Legal notes

Venice Athletic Club (Cockpit) is a fitness app where athletes track training and compete in small teams. Registration is available from age 16. In version 1.0, Sign in with Apple is the only login method and Google Login is not available; eligible users can create their own team. We do not sell user data and do not use it for advertising.

Niccolò Busetti (applicazi.one), Castello 3593, 30122 Venice, Italy — apps@applicazi.one.

Through Sign in with Apple we process the user's name and email address, an internal user identifier and a device token for push notifications. We also retain the identifier of the accepted VAC Terms version and the date and time of the acceptance associated with the account. In the profile the user can enter goals, training days, experience, date of birth, biological sex and height, used to calculate calorie targets, and, only if athlete discovery is active, an approximate training area. Private notes are not part of the version 1.0 profile payload and stay local. The date of birth is declared by the user and remains in the dedicated server age authority that enforces the 16+/18+ access limits; it is not identity verification, KYC or a claim of verified age.

VAC is positioned as a fitness and wellness service, not as a medical service. Even so, heart, sleep, body-composition, injury and longitudinal fitness metrics or inferences can reveal physical or mental health and are treated as health and special-category data where applicable.

HealthKit authorization lets the app read selected types and does not authorize transmission to our systems. Under consent “health-local-receipt-v1-2026-07-20”, version 1.0 reads only and never writes to Apple Health. Raw or detailed Health signals and related body, dietary and up-to-six-month trend series are processed and retained on the device. The minimized receipts described below are separate projections and do not contain the raw Health fields.

The B2 application data model keeps only on the device: primary and focus goals; sex, height and current weight used for local training; target weight and body-fat and muscle targets; training days, intensity and experience; manual body measurements and locally entered series; raw Apple Health samples and identifiers; manual workout rows with stable identifier, day and date, type, duration, optional load and calorie values, and explicit manual provenance; macro, hydration, micronutrient and pinned nutrition targets; meal rows with stable identifier, day, name and logging time, calorie, macro, water and per-nutrient values, source, optional recipe link and per-nutrient provenance, confidence and coverage; and day corrections with day, calorie, macro and water values and correction time; custom recipes and meal and recipe favourites and order; long-term goals; private notes, facts and user-authored coaching context; protected progress photos and minimal local metadata; and user-authored local state consumed by the deterministic coach.

For competitions, only a “vac.workout-receipt.v1” receipt may leave the device: a one-way pseudonymous identifier, sport, Europe/Rome civil day, duration rounded down into 5-minute buckets and, when available, distance in 250-metre and energy in 25-kcal buckets. It contains no Health UUID, exact time, heart rate, power, cadence, zones or source. App Attest authenticates the app, device and request and limits replay, but does not certify HealthKit provenance or real-world performance. Manual workout entries stay on the device, are not posted to the workout API and award no IC or GAIN points. Opponents see only necessary competition values or an aggregate result. HealthKit data are not used for advertising or tracking.

For sleep-duration IC, only an envelope with the two keys “receiptSchema” equal to “vac.sleep-receipt.v1” and “receipts” may leave the device. The array contains one to five records and no more than one per Europe/Rome wake day in the latest five days. Each record contains exclusively “wakeDay” and “durationMinutes15”: a duration from 4 to 14 hours rounded down into 15-minute buckets. The server awards 0 to 53 IC from duration alone. The receipt contains no UUID, source, exact time, stages, efficiency, midpoint, quality, consistency or other Health data. VAC does not persist it as a Metric, snapshot or dossier; it retains only the CoinEntry ledger row needed for IC, with amount, reason, a sleep/day reference, account/team/week attribution and creation time. App Attest is mandatory, body-bound through dedicated headers, and limits unauthenticated requests and replay, but does not certify HealthKit provenance, real sleep or sleep quality.

The device keeps the local archive described above under complete file protection and marked for exclusion from system backups on iOS. Progress photos follow the same local protection. Local-only data do not transfer automatically to a new device and may be lost on uninstall, reinstall or device replacement. The only current Health projections reaching the backend are the minimized workout and sleep receipts described above. Backups created before this protection at the iOS system level may contain historical copies; withdrawal or deletion does not retroactively remove them.

