Legal notes

Venice Athletic Club (Cockpit) is a fitness app where athletes track training and compete in small teams. Registration is available from age 16 and uses Sign in with Apple; eligible users can create their own team. We do not sell user data and do not use it for advertising.

Niccolò Busetti (applicazi.one), Castello 3593, 30122 Venice, Italy — apps@applicazi.one.

Through Sign in with Apple we process the user's name and email address, an internal user identifier and a device token for push notifications. We also retain the identifier of the accepted VAC Terms version and the date and time of the acceptance associated with the account. In the profile the user can enter goals, training days, experience, date of birth, biological sex and height, used to calculate calorie targets, and, only if athlete discovery is active, an approximate training area. Private notes are not part of the profile data sent to the server and stay on the device. The date of birth is declared by the user and held on the server, which uses it to enforce the 16+ and 18+ access limits; it is not identity verification and does not certify a verified age.

VAC is positioned as a fitness and wellness service, not as a medical service. Even so, heart, sleep, body-composition, injury and longitudinal fitness metrics or inferences can reveal physical or mental health and are treated as health and special-category data where applicable.

HealthKit authorization lets the app read selected types and does not authorize transmission to our systems. Under consent “health-local-receipt-v1-2026-07-20”, the app reads only and never writes to Apple Health. Raw or detailed Health signals and related body, dietary and up-to-six-month trend series are processed and retained on the device. The minimized receipts described below are separate projections and do not contain the raw Health fields.

The app keeps only on the device: primary and focus goals; sex, height and current weight used for local training; target weight and body-fat and muscle targets; training days, intensity and experience; manual body measurements and locally entered series; raw Apple Health samples and identifiers; manual workout rows with stable identifier, day and date, type, duration, optional load and calorie values, and explicit manual provenance; macro, hydration, micronutrient and pinned nutrition targets; meal rows with stable identifier, day, name and logging time, calorie, macro, water and per-nutrient values, source, optional recipe link and per-nutrient provenance, confidence and coverage; and day corrections with day, calorie, macro and water values and correction time; custom recipes and meal and recipe favourites and order; long-term goals; private notes, facts and user-authored coaching context; protected progress photos and minimal local metadata; and user-authored local state consumed by the deterministic coach.

For competitions, only a minimized workout receipt may leave the device: a one-way pseudonymous identifier, sport, Europe/Rome civil day, duration rounded down into 5-minute buckets and, when available, distance in 250-metre and energy in 25-kcal buckets. It contains no Health UUID, exact time, heart rate, power, cadence, zones or source. App Attest authenticates the app, device and request and limits replay, but does not certify HealthKit provenance or real-world performance. Manual workout entries stay on the device, are not posted to the workout API and award no IC or GAIN points. Opponents see only necessary competition values or an aggregate result. HealthKit data are not used for advertising or tracking.

For sleep-duration IC, the device may send only a submission of at most five receipts, one for each Europe/Rome wake day in the latest five days. Each receipt contains only the wake day and the sleep duration rounded down into 15-minute buckets, from 4 to 14 hours. The server awards 0 to 53 IC from duration alone. The receipt contains no Health identifier, source, exact time, stages, efficiency, midpoint, quality, consistency or other Health data. VAC does not keep it as a measurement, snapshot or dossier; it retains only the ledger entry needed for IC, with amount, reason, a sleep and day reference, account, team and week attribution and creation time. App Attest is mandatory, body-bound through dedicated headers, and limits unauthenticated requests and replay, but does not certify HealthKit provenance, real sleep or sleep quality.

The device keeps the local archive described above under complete file protection and marked for exclusion from system backups on iOS. Progress photos follow the same local protection. Local-only data do not transfer automatically to a new device and may be lost on uninstall, reinstall or device replacement. The only current Health projections reaching the backend are the minimized workout and sleep receipts described above. Backups created before this protection at the iOS system level may contain historical copies; withdrawal or deletion does not retroactively remove them.

The “.vacbackup” file is VAC's encrypted backup for restoring data to the device, not a generic data export. Once the archive has been verified and a complete trial restore has run, only the part that was held on the device is restored, and only for the same pseudonymous subject the backup is bound to; the part held on our servers is included as read-only and no restore can change it.

