Kjor Privacy Policy

Last updated: 13 June 2026

This Privacy Policy explains how WalshTT Pty Ltd (ABN [INSERT ABN]) ("WalshTT", "we", "us" or "our") collects, uses, holds, discloses and protects your personal information when you use the Kjor mobile and web application and related services (the "App" or "Kjor").

WalshTT is committed to protecting your privacy and handling your personal information in an open and transparent way. We comply with the Privacy Act 1988 (Cth) (the "Privacy Act") and the thirteen Australian Privacy Principles ("APPs") set out in that Act, as well as the Notifiable Data Breaches scheme.

Because Kjor is a health and fitness application, much of the information we collect is sensitive information (specifically, health information) under the Privacy Act. Sensitive information is given a higher level of protection, and we generally only collect it with your consent. By creating an account and providing this information to us, you consent to us collecting and handling it as described in this Policy.

Please read this Policy carefully. If you do not agree with it, please do not use Kjor.

1. Who this Policy applies to

Kjor is intended for use only by individuals aged 18 years or older. We do not knowingly collect personal information from anyone under the age of 18. If you are under 18, please do not use the App or provide us with any personal information. If we become aware that we have collected personal information from a person under 18, we will take reasonable steps to delete that information.

If you believe a person under 18 has provided us with personal information, please contact us using the details in Section 14.

2. What is personal information?

"Personal information" means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information is true or not and whether recorded in a material form or not.

"Sensitive information" is a subset of personal information that includes (among other things) health information about an individual. The physiological, training and performance data you provide to Kjor is health information.

3. The personal information we collect

We collect the following categories of personal information so that we can create and manage your account and generate personalised training plans.

3.1 Identity and contact information

• Name and username
• Email address
• Mobile telephone number
• Date of birth
• Gender

3.2 Health and fitness information (sensitive information)

• Physiological metrics, such as maximum heart rate, lactate-threshold heart rate and power (cycling), run heart-rate thresholds, run pace thresholds, and critical swim speed (CSS) time
• Sport and performance data for swimming, cycling and running (including baseline training load and zone calculation method)
• Your sport focus, training preferences, gym preferences and weekly training-hour availability

3.3 Activity and training information

• Races you create or target (including dates, distances, priorities, goal times and recorded results)
• Training plans generated for you, including phases, weeks and individual sessions
• Session details and your completion records (whether a session was completed and when)

3.4 Technical and usage information

When you use the App, we and our service providers may automatically collect limited technical information necessary to operate and secure the service, such as your device type and operating system, app version, log and diagnostic data, authentication tokens, and the dates and times of your activity. Data you enter is also stored locally on your device to allow the App to function.

We do not currently use third-party advertising networks or analytics SDKs that track you across other apps and websites, and we do not collect payment-card details through the App. If this changes, we will update this Policy.

4. How we collect your personal information

We collect personal information in the following ways:

• Directly from you, when you register for an account, complete your profile, fill in the onboarding questionnaire, enter race or performance details, or otherwise interact with the App.
• Automatically, through your use of the App and our supporting infrastructure (for example, authentication and log data).
• From our service providers, who collect and hold information on our behalf (see Section 7).

Wherever it is lawful and practicable, you have the option of dealing with us anonymously or by using a pseudonym (for example, the username feature). However, we cannot provide personalised training plans or manage your account without certain information, including your contact details and health and fitness data.

5. Why we collect, hold, use and disclose your personal information

We collect, hold and use your personal information for the following purposes:

• To create, authenticate and manage your account;
• To generate, validate and adjust personalised training plans using our coaching algorithms and artificial-intelligence models;
• To display your races, plans, schedules and progress, and to track session completion;
• To operate, maintain, secure, support and improve the App;
• To respond to your enquiries and provide customer support;
• To send you service-related communications (such as account, security and important update notices);
• With your consent, to send you optional product news or marketing (see Section 9); and
• To comply with our legal obligations and to protect our legal rights.

We collect sensitive (health) information only where it is reasonably necessary for the purpose of generating and managing your training plans, and with your consent. We will not use or disclose your sensitive information for a purpose other than the purpose for which it was collected, unless you have consented, or the use or disclosure is otherwise permitted or required by law.

6. Use of artificial intelligence

Kjor uses artificial-intelligence models (currently Google's Vertex AI / Gemini models) to generate and refine your training plans. To do this, the relevant information you provide — such as your physiological metrics, sport preferences, race goals and training history — is sent to our AI service provider for processing and a training plan is returned to the App.

This processing may occur on servers located outside Australia (see Section 8). We do not use your personal information to train third-party foundation models, and our AI provider acts as our processor under contractual terms that restrict the use of your data to providing the service to us.

