Legal

Privacy Policy

Last updated: 19 August 2026

This Privacy Policy explains how Kai Qin ("we", "us", "our"), the provider of the Basis mobile application ("Basis", the "App"), collects, uses, shares, and protects your information. By using Basis you agree to this Policy.

Basis was previously called Hybrid. Only the name changed — the provider, the app, and the data practices described below are the same.

This page covers the app. For the website you are reading it on, see the German Datenschutzerklärung.

1. Not a medical device

Basis is a training and recovery guidance tool for athletes. It isnot a medical device. It does not diagnose, treat, cure, or prevent any injury, illness, or medical condition, and its output is not medical advice. Always consult a qualified professional before acting on training or recovery guidance, and seek immediate medical attention for any acute symptom. See also our Terms of Service.

2. Who this Policy covers

This Policy applies to everyone who creates a Basis account and uses the App. Basis isnot directed to children and is intended for users16 years and older (see §11).

3. What we collect

We collect only what the coaching product needs. We do not collect data for advertising, and we do not sell your data.

Sensitive data. Some of what you provide — in particularmood, wellness, and other health-adjacent information — may qualify assensitive personal data (or a special category of data) under laws such as the GDPR. We treat the entire Basis dataset at that heightened bar. Where your jurisdiction requires it, we ask for your explicit consent before processing this data (see §9).

We do not intentionally collect precise location, contacts, browsing history, or financial account data.

4. How we use your data

• To provide the core service: generate your daily plan, parse your logs, compute fatigue/recovery, and answer your questions to the coach.
• To operate, secure, and improve the App (diagnostics, crash fixing, aggregate product analytics).
• To keep the Service affordable and available to everyone: enforcing rate limits, per-account AI spending ceilings, and the one-time free allowance, and preventing abuse of those limits (see §7).
• To send you notifications you have opted into (e.g. a "training ready" reminder), and transactional emails (e.g. sign-in codes).
• To comply with legal obligations.

We do not use your data for third-party advertising, and we donot sell it.

5. Artificial intelligence and your data (important)

Basis's coaching is powered by a third-party large language model (LLM). When you log a workout or wellness entry, or chat with the coach, the minimum necessary contextfor that request — which may include the text and images you submit and abounded slice of your recent training/wellness data — is sent to our AI processor to generate a response.

• AI processor: Google (Gemini API). We process AI requests through Google's Gemini API on its paid tier.
• No training on your data. Under the paid-tier terms, Google does not use your prompts or responses to train its models. This is a hard requirement of our design.
• Minimisation. We send only the context a given request needs — never your entire history. We prefer not to send your name or email into prompts.
• Your conversation is stored, but not re-sent in full. Your chat with the coach is saved to your account so that it survives reinstalling the App or moving to a new device, and so we can review the quality of the answers we give you. Storing more of the conversation does not mean sending more of it: each request still carries only a bounded slice of the recent exchange. You can delete your conversations by deleting your account (§8).
• Provider retention. The AI processor may retain request data transiently for abuse-prevention, security, and legal-compliance purposes as described in its own terms. Deleting your Basis data removes it from our systems but does not by itself purge a provider's short-term operational logs.

6. Sub-processors and third parties

We rely on the following service providers ("sub-processors") to run Basis. Each processes data only to provide its service to us:

Notifications are scheduled on your device and are not sent through a push service, so no notification token is created or transmitted. This list will be kept current. Future third-party integrations (e.g. Strava, Oura, remote push) will be added here and will only be enabled with your explicit connection.

We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users or the public.

7. Data retention

We retain your data for as long as your account is active. When you delete your account (§8), we delete your associated records — including your uploaded images — from our systems,with the single exception described immediately below. One category is kept for far less than that: coaching context snapshots (§3) are deleted automatically 7 days after they are created — or 30 days if you rated the reply 👎, because a reply you told us was wrong is one we want time to fix. Deletion runs hourly and is not conditional on you asking. Backups and provider operational logs may persist for a limited period before being overwritten. We may retain limited records where required to meet legal obligations.

7.1 The one thing we keep after you delete your account

Basis gives every new account a one-time free allowance of AI generations (a fixed number of coach messages and daily plans). To make that allowance one-time rather than one-time-per-deletion, we retain a single record after your account is gone:

• What we keep: an irreversible one-way cryptographic hash of your email address, combined with a secret value held only on our server, plus an integer count per feature.
• What we do not keep: your email address itself, your name, your account id, your training, wellness, or health data, your uploaded images, your coach conversations, or any other content. Nothing in this record is readable, reversible, or usable to contact, identify, or profile you — with the secret value it can answer exactly one question: "has this address already used its free allowance?"
• Why we keep it: without it, deleting an account and re-registering the same address would hand out a fresh free allowance indefinitely, and the same reset would clear the cost ceilings that keep the Service viable. Our legal basis is our legitimate interest in preventing abuse of a free tier and enforcing our Terms of Service, and under the GDPR this is the retention permitted by Article 17(3) notwithstanding a deletion request.
• What we never do with it: it is not used for analytics, marketing, personalisation, or any decision about you as a person, and it is never shared with or sold to anyone.
• Not included in your data export. It is not intelligible to you, and returning it would let anyone test whether someone else's email address still has a free allowance. If you want confirmation of what is held against your address, contact us at support@basiscoach.com.

If you have never used the free allowance, there is nothing to retain and no record is created.

8. Your rights — access, export, and deletion

You have the right to access, export, correct, and delete your data. Depending on your jurisdiction (e.g. GDPR, UK GDPR, CCPA/CPRA) you may also have the right to object to or restrict certain processing, and to lodge a complaint with a supervisory authority.

• Export. You can export your Basis data (your account, profile, training, and wellness records, your coach conversations, and references to your uploaded images) in a machine-readable format from within the App.
• Deletion. You can delete your account from within the App. Deletion removes your database records and your uploaded images from storage, and signs you out and clears Basis data cached on your device. One exception: the anonymous free-allowance marker described in §7.1 is retained — a one-way hash and a count, holding no email, name, or content.
• Provider caveat. As noted in §5, deletion does not purge an AI provider's short-term operational logs, which expire on the provider's own schedule.

To exercise a right that isn't available in-app, contact us atsupport@basiscoach.com.

You also have the right to lodge a complaint with a data-protection supervisory authority. The authority competent for us isDer Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany.

9. Consent for sensitive data

Because Basis processes health-adjacent and sensitive personal data (including mood and wellness), where your jurisdiction requires it we ask for your explicit, informed consent at onboarding before we process this data, and we make clear what is sent to our AI processor. You can withdraw consent by deleting the relevant data or your account. Withdrawing consent may limit or disable coaching features that depend on that data.

10. How we protect your data

• Every data row is scoped to its owner by database row-level security that fails closed.
• Authentication tokens are stored in the operating system's secure storage on your device.
• Data is transmitted over encrypted connections (TLS).
• Access to production systems is limited to what is necessary to operate the service.

No method of transmission or storage is 100% secure, but we work to protect your data using industry-standard measures.

11. Children's privacy

Basis is intended for users 16 and older and is not directed to children. We do not knowingly collect data from children under this age. If you believe a child has provided us data, contact support@basiscoach.comand we will delete it.

12. International data transfers

We and our sub-processors may process your data in countries other than your own, including the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses and the EU-US Data Privacy Framework) for such transfers.

13. Changes to this Policy

We may update this Policy from time to time. We will revise the "Last updated" date above and, for material changes, provide a more prominent notice in the App. Continued use after an update constitutes acceptance of the revised Policy.

14. Contact

Questions or requests about this Policy or your data: