Privacy policy

Effective from 22 October 2026 · Version 2.0

Libo is a training app for competitive athletes in federated sports and for hybrid athletes. It plans your season, fits your sessions around your real week and how you feel each day, and gives you a coach to talk to. To do that it needs to get to know you, and some of what it needs is health data. This policy explains what data we process, why, who we share it with, how long we keep it and how you stay in control.

Libo is in a pilot phase. We have written this policy to be read by people, not just lawyers; where more detail helps, you will find expandable Learn more sections. If anything is unclear, email us at [email protected].

1.Scope and who we are

What this policy covers

It covers the Libo app, this website (lb-hybrid-training.com) and any emails you exchange with us. It does not cover third-party services you choose to connect to Libo, such as watches or health apps, which have their own policies.

Data controllers

Libo is run by María Aguado and Clara San Martín, acting as individuals. We decide together why and how your data is processed, which makes us joint controllers (Article 26 of the General Data Protection Regulation, GDPR).

We have agreed between us that:

• there is a single point of contact for any privacy matter: [email protected];
• we are both responsible for complying with this policy and coordinate to handle your requests;
• you can still exercise your rights against either of us.

Supervisory authority

The competent authority is the Spanish Data Protection Agency, the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

2.Information we collect

We process three kinds of data: what you give us, what comes from the third-party services you connect, and what we work out from both. Like any online service, we also generate some technical data.

2.1 Information you give us

• Account: email address and password, or the identity Apple or Google assigns you if you sign in with them. Your date of birth is required, because Libo is only for people aged 16 and over.
• Profile: name, sex and, if you wish, phone number and photo.
• Sports profile: sport, position, club, level, goals, season and competition dates, the equipment you have and your availability (days, times, work).
• Your week: team training, matches, regular activities and any changes you make to your calendar.
• Training: completed sessions, sets, reps, loads, rate of perceived exertion (RPE), notes and any external activities you log (running, CrossFit…).
• Health data you log: check-ins (sleep, energy, stress, motivation, niggles), pain, injuries, episodes of illness and, if you switch on cycle tracking, the menstrual cycle. See section 3.
• Coach conversations: what you write to the coach and what it replies.
• Competition documents: PDFs of fixtures or results you choose to import. We extract dates, matches and results; the PDF itself is not stored.
• Team: your public profile (display name, @username, photo, bio), posts, photos, comments, Boosts, who you follow, and any blocks and reports you make.
• Correspondence: anything you email us and our replies.

2.2 Data from third-party services you connect

You can connect third-party services to Libo, such as watches and health apps. You choose what to connect and which data types to allow. Depending on what you allow, we may receive:

• Activities: type, date, duration, distance, pace or speed, heart rate, laps, elevation and, where the activity has one, the GPS route.
• Daily metrics: sleep, resting heart rate, heart rate variability (HRV), steps and calories.
• Menstrual cycle, only if you switch on cycle tracking.

If you connect Apple Health, the app reads data on your iPhone, only for the types you have allowed, and you can change these permissions in your iPhone's Health settings. Apple Health data is not used for advertising, is not sold and is not shared with third parties, other than the service providers that help us run Libo (section 7).

2.3 Information we work out

• Your season plan, phases and sessions.
• Your daily readiness and your training load by stimulus (strength, power, cardio…).
• Your progress, personal bests and level indicators.

2.4 Technical data

• Technical logs to detect errors and keep the service running, with a pseudonymous internal identifier.
• Operational data: language, time zone, platform and app version.
• A record of your consents: what you accepted, which version of the text, in which language, from which platform and when.

We don't show ads and we don't sell or rent data.

3.Health data

Some of the data Libo processes is data concerning health, a special category that the GDPR gives extra protection (Article 9). In Libo this means:

• check-ins on sleep, energy, stress and niggles;
• pain, injuries and episodes of illness;
• the menstrual cycle;
• heart rate, heart rate variability, sleep and activities from the watches and health apps you connect;
• the indicators we calculate from them, such as your readiness.

3.1 Legal basis: your explicit consent

We only process health data if you give us your explicit consent (Articles 6(1)(a) and 9(2)(a) GDPR). We ask for it on a separate screen, apart from accepting this policy, which explains what data, what for, and that the necessary context (without your name or email) is sent to an AI provider in the USA. We record the date, the version of the text, the language and the platform you used, so that we can prove it.

3.2 What we use it for

To work out your readiness, adjust the load in your plan (for example, easing off if you slept badly, are in pain or are ill) and let the coach answer you with context. We don't use it for advertising, we don't sell it and we don't publish it.

