Privacy policy

Last updated: 31 October 2026

This policy covers the website www.nobiru.ch, the Nobiru app (in the browser at app.nobiru.ch and as an iPhone and Android app) and the Nobiru connector for AI assistants. It follows the Swiss Federal Act on Data Protection (FADP) and, for people in the EU, the GDPR.

Who is responsible

Nobiru c/o David Schneider, Monbijoustrasse 15, 3011 Bern, Switzerland. Privacy questions and requests: info@nobiru.ch. See also the imprint.

In short

• Your data is stored in Switzerland (Microsoft Azure, Switzerland North region).
• We don't sell data or show ads. The website sets no cookies and has no tracking.
• Your AI assistant only sees what you allow through the connector, and you can revoke it at any time.
• You can download all your data and delete your account with all of it.

What we process and why

Waitlist (website)

Name, email, country and which AI assistant you use, so we can invite you and decide which assistants to support next. Deleted when you delete your account or ask us to.

Account and sign-in

Email address, display name, time zone and sign-in times. To sign in, we email you a code; only a salted hash of the code is stored. Signing in in the browser uses a session cookie that's needed for it.

Training

Your profile (goals, equipment, limitations, experience, preferred length and days), your exercises, sessions, plans and schedule, and your completed workouts with effort, feeling, skipped exercises, pain reports and notes, plus XP, streaks and badges. This is how you plan with your AI assistant and see your progress. Pain reports and limitations can be health data; you give them voluntarily, to train more safely.

Garmin (optional)

If you connect Garmin with your personal Garmin API key, we store the key encrypted and fetch sleep, heart-rate variability, stress, Body Battery and resting heart rate per day. This is health data; it's used to choose hard and easy days. Disconnecting Garmin deletes the key and the data.

Reminders (optional)

For push reminders we store a push address or device token per device and which reminders were sent. A reminder contains the session name and a link, no health data.

Connected apps

For each app you give access (e.g. Claude or the Nobiru app), we store the grant and its access tokens. See and revoke them under Account → Connected apps.

Technical data

Using the app and the connector creates technical logs (e.g. time, requested address, errors), kept for 30 days to fix problems. The website itself is static pages delivered through the global network of Azure Static Web Apps; Microsoft processes technical access data such as the IP address to deliver them.

Legal bases (GDPR)

Account, training, reminders and the connector: performing the user agreement (Art. 6(1)(b)). Waitlist: your consent (Art. 6(1)(a)). Health data (pain reports, limitations, Garmin): your explicit consent (Art. 9(2)(a)), which you can withdraw at any time by deleting the entries or disconnecting Garmin. Technical logs: legitimate interest in running the service securely (Art. 6(1)(f)).

Who receives data

• Microsoft (Azure): hosting, database, key management and sending email, as our processor in the Switzerland North region.
• Your AI assistant (e.g. Anthropic's Claude): reads and writes your Nobiru data through the connector, only if and as long as you allow it. What the assistant does with it is governed by its own terms.
• Apple, Google and browser vendors: deliver push reminders (session name and link only).
• Garmin: only if you connect Garmin; we fetch your data there with your key.

We share data with no one else. Providers based in the USA may process data outside Switzerland; for that we rely on the safeguards they offer (e.g. standard contractual clauses or the Swiss-U.S. Data Privacy Framework).

Your rights

• Access and portability: download all your data as a file at app.nobiru.ch/account/export (in the app: Account → Download your data).
• Erasure: delete your account with all its data at app.nobiru.ch/account/delete (in the app: Account → Delete account). Technical logs expire after 30 days.
• Correction: change your profile, exercises and workouts in the app or through your AI assistant.
• Objection and withdrawal: disconnect Garmin, turn reminders off or revoke connected apps at any time.
• Complaints: to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, your data protection authority.

For anything else, write to us: info@nobiru.ch.

Security

Connections are encrypted (HTTPS). The Garmin key is encrypted as well, with keys held in Azure Key Vault. Sign-in codes are stored only as hashes. Every query is limited to your own account.

Changes

If we change this policy in a meaningful way, we'll tell signed-up users by email.