On the first authenticated sign-in, the app automatically brings back to this device only the data meant to live there: profile, primary and focus goals, body inputs and targets, training preferences, nutrition targets, meals and corrections, recipes and favourites, long-term goals, and the private context not derived from Health, namely the profile note, private notes and pinned facts. The app verifies the complete copy and saves it on the device before confirming the transfer; only a confirmation bound to the fingerprint of that copy authorizes deletion of the matching remote copy, and a copy that is incomplete or over the size limit is rejected rather than silently truncated. Once that confirmation exists, no other device can download the copy from the server again: receiving those data requires an encrypted, verified “.vacbackup” backup bound to the same subject. Earlier copies kept on our servers — data derived from Health, and manually entered workouts or body measurements outside the transfer — do not become the local reference and follow a separate retention or erasure path.

The dashboard and CoachEngine produce personalized guidance on the device from the dossier, Health, body, nutrition, notes and history without calling Anthropic. Generative Marco is separate and optional. Meal text and photos stay on the device, and the coach's memory is built and updated there alone: no outside service reranks it or extracts facts from it in the background.

The user's question is classified on the device. Sensitive, medical or unclassifiable text is not sent to the cloud. For a supported fitness intent, the consultation application content received by Vercel and Anthropic is limited to a closed object with schema “fitness_coach_intent_v1”; one of daily_session, weekly_plan, training_idea, technique_tip, mobility_session, motivation, outdoor_adjustment, competition_preparation or general_fitness; and a “fitness_context_v1”. Context may contain only goal (strength, endurance, mobility, mixed or general), duration (short, medium or long), intensity (easy, moderate or hard), setting (indoor, outdoor or flexible), equipment (bodyweight, basic or full), coarse weather (cold, mild or hot; clear, cloudy, rain, storm, snow or other), day period and weekday. The sent locale is limited to it, en or de. Vercel also processes the necessary technical authentication/session, network and operational-log metadata, plus schema/protocol metadata; these do not expand the enumerated user content sent to Anthropic.

Anthropic does not receive the user's original words or chat history, name, photos, Health or body data, nutrition, injuries, notes, dossier, activity, measurements, coordinates, exact temperature or time zone. The server does not keep the question text; the answer returns to the device and the VAC database retains only the fixed “bounded_reply_completed” marker with quota/operational metadata, not the generated text. It creates no notes or facts from the answer. The flow rejects non-conforming payloads and requires age 18 or over and separate consent. One generative answer is available per day; local coaching remains available.

Anthropic calls require age 18 or over and separate coach consent “2026-07-20.v1” on the server. Use is optional. Once withdrawal is recorded, VAC stops future calls; data already sent remains subject to the periods below. Marco is based on Anthropic's Claude and is presented as AI, not a person. Answers can be inaccurate and are general fitness and wellness information, not medical advice; the coach makes no automated decision with legal or similarly significant effects.

According to Anthropic's current public documentation, standard API inputs and outputs are automatically deleted within 30 days, except for longer-retention services, a different agreement, Usage Policy enforcement or legal requirements. Flagged inputs and outputs may be retained for up to 2 years, safety-classifier scores for up to 7 years, and feedback or bug reports for up to 5 years. Commercial inputs and outputs are not used for model training by default, but feedback, bug reports or explicit permission may be used. Data are stored in the United States; traffic may be processed in the United States, Europe, Asia or Australia.

The user can publish team-chat and direct messages, notes, proposals, an optional profile photo, a club photo if they are the founder, progress photos, reward photos and reward text. Progress photos stay on the device; profile, club and reward photos are uploaded to the database, and we do not use facial recognition. Team members see activity and messages published in the team; direct messages are visible only to sender and recipient. The team board is readable and writable by every registered user. Users may report and block people or content. One report does not by itself hide content; content may be hidden when the reporting threshold is reached or by moderator decision. Automated filters or thresholds may restrict content, but an automated restriction is never final: a user can ask a person to review it by writing to apps@applicazi.one. We act as soon as reasonably possible. Blocking hides the blocked person's content and prevents new contact between the two accounts.

