This English translation is provided for convenience. In case of discrepancy, the French version prevails.
Privacy policy
This privacy policy explains how Overload collects, uses, and protects your personal data, whether you use the overload.coach website or the Overload mobile application.
1. Data controller
Olivier Cartier, sole proprietor
For full contact details (postal address, phone, SIRET), see the legal notice.
Email: olivier@overload.coach
2. Data collected
On the overload.coach website
The site is a static website with no forms and no user accounts. No personal data is collected directly through the site.
Cookieless audience measurement tools (Plausible Analytics and PostHog in cookieless mode) collect anonymized browsing data: URL visited, session duration, device type, approximate country. These tools cannot identify you. For details, see the cookies and trackers policy.
In the Overload mobile application
The data below is grouped by where it comes from.
What you enter yourself
- Account: email address, password (stored hashed), first name or nickname, language.
- Training: sessions, exercises, sets, loads, repetitions, durations and free-text comments.
- Sport profile: age, weekly goal, training level.
- Conversations with the AI assistant: the text you write or dictate to it, kept so you can reopen a conversation.
What the app reads from Apple Health or Health Connect, if you allow it
- Sleep, step count, nutrition (calories, protein, per-meal breakdown).
- Weight, body fat percentage, lean body mass, bone mass, body water mass.
What the app imports from Strava, if you connect your account
- Runs and rides: GPS route, distance, pace, elevation, power.
- Average and maximum heart rate.
What the app produces or receives
- Derived analyses: tonnage, training load, personal records, strength estimates, weekly recaps.
- Coach memory: what the AI assistant keeps from one conversation to the next, such as goals, injuries, restrictions, equipment, availability, preferences, nutrition and body measurements. It records what you tell it and what it infers from your conversations and training. You can view, correct and delete each item in the app.
- Subscription: customer identifier, purchase and renewal history.
- Notifications: a push token specific to your device.
- Support: the content of the tickets you open.
- Telemetry: usage events, and if you consent, session recordings and install events.
Health data (Article 9 GDPR)
Sleep, heart rate, weight and body composition are health data, which the GDPR treats as a special category under Article 9. Processing them relies on your explicit consent, given when you authorise the connection to Apple Health, Health Connect or Strava.
The AI assistant keeps injury, nutrition and body measurements in its memory only if you gave that consent.
You can withdraw that consent at any time from the app. Disconnecting stops the sync, and the purge erases the data already imported, including the health items in the coach memory.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 and 9 GDPR) |
|---|---|
| Providing the application's features (account, notes, analyses) | Performance of a contract (Art. 6(1)(b)) |
| Syncing and displaying health data and sport activities | Explicit consent (Art. 9(2)(a)) |
| Managing the subscription and billing | Performance of a contract (Art. 6(1)(b)) |
| Push notifications | Consent (Art. 6(1)(a)) |
| AI assistant and generated recaps | Performance of a contract (Art. 6(1)(b)) |
| Anonymous audience measurement of the website | Legitimate interest — trackers exempt from consent (Art. 6(1)(f) + CNIL deliberation 2020-091) |
| Session insights and attribution in the app | Consent (Art. 6(1)(a)) |
| Service security and abuse prevention | Legitimate interest (Art. 6(1)(f)) |
| Retention of accounting records | Legal obligation (Art. 6(1)(c)) |
4. Retention periods
| Data | Duration |
|---|---|
| Account and training data | Erased when the account is deleted. Residual data is purged within 60 days at most |
| Imported health data | Until you disconnect the source or trigger the purge |
| Server logs (OVH) | 12 months maximum |
| Website audience statistics (Plausible, self-hosted) | Kept as long as the instance runs. The measurements are aggregated and carry no identifier that could recognise you |
| Usage events (PostHog) | Per the retention of the PostHog plan in force: 1 year on the free tier, 7 years on paid tiers |
| Session recordings (PostHog) | 30 days |
| AI assistant requests and responses in technical monitoring (PostHog) | Per the retention of the PostHog plan in force, like usage events |
| Conversations with the AI assistant | Until the account is deleted. A conversation you delete disappears from the app, but its content stays stored until the account is deleted |
| Coach memory | Until you delete the item or the account. A health item the assistant infers, rather than one you state, stops being used after 30 days |
| AI assistant requests and responses at Anthropic | Not kept after the response, by default. Content flagged by Anthropic's automated trust and safety systems can be kept for up to 2 years |
| Accounting records | 10 years (legal obligation) |
Account deletion happens in two stages. The account and its content become inaccessible immediately. Residual data, meaning technical copies and caches, is erased within the following 60 days.
5. Recipients and processors
Your data is neither sold nor transferred to third parties for commercial purposes.
