Comprehensive Privacy Notice · ZAVENO

Last updated: September 24, 2026 · Version: 1.3

This is an English translation provided for convenience. If there is any discrepancy, the Spanish version prevails.

1. Who is responsible for your data

Manolo Cicero Aranda, who operates the ZAVENO platform (zaveno.app), with an address for receiving notices and communications at Calle 18 #90 por 19, colonia Itzimná, C.P. 97100, Mérida, Yucatán, México, is the data controller responsible for the processing of your personal data.

The person in charge of handling all matters related to your data is Manolo Cicero Aranda. Contact: privacidad@zaveno.app.

2. What data we process

ZAVENO processes only the data on this list, depending on the features you use.

a) Account and access

Your profile name or alias.
The public key of your passkey. Your fingerprint, your face and your PIN never leave your device; ZAVENO does not receive them.
Language, units and time zone.
If you turn on notifications, the notification subscription identifier of your browser or phone.
If you connect your AI assistant or your calendar: the cryptographic fingerprint of the tokens or private links (never the token in plain text), their permissions, their creation date and their last use.

b) Training

Routines, folders, weekly plan and calendar.
Logged sessions: exercises, sets, reps, loads, times, distances, calories from the equipment and notes.
Results of timed blocks, personal records and goals.
For runs with GPS: the route, the pace and your location during the activity.
Weather and air-quality data for the place of your activity, obtained from that location.
Your HYROX races: the times you enter or import from the page of your own official result, plus the date, the event and the division.
If you use Gym Bro (training the same session with a friend): the shared session while it lasts.
The music playlists you paste into your blocks.

c) Sensitive personal data (health)

Intake questionnaire. When you create your profile we ask four screening questions — whether you have trained in the last 3 months, whether a doctor has diagnosed you with a heart, metabolic or kidney condition, whether you have had certain symptoms, and how hard you want to train — and then questions specific to the disciplines you choose (for example previous injuries if you run, osteoporosis or postpartum status if you do Pilates, allergies and intolerances if you complete the food block). Every one can be skipped, and we ask for your express consent before the first. The screening result follows the American College of Sports Medicine algorithm and is not a diagnosis: it only decides how hard the app proposes you train.
Body weight.
Daily check-in: sleep, muscle soreness and energy, on a scale.
Symptoms and injuries: body area, pain (0–10), fever, dates and notes.
Supplementation: compounds, doses, schedules, protocols, effects you log and lab results you enter.
The meal plan prescribed to you by your professional, your adherence to it and the water you log.
Heart rate during your workouts, if you connect a Bluetooth sensor.
Data from the wearables and services you connect:

WHOOP: recovery, heart rate variability, resting heart rate, oxygen saturation, skin temperature, sleep, strain and workouts;
intervals.icu (Garmin, Amazfit, Polar, COROS, Suunto or Oura): activities, heart rate, sleep and wellness, and your thresholds (max HR, lactate threshold, FTP, paces);
Health Connect (Android app): heart rate, variability, resting heart rate, sleep, steps, weight, respiration, oxygen saturation, VO2 max and workouts.

If you use ZAVENO AI (the app's AI assistant): your messages, the replies, the number of photos you added (photos are used to answer and are not stored on the server), the date and version of your consent for the chat, how many messages and how much AI service usage you use per day and per month, and the reports you send about a reply.

ZAVENO AI memory: if you leave it on, ZAVENO AI saves short facts you share to personalise its replies: your goals, training preferences, schedule, equipment, sports and how you like answers (up to 50 memories of up to 200 characters each). Memory never stores health data (injuries, symptoms, medications, diagnoses, supplements or readings from your wearable) or data from Strava or Oura. Every time it changes, the app shows you with an option to undo; in Settings → ZAVENO AI → Memory you can see it, edit it, delete it or turn it off (when off, nothing is saved or used).

d) Technical data

Server access logs (IP address, date and time, browser type). They are used only for security and to diagnose failures.

The data in item c) is sensitive personal data because it may reveal your health status. We process it only with your express consent (section 5).