The app includes a public Improve the app board, shared across all teams, where a registered user may submit at most one idea per month. Proposals are public with the author's name and other users may react. The same moderation rules apply. A moderator may grant the author a period of free VAC Pro access and show the name and period in the Hall of Fame. The gift does not use StoreKit or payment data. Account deletion removes proposals and reactions from the active application database; copies in logs, caches or backups follow the periods in the retention section.

The Pot records EUR amounts and statuses for Stake (EUR), voluntary deposits, the team treasury, contributions, proposed spending, paid/unpaid items, rewards, penalties and forfeits. No-prize functions and entries without a stake, spend or real contribution are available from age 16; recording a stake or pledge, contributing to or spending from the Pot, and attaching a reward, penalty or forfeit require age 18 or over. Correction, paid/unpaid status and external settlement of an existing record may remain accessible if the declared age changes. Members enter amounts and statuses; any real payment, delivery or settlement takes place directly between them outside VAC. VAC does not process, hold or transfer money. A winner may report an unsettled off-platform reward; the reversible report feeds the Honor score and may be reviewed by a moderator.

During a weekly team challenge, the server uses the minimized workout receipts to calculate sessions, load, distance, minutes and active days for members who opt in. The opposing team sees only the aggregate score; it does not see individual receipts, Health signals, recovery or other health indicators. Participation is off by default. Team members may see reward proposers and vetoes; any settlement happens outside the app; see Team Pot.

The user can challenge a teammate on sessions, load, distance, active minutes or training days over a rolling seven-day window. The comparison uses only values calculated from minimized competition receipts; Apple Health provenance and App Attest do not certify real-world performance. Recovery, dossier, body values and raw signals do not enter the competition. The opponent sees values necessary for the duel; history with values and names is limited to the user, teammates and accepted friends, never the public. Rewards and penalties describe off-app agreements and are subject to filtering and reporting; no payment happens in VAC.

Honor is a reputation percentage showing how often a user or club has honored challenges with a reward at stake. It is behavioral data derived from challenge outcomes, not health data, and is visible like ranking position. At the end of a challenge with a reward, the winner can report a failure by the losing party to settle the off-platform reward. The report is reversible and recorded for moderator review. Unfounded reports may lead to moderator action against the person who made them.

Athlete discovery is optional and off by default. The iOS client rounds coordinates to two decimals before sending them to VAC endpoints; other users see only an area and distance. Turning it off starts deletion of stored location, limited to 7 days; search or location parameters may appear in request logs. Apple's WeatherKit and CLGeocoder may receive unquantized location directly from the device. Anthropic may receive only coarse weather categories and a day period/weekday, never coordinates, exact temperature, humidity or time zone.

VAC uses Vercel for hosting, accounts, APIs/functions and logs; application functions are hosted in Germany, while Vercel's platform management, logs and subprocessors may process elsewhere. The Neon database is hosted in the United States. Anthropic receives only the enumerated payload and produces the answer; Apple provides Sign in with Apple, APNs, WeatherKit, CLGeocoder and App Store services. From current detailed HealthKit data, only the minimized workout and sleep receipts described above leave the device. Earlier copies kept on our servers may remain until deletion or expiry. APNs receives device tokens and, depending on the event, notification content and metadata that may include names, message previews, stake or pledge information and moderation reasons. Processing is not entirely EU-resident and may occur outside the EEA and UK. We do not sell data or share it with advertisers.

On our servers, application data are limited to account identity, binding, sessions and authentication providers; date of birth, age-assurance result and adult or minor state; consent and Terms acceptance records; the operational locale needed for communication and routing; a non-sensitive onboarding completion boolean and version; attested non-backfilled minimized workout and sleep receipt projections; the bounded Marco intent enum and coarse context and any retained audit marker; friendships, memberships, blocks and discovery state; boards, direct messages, posts and necessary relationship context; moderation reports, evidence references, actions and audit trail; the ledger, entitlements, stakes, forfeits and settlement state; challenge and duel membership, minimized receipts and results; and redacted device registration, anti-replay and App Attest operations. Provider, network, security and operational-log metadata are described separately.