3.3 If you don't give consent

Libo needs this data to plan and adjust your training, so without consent the app cannot coach you. You can give consent whenever you like, download the data we already hold or delete your account.

3.4 If you withdraw it

You can withdraw it at any time in Settings > Account and privacy. When you do:

• we stop using your health data and disconnect your watches and health apps, so no new data comes in;
• if you don't give consent again within 30 days, we delete your health data. The grace period lets you undo a withdrawal made by mistake without losing your history;
• your training history is kept;
• withdrawing consent does not affect the lawfulness of what we did before.

3.5 Menstrual cycle

Cycle tracking is optional and switched on separately in the app. Cycle data is not sent to the coach or to any AI model. You can switch it off at any time.

3.6 Kept out of the feed

Sleep, pain, injuries, illness, cycle, check-ins and readiness are not published in Team, even if you share that day's session.

4.How we use your information

We only use your data for the purposes described here. Each needs a legal basis; Libo relies on four:

• Contract (Article 6(1)(b) GDPR): what is needed to provide the service you asked for when you created your account.
• Consent (Article 6(1)(a) and, for health data, 9(2)(a)): things we only do if you say yes, and which you can withdraw.
• Legitimate interests (Article 6(1)(f)): what we need to keep the service secure and working well, provided your rights don't override it. You can object (see section 11).
• Legal obligation (Article 6(1)(c)): what the law requires of us, such as being able to prove your consents or responding to your rights requests.

4.1 Providing the service

• Creating and managing your account, letting you sign in and checking your age.
• Planning your season and sessions around your sport, goals, calendar and availability, and adapting them to your real week.
• Matching load to how you feel each day, using your health data if you consent.
• Counting your external activities (running, CrossFit…) towards your load, whether you log them or they come from a connected service.
• Answering you in the coach chat and writing your session texts.
• Importing your competition calendar from the PDFs you upload.
• Team: showing your profile and posts to the people you choose, and showing you posts from people you follow.
• Sending a session summary to another app you have connected for that purpose, when you ask us to.
• Managing your subscription, where there is one: Apple or Google take payment and tell us your subscription status; we don't receive your payment details.
• Getting in touch with you about the service and the pilot.

4.2 Keeping Libo secure and working

• Security and bug fixing: technical logs to spot faults, abuse and unauthorised access, including in how the AI works.
• Team moderation: an automatic content filter before posting, and review of reports.
• Cost control: what the AI costs per feature and per user each month, pseudonymised.

4.3 Complying with the law

• Keeping proof of your consents and handling your rights requests.
• Responding to requests from authorities and defending ourselves against claims.

We don't use your data for advertising. If we wanted to use it for something other than what this policy describes, we would let you know and, where the law requires, ask for your consent.

5.Artificial intelligence and automated decisions

5.1 Where we use AI

• The coach: a conversational assistant that reads your plan, your load and, if you consented, your sleep and readiness, so it can answer with context.
• Session texts and sessions you describe in free text.
• Reading competition documents to extract dates, matches and results.
• Team content filter: before posting, text and photos go through an automatic filter that detects offensive or inappropriate content.

We use models from a language model provider based in the USA. The coach shows the notice "Your coach is an AI and can make mistakes".

5.2 What reaches the model

• Only the context needed for each answer: training, load, calendar and, if you consented, health data. We don't send your name, email address, phone number or date of birth.
• Menstrual cycle data is not sent.
• Before it is sent to the AI provider, text (from the chat, your sessions, competition documents or anything you are about to post) goes through an automatic filter that removes identifying details such as email addresses, phone numbers, Spanish ID numbers (DNI/NIE), IBANs or card numbers. No filter is perfect, so we recommend not including personal details you don't need to.
• Under the provider's terms, the data we send is not used to train its models and is kept for up to 30 days for abuse monitoring.

5.3 Are any automated decisions made about you?

Your plan is generated automatically: a rules-based planning engine chooses your sessions from your data (calendar, availability, load, readiness), and the AI writes texts and replies in the chat. These decisions do not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR: they are training suggestions you can change, move or ignore.

If the content filter stops you posting something you think is fine, email us.

