Privacy

Privacy policy.

Kadiio is an AI MMA coach, so it handles personal data and, because you tell it about training and injuries, some health data. This page says what, why, for how long, who else touches it, and how you stay in control.

Last updated 1 November 2026.

Who runs Kadiio

The controller and service provider is Tsepo Mkwebu, a private individual: the person who decides why and how your data is used (the "controller" under the GDPR). Write to info@kadiio.com for anything about your data.

Controller and service provider: Tsepo Mkwebu, a private individual
Address: Ludna 1b, 00-405 Warszawa, Poland
Contact: info@kadiio.com

The same details are on the imprint.

What Kadiio keeps

Your account. Your first name and Telegram identity (a number, not your phone number), your time zone, your check-in time and quiet hours, and an email address if you add one. If you sign in with Google, Kadiio also keeps your Google account's id, the email address and the first name Google gives it, and when you last used it. It never asks for your password, contacts, files or calendar when you sign in.
Your profile. What you tell Kadiio about yourself: stance, goals, equipment, experience, height and weight if you give them, and your availability.
Training and health information. Check-ins (time, energy, sleep, soreness, knee pain and red flags), the plans Kadiio made, the sessions you logged with effort and pain, knee tests, mobility and fitness results, and an injury and physio prescription if you enter one. This is information about your health, which the GDPR treats as especially sensitive.
Conversations. What you write to the coach and what it answers.
Your location, if you share it. Only the latest point, rounded to about a kilometre, to find gyms near you. No history is kept, and you can delete it in Settings.
Coach mode. The connections you make with a coach or an athlete, what you allow them to see, the shared plan, tasks, comments, notes a coach keeps about you, proposed sessions and your availability.
Access and usage. Whether your account is let in, its role and plan, when you were last active, and a record of every call Kadiio makes to the AI model for you: when, what it was for, which model, how many tokens it used and an estimated cost. The record holds counts, not what you wrote. It is used to keep each person within their monthly allowance and to see what the service costs to run.
Devices. The address your browser gives for notifications, if you turn them on; and records that keep the app safe (see below).

You can give consent on the Account page in the app, or with /consent in Telegram, and withdraw it there at any time. Withdrawing stops health processing at once: no more check-ins, pain logs or knee inputs are taken, nothing more goes to the AI model and Kadiio stops sending you check-in questions. When you withdraw you can also choose to delete the health data already stored (check-ins, injuries and the knee track, logged pain and effort, assessments, your conversations with the coach, and your height and weight). The same choice is in Telegram. Withdrawing does not affect what was done before you withdrew. If you change the wording of your agreement later, Kadiio asks again.

Why, and on what basis

To give you the service (the GDPR's "performance of a contract"): planning your training, remembering your logs, sending your check-in and reminders.
Your explicit consent, for health data (GDPR art. 9(2)(a)). Before the first health question, injury or body measurement, in the app and in Telegram, Kadiio shows a separate step with an unticked box (a button in Telegram): "I agree that Kadiio processes my health data to coach me. This includes sending it to Anthropic (Claude) to generate replies. I can withdraw this at any time in Settings." Until you agree, Kadiio takes no health information from you and sends nothing to the AI model. Kadiio records that you agreed, when (in UTC), which version of the wording and whether it was on the web or in Telegram.
Keeping the service secure (a "legitimate interest"): sign-in sessions, rate limits and short-lived technical records so the service is not abused.

Kadiio does not sell your data, does not show adverts, and does not use your data to profile you for anyone else.

The AI model

To write the coaching, Kadiio sends your messages, and the parts of your profile, plan and recent training it needs to answer, to an AI model: Claude, made by Anthropic. Anthropic processes that to produce the reply, under its own terms and privacy policy. Kadiio's safety rules, such as the knee rules and red-flag stops, run in Kadiio's own code, not in the model. Kadiio asks the model not to invent facts about you, but an AI can still be wrong: treat its answers as guidance.

Diet

Diet is an optional part of Kadiio, off until you are given it and agree to its own terms (a separate, unticked step, on top of the health consent). When you use it Kadiio stores your birth year, sex, height and weight, your goal, how you eat, your allergies and foods you dislike, what you log as eaten, your meal plans and shopping lists, and the meal photos you add. This is health data, kept on the same basis as the rest of your health data: your explicit consent (GDPR art. 9(2)(a)).

The AI model. A meal photo, or a description of food Kadiio's own list cannot match, is sent to Anthropic (Claude) to estimate its nutrition. The photo is first stripped of its location and camera details and made smaller. Targets, plans and shopping lists are worked out by Kadiio's own code, not by the AI.
Photos are kept privately in Kadiio's database (never at a public address) and shown only to you. They are deleted after 30 days; the meal stays in your log without the photo. You can delete a photo or an entry at any time, or choose not to keep photos at all. Photos can remain in database backups until those rotate out.
Open Food Facts. Looking up a barcode or a packaged food sends that barcode or search word, and nothing about you, to Open Food Facts. Its data is available under the Open Database License (ODbL).
Partner shops. A shopping list can link to partner shops. If you buy, Kadiio may earn a commission; it does not change your price. Kadiio counts that you tapped a link (which shop, which list, when) but sends the shop nothing about you beyond the click, and only the words of what is on your list in the link. Buy links are shown to people aged 18 and over.
Withdrawing. You can withdraw from Diet at any time in Diet settings: it stops at once, and you can delete everything Diet stored. This is general guidance, not medical or dietetic advice.