Barcode scanning may retrieve product data from Open Food Facts. The source is identified in the app; the database is licensed under the Open Database License (ODbL) and individual contents under the Database Contents License. Food-catalog data are kept separate from personal user data.

We manage accounts and contractual app functions under Article 6(1)(b) GDPR and the corresponding UK GDPR basis. Local Health reading, creation of the minimized workout and sleep receipts and their storage on our servers rely on the user's separate, explicit and revocable consent under Articles 6(1)(a) and 9(2)(a) GDPR or UK GDPR. Separate AI-coach consent covers only the enumerated intent and context; it does not authorize Health data transmission to Anthropic. Approximate location and an optional profile photo rely on consent; club photo and social functions rely on contract. Team-challenge participation is off by default.

Data handled by VAC include Other Financial Info for user-linked EUR Pot amounts and Contacts for the social graph of friends, requests, teams and blocks. VAC endpoints receive location rounded to two decimal places; Apple's WeatherKit and CLGeocoder may receive unquantized location from the device. Searches for users, teams or administration may travel in URLs and related logs. VAC does not collect card, account or payment-provider details and does not process Payment Info or Purchase History.

VAC does not use these data for tracking. The app is free and takes no payment inside it: it does not use StoreKit and does not process purchase data. VAC Pro access assigned by a moderator is a non-commercial gift and does not activate StoreKit or payment-data processing.

The current local archive includes necessary Health data, manually logged body-measurement history, manual workouts, private notes and pinned facts. It is tied to the user's account, protected and excluded from backups; uninstalling or reinstalling the app or changing device may therefore cause its loss. Pausing Health reading stops new Health updates; Revoke consent and delete data removes the local Health archive and starts deletion of directly linked earlier Health copies from the active system. Accepted workout receipts and IC-ledger entries created from sleep duration alone follow the account's result and IC-ledger retention.

Competition receipts and completed shared results, virtual balances, social content and the other categories held on our servers and described above may remain with the account where needed for the feature or shared context. Data that stay only on the device are not part of the active data on our servers. Earlier copies kept on our servers, including remote copies of private notes, workouts, measurements, goals or nutrition, logs, caches, replicas and backups, are not removed immediately. Enumerated inputs already sent to Anthropic and generated outputs follow the periods and exceptions in the AI Coach section.

Account, profile, content, competition receipts and fixed consultation markers remain while the account is maintained unless deleted or another need described here applies. VAC does not retain the generated answer text. Sessions expire within 30 days; discovery location is limited to 7 days; push logs about 28 days; security logs up to 12 months. Open moderation reports remain until decision and resolved or dismissed reports may remain up to 180 days.

Account deletion removes the active account, profile and many linked contents and anonymizes Pot entries. Technical security logs may remain for up to 12 months. For a banned identity, a pseudonymous anti-abuse identifier may remain with reason, expiry and review metadata; temporary bans remain until expiry, while a permanent ban and the associated anti-abuse retention may be reviewed manually after a user challenge or when needed to protect the service. VAC attempts to revoke Sign in with Apple authorization when it has a usable token; VAC deletion may complete even when Apple revocation is unavailable or unsuccessful, and the user may separately manage authorization in Apple ID settings. Provider logs, caches, replicas and backups may follow additional periods and are not removed immediately.

The user may start deletion in the app or write to apps@applicazi.one for access, rectification, restriction, portability, objection or deletion requests, to withdraw consent, or to make a data-protection complaint. We may request proportionate information to verify the requester without asking the user to send Health records or account secrets by email. Requests are handled within applicable statutory time limits. EEA users may contact their competent supervisory authority; United Kingdom users may complain to the Information Commissioner's Office.

To use VAC, the user must be at least 16 years old and enter a date of birth at registration. Functions and challenges without a prize or stake, Pot entries without a stake, spend or real contribution, and free GAIN are available from age 16 where offered. The AI coach, recording a stake or pledge, contributing to or spending from the Pot, and rewards, penalties or forfeits require age 18 or over. Correction, paid/unpaid status or external settlement of an existing record may remain accessible if the declared age changes. If we believe a user is below the required age, we may suspend or delete the account.

