Terms & Conditions

Nothing in these Terms is intended to exclude or limit your mandatory statutory rights under the New Zealand Consumer Guarantees Act 1993 ("CGA") or the Fair Trading Act 1986 ("FTA"), or any mandatory consumer protection laws in your local jurisdiction that cannot legally be excluded.

1. Definitions

To ensure clarity and avoid ambiguity, the following terms used throughout these Terms and the Privacy Policy are defined as follows:

• The App / The Platform: The TriPilot mobile application, website, user interfaces, software, and all underlying technical infrastructure operated by TriPilot.
• Health Data: User-provided or device-synced metrics including, but not limited to, heart rate, pace, distance, power, swim strokes, pool length, and GPS/location data.
• AI Insights / Training Plan: The dynamically generated, automated fitness, coaching, and multisport training recommendations produced by TriPilot's artificial intelligence models.
• Content: All text, graphics, user interfaces, visual interfaces, photographs, trademarks, logos, sounds, music, artwork, and data made available through the App, excluding User Content.
• User Content: Any data, information, or metrics generated, uploaded, or synced to the App by you.

2. User Eligibility & Account Security

• Minimum Age: Users under the age of 16 are strictly prohibited from using the App without parent or legal guardian supervision. Any account found to belong to a person under 16 without verified supervision will be immediately removed.
• Minor Users (16–17): If you are aged 16 or 17, you represent and warrant that you have the explicit consent of a parent or legal guardian to use the App. Parents or legal guardians may contact us at any time to exercise statutory rights over a minor user's account, verify consent mechanisms, or request data deletion.
• Account Accuracy: You agree to provide accurate, current, and complete information when creating your account. You are strictly responsible for ensuring that any fitness, personal, or health data you manually provide or sync via third-party devices is accurate to the best of your knowledge.
• Account Security: You are solely responsible for maintaining the confidentiality of your login credentials and account security. You must notify us immediately if you suspect unauthorized access. TriPilot is not liable for any losses or damages caused by unauthorized use of your account.

3. Acceptable Use & Account Suspension

• Prohibited Conduct: You agree not to use the App for any illegal or unauthorized purpose. You must not harass, abuse, or threaten other users; upload or transmit malware, viruses, or malicious code; or attempt to "scrape," crawl, reverse-engineer, decompile, or copy the App's source code, object code, or underlying architecture.
• Suspension vs. Termination: We reserve the right to suspend or terminate your account immediately, without prior notice or liability, if we reasonably believe you have breached these Terms, violated applicable laws, or risked the safety of others.
• Data During Suspension: During any operational suspension period, your data will be securely retained by TriPilot but will remain completely inaccessible to you. Our ongoing data protection and privacy obligations under applicable law continue to apply during any period of suspension. We will reinstate or permanently terminate the account at our sole discretion following an internal review.

4. Intellectual Property (IP) Rights

• Our Property: The App, its design, layout, logos, "look and feel," underlying software, source code, object code, and proprietary AI algorithm architecture are the exclusive intellectual property of TriPilot and are protected as literary and creative works under the New Zealand Copyright Act 1994 and international IP laws.
• AI Outputs: All training plans, insights, text, schedules, and analytics dynamically generated by our AI models are exclusively owned by TriPilot, regardless of the evolving legal copyright status of AI-generated works globally. Users are granted a limited, personal, non-exclusive, non-transferable, fully revocable license to view and use those AI outputs solely for their own personal, non-commercial fitness training.
• User Content License: You retain ownership of the fitness and health data you generate. However, by using the App, you grant TriPilot a non-exclusive, worldwide, royalty-free, perpetual, and sub-licensable license to use, store, host, and process this data exclusively to deliver, maintain, and improve your personalized fitness plans and optimize our local AI models.
• User Feedback: We welcome feedback and suggestions. If you submit ideas or feedback regarding the App, you agree that TriPilot may implement and use these suggestions without any financial obligation or restriction to you. This clause applies strictly to general functional feedback and does not extend to materials constituting your original, separate creative or technical contributions.

