Peak ("we", "us", "our") is the peakiq.app platform, operated by Progressive Overcome Coaching, the data controller for the purposes of the EU General Data Protection Regulation (GDPR) and Dutch data protection law. This policy explains what personal data we collect, why, the legal bases we rely on, and the rights you have. For any data protection question or request, contact us at admin@peakiq.app.
Your body data and progress photos are "special category" personal data under Article 9 GDPR. We process them only with your explicit consent, given when you use the features that collect them, and solely to provide the nutrition and training functionality you have asked for. You can withdraw your consent at any time by deleting the relevant data or your account, or by contacting admin@peakiq.app. Withdrawing consent does not affect processing carried out before withdrawal.
We do not sell your personal data, and we do not use it for advertising.
Where a coach invites and manages a client on Peak, the coach determines what client data is entered and how it is used, and acts as a controller of that client's data; Peak acts as a processor on the coach's behalf for the plan and health data the coach manages. Coaches are responsible for having a lawful basis and appropriate consent to enter their clients' personal and health data into the platform. Peak remains the controller for account, billing, and platform-security data. Clients can only ever access their own data — never other clients' data.
We share data with the following providers strictly to run the Service:
We do not sell your data to third parties.
Some of our providers process data outside the European Economic Area (for example in the United States). Where they do, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an applicable adequacy decision.
We keep your personal data for as long as your account is active. If you delete your account, your account data, health data, and progress photos are removed promptly (and in any event within 30 days), except where we are legally required to retain certain records — for example, billing and tax records, which are kept for the period required by law.
Data is encrypted in transit (HTTPS) and at rest. Access to your records is restricted by database row-level security, so each user can only reach their own data (and coaches only their own clients'). Progress photos are stored in a private, non-public bucket and are only served through short-lived signed links. Payments are handled entirely by Stripe. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data.
Under the GDPR you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to withdraw consent at any time. To exercise any of these, contact admin@peakiq.app. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or your local data protection authority.
If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority, and affected users where required, without undue delay and in line with our GDPR obligations.
Peak uses only essential session cookies and local storage required for authentication and for the app to function. We do not use tracking or advertising cookies.
Peak is not intended for anyone under 18. We do not knowingly collect data from minors; if you believe a minor has provided us data, contact admin@peakiq.app and we will delete it.
We may update this policy from time to time. We will notify users of significant changes via email or an in-app notice, and update the "last updated" date above.
For any privacy or data protection question, or to exercise your rights, contact us at admin@peakiq.app.