Privacy Notice for Daqli Performance
Version 1 · effective 8 October 2026
In case of discrepancy the English version prevails.
Daqli Performance is a platform for health and movement data from various wearable devices. It consists of a web application and an app for wearable devices. It shows you the health and movement data that your devices send. Here you will find what data we process, why, for how long, and what rights you have. The Terms of Use are in section 15.
1. Who processes the data
The controller of the personal data is the operator of Daqli Performance, a natural person.
We will add the controller's identification and contact details before the live service starts.
No data protection officer has been appointed.
2. Pilot operation
The service runs in pilot operation at https://performance-preprod.daqli.com. Registration is open to people aged 18 and over and is free of charge.
This environment has no backups and data in it may be lost at any time, so do not upload anything you are not willing to lose.
3. What data we process
| Group | What exactly | Where from |
|---|---|---|
| Account | e-mail, display name (optional), password hash (we do not store the password itself), e-mail verification status | from you |
| Sign-in with Google | Google account identifier, e-mail and name that Google passes on | from Google, when you choose this option |
| Settings | language, time zone, display options | from you |
| Consents and acknowledgements | which consents and acknowledgements you gave, the version of the text and the time | from you |
| Device | model, name, app version, pseudonymous installation identifier, time of pairing and of last connection | from the device and from you |
| Health and movement data | heart rate, resting heart rate, respiration rate, blood oxygen saturation, stress, energy reserve and recovery time estimates (where the device provides them), steps, distance, floors, ascent, intensity minutes, energy expenditure, VO2max estimate, activity summaries (sport, start, duration, distance), data from the profile in the device (for example weight and height) and goals set in the device | from your devices |
| Security records | type and time of an event (sign-in, sign-out, device pairing, deletion), e-mail hash, truncated IP address | created when you use the service |
| Technical logs | errors and request flow without health data, passwords, links or full e-mails | created when you use the service |
With each consent and acknowledgement we also store the language in which its text was shown to you, so that we can prove which language version you saw.
We do not collect location (GPS) or activity routes. We do not store the full IP address in the database, only a truncated one or a hash.
4. Why we process the data and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and running the account and sign-in, including e-mails with a link for creating the account, verification, sign-in and password recovery | account, sign-in with Google, settings | performance of a contract, that is, providing the service you ask for (Art. 6(1)(b) GDPR) |
| Storing and showing health and movement data from your devices, including the overviews made from it | device, health and movement data | your explicit consent (Art. 9(2)(a) and Art. 6(1)(a) GDPR) |
| Proving consents and acknowledgements | consents and acknowledgements | compliance with a legal obligation to demonstrate consent (Art. 7(1) and Art. 6(1)(c) GDPR) |
| Declaration of age 18+ | your declaration (we do not verify age) | legitimate interest in running the service for adults only (Art. 6(1)(f) GDPR) |
| Securing the service, detecting attacks and proving that an erasure was carried out | security records, technical logs | legitimate interest in secure operation (Art. 6(1)(f) GDPR) |
To create an account, you need an e-mail address. Creating an account does not require consent to the processing of health data: we ask for your explicit consent when you pair your first device. Without this consent no device can be paired, and the service then has nothing to show you, because health and movement data is its only content.
We are building Daqli Performance around an AI coach: in a future version, artificial intelligence will evaluate your health and movement data and suggest training plans to you. This version of the service does not do that yet. Before we switch the AI coach on, we will publish a new version of this Privacy Notice naming the AI provider and where the data is processed, and we will ask for your separate, explicit consent. The AI coach will be a core part of the service: if you do not agree to it, you will not be able to keep using the service, and you can delete your account with all your data at any time (section 11). We do not use the data for advertising and we do not sell it. No automated decisions are made about you (Art. 22 GDPR): the AI coach will only suggest plans, and the decision stays with you.
5. Data from wearable devices
The Daqli Performance app in the device sends data encrypted (HTTPS) directly to our server. On the way, the request may be passed on by the device maker's companion app on your phone. The data go to us, not to the device maker, and we do not pass them to the maker.
When you pair your first device, you give your explicit consent to the processing of health data. For each device, you also confirm, when pairing it and before it starts sending data, your consent to the transfer of data from that device. Data that has not been sent stays in the device until the app sends it. When you pair the device with a different account, the unsent data of the previous account is deleted from the device automatically.
6. Sign-in with Google
When you choose sign-in with Google, Google is a separate controller of your data for this part. It follows its own policy: https://policies.google.com/privacy. From Google we receive only the account identifier, the e-mail, the information whether it is verified, and the name. We do not see your Google password.
7. Who we pass the data to
- FORPSI (INTERNET CZ, a.s.) runs the server on which the service runs and sends our e-mails. It is our processor.
- Providers of artificial intelligence tools that the controller uses in development and server administration (currently Anthropic). The operating rules do not show them your data: the tools see only aggregate counts and status codes, not records with your data. If a piece of data should exceptionally reach them, we treat it as a security incident.
- Public authorities, only when the law requires it.
We do not pass the data to anyone else. We keep the list of processors up to date.
8. Where the data is stored
The service's server is in the Czech Republic. Data may leave the European Union only in two cases. The first is sign-in with Google, which you choose yourself. The second is the exceptional case under point 7 at an artificial intelligence tool provider based in the USA.
9. How long we keep the data
| Data | Retention period |
|---|---|
| Account, settings, consents and acknowledgements | until the account is deleted |
| Unfinished account creation with an e-mail link | until the link expires (15 minutes), then deleted automatically, usually within an hour |
| Unverified registration with a password | 7 days, then deleted automatically |
| Health and movement data | until the device it comes from is deleted, or until the account is deleted |
| Devices and pairing records | until the device or the account is deleted |
| Security records | 12 months from creation, even after the account is deleted; the e-mail hash and the truncated IP address are removed after 90 days |
| Technical logs | overwritten according to size, usually within days to weeks |
If we later introduce a shorter period for older health data, we will announce it in a new version of this Privacy Notice.