3. What we use it for

Necessary purposes (without them we cannot provide the service):

Creating and protecting your account, and letting you sign in with your passkey.
Storing, displaying and syncing across your devices your training, your health and your nutrition.
Calculating your metrics (Readiness, Load, Engine, zones and records) and offering you adjustments to the session when you start training. Suggestions are never applied automatically: if you do not accept them, you train what you had planned.
Sending you the reminders you turn on.
Connecting the services you activate (wearables, calendar, music and your AI assistant) and displaying their data.
If you use ZAVENO AI (the app's AI assistant): answering your questions with your data, saving what you confirm, applying usage limits and reviewing the replies you report.
Calculating aggregated, anonymous percentiles of HYROX races among ZAVENO athletes: your race counts toward the statistics for your division, and no individual's race is ever shown; they are calculated only when there are at least 5 races from other people.
Maintaining the security of the platform, preventing abuse and backing up information.
Handling your ARCO rights requests and complying with legal obligations.

Non-necessary purposes: currently ZAVENO does not use your data for any secondary purpose. There is no advertising, no sale of data, no commercial profiling and no training of artificial intelligence models with your information. If in the future we wanted to use it for anything else, we will ask you first and you may refuse without losing the service.

4. Where it comes from

From you, when you enter it in the app.
From the services you connect, always at your request and with the authorization you give on their own page: WHOOP (its official API), intervals.icu (with your key), Health Connect (with the permissions you grant on your phone) and Bluetooth heart rate sensors. Each service is responsible for its own data and applies its own policy.
From the page of your official HYROX result (results.hyrox.com), only when you paste its link and ask to import it.
From your AI assistant, when you give it write permission and it asks to create a routine or save your nutritionist's plan.

5. Your consent for sensitive data

We ask for your express consent to process health data the first time you use a feature that requires it: the Health section, logging your weight or the daily check-in, or connecting a wearable. You give it as follows: you read this summary, check the acceptance box (which is never pre-checked) and tap I accept.

We store the date and time, the version of this notice and your response, as proof of your consent. If you do not give your consent, you can continue using the training features that do not require health data. You can revoke it in Settings → Privacy.

6. Who we share it with

Only when you decide to:

Recipient	What it receives	What for	How you authorize it
Your coach on ZAVENO	Your training, progress and recovery; supplementation only if you turn it on	So they can support you and suggest changes (you accept them or not)	Settings → Coach: you choose your coach and revoke access whenever you want
Your AI assistant (Claude by Anthropic, ChatGPT by OpenAI, or another you connect with the ZAVENO connector)	The data you authorize when you connect it, each time the assistant looks it up: read access to training and, if you check it, health; write access to routines, workouts, logs or the meal plan	So your assistant can help you with your data	When you connect it, on ZAVENO's permission screen; you disconnect it in Settings → Integrations. What that assistant receives stays in your account with that provider, which handles it according to its own policy
Anyone with the public link to a workout	A read-only copy of that workout: exercises, sets and, if you check it, heart rate and distance (never notes, location or route)	To share a workout	You create the link, choose how long it lasts and revoke it whenever you want
Your calendar app (Google, Apple, Outlook or another)	The names of your planned routines and your workouts, with their date	To see them in your calendar	You create your private link in Calendar → Sync; you change it or turn it off whenever you want
Your friends in Gym Bro	The session's routine and what you log in it, while it lasts	To train together	You share the session with its code or QR code and end it whenever you want
Authorities	Whatever is required by a duly founded and reasoned request	To comply with the law	Without consent, in the cases provided for by law

Transfers clause: in each case you decide at the moment of sharing. If you do not accept, nothing is shared.

Health data never goes to your AI assistant unless you give it health permission. The raw data from your wearables (for example, your heart rate variability) is not provided to the assistant or to ZAVENO AI.

Spotify: if you link your account, the connection lives on your device: your app talks directly with Spotify to show what is playing and control it. The ZAVENO server does not receive your Spotify data.

