Privacy

Kinevolab privacy policy

Last updated 2026-10-29

Who runs this

Kinevolab is run by Tyler Diminick, an individual in New Jersey, USA. Contact: [email protected].

What we collect, and why

Your account: email address, first name, last name, and a hashed password. Needed to run the service (contract).
Your health and fitness data: whatever you log — weight, resting heart rate, sleep, runs with heart rate and pace, workouts, body scans and measurements, meals and nutrients, check-ins, races, goals, plans and notes. This is "data concerning health". We process it only to provide the service to you, and only with your explicit consent, which you give at signup and can withdraw at any time by deleting your account.
Your preferences (layouts, saved charts, display tone) and your quick-start answers (what you are here to do). Contract.
Feedback you send through the app, with the page you sent it from. We read it to improve the product (legitimate interest). It is linked to your account.
Billing, if you subscribe: Stripe collects your payment details; we never see your card. We keep your Stripe customer and subscription identifiers and the subscription's status. Contract.

We do not collect your IP address, device information or location into any record. The app runs no analytics. This marketing site uses Cloudflare Web Analytics, which counts page views — which page, the page that linked to it, and rough country and device type — without cookies or any identifier that follows you between visits or sites. We run no advertising of any kind.

Cookies and browser storage

We set no cookies. The app keeps a few keys in your browser's local storage so it works: your session tokens, your name for the header, a cache of your preferences, a sync marker between tabs, your theme, and your quick-start mode. All are needed to run the app or are your own settings; none are used to track you, and none are set before you log in except reading your theme choice. This site stores nothing.

Who else handles your data

Cloudflare (hosting for the web pages and the secure connection to our servers, and the marketing site's page-view counts; it handles your requests in transit), Hetzner (our servers), Neon (our database), Resend (sends password-reset and other account emails to you), and Stripe (payments). None of them use your data for their own purposes. No AI company receives your data from us.

If you connect an AI assistant

Kinevolab can be connected to an AI assistant through a token you create or a connection you approve. From then on, whatever you ask that assistant to do with your log — read it, add to it, summarise it — sends that data to the assistant's provider, under their terms, at your instruction. Revoke the token or connection in the app at any time to stop that.

Administrators

The person running Kinevolab can see each account's email, name, how much has been logged and when, and feedback messages. Administrators cannot browse your health and fitness entries.

Where your data is

Our servers are in Ashburn, Virginia, USA, and our database is hosted by Neon on Amazon Web Services in Ohio, USA. If you use Kinevolab from the EU or UK, your data is transferred to and stored in the United States.

How long we keep it

Until you delete your account. Rows you delete in the app are marked as deleted rather than removed, so a mistake does not cost you your history; they are included in your export and are removed for good when you delete your account. Expired sessions and tokens are removed automatically. Server logs are kept for about two weeks and contain no personal information beyond an account identifier. Database backups are kept for five days, after which a deleted account is gone from them too. Stripe keeps invoices for as long as tax law requires.

Your rights

You can see everything you have logged in the app at any time, and change it while your account has access — free, a trial, or a subscription. You can download all of it as a file from Access Tokens → Your account → Export my data. You can delete your account, which deletes everything above, from Access Tokens → Your account → Delete account; this is also how you withdraw consent to our processing your health data. To have particular entries erased without deleting your account, send a privacy request from Feedback in the app, or email us, saying which; we erase them within one month. You can change your name and email address from Your account; a new email address must be verified before it takes effect. You can object to or ask about any processing by emailing us. If you are in the EU or UK you can complain to your data protection authority.

Consumer Health Data Privacy Policy

For Washington residents under the My Health My Data Act. It restates, in that law's terms, what the rest of this policy says.

What we collect: the health and fitness data you enter — body weight, resting heart rate, sleep hours, body composition from scans, body measurements, runs with heart rate and pace, workouts, meals and nutrients, weekly check-ins, race results and goals, and any notes you attach to them. Nothing is inferred from it, and nothing is collected from your device or from anyone else.
Where it comes from: you, by typing it in, or an assistant you connected entering it at your instruction.
Why: to show it back to you, compute your summaries and charts, and compare it with the targets you set — that is, to provide the service you asked for. For no other purpose.
Who it is shared with: the hosting providers named above, who store and transmit it to run the service, and no one else. If you connect an AI assistant, your data goes to its provider at your instruction, as described above. We do not sell health data and will not without your signed authorisation, which we do not intend to ask for.
Your rights and how to use them: you can withdraw consent and have everything deleted from Delete account, which also removes it from our backups within five days; you can see and export it from the same place; and you can ask us anything about it at [email protected]. If we decline a request you may appeal by replying to our answer, and we will respond within the time the law allows.

Changes

We will update the date above when this policy changes, and ask for your consent again if what we do with your health data changes.