Sweden (Stockholm).
• Expo (650 Industries, United States): delivery of notifications, with their title and text (including that of a message received, except for a protected account), and of app updates.
• Anthropic (Anthropic PBC, United States): Chiron’s AI provider, only with your consent (see “Chiron and AI”).
• Apple: sign-in, maps and address search on iPhone (Maps), notifications, purchases, Apple Health.
• Google: sign-in, notifications, purchases, Health Connect, and maps on Android (Google Maps): when a map is shown, device and map data go to Google.
• RevenueCat (RevenueCat, Inc., United States): your Mytik+ subscription status, with your Mytik account ID.
• Sentry and PostHog: only with your consent, Europe region.
• OpenStreetMap: the map background of the web tracking page. The browser of the person following the map loads its images from OpenStreetMap, which receives their IP address. And, through its Overpass service, the list of football pitches in an area of the map, without your identity.
• Open-Meteo: the weather (“Today’s sky”), from a location rounded to about 1 km, without your identity.
• OpenRouteService (HeiGIT): computing route loops (from a starting point rounded to about 100 m) and the routes you draw by hand, and address search on Android, without your identity.
• Resend (Resend, Inc., United States): sending emails (sign-in code, waitlist, export link, warnings before deletion, end-of-trial reminder, support replies, student code, and Mytik news if you accept them).
• Cloudflare (Cloudflare, Inc., United States): hosting of the mytikapp.com website, which receives visitors’ IP addresses.

Some services are located outside the European Union, mostly in the United States (Anthropic, Expo, RevenueCat, Resend, Cloudflare, Apple, Google). The transfer is covered by the EU–US Data Privacy Framework when the service has joined it, otherwise by the European Commission’s standard contractual clauses [to check for each service].

Where your data is

On servers located in the European Union (Supabase, in Sweden). In demo mode, everything stays on your phone.

The waitlist

Before Mytik launches, you can leave your email on mytikapp.com to hear when it’s out.

• What we keep: your email, your language, your sport if you chose one, the name of the link that brought you if it’s in the address (for example “tiktok”), and the date of your consent with its wording.
• Why: to email you to confirm your address, then on launch day. That’s it. The legal basis: your consent, which you can withdraw at any time.
• What we don’t do: your email is never sold or shared. No cookies, no analytics, no ads on this page.
• Against bots: your IP address is turned into an unreadable code, kept 48 hours at most, never with your email.
• How long: without confirmation, your email is deleted within 30 days. If you unsubscribe, it’s deleted right away. Otherwise, the whole list is deleted no later than 6 months after launch.
• Who helps us: Supabase (database, in Sweden) and Resend (sending emails).
• Unsubscribe: the link in every email, or a message to help@mytikapp.com.

How long

• As long as your account exists. An account you haven’t visited for 3 years is deleted, after two warning emails (30 days and 7 days before), unless your Mytik+ subscription is running. An account without an email is deleted after those 3 years without a warning.
• When you delete your account (Me › My account, or Settings › My data), it is deactivated right away, then permanently deleted 30 days later. You can change your mind during those 30 days.
• Past weekly leaderboards and phalanx matches keep their points under “Former member”, without your username, so other players’ results stay fair.
• Your support requests are no longer linked to your account once it is deleted, but your email and message stay, so we can finish answering you. They are deleted 3 years after the last exchange. The attached screenshot is deleted with your account.
• Morning readiness is kept for 12 months; shared location, 24 hours after sharing ends.
• Messages are kept for 2 years; notifications, 1 year; logs of calls to services (exercise import, routes, weather), 1 year; the moderation log and handled reports, 3 years; your data export archive, 7 days.
• Crash reports are kept for 90 days at most.

Your rights

You can access, correct, export or delete your data, object to its use and withdraw your consents. In the app, Settings › My data lets you export your data and delete your account. You can also write to help@mytikapp.com. You can also tell us what should happen to your data after your death. You can file a complaint with the CNIL (cnil.fr) or your local data protection authority.

Age

Mytik is open from the age of digital consent in your country, read from your phone’s settings: 13 in the United States, 15 in France, 13 to 16 elsewhere depending on the country, and 16 if your country is not on our list [ages by country to be confirmed by a lawyer]. Below that age, no account is created and nothing entered is kept.

Until you turn 18, your account is protected (see “Who sees what”): no AI, no news emails, no My body or Your body, and the consent for your health data is only offered from 15.

Changes

If this policy changes in an important way, you’ll be told in the app first.