Privacy policy — Lapin

Lapin is published by Ternaire inc. (Brossard, Québec, Canada). This policy says what personal information Lapin collects, why, where it goes, how long we keep it and what your rights are. It is written to be read; if something is unclear, write to us. It answers Québec's Act respecting the protection of personal information in the private sector (Law 25) and serves as the policy required by Google Play.

1. Who is responsible, and how to reach us

Ternaire inc. (Brossard, Québec, Canada), publisher of Lapin, is responsible for the personal information Lapin collects. The person in charge of protecting it is the vice-president of Ternaire inc. For any question about your information or to exercise your rights: privacy@ternaire.ca or vieprivee@ternaire.ca (both reach the same place). For a glitch, a question or an idea: support@ternaire.ca, or “Write to us” in the app.

2. What Lapin collects, and why

We only collect what serves the service — nothing more. No advertising, no resale, no advertising profile.

Your account: the email address and identifier provided by your Google account at sign-in (Firebase also receives the name and photo of your Google profile; Lapin does not use them)	create and secure your account; reach you for account operations (deletion confirmation, reminder before the deadline, inactivity warning)
Your profile: first name, form of address, your starting point (how you move these days, your weekly walking or running time, your typical outing in your own words), your motivations	personalise the app and the coach's tone; generate your first programme
Your goal: the goal in your own words, your notes, the number of outings per week, the maximum duration, the progression pace, your preferred days	generate and adjust your programmes (preferred days place the sessions; they are never sent to the artificial intelligence model)
Your sessions, in summary: date, duration, distance, average and maximum heart rate, planned session and its title, optional comment, finished or interrupted	find your history again when you change device; compute your statistics, your records, your XP and your badges; let the coach adjust your programmes
Your exchanges with the coach: your messages, your adjustment requests, your reports	answer you and propose adjustments; check the coach's quality and safety (section 4)
Your subscription: the subscription state and a purchase identifier that Google Play passes to RevenueCat	open and close functions according to your subscription — never your card, which stays with Google Play
Your support requests: your message, the app version, the phone model, the Android version, the language and, only if you switch it on, the diagnostic log (the last 500 lines of the app's technical log)	answer you and fix glitches
Server technical logs: IP address, date and time, requested operation, status, duration	security, abuse detection, outage diagnosis

3. What stays on your device

These never leave your phone or your watch for our servers:

• your birth year — optional, it only serves the local calculation of your heart-rate zones;
• your profile photo;
• your GPS tracks and your second-by-second heart-rate series: the server only receives a session's summary (section 2), never the route;
• your settings.

Consequence: if you change device, the photo and the birth year have to be entered again, and your tracks only follow you through Android backup or the export (section 7).

4. The coach: artificial intelligence and Anthropic

The programmes, adjustments, suggested sessions and coach messages are produced by Claude models, provided by Anthropic (United States). For each request, our servers send it what it needs to answer: your first name and form of address, your profile and goal answers, a summary of your history (number of sessions, minutes and distance per week, longest run, average pace, days since the last outing), your current programme and your messages. Never your email, your birth year, your photo or a GPS route.

Anthropic processes this data on our behalf, under contract: it does not use it to train its models and deletes it from its systems within 30 days.

At Ternaire inc., your exchanges with the coach are kept for at most 12 months, tied to your account, to check the quality and safety of the answers, support you in case of a dispute, improve the coach's instructions and detect abuse. Access is restricted to the people who run the service. They are deleted along with your account.

You can report a coach answer directly in the app (long-press a bubble): the report goes out with the conversation as context and enters a priority review queue.

A coach proposal is never a decision imposed on you: nothing applies without your action, and you can write to us to have a person review it.

5. Location, sensors and adaptation to your practice

Lapin uses technologies that make it possible to locate you and to adapt the service to your practice. Here is which ones, and how they switch on — none is on without your action:

• Location: the phone's or the watch's GPS measures your distance and your route during a session only, never in the background outside a session. It switches on through the location permission your device asks you for; a session works without it, simply with no distance or track.
• Heart rate: measured by the sensor of your Wear OS watch, if you install Lapin on it and allow the sensor.
• Activity detection: the phone's pedometer pauses the session when you stop; steps are not recorded.
• Adaptation to your practice: the coach reads your answers and the summary of your sessions to propose and adjust your programmes. It is the heart of the service and its only purpose; this adaptation starts when you ask for your first programme, and every proposal waits for your action.

None of this serves advertising, and nothing is sold.