Processors (Article 28 GDPR)
These providers process your data on our behalf and on our instructions, strictly to the extent each purpose requires. Each is bound by a data processing agreement.
| Processor | Role | Data involved | Location |
|---|---|---|---|
| OVH SAS | Hosting of the site, the API and the database | All account data | France (EU) |
| Plausible Analytics (self-hosted instance) | Website audience measurement | Anonymous browsing data | France (EU) |
| PostHog Inc. (PostHog Cloud EU) | Audience measurement, product analytics and technical monitoring of the AI assistant | Usage events, AI assistant requests and responses, session recordings where consented | Germany — AWS eu-central-1 (EU) |
| Zammad (self-hosted instance) | Support and tickets | The content of your requests | France (EU) |
| Anthropic PBC | AI assistant, recaps, categorisation | Training notes, health figures sent to the coach, coach memory and conversation text | United States |
| RevenueCat Inc. | Subscription management | Email, identifier, purchase history | United States |
| Google LLC (Firebase Cloud Messaging) | Android push notifications | Device token | United States |
| Google LLC (Gmail SMTP) | Transactional email delivery | Email address, message content | United States |
| Expo | Push notifications | Device token, notification content | United States |
| Meta Platforms Ireland Ltd. | Advertising attribution, where you consent | Install and conversion events | Ireland (EU), with onward transfer to the United States |
| TikTok | Advertising attribution, where you consent | Install and purchase events | United States, Singapore |
Processing marked "where you consent" happens only after you agree, and you can revoke that agreement at any time from the app's privacy settings.
Other recipients and sources
These parties are not processors. They decide the purposes and means of their own processing, and are controllers in their own right. Their own privacy policy governs what they do with your data.
| Party | Relationship | Data involved |
|---|---|---|
| Strava Inc. | Source. When you connect your Strava account, you are the one authorising Strava to pass us your activities | Access tokens, GPS routes, heart rate, pace |
| Apple Inc. | Identity provider and reseller. "Sign in with Apple", then App Store distribution and subscription billing, and attribution of installs from Apple Search Ads | Apple identifier, purchase identifier, install attribution token |
| Google LLC (Google Play, Google Sign-In) | Identity provider and reseller. "Sign in with Google", then Android distribution and subscription billing | Google identifier, email address, purchase identifier |
| Apple Health / Health Connect | Source, on your device. You authorise us to read your measurements there | Sleep, steps, nutrition, weight, body composition |
| Apple or Google speech recognition | A system service on your device. When you dictate a message to the AI assistant, the system can send the audio to Apple or Google servers to transcribe it | Recording of your voice |
Anthropic does not use the content of your exchanges with the AI assistant to train its models without our express permission, and we do not give it.
AI assistants you connect (Claude, ChatGPT)
You can connect Claude (Anthropic) or ChatGPT (OpenAI) to your Overload account with our connector. In that case, Anthropic or OpenAI does not act as our processor. It receives your data at your request.
- You start the connection, then approve it on the Overload consent screen.
- The assistant receives only the data it asks for to answer you. The privacy policy of Anthropic or OpenAI governs that data.
- Overload stores no content from your conversations with these assistants.
- Access stops when you disconnect the assistant. A connection token lasts 30 days at most.
6. Transfers outside the European Union
Your training data and your health data are hosted inside the European Union, with OVH SAS in France.
Some processors listed above do process data in the United States: the AI assistant, subscription management, push notifications, email delivery and, where you consent, advertising attribution. Those transfers rely on the safeguards set out in Chapter V of the GDPR, meaning certification under the EU–US Data Privacy Framework or signature of the European Commission's standard contractual clauses, depending on the processor.
The AI assistant runs at Anthropic PBC, in the United States. Each request sends it the data your question needs, including health data when you ask the coach. That transfer relies on the European Commission's standard contractual clauses, incorporated in Anthropic's data processing addendum.
7. Your rights (Articles 15 to 22 GDPR)
Under the GDPR, you have the following rights:
- Right of access (Art. 15) — obtain a copy of your data.
- Right to rectification (Art. 16) — correct inaccurate data.
- Right to erasure (Art. 17) — request the deletion of your data.
- Right to restriction (Art. 18) — temporarily suspend processing.
- Right to object (Art. 21) — object to processing based on legitimate interest.
- Right to data portability (Art. 20) — receive your data in a structured format.
- Right to withdraw consent (Art. 7(3)) — withdraw a consent you gave at any time, without affecting the lawfulness of processing already carried out.
- Right to set instructions for your data after your death.
To exercise your rights:
Send your request by email to olivier@overload.coach or by post to Olivier Cartier, 4 rue Antoine de Saint-Exupéry, 69160 Tassin-la-Demi-Lune, France, enclosing a copy of an identity document.
You also have the right to lodge a complaint with the CNIL (the French data protection authority).
8. Security
Appropriate technical and organizational measures are in place to protect your data: HTTPS connections, hashed passwords, restricted access to data, hosting with OVH SAS in France.
In the event of a security incident likely to affect your rights and freedoms, you will be informed as soon as possible in accordance with Article 34 GDPR.
9. Changes
This policy may be updated at any time. The date of the last update is shown below. In the event of a substantial change, a notice will be published on the site.
Last updated: 13 October 2026