Privacy Policy

1. Who We Are

Ritual is developed and published by Kove, an independent software studio based in Chennai, India. References to "we," "us," or "Kove" in this policy refer to this entity.

Contact: hello@trainritual.com

2. Data Stored Locally on Your Device

The following data is created and stored exclusively on your device. It is never transmitted to Kove's servers or any third party, unless you explicitly use the public share link feature described in Section 5:

• Workout sessions, exercises, sets, reps, weight, and volume
• Cardio sessions, GPS route data, pace, distance, and splits
• Hydration logs and daily intake records
• Step count data (read from Apple Health)
• Recovery session logs (breathwork, foam rolling, stretching)
• Health Score inputs and composite results
• Calculator inputs and results (VO2 Max, TDEE, body fat, 1RM, Wilks, etc.)
• Ritual Labs profile data and progression history
• Achievements, XP, levels, and gamification progress
• Athlete coaching profiles and associated session data
• App settings, themes, and preferences
• Subscription status, managed securely by Apple via StoreKit

3. Device Permissions

Ritual may request the following device permissions, strictly as required to operate features you choose to use:

• Location (When In Use only): requested solely during active outdoor GPS cardio sessions to record your route, pace, and distance. Location is never accessed in the background and is never collected passively. Your GPS route data is stored on your device only and is not transmitted to Kove.
• Apple Health (read and write): Ritual integrates with Apple Health to read your step count data and write completed workout and cardio sessions to your Apple Health record. This exchange occurs entirely within Apple's HealthKit framework on your device. Kove does not have access to your Apple Health data at any point.
• Notifications: requested for optional workout, cardio, hydration, and bedtime reminders. All notifications are generated locally on your device. No notification content or interaction data is sent to Kove.
• Camera, Photos, Microphone: Ritual does not request or use camera, photo library, or microphone access.

4. iCloud Backup

Ritual supports optional iCloud backup of your training data through up to 7 independent backup slots. This backup is managed entirely by Apple under Apple's iCloud Terms and Privacy Policy. Kove does not have access to your iCloud backup data. You may manage or disable iCloud backup for Ritual at any time in your device's iCloud settings.

5. Public Share Links - Third-Party Data Storage

Ritual allows you to generate a public web share link for any workout or cardio session. When you choose to generate a share link, the session data for that specific session is transmitted to and stored on a third-party key-value database (Upstash, operated via Vercel infrastructure) solely to serve that link to anyone who accesses the URL.

The following applies to share link data:

• Data stored is limited to the specific session you chose to share
• No personally identifying information is attached to stored data - no name, email, account, or device identifier
• The share link is accessible by anyone with the URL
• You may delete a share link within Ritual at any time, which removes the session data from the database
• Upstash's privacy policy governs data stored on their infrastructure: upstash.com/privacy

6. What We Do Not Collect

Kove does not collect, process, or store any of the following:

• Your name, email address, phone number, or any personal identity information
• Advertising identifiers (IDFA or equivalent)
• Behavioural analytics or in-app usage telemetry
• Crash reports or diagnostic data sent to Kove
• Purchase history beyond Apple's anonymised confirmation of subscription status
• Device fingerprints or hardware identifiers
• Data from any third-party advertising or tracking network

Ritual contains no advertising SDKs, no analytics SDKs (such as Firebase, Mixpanel, Amplitude, or equivalents), and no social login integrations.

7. Website Analytics

The Ritual website (trainritual.com) is hosted on Vercel. Vercel may collect standard server-side request data including IP addresses, request timestamps, and browser user agent strings as part of normal infrastructure operation. This is governed by Vercel's privacy policy at vercel.com/legal/privacy-policy. Kove does not operate any additional analytics tools, tracking pixels, or behavioural monitoring on the website.

8. Apple and the App Store

Ritual is distributed through the Apple App Store. Apple's standard App Store data practices apply to the download and purchase process, including transaction processing for Ritual Pro subscriptions. Apple's privacy policy governs these interactions: apple.com/legal/privacy. Kove receives only anonymised aggregate sales data from Apple and does not receive any personal data about individual users or purchasers.

9. Children's Privacy

Ritual is rated 17+ on the Apple App Store and is not directed at children under the age of 13 (or the applicable minimum age in the user's jurisdiction). Kove does not knowingly collect any data from children. If you believe a child has used the app in a way that has resulted in data collection, contact us at hello@trainritual.com and we will take immediate action.

10. Your Rights

Because Kove does not collect or hold personal data from in-app use (with the limited exception of opt-in share link session data), most data rights are exercisable directly by you on your own device:

• Access and portability: All your training data is accessible within Ritual and exportable via the free PDF export feature at any time.
• Deletion: Deleting the Ritual app removes all locally stored data from your device. Share link data can be deleted from within Ritual before uninstalling.
• Correction: All data in Ritual is entered and editable by you at any time within the app.
• Objection to processing: You may withdraw any device permission (location, Health, notifications) at any time via your device settings.

If you are located in the European Economic Area, United Kingdom, or California, you may have additional rights under GDPR, UK GDPR, or the CCPA respectively. For any privacy rights request, contact hello@trainritual.com and we will respond within 30 days.

11. Data Security

Because the vast majority of your data never leaves your device, your primary security layer is your device's own protection: screen passcode, Face ID or Touch ID, and Apple's hardware encryption. For share link data stored via Upstash and Vercel, industry-standard TLS encryption in transit and encryption at rest is applied by those services. Kove does not have administrative access to individual share link records.

12. Data Retention

Data stored on your device is retained until you delete it within Ritual or delete the app entirely. Share link session data is retained on Upstash infrastructure until you delete the share link within Ritual, at which point a deletion request is issued to the database. Website infrastructure logs retained by Vercel are subject to Vercel's own data retention policies.

13. International Data Transfers

In-app data does not leave your device under normal operation. Share link data and website infrastructure operate via Vercel and Upstash, which may process data in the United States or other jurisdictions. These providers maintain data processing agreements consistent with international transfer requirements, including GDPR Standard Contractual Clauses where applicable.

14. Changes to This Policy

Kove may update this Privacy Policy from time to time. The date of the most recent revision is displayed at the top of this page. Material changes will be noted in Ritual's App Store update release notes. Continued use of Ritual following any revision constitutes acceptance of the updated policy.

15. Contact

For any privacy-related questions, requests, or concerns:
Email: hello@trainritual.com
Business: Kove, Chennai, India