Providers that help us operate (processors, which process data on our behalf):

Cloudflare: network, secure connection between your device and our server, and forwarding of contact email.
Open-Meteo: receives the approximate location of your activity to return the weather and air quality; it does not receive your name.
Notification services of your browser or operating system (Google, Apple or Mozilla), only to deliver notifications. The notification text does not include health data.
jsDelivr: delivers the exercise images; it receives your device's IP address, like any website.
OpenAI (United States), only if you use ZAVENO AI (the app's AI assistant) and give your consent in ZAVENO AI: it receives your messages, the photos you add and the ZAVENO data needed to answer, including health data if your question needs it and you gave your consent for health data. It processes them on ZAVENO's behalf to generate the reply. Under its API terms, OpenAI does not use this data to train its models and may keep it for up to 30 days to detect abuse. ZAVENO sends it a hashed identifier, never your name or email. You withdraw your consent from the ZAVENO AI menu.

Our server is located in Mexico. ZAVENO AI uses OpenAI's servers in the United States.

7. Your ARCO rights and how to exercise them

You have the right to Access your data, Rectify it, Cancel it and Oppose its processing (ARCO rights: Access, Rectification, Cancellation and Opposition). You may also object to an automated decision about your health or your performance affecting you in a significant way. On ZAVENO, no suggestion is applied without your acceptance.

From the app you can, at any time, view and correct your information, download a copy of all your data and delete your account (Settings → Privacy).

By email, write to privacidad@zaveno.app with:

your name and an email address where we can reply;
something that proves you are the data subject (for example, writing from the email address you gave us or confirming from your session in the app);
the right you are exercising;
the data it refers to (except for access requests);
any detail that helps locate it.

Time limits:

We will respond within a maximum of 20 business days and, if applicable, we will carry it out within the following 15 business days.
Each time limit may be extended only once for an equal period, if justified.
The process is free of charge.
Access is provided as an electronic file (JSON or CSV) or in the format we agree on.

If you disagree with the response, you may turn to the Secretaría Anticorrupción y Buen Gobierno (Mexico's Ministry of Anti-Corruption and Good Governance), the authority on personal data protection.

8. How to revoke your consent or limit use

Revoke: in Settings → Privacy → Health data consent, in Settings → Coach and Integrations, or by email. Revocation has no retroactive effect and is free of charge.
Limit: you can stop using any module, disconnect a wearable, stop sharing with your coach, disconnect your AI assistant, turn off your calendar link and turn off notifications.

9. How long we keep it

For as long as you keep your account. If you delete it, your data is deleted from the server immediately and from the calculation databases at the next sync. Backup copies are deleted when their rotation cycle ends, within a maximum of 6 months.
Data from a wearable stops being updated when you disconnect it.
ZAVENO AI memory is kept until you delete it in Settings → ZAVENO AI → Memory or delete your account; clearing the chat history does not delete it. It is sent to OpenAI only inside each message, to answer, under the same terms as the rest of the chat.
ZAVENO AI history is kept (up to the last 100 messages) until you clear it from ZAVENO AI or delete your account. Reports about replies are kept until they are reviewed, up to 500 in total.
Public links expire after the period you choose or when you revoke them, and are deleted with your account.
The record of your consent and of your acceptance of the terms is kept for as long as the law requires.

10. Cookies and local storage

ZAVENO does not use third-party advertising or analytics cookies. It only uses technical storage, necessary for it to work: the session cookie that keeps you signed in, the browser storage where the app saves your information so it can work offline (including, if you link it, the connection with Spotify) and the service worker that allows it to be installed as an app.

If you clear the site data in your browser, it is deleted from that device, but not from your account.

11. Security

Your information travels encrypted (HTTPS) and each person's files are stored with restricted access on the server.
Access is through passkeys, with no passwords that can be stolen.
AI connections and private links are stored only as a cryptographic fingerprint and can be revoked.
Security measures are reviewed at least once a year.

If a breach occurs that significantly affects your rights, we will notify you immediately. The notice will state what happened, what data was affected, what you can do and what we did.

12. Age and country

ZAVENO is for people 18 years of age or older and is intended for people who reside in Mexico.

13. Changes to this notice

Any change is published at zaveno.app/privacy.html, with its date and version, and we will let you know within the app. If a change requires new consent (for example, a new purpose), we will ask you for it before applying it.