7. Who we disclose your personal information to

We do not sell your personal information. We disclose personal information only to the following categories of recipients, and only as necessary for the purposes described above:

• Our service providers and processors, who host and operate the App on our behalf. These currently include:
  • Supabase, which provides our authentication and database services and stores your account and training data;
  • Google Cloud Platform (including Vertex AI / Gemini and Google Cloud Storage), which provides our backend hosting, file storage and the AI models used to generate training plans.
• Professional advisers, such as our lawyers and accountants, where reasonably required.
• Government, regulatory or law-enforcement bodies, where we are required or authorised by law to do so.
• A purchaser or successor entity, in the event of a sale, merger or restructure of our business, subject to appropriate confidentiality protections.

We require our service providers to handle your personal information consistently with this Policy and applicable privacy laws.

8. Overseas disclosure

Some of our service providers store or process personal information on servers located outside Australia. In particular, our cloud, database and AI processing infrastructure (including Supabase and Google Cloud / Vertex AI) may store or process your information in countries including the United States and other locations where these providers operate. The AI models we use are served via a global endpoint and processing may occur in various jurisdictions.

Note: We are confirming the specific hosting locations of our providers. We will keep this section current. If you would like to know where your data is currently stored, contact us using the details in Section 14.

Before disclosing personal information overseas, we take reasonable steps to ensure that the recipient handles it in a manner consistent with the APPs, including by entering into contractual arrangements with our service providers. However, you acknowledge that, by using Kjor and providing your information, an overseas recipient may not be subject to the same privacy laws as Australia, and we may not be accountable under the Privacy Act for how some overseas recipients handle your information, except as required by law.

9. Direct marketing

We will only use your contact details to send you optional marketing or promotional communications about Kjor where you have consented, or where it is otherwise permitted by law. You can opt out of marketing communications at any time by using the unsubscribe link or instructions contained in the message, by adjusting your in-app preferences, or by contacting us using the details in Section 14. We will action your request as soon as practicable.

Service-related and transactional messages (such as security alerts and essential account notices) are not marketing and you cannot opt out of these while you hold an account.

10. How we hold and protect your personal information

We hold your personal information in electronic form within the systems of our service providers described above. We take reasonable steps to protect your personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure, including through:

• access controls and authentication;
• encryption of data in transit;
• restricting access to personal information to those who need it; and
• using reputable infrastructure and service providers.

While we take reasonable steps to protect your information, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

If we experience a data breach that is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner ("OAIC") in accordance with the Notifiable Data Breaches scheme.

11. How long we keep your personal information

We keep your personal information only for as long as it is needed for the purposes described in this Policy, or for as long as we are required to keep it by law. When your information is no longer needed, we will take reasonable steps to destroy it or de-identify it. If you close your account or ask us to delete your information, we will delete or de-identify it within a reasonable period, except where we are required to retain it for legal, regulatory, dispute-resolution or backup purposes.

12. Accessing and correcting your personal information

You have the right to request access to the personal information we hold about you, and to ask us to correct it if it is inaccurate, out of date, incomplete, irrelevant or misleading. You can update much of your information directly within the App (for example, in your profile and account settings).

To request access or correction, contact us using the details in Section 14. We will respond within a reasonable period (generally within 30 days) and will not charge you for making a request, although we may charge a reasonable fee for giving access in certain circumstances. If we refuse your request, we will tell you why in writing and explain how you can complain.

We may need to verify your identity before actioning your request.

13. How to make a complaint

If you believe we have breached the Australian Privacy Principles or otherwise mishandled your personal information, please contact us first using the details in Section 14. Please include enough detail for us to investigate. We will acknowledge your complaint and aim to respond within a reasonable period (generally within 30 days).

If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner:

• Website: www.oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5288, Sydney NSW 2001

14. Contact us

If you have any questions about this Policy, wish to access or correct your information, opt out of marketing, or make a complaint, please contact us:

• Entity: WalshTT Pty Ltd (ABN [INSERT ABN])
• Privacy contact / email: [INSERT PRIVACY EMAIL]
• Postal address: [INSERT POSTAL ADDRESS]

15. Changes to this Policy

We may update this Policy from time to time to reflect changes to our practices, our service providers, or the law. When we make changes, we will update the "Last updated" date at the top of this Policy and, where the changes are significant, we will take reasonable steps to notify you (for example, through the App). Your continued use of Kjor after a change takes effect indicates your acceptance of the updated Policy.

This document is a template prepared to reflect the data-handling practices identified in the Kjor codebase as at the date above. It is provided for general guidance and is not legal advice. Before you publish it, we recommend you complete the bracketed fields, confirm the hosting locations of your service providers, and have it reviewed by a qualified Australian privacy lawyer — particularly given that Kjor handles sensitive health information.