5. Sponsor and Commercial Relationships

• Sponsor Property: The App may feature sponsored content, race information, branding, or advertisements. All intellectual property, trademarks, and logos belonging to third-party sponsors remain the exclusive property of those respective sponsors.
• Content Allocation: Ownership of any specialized, sponsor-contributed content (such as official race route data, event specifics, or branded training modules) is legally allocated between TriPilot and the sponsor, and is licensed to you only for temporary, personal use within the App.
• Data Protection Safeguards: The existence of a commercial or sponsorship relationship does not grant sponsors access to your personal information. No user data, whether individual, aggregated, or pseudonymised, is ever shared with commercial sponsors without your explicit, separate, informed consent.

6. Subscription Fees, Pricing, and Refunds

• Billing and Structure: The App operates on a paid subscription basis. The applicable subscription price, billing cycles (e.g., monthly or annually), and explicit instructions on how to cancel before the next billing cycle will be clearly displayed to you prior to completing any purchase. Subscription pricing will be transparent and will not mislead or deceive users regarding the true cost of the service.
• Refund Policy: Refunds will be processed strictly in accordance with your statutory consumer rights. For New Zealand consumers, this is governed by the Consumer Guarantees Act 1993. Where a service fails to meet a statutory guarantee and a refund is legally required, it will be issued in cash or the original value of consideration provided. We do not replace legal refunds with credit notes or mandatory requirements to purchase alternative services.

7. Limitation of Liability & Fitness Disclaimer

• Fitness Disclaimer: TriPilot provides fitness coaching and AI-generated training plans for informational and educational purposes only. We are not medical professionals, and the App does not provide medical advice, diagnosis, or treatment. You must consult a qualified physician or healthcare provider before beginning any new exercise or endurance regime. You explicitly acknowledge that physical endurance training involves inherent risks of strenuous physical injury, illness, or death, and you assume full responsibility for those risks.
• Data Accuracy Disclaimer: TriPilot relies on the accuracy of the data supplied by you or synced from third-party wearable hardware and platforms (including Garmin, Apple Watch, and Strava). TriPilot accepts absolutely no responsibility or liability for AI training plans that are generated based on inaccurate, corrupted, false, or faulty data supplied by you or transmitted by third-party devices.
• AI Outputs Liability Exclusion: To the maximum extent permitted by applicable law, TriPilot specifically excludes liability for any foreseeable harm, injuries, errors, or losses arising from inaccurate, inappropriate, or dangerous training recommendations dynamically generated by the AI models. Always prioritize your immediate physical feeling and perceived exertion over automated AI recommendations.
• Limitation of Liability: To the maximum extent permitted by law, TriPilot, its directors, and platform partners shall not be liable for any indirect, incidental, special, consequential, or punitive damages, including but not limited to lost profits, loss of data, personal injury resulting from user-negligence, or app downtime. Where statutory frameworks like the CGA apply and cannot be excluded, TriPilot's total liability is strictly limited to the repair, replacement, or refunding of the cost of the service.

8. Boilerplate Legal Provisions

8.1. Governing Law and Jurisdiction

These Terms and your relationship with TriPilot are governed by, and construed in accordance with, the laws of New Zealand. Subject to the tiered dispute resolution process below, you agree to submit to the non-exclusive jurisdiction of the courts of New Zealand.

International Carve-Out: If you are a consumer residing in the European Union (EU), United Kingdom (UK), or other jurisdictions with mandatory local consumer protections, this clause does not displace your local mandatory consumer laws or deprive you of protection under regulations that cannot be contractually altered.