The “.vacbackup” file is VAC's encrypted backup-and-restore artifact, not a generic data export. After archive authentication and a complete dry-run, only the localRestorable segment can be restored for the same opaque backup subject; the serverViewOnly segment remains view-only in the server export and never enters a mutation API.

On the first authenticated B12 migration, the client automatically copies to this device only the B2 localRestorable snapshot: profile, primary and focus goals, body inputs and targets, training preferences, nutrition targets, meals and corrections, recipes and favourites, long-term goals, and non-Health-derived private context — the profile note, UserNote records and PinnedFact records. It validates the complete snapshot and commits it locally before acknowledging the migration; only the acknowledgement bound to the snapshot digest permits purge of the matching remote source, and an invalid or over-limit snapshot is rejected rather than silently truncated. After that receipt exists, another device cannot fetch the server snapshot again and needs an authenticated, encrypted, same-subject “.vacbackup” backup to receive this local state. Health-derived legacy data and legacy manual workouts or body measurements outside the migration payload do not become local authority and follow a separate retention or erasure path.

The dashboard and CoachEngine produce personalized guidance on the device from the dossier, Health, body, nutrition, notes and history without calling Anthropic. Generative Marco is separate and optional. Cloud meal estimation from text or photos, cloud memory reranking and cloud background fact extraction are disabled and unavailable in version 1.0.

The user's question is classified on the device. Sensitive, medical or unclassifiable text is not sent to the cloud. For a supported fitness intent, the consultation application content received by Vercel and Anthropic is limited to a closed object with schema “fitness_coach_intent_v1”; one of daily_session, weekly_plan, training_idea, technique_tip, mobility_session, motivation, outdoor_adjustment, competition_preparation or general_fitness; and a “fitness_context_v1”. Context may contain only goal (strength, endurance, mobility, mixed or general), duration (short, medium or long), intensity (easy, moderate or hard), setting (indoor, outdoor or flexible), equipment (bodyweight, basic or full), coarse weather (cold, mild or hot; clear, cloudy, rain, storm, snow or other), day period and weekday. The sent locale is limited to it, en or de. Vercel also processes the necessary technical authentication/session, network and operational-log metadata, plus schema/protocol metadata; these do not expand the enumerated user content sent to Anthropic.

Anthropic does not receive the user's original words or chat history, name, photos, Health or body data, nutrition, injuries, notes, dossier, activity, measurements, coordinates, exact temperature or time zone. The server records the question as null; the answer returns to the device and the VAC database retains only the fixed “bounded_reply_completed” marker with quota/operational metadata, not the generated text. It creates no notes or facts from the answer. The flow rejects non-conforming payloads and requires age 18 or over and separate consent. One generative answer is available per day; local coaching remains available.

Anthropic calls require age 18 or over and separate coach consent “2026-07-20.v1” on the server. Use is optional. Once withdrawal is recorded, VAC stops future calls; data already sent remains subject to the periods below. Marco is based on Anthropic's Claude and is presented as AI, not a person. Answers can be inaccurate and are general fitness and wellness information, not medical advice; the coach makes no automated decision with legal or similarly significant effects.

According to Anthropic's current public documentation, standard API inputs and outputs are automatically deleted within 30 days, except for longer-retention services, a different agreement, Usage Policy enforcement or legal requirements. Flagged inputs and outputs may be retained for up to 2 years, safety-classifier scores for up to 7 years, and feedback or bug reports for up to 5 years. Commercial inputs and outputs are not used for model training by default, but feedback, bug reports or explicit permission may be used. Data are stored in the United States; traffic may be processed in the United States, Europe, Asia or Australia.

The user can publish team-chat and direct messages, notes, proposals, an optional profile photo, a club photo if they are the founder, progress photos, reward photos and reward text. Progress photos stay on the device; profile, club and reward photos are uploaded to the database, and we do not use facial recognition. Team members see activity and messages published in the team; direct messages are visible only to sender and recipient. The team board is readable and writable by every registered user. Users may report and block people or content. One report does not by itself hide content; content may be hidden when the reporting threshold is reached or by moderator decision. Automated filters or thresholds may restrict content, but the controller is the sole designated human escalation contact and can review a moderation decision through apps@applicazi.one. We act as soon as reasonably possible without promising continuous coverage or a fixed response time. Blocking hides the blocked person's content and prevents new contact between the two accounts.