10. Backups
We do not make backups or other copies of the database. Deleted data therefore does not remain anywhere. It also means, however, that if the server fails, data may be lost irretrievably.
11. What remains after the account is deleted
By deleting the account we delete the account, consents, settings, devices and all health and movement data. The erasure runs in the background and usually finishes within a few minutes.
Only security records without a name and without health data remain for 12 months. They contain a random account identifier, the type and time of the event, and counts of deleted items. They contain the e-mail hash and the truncated IP address only for 90 days after the record is created; then we remove them. They are pseudonymous personal data: while a record still carries the e-mail hash, only someone who knows your e-mail can link it to you. They serve to detect attacks and to prove that the erasure took place.
12. Your rights
| Right | How to exercise it |
|---|---|
| Access to data (Art. 15) | You can see most of your data in the app. For a full copy, ask the controller by e-mail. |
| Rectification (Art. 16) | You can change your name and settings in the app, anything else by e-mail. |
| Erasure (Art. 17) | You delete a device together with its data in Settings › Watches, and the account in Settings › Account. |
| Restriction of processing (Art. 18) | by e-mail |
| Data portability (Art. 20) | There is no export in the app yet. Ask by e-mail for your data in a machine-readable form. |
| Objection (Art. 21) | by e-mail; concerns processing based on legitimate interest (point 4) |
| Withdrawal of consent (Art. 7(3)) | You withdraw your consent to the processing of health data by deleting the account. You withdraw your consent to the transfer from a specific device by deleting that device. Separate withdrawal without deletion is being prepared. Withdrawal does not affect processing before it. |
We will reply to your request without undue delay, at the latest within one month.
You also have the right to lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, https://uoou.gov.cz.
13. Security, cookies and local storage
Communication is encrypted (HTTPS). We store passwords and one-time links only as hashes. The data of each account is separated and you see only your own. Access to the server is only via keys, and administration tools output only aggregate counts. Data in the database is not encrypted per column.
The web application stores only the following cookies in your browser. It needs them for signing in and for protecting your account, and they contain only random values, not your name, e-mail or health data. Because they are strictly necessary, they do not require your consent under section 89(3) of the Czech Electronic Communications Act (No. 127/2005 Coll.).
| Cookie | Purpose | Duration |
|---|---|---|
| __Host-Session and __Host-Session-Strict | keep you signed in during a visit; the second copy confirms that a change was requested from our own pages | until you close the browser or sign out; the session itself ends after 30 minutes without activity and at the latest 12 hours after signing in |
| __Host-Grant | keeps you signed in on this browser even after you close it, so that you do not have to sign in again each time | 30 days from signing in; earlier when you sign out or delete the account |
| __Host-Daqli.Performance.Antiforgery | protects against requests forged by other websites | until you close the browser |
| __Host-Daqli.Identity.Oidc | links your return from Google to the sign-in you started; only when you choose sign-in with Google | 10 minutes; deleted when you return from Google |
On a shared computer, sign out when you finish, so that the next person cannot get into your account.
The web application also remembers a few settings in your browser's local storage (localStorage and sessionStorage). Unlike cookies, the browser does not send them to our server by itself, and they contain no health data. They only remember choices you make in the application or help to complete your sign-in, so like the cookies they do not require your consent.
| Entry | Purpose | Duration |
|---|---|---|
| dqp.locale | remembers the language of the application, so that pages before sign-in are also shown in your language; contains only the language code | until deleted in your browser |
| dqp.locale.explicit | remembers the language you chose before signing in, so that it is saved to your account after sign-in | until you sign in or close the tab |
| dqp.returnTo | remembers the page to return to after you sign in with an e-mail link or with Google | used only within 10 minutes; deleted once used or when you close the tab |
| dq-theme | remembers the light or dark appearance; stored only when you switch it | until deleted in your browser |
| dqp.tz-declined.(account identifier) | remembers that you declined to change the time zone of your account to the time zone of your browser, so that we do not offer it again; contains the random identifier of your account and the declined time zone | until deleted in your browser |
Entries that last until you delete them stay in your browser even after you sign out or delete your account. You can delete cookies and stored entries at any time in your browser settings; you will then be signed out, and the application will follow the language of your browser again.
We do not use analytics, advertising or tracking cookies. Our pages load nothing from other companies' servers, so no third party stores cookies through them. If you choose sign-in with Google, Google stores its own cookies on its own pages under its own rules (section 6). The website daqli.com, including this page, stores no cookies and nothing in your browser's storage.
If we decide to use analytics or marketing in the future, we will first publish a new version of this Privacy Notice and ask for your consent in a banner in which the button to reject is as prominent as the button to accept. Without your consent, no such cookies will be stored.
14. Changes to this Privacy Notice
When something changes, we issue a new version with a new effective date. We inform you of a material change in the app or by e-mail.
15. Terms of Use (pilot operation)
You accept these terms by creating an account: by continuing with a link sent by e-mail or with Google, or by registering with a password.
- The service is free of charge and in trial operation. It may be unavailable, change or end.
- This environment has no backups and data in it may be lost at any time, so do not upload anything you are not willing to lose.
- The service is not a medical device. It does not make a diagnosis or give medical recommendations.
- Only people aged 18 and over may register, each only for themselves.
- It is forbidden to interfere with the service, circumvent its security or try to obtain other people's data.
- You can delete your account at any time. The controller may cancel an account for breach of these terms or when the pilot ends; where possible, they will warn you beforehand by e-mail.