8.2. Tiered Dispute Resolution

In the event of any dispute, controversy, or claim arising out of or relating to these Terms, the parties agree to resolve the matter through the following progressive steps:

• Informal Resolution: You must first contact our Privacy/Dispute Officer at contact@tripilot.website to outline the grievance and attempt to resolve the issue informally in good faith.
• Mediation: If the dispute is not resolved informally within thirty (30) business days of the initial notice, the dispute may be referred by either party to independent mediation in New Zealand, with the costs shared equally between the parties.
• Formal Proceedings / Arbitration: If mediation fails to resolve the issue, formal legal proceedings may be commenced in the New Zealand courts. Any consumer arbitration clause included will strictly comply with the consent requirements of the New Zealand Arbitration Act 1996 and the unfair contract terms provisions of the FTA.

8.3. Entire Agreement

These Terms, along with our Privacy Policy, constitute the entire legal agreement between you and TriPilot regarding your use of the App, superseding all prior oral or written agreements, negotiations, or representations. In accordance with consumer protection law (including section 9 of the New Zealand FTA), this clause does not exclude liability for any fraudulent pre-contractual misrepresentations made in trade.

8.4. Severability

If any specific provision or clause of these Terms is found by a court of competent jurisdiction to be invalid, illegal, or unenforceable under applicable law, that provision will be severed or modified to the minimum extent necessary. The invalidity of such a clause shall not affect the validity, legality, and enforceability of the remaining provisions of these Terms, which will continue in full force and effect.

8.5. Non-Waiver

No failure or delay by TriPilot in exercising any right, power, or remedy under these Terms shall operate as a waiver of that right, nor shall any single or partial exercise of a right preclude further exercise of that or any other legal right or remedy. Any effective waiver of a breach of these Terms must be executed explicitly in writing.

8.6. Force Majeure

TriPilot shall not be held liable or responsible for any failure, interruption, or delay in performing our obligations under these Terms if such failure arises from causes beyond our reasonable control. This includes, but is not limited to: severe weather events, natural disasters, acts of God, war, cyber-attacks, extensive internet or telecommunication outages, failures or service terminations of our core platform sub-processors (e.g., Rork, Supabase, OpenAI), or abrupt regulatory/governmental actions that render the continued operation of our AI fitness feature unlawful. During a force majeure event, TriPilot's performance obligations are suspended for the duration of the event.

8.7. User Indemnity

You agree to indemnify, defend, and hold harmless TriPilot and its affiliates from and against any direct losses, liabilities, damages, costs, or legal expenses resulting from your deliberate misuse of the App, fraudulent submission of false health data, or intentionally allowing unauthorized, underage individuals to access the App through your credentials. This indemnity is narrowly tailored to deliberate or fraudulent user conduct to remain fair, reasonable, and compliant with standard consumer protection laws.

9. Updates to Terms and Rejection of Changes

We may modify or update these Terms from time to time to reflect changes in our services or global legal obligations. If we make significant or material changes, we will notify you at least 30 days in advance via your registered email address or an explicit in-app notification.

• Acceptance: By continuing to use the App after the 30-day notice period expires, you agree to be bound by the revised terms.
• Rejection: If you do not wish to accept the modified Terms, you have the right to reject them by closing your account and requesting the complete erasure of your health and fitness data before the new terms take effect. TriPilot will process your deletion request promptly within standard regulatory windows.

1. Purpose and Scope of Data Collection

We collect and process your personal and health information strictly for specified, lawful purposes related to providing you with advanced coaching analytics:

• Account Identity: Your name and email address are collected to create, verify, and secure your user profile.
• Dynamic Personalization (AI Learning): We process biometric and performance data—including your pace, heart rate, power, running/swimming distance, and physical metrics—to analyze your historical fitness trends. This enables our local AI models to dynamically adjust your multisport training plans.
• Service Delivery: Core data tracking and processing are handled via our specialized platform provider (Rork) and cloud database infrastructure (Supabase) to maintain secure tracking metrics.