The app includes a public Improve the app board, shared across all teams, where a registered user may submit at most one idea per month. Proposals are public with the author's name and other users may react. The same moderation rules apply. A moderator may grant the author a period of free VAC Pro access and show the name and period in the Hall of Fame. The gift does not use StoreKit or payment data. Account deletion removes proposals and reactions from the active application database; copies in logs, caches or backups follow the periods in the retention section.

The Pot records EUR amounts and statuses for Stake (EUR), voluntary deposits, the team treasury, contributions, proposed spending, paid/unpaid items, rewards, penalties and forfeits. No-prize functions and entries without a stake, spend or real contribution are available from age 16; recording a stake or pledge, contributing to or spending from the Pot, and attaching a reward, penalty or forfeit require age 18 or over. Correction, paid/unpaid status and external settlement of an existing record may remain accessible if the declared age changes. Members enter amounts and statuses; any real payment, delivery or settlement takes place directly between them outside VAC. VAC does not process, hold or transfer money. A winner may report an unsettled off-platform reward; the reversible report feeds the Honor score and may be reviewed by a moderator.

During a weekly team challenge, the server uses minimized “vac.workout-receipt.v1” receipts to calculate sessions, load, distance, minutes and active days for members who opt in. The opposing team sees only the aggregate score; it does not see individual receipts, Health signals, recovery or other health indicators. Participation is off by default. Team members may see reward proposers and vetoes; any settlement happens outside the app; see Team Pot.

The user can challenge a teammate on sessions, load, distance, active minutes or training days over a rolling seven-day window. The comparison uses only values calculated from minimized competition receipts; Apple Health provenance and App Attest do not certify real-world performance. Recovery, dossier, body values and raw signals do not enter the competition. The opponent sees values necessary for the duel; history with values and names is limited to the user, teammates and accepted friends, never the public. Rewards and penalties describe off-app agreements and are subject to filtering and reporting; no payment happens in VAC.

Honor is a reputation percentage showing how often a user or club has honored challenges with a reward at stake. It is behavioral data derived from challenge outcomes, not health data, and is visible like ranking position. At the end of a challenge with a reward, the winner can report a failure by the losing party to settle the off-platform reward. The report is reversible and recorded for moderator review. Unfounded reports may lead to moderator action against the person who made them.

Athlete discovery is optional and off by default. The iOS client rounds coordinates to two decimals before sending them to VAC endpoints; other users see only an area and distance. Turning it off starts deletion of stored location, limited to 7 days; search or location parameters may appear in request logs. Apple's WeatherKit and CLGeocoder may receive unquantized location directly from the device. Anthropic may receive only coarse weather categories and a day period/weekday, never coordinates, exact temperature, humidity or time zone.

VAC uses Vercel for hosting, accounts, APIs/functions and logs; application functions are configured for fra1 (Frankfurt), while Vercel's control plane, logs and subprocessors may process elsewhere. Neon remains on AWS us-east-1. Anthropic receives only the enumerated payload and produces the answer; Apple provides Sign in with Apple, APNs, WeatherKit, CLGeocoder and App Store services. From current detailed HealthKit data, only the minimized workout and sleep receipts described above leave the device. Legacy server copies may remain until deletion or expiry. APNs receives device tokens and, depending on the event, notification content and metadata that may include names, message previews, stake or pledge information and moderation reasons. Processing is not entirely EU-resident and may occur outside the EEA and UK. We do not sell data or share it with advertisers.

At application-content level, B2 server state is limited to account identity, binding, sessions and authentication providers; date of birth, age-assurance result and adult or minor state; consent and Terms acceptance records; the operational locale needed for communication and routing; a non-sensitive onboarding completion boolean and version; attested non-backfilled minimized workout and sleep receipt projections; the bounded Marco intent enum and coarse context and any retained audit marker; friendships, memberships, blocks and discovery state; boards, direct messages, posts and necessary relationship context; moderation reports, evidence references, actions and audit trail; the ledger, entitlements, stakes, forfeits and settlement state; challenge and duel membership, minimized receipts and results; and redacted device registration, anti-replay and App Attest operations. Provider, network, security and operational-log metadata are described separately.

