Privacy Policy

1. Who we are

Waldo Studio BV, Belgium, operates Century, the joincentury.app website, related APIs, and Century mobile applications.

2. Information we process

We process account and contact data, such as name, email address, authentication identifiers, support messages, and account preferences.

We process subscription and entitlement information. Payment card details are processed by the applicable app store or payment provider and are not stored by Century.

We process device, application, diagnostic, security, and limited product-usage information needed to operate, protect, and improve the Service.

We process health and fitness information from sources you choose to connect, as described below, plus scores, trends, workout history, and other results generated to provide Century features.

We also process information you voluntarily provide through support, surveys, account settings, or other interactive features.

3. Why we process information

We process information to create and secure accounts, provide the features you choose, synchronize permitted data, calculate and display health insights, manage subscriptions, provide support, prevent fraud and abuse, diagnose failures, comply with law, and improve Century.

Depending on the activity, our legal basis is performance of a contract, your consent, compliance with legal obligations, or our legitimate interests in operating and securing the Service without overriding your rights.

4.1 Apple Health and Android Health Connect

When you connect Apple Health or Android Health Connect, raw device health data is read and processed on your device. Century does not store that raw device-source data on its servers. Century may store calculated scores, history, and account-linked results needed to provide synchronization and historical features.

4.2 Google Health

When you choose to connect Google Health, Century requests read-only access to activity and fitness data, sleep data, health metrics and measurements, and GPS location recorded during exercise. This can include steps, energy, distance, workouts, heart rate and related measurements, weight and body composition, sleep, and exercise routes.

Century's EU-hosted systems fetch and process Google Health data to provide health, recovery and sleep scores, trends, workout history, and route displays. Raw daily measurements are processed transiently. Century stores the Google connection and encrypted OAuth credentials, imported workouts and routes, and derived scores and history needed across sessions and devices.

Google Health data is not sold, used for advertising, lending, insurance, employment, data brokerage, generalized AI or model training, or shared with advertising platforms. Google Health values and values derived from them are excluded from PostHog analytics event content, and touch autocapture is disabled. Century Coach is not available in the current release; Google Health-derived data is technically blocked from Coach and AI-provider paths.

When you request a workout map, Century sends the workout's summary exercise route to Mapbox only to render that map. Mapbox acts as a mapping subprocessor for this purpose.

Century's use and transfer of information received from Google Health adheres to the Google Health API Developer and User Data Policy, including the Limited Use requirements: https://developers.google.com/health/policies/health-api-developer-user-data-policy

4.3 Garmin and other connected sources

If you connect Garmin or another supported source, Century processes the permitted health, fitness, wellness, workout, and connection information needed to provide the features you select. Provider-specific authorization controls which data Century can access. Connected-source data is not sold or used for advertising.

5. Analytics, marketing, and AI boundaries

Century may use limited product and diagnostic analytics to understand reliability and feature use. Google Health data and derived health values are excluded from analytics event content.

The Century mobile app does not display third-party advertising. External campaign platforms may process information through their own advertising systems, but Century does not provide them with account health data or in-app health behavior for targeting.

Century Coach is not available in the current release. Google Health-derived data is technically blocked from the disabled Coach and AI-provider paths.

6. Service providers and sharing

We share personal data only when necessary to provide, secure, support, or comply with legal obligations for the Service. Relevant providers include Supabase for authentication and backend services; Hetzner and Disco for hosting and deployment; Google APIs and connected health providers for user-authorized integrations; Mapbox for rendering a user-requested summary workout route; PostHog for restricted product analytics that exclude Google Health content and derived values; and RevenueCat, Apple App Store, Google Play, and where applicable Stripe for subscription or payment administration.

We may also share information with professional advisers, insurers, authorities, or transaction counterparties when legally required or reasonably necessary. Processors may use personal data only to provide their contracted service and are subject to applicable confidentiality, security, and data-protection obligations. We do not sell or rent personal data.

7. Storage, security, and international transfers

Century uses technical and organizational measures appropriate to the nature of the data, including HTTPS, access controls, multi-factor authentication for administrative services where supported, encrypted server-side Google OAuth credentials, restricted logs, and platform-protected mobile storage. No method of transmission or storage can guarantee absolute security.

Century's primary health-service processing is EU-hosted. Some providers may process information in other countries. Where required, Waldo Studio BV relies on adequacy decisions, contractual safeguards, or another lawful transfer mechanism.

8. Retention, disconnect, and deletion

Account information is retained while your Century account is active and as needed for support, security, legal, or contractual obligations. Usage and security records are retained only as long as needed for their documented operational, security, or legal purpose.

Google Health credentials are retained while the integration remains connected. Imported workouts, routes, and derived history are retained while the account remains active so Century can provide history and synchronization.

Disconnect Google Health through Settings > Data sources > Google Health to stop future access, revoke access where available, and delete Century's stored Google OAuth credentials and applicable normalized Google cache.

Delete your Century account through Settings > Account to revoke connected-source access and delete connection records, imported workouts and routes, derived account history, and the Century account, subject to limited legal or security retention requirements.

9. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent. You may also complain to the competent data-protection authority. We may ask you to verify your identity and may retain limited information where law permits or requires it. Send privacy requests to info@joincentury.app.

10. Cookies and device technologies

The website may use session, preference, security, and analytics technologies needed to operate and understand the Service. Browser settings can restrict cookies, although parts of the website may then function differently. The Century mobile app does not use cookies to display third-party advertisements.

11. Children

Century is not directed to children under 16 and Waldo Studio BV does not knowingly collect their personal data without appropriate authorization. Contact us if you believe a child has provided personal data so we can investigate and take appropriate action.

12. Changes and contact

We may update this policy as Century, its providers, or legal requirements change. The current version is published at https://joincentury.app/privacy-policy with its effective date. Material changes are communicated through the Service or by email when appropriate.

Privacy and data-rights requests: info@joincentury.app. Security reports: sander@waldo.studio. Controller: Waldo Studio BV, Belgium.