We do not track users across third-party apps or websites and do not use identifiers for advertising purposes.

App EULA and acceptance of the VAC Terms

The iOS app is licensed under the EULA shown on its App Store page. These VAC Terms, effective July 20, 2026, are supplementary terms governing the VAC account and service.

Before starting Sign in with Apple, the user must expressly accept the current VAC Terms version. Acceptance is recorded on the server for the identified account, with version and date and time; a new material version requires renewed acceptance and access to the cockpit remains blocked until the server confirms it. Any demo-mode acceptance remains local and is not attributed to a real account. Users must be at least 16. Ordinary functions and no-prize or no-stake challenges, viewing and ordinary Pot entries that do not involve taking on a stake, spending or a real contribution, and free GAIN are available from age 16 where offered; the AI coach, stakes or pledges, Pot contributions or spending, and rewards, penalties or forfeits require age 18 or over. Correction, paid/unpaid status or external settlement of an existing record may remain accessible if the declared age changes.

The service is available in Italy, Germany and Austria. Features and availability may be limited by territory, applicable rules and age requirements.

The app allows the user to publish content: team chat messages, direct messages, proposals, a profile photo, a club photo if the user is the founder, progress and reward photos and the text of team-challenge rewards. The user is solely responsible for what they publish and confirms that they have the right to upload the images they publish. We apply zero tolerance for offensive content and abusive behavior: it is prohibited to publish or send illegal, harassing, threatening, hateful, discriminatory, sexually explicit, defamatory or rights-infringing content, as well as spam or impersonation. We may remove any content and suspend or close accounts that violate the Terms without notice. Each team also has a public board: any registered user can read and write on it, so messages posted on the board are visible to all app users and subject to the same content rules and moderation.

Messages and members can be reported or blocked in the app. One report does not by itself hide content; content may be hidden when the reporting threshold is reached or by moderator decision. Automated filters or thresholds may restrict content; an automated restriction is never final and a person carries out the review. Content, users, a reporting outcome or a moderation decision can be reported or challenged through the in-app control or at apps@applicazi.one with the account, exact content location, reason and relevant context. Receipt of a report is distinct from its outcome; an outcome records the decision and available review route. We review reports and act as soon as reasonably possible. Blocking hides the person's messages and profile and prevents new contact between the two accounts.

The Team Pot ledger displays stakes and EUR amounts, voluntary deposits, the team treasury, voted spending and paid/unpaid status, as well as rewards, penalties and forfeits. Entries without a stake, spend or real contribution and free GAIN are available from age 16; stakes, pledges, contributions, spending, rewards, penalties and forfeits require age 18 or over. Correction, status updates and external settlement of an existing record may remain accessible. Members perform every real settlement outside the app. VAC records amounts and settlement declarations but does not process, hold or transfer money. An unsettled report may affect Honor and be reviewed by a moderator. VAC may limit or disable these features by territory, applicable rules and age requirements.

The app provides weekly team challenges and one-on-one duels. Competitions without a stake are available from age 16; rewards, stakes, penalties and forfeits require age 18 or over. Members propose and negotiate the description, and where used the photo, of a reward or penalty, then perform or settle it outside VAC. The winner may mark the result paid or unpaid; that declaration may affect Honor and be reviewed by a moderator. VAC does not process, hold or transfer money and may limit or disable these features by territory, applicable rules and age requirements.

The app includes a public Improve the app board, shared across all teams, where each registered user may submit at most one idea per month to improve the app. Proposals are public and shown with the author's name; other users can react with a like or dislike. Proposals are user-generated content, subject to the content rules and moderation above. By proposing an idea, the user grants us a non-exclusive, free and perpetual right to use and implement it in the app without compensation, confidentiality or attribution obligations. A moderator may accept a proposal and, at their sole discretion, grant the author a period of free VAC Pro access, displaying the name in an internal Hall of Fame. The gift is a free, discretionary and non-commercial entitlement to Pro features: it is not a payment, purchase or paid subscription, is not owed or guaranteed for any proposal and may be revoked in case of abuse.