Barcode scanning may retrieve product data from Open Food Facts. The source is identified in the app; the database is licensed under the Open Database License (ODbL) and individual contents under the Database Contents License. Food-catalog data are kept separate from personal user data.

We manage accounts and contractual app functions under Article 6(1)(b) GDPR and the corresponding UK GDPR basis. Local Health reading and creation of the minimized workout and sleep receipts rely on separate, explicit and revocable consent under Articles 6(1)(a) and 9(2)(a) GDPR or UK GDPR. For minimized receipts or other server-side account data that reveal health status, the Article 6(1)(b) basis alone is insufficient: an applicable Article 9 condition and a compatible provider contract are also required. This notice neither creates nor evidences those prerequisites. Separate AI-coach consent covers only the enumerated intent and context; it does not authorize Health data transmission to Anthropic. Approximate location and optional profile photo rely on consent; club photo and social functions rely on contract. Team-challenge participation is off by default.

Data handled by VAC include Other Financial Info for user-linked EUR Pot amounts and Contacts for the social graph of friends, requests, teams and blocks. VAC endpoints receive location rounded to two decimal places; Apple's WeatherKit and CLGeocoder may receive unquantized location from the device. Searches for users, teams or administration may travel in URLs and related logs. VAC does not collect card, account or payment-provider details and does not process Payment Info or Purchase History.

VAC does not use these data for tracking. Version 1.0 is free and offers no paywall, in-app purchases, paid subscriptions, purchase restoration or subscription management. VAC Pro access assigned by a moderator is a non-commercial gift and does not activate StoreKit or payment-data processing.

The current local archive includes necessary Health data, manually logged body-measurement history, manual workouts, private notes and pinned facts. It is identity-scoped, protected and excluded from backups; uninstalling or reinstalling the app or changing device may therefore cause its loss. Pausing Health reading stops new Health updates; Revoke consent and delete data removes the local Health archive and starts deletion of directly linked legacy Health records from the active system. Accepted workout receipts and IC-ledger entries created from sleep duration alone follow the account's result and IC-ledger retention.

Competition receipts and completed shared results, virtual balances, social content and the other B2 server categories described above may remain with the account where needed for the feature or shared context. Local-only B2 data are not part of active server state. Legacy records, including earlier remote copies of private notes, workouts, measurements, goals or nutrition, logs, caches, replicas and backups are not removed immediately. Enumerated inputs already sent to Anthropic and generated outputs follow the periods and exceptions in the AI Coach section.

Account, profile, content, competition receipts and fixed consultation markers remain while the account is maintained unless deleted or another need described here applies. VAC does not retain the generated answer text. Sessions expire within 30 days; discovery location is limited to 7 days; push logs about 28 days; security logs up to 12 months. Open moderation reports remain until decision and resolved or dismissed reports may remain up to 180 days.

Account deletion removes the active account, profile and many linked contents and anonymizes Pot entries. Technical security logs may remain for up to 12 months. For a banned identity, a pseudonymous anti-abuse identifier may remain with reason, expiry and review metadata; temporary bans remain until expiry, while a permanent ban and the associated anti-abuse retention may be reviewed manually after a user challenge or when needed to protect the service. VAC attempts to revoke Sign in with Apple authorization when it has a usable token; VAC deletion may complete even when Apple revocation is unavailable or unsuccessful, and the user may separately manage authorization in Apple ID settings. Provider logs, caches, replicas and backups may follow additional periods and are not removed immediately.

The user may start deletion in the app or write to apps@applicazi.one for access, rectification, restriction, portability, objection or deletion requests, to withdraw consent, or to make a data-protection complaint. We may request proportionate information to verify the requester without asking the user to send Health records or account secrets by email. Requests are handled within applicable statutory time limits. EEA users may contact their competent supervisory authority; United Kingdom users may complain to the Information Commissioner's Office.

To use VAC, the user must be at least 16 years old and enter a date of birth at registration. Functions and challenges without a prize or stake, Pot entries without a stake, spend or real contribution, and free GAIN are available from age 16 where offered. The AI coach, recording a stake or pledge, contributing to or spending from the Pot, and rewards, penalties or forfeits require age 18 or over. Correction, paid/unpaid status or external settlement of an existing record may remain accessible if the declared age changes. If we believe a user is below the required age, we may suspend or delete the account.