6. Our providers, and what leaves Québec

We use providers that process data on our behalf, under contract:

Google Cloud (Cloud Run, Firestore)	hosting of the server and of your data — Montréal region, Canada; Google may access it from other countries for operations and support
Google (Firebase Authentication)	sign-in with your Google account — United States and other countries where Google operates
Anthropic	the coach's artificial intelligence models (section 4) — United States
RevenueCat	your subscription state, from the Google Play purchase identifier — never your card — United States
Google Play	sale and billing of the subscription, under its own privacy policy
Our email providers (Cloudflare, Google)	route the emails you send us and those we send you — United States

Some of your information is therefore communicated outside Québec, mainly to the United States, where the law may differ from Québec's. Before entrusting information outside Québec, we assess the protection it will receive there and frame it by contract. We sell no data. There is no advertising in Lapin, and no data is shared for advertising purposes.

7. Health Connect, Android backup, sharing: what you choose

• Health Connect: if you connect Lapin in “Devices and connections”, every finished session is written to Health Connect, on your phone (session, distance, heart rate, route). What other apps (Samsung Health, Fitbit, Garmin Connect…) do with it depends on the access you give them; Ternaire inc. does not see it. Lapin reads nothing from Health Connect. You can disconnect at any time.
• Android backup: if your phone's backup is on, Android copies your session history (tracks included), your settings, your local profile and your photo to the Google Drive of your Google account, never your sign-in identity or the session under way. It is a Google service, under your account, which Ternaire inc. cannot access; you set it in Android's settings.
• Sharing and export: “My outing in a picture”, the weekly summary and “Export my data” leave through Android's share sheet to the app you choose; what it does with them is up to its own policy.
• Your watch: phone and watch exchange your data directly, without going through our servers.

8. Your rights

At any time and free of charge, you can:

• access your information and ask for a copy;
• correct it if it is inaccurate (editing your profile covers most of it directly in the app);
• withdraw your consent to what is optional — birth year, photo, location, Health Connect, diagnostic log — by removing it or switching it off in the app or in the device's settings;
• ask for erasure: deleting your account, in the app, erases all your server data (profile, goal, programmes, sessions, conversations);
• exercise your portability: “Export my data” (in the app) produces a ZIP file containing “lapin.json” (profile, goal, programmes, sessions, statistics — a structured, readable format) and a “gpx” folder (one GPS track per session), handed over through Android's share sheet;
• ask for a person to review a coach proposal, and ask any question about how it is produced;
• lodge a complaint with the Commission d'accès à l'information du Québec (CAI) or, if you live elsewhere, with your country's data protection authority.

For any request beyond the app: privacy@ternaire.ca or vieprivee@ternaire.ca, from your account's email address — that is how we verify your identity, without asking for anything more. You receive an acknowledgement within 5 business days and an answer within 30 days.

9. Retention

• Your data is kept as long as your account exists.
• On your deletion request, a 30-day grace period runs (signing back in cancels the request); when it ends, all your server data is erased.
• An account with no sign-in for 24 months is warned by email 30 days before, then deleted the same way; signing back in cancels it.
• Your exchanges with the coach: 12 months at most (section 4).
• The server's technical logs: 30 days.
• A technical backup copy of the server: 7 days at most.
• At Anthropic: 30 days at most (section 4).
• Your support requests and your requests about your rights: as long as it takes to handle them, then at most 2 years, so we can come back to them if you write to us again.

10. Security

Data travels encrypted (TLS) between your device and our servers. On our servers, it is encrypted at rest by Google Cloud; on your phone, it is protected by the device's encryption. Access to production data is restricted to the people who run the service, and logged. In the event of a confidentiality incident that presents a risk of serious harm, we notify you and we notify the Commission d'accès à l'information, as the law requires; we keep a register of incidents.

11. Consent and default settings

Lapin is set for the highest privacy by default: location only switches on if you allow it, Health Connect and the diagnostic log stay off until you turn them on, the birth year and the photo are optional, and there is no advertising. By creating your account, you consent to the processing described here, which is necessary to provide you the service; for what is optional, your action counts as consent, and you can go back on it at any time (section 8).

12. Minors

The service is reserved for people aged 14 and over (terms of use, article 3). We do not knowingly collect information about people under 14; any account identified as such is deleted. A parent or guardian can write to us at privacy@ternaire.ca.

13. Cookies

Lapin is a native app: no cookies, no advertising trackers. The ternaire.ca website has its own policy.

14. Changes to the policy

We may change this policy; any substantial change is announced in the app before it takes effect, with the version and date of the text.

15. Our governance

Ternaire inc. maintains personal information protection policies and practices: a person in charge (section 1); minimal collection (section 2) and privacy by default (section 11); retention and destruction rules (section 9); the handling of requests and complaints (section 8: write to us first, then the CAI); a register of incidents (section 10); a privacy impact assessment before any new processing or new provider outside Québec; and a review of this policy at least once a year.

English translation — the French version is the authoritative one.