The app, including the AI coach, is intended and marketed for general fitness and wellness, not to diagnose, prevent, monitor, predict, treat or alleviate disease. It is not an emergency service. AI-generated guidance can be inaccurate or incomplete and does not replace a qualified professional. The user should stop activity if they feel unwell and contact local emergency services in an emergency.

Weather data provided through WeatherKit, including when used by the coach as general context, may be inaccurate, incomplete or differ from actual conditions. The app is not designed or marketed for emergencies or life-saving purposes. When the app provides real-time weather guidance, the following notice applies: YOUR USE OF THIS REAL TIME WEATHER GUIDANCE APPLICATION OR WEBSITE IS AT YOUR SOLE RISK. WEATHER DATA MAY NOT BE ACCURATE.

The app is provided as a general fitness and wellness service and availability may change. To the maximum extent permitted by law, VAC is not responsible for user-to-user agreements or for loss caused by reliance on inaccurate AI, weather or fitness estimates. Nothing in these Terms excludes or limits liability that cannot lawfully be excluded, including liability for fraud, wilful misconduct, death or personal injury caused by negligence, or mandatory consumer rights.

The user may stop using the app at any time. We may suspend or revoke access in case of violation of the Terms, subject to applicable law and available review. These Terms are governed by Italian law, but that choice does not deprive a consumer of mandatory protections of the law of the country where the consumer habitually resides or of any court rights that cannot validly be excluded. For any request: apps@applicazi.one.

Contact and request handling

Venice Athletic Club is a fitness app where athletes track workouts and compete in teams. For questions, issues or requests, email apps@applicazi.one. We review requests and respond as soon as reasonably possible, without a guaranteed response time.

For European Union service recipients and authorities, apps@applicazi.one is the electronic contact point for Digital Services Act matters; communications are accepted in Italian and English. A notice alleging illegal content should identify the exact content reference or URL, explain why the content is alleged to be illegal, provide the submitter's name and electronic contact unless the law permits an exception, and include a good-faith statement that the information is accurate and complete. Do not attach illegal sexual imagery or abuse material; provide only the reference needed to locate it.

Receipt and outcome are separate records: a receipt only confirms that a notice entered the review channel, while an outcome states the decision. Where notice is lawful, a restriction outcome should identify the affected content or account, the legal or Terms basis, the material facts and circumstances, whether automated means were used, the scope and duration of the restriction, and the available review route. A review request may be sent to the same electronic contact point.

In the app, open a message or member profile to report or block. One report does not by itself remove the message; it may be hidden when the reporting threshold is reached or by moderator decision. We review reports and act as soon as reasonably possible. Blocking hides the person's messages and prevents new contact between the two accounts. Content, users or a review request may also be sent by email with the relevant details.

The user can start account deletion in the app at Settings > Delete account or write to apps@applicazi.one from the account email address. The path removes the data described under Retention and user rights with the retained items, Sign in with Apple revocation limits and provider propagation expressly stated there; it is not a promise of immediate deletion of every copy.

Email apps@applicazi.one with the subject “Data protection request” or “Data protection complaint”, identify the account and describe the requested outcome. Do not email Health records, passwords, tokens or other account secrets. For a United Kingdom data-protection complaint, VAC acknowledges receipt within 30 days, investigates as appropriate, keeps the complainant informed and provides an outcome without unjustifiable or excessive delay. This statutory complaint process is separate from the general support response time. A UK user may also complain to the ICO.

The app reads only Apple Health data authorized through the system prompt and never writes to Apple Health. Access can be changed in iOS Settings > Privacy & Security > Health > Venice Athletic Club. Under Settings > Data sources, the user can pause reading or start Revoke consent and delete data. That path deletes the local Health archive and starts deletion of directly linked earlier copies from the active system; completed receipts or shared results and copies in logs or backups may remain as described under Retention and user rights.

For legal or privacy questions: apps@applicazi.one

Last updated: July 20, 2026