We do not track users across third-party apps or websites and do not use identifiers for advertising purposes.

Apple Standard EULA and acceptance of the VAC Terms

The iOS app is licensed under the Apple Standard EULA, which Apple applies automatically when no custom EULA is provided in App Store Connect. These VAC Terms, document “vac_terms” version “2026-07-20”, effective July 20, 2026, are supplementary terms governing the VAC account and service: they are not a custom EULA and do not replace the Apple Standard EULA.

Before starting Sign in with Apple, the user must expressly accept the current VAC Terms version. Acceptance is recorded on the server for the identified account, with version and date and time; a new material version requires renewed acceptance and access to the cockpit remains blocked until the server confirms it. Any demo-mode acceptance remains local and is not attributed to a real account. Users must be at least 16. Ordinary functions and no-prize or no-stake challenges, viewing and ordinary Pot entries that do not involve taking on a stake, spending or a real contribution, and free GAIN are available from age 16 where offered; the AI coach, stakes or pledges, Pot contributions or spending, and rewards, penalties or forfeits require age 18 or over. Correction, paid/unpaid status or external settlement of an existing record may remain accessible if the declared age changes.

App Store storefront availability and in-service territory controls are separate. This notice does not by itself announce availability in France or the United Kingdom; those territories remain disabled until their respective legal-market readiness requirements are verified and availability is separately authorized. VAC may decline access or limit a feature where a territory is not supported. The United Arab Emirates, including Dubai, remain outside the planned initial scope.

The app allows the user to publish content: team chat messages, direct messages, proposals, a profile photo, a club photo if the user is the founder, progress and reward photos and the text of team-challenge rewards. The user is solely responsible for what they publish and confirms that they have the right to upload the images they publish. We apply zero tolerance for offensive content and abusive behavior: it is prohibited to publish or send illegal, harassing, threatening, hateful, discriminatory, sexually explicit, defamatory or rights-infringing content, as well as spam or impersonation. We may remove any content and suspend or close accounts that violate the Terms without notice. Each team also has a public board: any registered user can read and write on it, so messages posted on the board are visible to all app users and subject to the same content rules and moderation.

Messages and members can be reported or blocked in the app. One report does not by itself hide content; content may be hidden when the reporting threshold is reached or by moderator decision. Automated filters or thresholds may restrict content; the controller is the sole designated human escalation contact. Content, users, a reporting outcome or a moderation decision can be reported or challenged through the in-app control or at apps@applicazi.one with the account, exact content location, reason and relevant context. Receipt of a report is distinct from its outcome; an outcome records the decision and available review route. We review reports and act as soon as reasonably possible, without continuous coverage or a fixed response time. Blocking hides the person's messages and profile and prevents new contact between the two accounts.

The Team Pot ledger displays stakes and EUR amounts, voluntary deposits, the team treasury, voted spending and paid/unpaid status, as well as rewards, penalties and forfeits. Entries without a stake, spend or real contribution and free GAIN are available from age 16; stakes, pledges, contributions, spending, rewards, penalties and forfeits require age 18 or over. Correction, status updates and external settlement of an existing record may remain accessible. Members perform every real settlement outside the app. VAC records amounts and settlement declarations but does not process, hold or transfer money. An unsettled report may affect Honor and be reviewed by a moderator. VAC may limit or disable these features by territory, applicable rules and age requirements.

The app provides weekly team challenges and one-on-one duels. Competitions without a stake are available from age 16; rewards, stakes, penalties and forfeits require age 18 or over. Members propose and negotiate the description, and where used the photo, of a reward or penalty, then perform or settle it outside VAC. The winner may mark the result paid or unpaid; that declaration may affect Honor and be reviewed by a moderator. VAC does not process, hold or transfer money and may limit or disable these features by territory, applicable rules and age requirements.

The app includes a public Improve the app board, shared across all teams, where each registered user may submit at most one idea per month to improve the app. Proposals are public and shown with the author's name; other users can react with a like or dislike. Proposals are user-generated content, subject to the content rules and moderation above. By proposing an idea, the user grants us a non-exclusive, free and perpetual right to use and implement it in the app without compensation, confidentiality or attribution obligations. A moderator may accept a proposal and, at their sole discretion, grant the author a period of free VAC Pro access, displaying the name in an internal Hall of Fame. The gift is a free, discretionary and non-commercial entitlement to Pro features: it is not a payment, purchase or paid subscription, is not owed or guaranteed for any proposal and may be revoked in case of abuse.