2. Data Notification & Recipients (Who Processes Your Data?)

To deliver our services, your information is shared only with vetted, enterprise-grade cloud service providers under strict data processing agreements:

• App Infrastructure (Rork): Rork AI operates our operational interface and handles technical system processing (e.g., device type, operating system, and IP addresses) for security logging and localized screen display optimization.
• Database Infrastructure (Supabase): This is our primary secure database. All profile data, training histories, and health metrics are stored using industry-standard encryption protocols on servers physically located in the USA.
• OpenAI API Integration: To generate your personalized, responsive coaching insights, we transmit activity metrics (specifically pace, distance, and heart rate history) to OpenAI via their commercial API. This data is completely pseudonymised; we never transmit your name, email, or account credentials to OpenAI. Under our enterprise architecture, this data is used exclusively to generate your real-time insights and is strictly prohibited from being used to train OpenAI's global public models.
• Commercial Sponsors: We maintain a strict data wall. No user data—whether individual, aggregated, or completely pseudonymised—is ever sold or shared with app sponsors without separate, explicit, affirmative opt-in disclosures presented directly to the user.
• Email Marketing Provider: If you subscribe to our mailing list, your email address and subscription status are stored with our email service provider so we can send you product updates, training articles and offers. This is separate from your app account: unsubscribing from emails does not delete your account, and deleting your account does not by itself remove you from the mailing list. Every email we send carries a one-click unsubscribe link.
• Sub-Processors: Our core processors (Supabase, Rork, OpenAI) are contractually restricted from engaging downstream sub-processors without ensuring equivalent or superior data protection standards. TriPilot requires written guarantees that any entity in the processing chain maintains data protection levels that comply fully with both the New Zealand Privacy Act and GDPR frameworks.

3. Third-Party Fitness Integrations (Garmin, Apple Health, Strava)

• Explicit Authorization: The App will only access data from external ecosystems (such as Apple Health, Garmin Connect, or Strava) if you explicitly grant permission through the App's settings or your device's native OS permission dialogues.
• Data Usage Limits: Data retrieved from these services (including heart rate, power curves, swim stroke analytics, and pool lengths) is leveraged strictly to feed your multisport metrics panel and run the AI coaching calculations.
• No Marketing or Advertising Use: We strictly prohibit using health or biometric data pulled from Apple Health, Garmin, or Strava for marketing, promotional, or cross-contextual behavioral advertising purposes.
• Revocation of Permissions: You can disconnect these API integrations at any time via your settings. Once disconnected, TriPilot will immediately stop importing new metrics. Your historical synced logs will be preserved to maintain your training plan integrity unless you explicitly request permanent data erasure.

4. Mandatory vs. Voluntary Data and Geolocation Classification

• Mandatory Data: Your email address is strictly mandatory during registration to verify your account identity, manage billing, and issue critical security updates.
• Marketing Emails: Joining our mailing list is entirely optional and always requires a separate, affirmative opt-in — we never add you to it just because you created an account. You can withdraw that consent at any time using the unsubscribe link in any email, or by emailing us. Withdrawing it stops all marketing email and does not affect your use of the App.
• Voluntary & Sensitive Data: Biometric data (Heart Rate) and GPS Geolocation are voluntary, but require explicit, affirmative consent. Under international privacy standards (including GDPR and privacy frameworks), GPS location data is classified as sensitive data because it can easily reveal routine health patterns, daily behavioral habits, and sensitive locations. While voluntary, the App cannot calculate pace metrics or provide customized AI training plans if you refuse access to these indicators.

5. Automated Decision-Making & AI Processing Disclosures

Because TriPilot utilizes automated machine learning models to adjust your training schedule based on your physical inputs, we maintain clear procedural safeguards:

• Human-In-The-Loop Principle: The AI models provide information and adaptive recommendations only. The outputs do not represent medical mandates. Users must always prioritize their physical well-being and listen to their bodies.
• Right to Opt-Out: You have the right to opt out of automated profiling and AI processing at any time. You can disable the "AI Insights" feature within the account settings panel, which converts the App into a basic training logger without automated personalization.