5.4 AI Transparency Statement

• What the AI processes: besides what you tell the coach, it can receive a summary of data from the smartwatches and health apps you connect (recent activities, sleep, resting heart rate, heart rate variability and steps) so it can answer with context about your own training.
• Only with your explicit consent: this data only reaches the AI if you have given your explicit health data consent, which we ask for on its own screen, separate from accepting this policy, before any of it is processed.
• Easy to withdraw: you can withdraw that consent at any time in Settings > Account and privacy. From then on we stop sending your health and smartwatch data to the AI (section 3.4).
• No AI training: we use an existing language model; we don't train, fine-tune or improve AI models with your data or with anything derived from it, and the provider doesn't use it to train its models either.
• You stay in control: the AI only suggests. If the coach proposes a change to your plan, nothing changes until you confirm it.

6.Team: what other people see

Team is Libo's social side: you can follow teammates, share sessions, comment and give Boosts. Using it is optional.

• What is visible: your public profile (display name, @username, photo and bio), the sessions you share with their summary (type, duration, distance, pace, session heart rate and, where there is one, the route), any photos and text you add, your comments and Boosts, and who you follow.
• Who sees it: whoever your visibility settings allow. You can change them, and edit or delete your posts and comments, at any time.
• What is not visible: your health data (sleep, pain, injuries, illness, cycle, check-ins, readiness), your email address, phone number and date of birth.
• Routes: trimmed at the start and finish so they don't reveal where you set off or finish. Even so, think twice before posting a route that starts near your home.
• Blocking and reporting: you can block someone and report posts, comments and profiles. We don't reveal who made a report.
• Illegal content: if a report reveals illegal content, we may keep it and pass it to the authorities.
• Other people's data: if you post photos of or mention other people, make sure they are happy with it.

Anything other people have seen, saved or screenshotted before you delete it is outside our control.

7.How we share your information

We don't sell or rent your data. We only share it with those we need to make Libo work.

7.1 Providers working for us (processors)

They process data only on our instructions, under a contract that requires them to protect it. We group them by category:

7.2 Third parties acting on their own account (independent controllers)

• Apple and Google, if you sign in with them, as app stores (they handle downloads, payments and refunds) and as the phone's health platforms.
• The third-party services you connect (watches, health apps) and any app you ask us to send a session summary to.

Each processes your data under its own privacy policy.

7.3 Other users

What you post in Team is seen by whoever your settings allow (section 6). If you choose to share a competition document with the league, the competition data (dates, matches, results) may be used for other people in that league; your name does not appear.

7.4 Authorities

We will disclose data to courts, police or other authorities where the law requires it.

8.International transfers

Our language model provider and our map provider are in the United States. These transfers rely on the EU-US Data Privacy Framework where the provider is certified or, failing that, on the European Commission's standard contractual clauses. You can ask us for information about these safeguards by emailing us.

9.How long we keep your data

We keep your data while you have an account and we need it to provide the service. When you delete your account we delete it, with the exceptions in the table.

10.Security

We apply reasonable technical and organisational measures to protect your data against loss, unauthorised access or misuse: communication with our servers is encrypted, and each person can only access their own data and what others allow them to see. No system is infallible; use a unique password and don't share it.

If a security breach affecting your data occurs, we will act as the GDPR requires, notifying the AEPD and, where it poses a high risk to you, letting you know.

11.Your rights and choices

You can exercise these rights at any time, free of charge:

11.1 How to exercise them

If you email us, please write from your account email address and say which right you want to exercise. If we can't verify your identity, we may ask for some additional information. We will reply within the legal time limit of one month, which may be extended by two further months for complex requests, in which case we will let you know. More detail on our contact page.

11.2 Complaining to the AEPD

If you think we have mishandled your data or not dealt with your request, you can lodge a complaint with the Agencia Española de Protección de Datos at www.aepd.es or through its online portal, sedeagpd.gob.es. If you live in another EU country, you can also complain to your local data protection authority.

12.Children

Libo is only for people aged 16 or over. We ask for your date of birth when you sign up, and it is required:

• if you are under 16, you cannot create an account or use the app, and we don't store your date of birth;
• if an existing account shows an age under 16, it can only be deleted or signed out;
• if we learn that an account belongs to someone under 16, we will delete it.

If you are a parent or guardian and believe a child in your care is using Libo, email us.

13.Updates to this policy

We may update this policy when Libo or the law changes. The version and effective date are shown at the top. If a change is significant, we will let you know in the app and, where needed, ask you to accept it again.

This policy is also available in Spanish. If the two versions differ, the Spanish version prevails.

14.Contact us

For any privacy question or to exercise your rights: [email protected]. Controllers: María Aguado and Clara San Martín. More ways to reach us on our contact page.