The app, including the AI coach, is intended and marketed for general fitness and wellness, not to diagnose, prevent, monitor, predict, treat or alleviate disease. It is not an emergency service. AI-generated guidance can be inaccurate or incomplete and does not replace a qualified professional. The user should stop activity if they feel unwell and contact local emergency services in an emergency.

Weather data provided through WeatherKit, including when used by the coach as general context, may be inaccurate, incomplete or differ from actual conditions. The app is not designed or marketed for emergencies or life-saving purposes. When the app provides real-time weather guidance, Apple's required notice applies: YOUR USE OF THIS REAL TIME WEATHER GUIDANCE APPLICATION OR WEBSITE IS AT YOUR SOLE RISK. WEATHER DATA MAY NOT BE ACCURATE.

The app is provided as a general fitness and wellness service and availability may change. To the maximum extent permitted by law, VAC is not responsible for user-to-user agreements or for loss caused by reliance on inaccurate AI, weather or fitness estimates. Nothing in these Terms excludes or limits liability that cannot lawfully be excluded, including liability for fraud, wilful misconduct, death or personal injury caused by negligence, or mandatory consumer rights.

The user may stop using the app at any time. We may suspend or revoke access in case of violation of the Terms, subject to applicable law and available review. These Terms are governed by Italian law, but that choice does not deprive a consumer of mandatory protections of the law of the country where the consumer habitually resides or of any court rights that cannot validly be excluded. For any request: apps@applicazi.one.

Contact and request handling

Venice Athletic Club is a fitness app where athletes track workouts and compete in teams. For questions, issues or requests, email apps@applicazi.one. We review requests and respond as soon as reasonably possible, without a guaranteed response time.

For European Union service recipients and authorities, apps@applicazi.one is the electronic contact point for Digital Services Act matters; communications are accepted in Italian and English. A notice alleging illegal content should identify the exact content reference or URL, explain why the content is alleged to be illegal, provide the submitter's name and electronic contact unless the law permits an exception, and include a good-faith statement that the information is accurate and complete. Do not attach illegal sexual imagery or abuse material; provide only the reference needed to locate it.

Receipt and outcome are separate records: a receipt only confirms that a notice entered the review channel, while an outcome states the decision. Where notice is lawful, a restriction outcome should identify the affected content or account, the legal or Terms basis, the material facts and circumstances, whether automated means were used, the scope and duration of the restriction, and the available review route. A review request may be sent to the same electronic contact point. This description does not promise continuous coverage or a fixed decision time.

In the app, open a message or member profile to report or block. One report does not by itself remove the message; it may be hidden when the reporting threshold is reached or by moderator decision. We review reports and act as soon as reasonably possible, without a fixed response time. Blocking hides the person's messages and prevents new contact between the two accounts. Content, users or a review request may also be sent by email with the relevant details.

The user can start account deletion in the app at Settings > Delete account or write to apps@applicazi.one from the account email address. The path removes the data described under Retention and user rights with the retained items, Sign in with Apple revocation limits and provider propagation expressly stated there; it is not a promise of immediate deletion of every copy.

Email apps@applicazi.one with the subject “Data protection request” or “Data protection complaint”, identify the account and describe the requested outcome. Do not email Health records, passwords, tokens or other account secrets. For a United Kingdom data-protection complaint, VAC acknowledges receipt within 30 days, investigates as appropriate, keeps the complainant informed and provides an outcome without unjustifiable or excessive delay. This statutory complaint process is separate from the general support response time. A UK user may also complain to the ICO.

The app reads only Apple Health data authorized through the system prompt and never writes to Apple Health. Access can be changed in iOS Settings > Privacy & Security > Health > Venice Athletic Club. Under Settings > Data sources, the user can pause reading or start Revoke consent and delete data. That path deletes the local Health archive and starts deletion of directly linked legacy records from the active system; completed receipts or shared results and copies in logs or backups may remain as described under Retention and user rights.

For legal or privacy questions: apps@applicazi.one

Last updated: July 20, 2026