6. User Privacy Rights: Access, Correction, and Erasure

Regardless of your geographic location, TriPilot provides comprehensive data rights to all users:

• Access and Portability: You have the right to request a complete copy of all personal and health information we hold about you. We will provide this workout data in a structured, machine-readable format (such as .CSV or .JSON).
• Correction: You can request that we update or correct any inaccurate, outdated, or incomplete data linked to your account.
• Response Timeframes: In accordance with section 44 of the New Zealand Privacy Act 2020, we will respond to your formal access or correction requests as soon as reasonably practicable, and no later than 20 working days from receipt. Users may flag requests as urgent, and we will evaluate priority accordingly.
• Erasure (The Right to be Forgotten): You can request the permanent deletion of your profile, account history, and associated sensitive health metrics. Upon receiving a verified voluntary account closure or deletion request, TriPilot will purge your data from our main production servers and instruct our third-party processors (such as Supabase and OpenAI) to remove your records from their systems within standard legal timeframes.
• Data Retention Policy: We retain your account information and performance activity logs only for as long as your account remains active or as strictly necessary to fulfill the core training optimization services outlined in this policy. If an account remains entirely inactive for a prolonged period, or if erasure is formally requested, your personal data is securely deleted or permanently anonymised.

7. Mandatory Data Breach Notification

TriPilot maintains an internal privacy breach response framework. If we discover a security breach or unauthorized access involving your sensitive fitness, health, or GPS location metrics that poses a plausible risk of serious harm to you, we will immediately carry out our statutory obligations. This includes notifying the New Zealand Privacy Commissioner (under the Privacy Act 2020), relevant international supervisory authorities (under GDPR), and notifying you directly so that you can take protective steps.

Minor Safeguards: In accordance with section 116 of the Privacy Act 2020, if an affected user is a minor under 16 and direct notification would be contrary to their best interests, TriPilot will notify an appropriate parent, legal guardian, or representative after consulting with health practitioners if necessary.

8. Global Regulatory Frameworks & International Data Transfers

• GDPR Legal Bases (EU & UK): If you access the App from the EU or UK, our lawful bases for data processing are:
  • Performance of a Contract: To manage your account and deliver core analytics.
  • Explicit Consent: Required under GDPR Article 9 for processing Special Category Data, including biometric heart rate metrics and sensitive GPS geolocation.
  • Legitimate Interests: To maintain application security, log platform errors, and prevent fraudulent activity.
• International Transfers: Your data is transferred outside the EU/UK/NZ to servers located in the United States (via Supabase and OpenAI). To ensure your information receives equivalent protection, we utilize Standard Contractual Clauses (SCCs) approved by the European Commission along with robust data processing addendums.
• California Consumer Privacy Act (CCPA/CPRA): We do not sell your personal information. You have the right to request disclosure of data collection, access your records, and opt out of any potential sharing of data for cross-contextual behavioral advertising via your App Settings panel.

9. Cookies and Tracking Technologies

• Essential Trackers: We utilize strictly necessary, first-party technical identifiers via Supabase and Rork. These are required to keep you securely logged into your account session and prevent cross-site security exploits. These do not require independent user consent.
• Non-Essential Analytics: We may use internal tracking pixels or analytics identifiers to evaluate user interaction patterns and confirm email delivery success. For users located in jurisdictions requiring consent for non-essential tracking (such as the EU/UK under the ePrivacy Directive), these features are disabled by default and require separate, freely given, granular consent via our cookie consent banner.

10. Policy Updates and Contact Information

• Policy Updates: We will notify you at least 30 days in advance of any material updates to this Privacy Policy via email or prominent in-app alerts. Continued use of the App after the 30-day period constitutes clear acceptance of the revised privacy practices.
• Contact Our Privacy Officer: To exercise your rights of access, correction, data portability, or erasure, or to file an official privacy complaint, please contact our Privacy Officer directly at contact@tripilot.website.