Legal

Privacy Policy

Last updated: 2026-05-14

1. Who we are

Peak Performance ("the Service") is operated by Roy Thande ("we", "us", "the Controller"), reachable at roy.thande@gmail.com. The Service is hosted at peakperf.roythan.de.

2. What data we collect and why

CategoryDataPurposeLegal basis
Account Email address Authentication (magic link), service communications Contract performance
Check-ins Date, stress / energy / focus scores (1–5), sleep quality, stressor tags, free-text note Core product functionality — trend analysis and personalised insights Contract performance
Insights AI-generated text cards derived from your check-ins, feedback (thumbs up/down) Displaying your personalised performance insights Contract performance
Preferences Timezone, default stressor tags Align calendar-day boundaries and pre-populate forms Contract performance
Audit Email and timestamp of data-export or account-deletion requests Compliance audit trail Legal obligation
Technical Anonymous usage events (page views, feature interactions) Product analytics and error monitoring Legitimate interest

We do not collect health diagnoses, financial data, or precise location. Check-in scores are self-reported wellbeing proxies, not medical measurements.

3. Service processors (sub-processors)

ProcessorPurposeLocation
Neon (Neon Inc.)Managed PostgreSQL — stores all structured dataEU (Frankfurt)
Virtual machine hostApplication server — processes requests in memoryEU
Resend (Resend Inc.)Transactional email — magic-link delivery onlyUSA (SCCs apply)
PostHog (PostHog Inc.)Product analytics — anonymous event telemetryEU (self-hosted option available)
Sentry (Functional Software Inc.)Error monitoring — stack traces, request metadataUSA (SCCs apply)
Cloudflare R2 (Cloudflare Inc.)Object storage — data exports, backupsEU

Standard Contractual Clauses (SCCs) govern transfers to USA-based processors where noted. Processor DPAs are in place for each.

4. How long we keep your data

We keep your account and check-in data for as long as your account is active. If you delete your account (via Settings → Delete my account), all personal data is purged immediately from our primary database. Audit log rows (email + timestamp of deletion request) are retained for 12 months for compliance purposes. Backup snapshots are rotated within 30 days.

5. Your rights under GDPR (EEA/UK users)

If you are in the European Economic Area or United Kingdom, you have the following rights:

  • Access — request a copy of your data (use Settings → Export my data for self-service).
  • Rectification — correct inaccurate personal data.
  • Erasure — delete your account and all associated data (Settings → Delete my account, or email us).
  • Portability — receive your data in machine-readable JSON format.
  • Objection / restriction — object to or restrict processing based on legitimate interest.
  • Withdraw consent — where processing is based on consent (none currently), withdraw at any time.

To exercise any right, email roy.thande@gmail.com. We will respond within 30 days. You may also lodge a complaint with your national supervisory authority.

6. Kenya Data Protection Act, 2019 (Kenyan users)

We operate in compliance with the Kenya Data Protection Act, 2019 and the regulations issued thereunder.

  • Data controller registration: We are registered with the Office of the Data Protection Commissioner (ODPC). Registration number will be published here once issued.
  • Subject access requests (SARs): We will acknowledge SARs within 7 days and fulfil them within 30 days.
  • Breach notification: In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify the ODPC within 72 hours and notify affected individuals without undue delay.
  • Cross-border transfers: Data transferred to processors outside Kenya is protected by contractual safeguards equivalent to Kenya DPA standards.

To exercise your rights under the Kenya DPA, email roy.thande@gmail.com.

7. Cookies and local storage

We use a single session cookie (HttpOnly, Secure, SameSite=Lax, 30-day max-age) to maintain your logged-in session. No third-party tracking cookies are set. We use browser localStorage to temporarily save check-in drafts (key: peak_draft_v1) — this data never leaves your device unless you submit a check-in.

8. Children

The Service is not directed at persons under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

9. Changes to this policy

We may update this policy. Material changes will be communicated via email to registered users at least 14 days before they take effect. The "Last updated" date at the top reflects the most recent revision.

10. Contact

Questions or requests: roy.thande@gmail.com