Who at Kadiio can see what

The people who run Kadiio use an admin console. In it they can see your account and usage data: your name, how you signed in, your role and plan, whether you are let in, when you were last active, and your AI usage and estimated cost. They can let you in, pause or delete an account, change your plan or allowance and switch features on or off for you. The console does not show your conversations, check-ins, logs or health information, and every action an admin takes is written to an audit log that keeps only who did what to which account, never the content.

Hosting: Hostinger hosts the database and the app.
Telegram. If you use the bot, your messages also pass through Telegram, which has its own policy, may process them outside the EEA and keeps them itself. Kadiio cannot delete messages from Telegram.
Anthropic (United States), the AI model, as above: it receives your messages and the health and training context needed to answer, and only after you have agreed to health-data processing. Your data is sent to Anthropic Ireland, Limited; because Anthropic also processes it in the United States, the transfer relies on the European Commission's standard contractual clauses in Kadiio's data processing agreement with Anthropic. Anthropic keeps the inputs and outputs of these requests for up to 30 days, and longer if they are flagged under its usage policy; Kadiio cannot delete them there sooner.
Payments, when subscriptions open: Stripe takes the payment and keeps the card details. Kadiio never sees them and only learns whether your subscription is active.
Email: Resend delivers sign-in links and confirmations if you use email.
Notifications. If you turn them on, the browser's push service (Google, Apple, Mozilla or Microsoft, depending on your browser) carries a short, encrypted notice. It never contains health details.
Maps. Only when you press "Show the map" does your browser ask OpenStreetMap's servers for map pictures, so they see your IP address.
Google, for signing in, only if you choose "Continue with Google": Google tells Kadiio who you are (your account id, email address and name) and learns that you signed in to Kadiio. Google is a United States company; it is governed by Google's own privacy policy. Because it is outside the EEA, the transfer relies on a safeguard the GDPR allows: the EU–US Data Privacy Framework where the company is certified under it, otherwise the European Commission's standard contractual clauses.
Google Calendar, only if you connect it: Kadiio asks Google when you are busy (never what for) and adds agreed sessions to your calendar.
Your coach or athletes, only what you choose. By default a coach you invite sees your plan and logged sessions; check-ins and the knee are off until you switch them on, and you can switch anything off at once.

Where a company named here is outside the EEA, Kadiio relies on one of those safeguards for sending it your data (see Chapter V of the GDPR). Write to info@kadiio.com to ask which one applies, or for a copy.

How long it is kept

Your data is kept until you delete it or your account. What was sent to Anthropic to write a reply is kept by Anthropic for up to 30 days, longer if flagged under its usage policy (see above). Some things are removed sooner: handled-message records after 14 days, delivery records after about four months, coach-mode messages after 14 days (or 3 days if they could not be delivered), sign-in sessions after 30 days (7 days if unused), and email sign-in links after 15 minutes. Backups of the database are kept for about two weeks, so deleted data disappears from them within that time.

Your rights

Under the GDPR you can access your data, correct it, delete it, restrict or object to its use, take it with you, and withdraw consent. Most of this you can do yourself: the Account page in the app downloads everything Kadiio stores about you (a file you can read) and deletes your account and all of it, once you have signed in recently. For anything else, write to info@kadiio.com and you will get an answer within a month. You can also complain to your data protection authority; in Poland that is the President of the Personal Data Protection Office (UODO).

Cookies and similar

Kadiio sets one cookie, to keep you signed in, and remembers your light or dark choice, a few preferences and any changes you make offline on your own device. There is no advertising, no analytics and no tracking across sites, so there is no cookie banner to click through.

Two third parties can set their own cookie, and only if you choose them. Telegram sets its own cookie, and learns your address, only when you tap "Log in with Telegram": nothing is sent to Telegram when you merely open the sign-in page. Google does the same if you choose "Continue with Google".

Security

Connections are encrypted. Sign-in and invite tokens are stored only as hashes, and secrets such as calendar connections are encrypted. Access to your data by a coach is checked against your choices on every request. No system is perfectly secure: if something affecting you went wrong, Kadiio would tell you and the authority as the law requires.

Automated decisions

Kadiio makes no decisions about you based solely on automated processing that have legal or similarly significant effects (GDPR Art. 22). Its plans and answers are training guidance that you are free to follow or ignore.

Age

Kadiio is for adults (18 or over). It is not meant for children, and an account found to belong to one will be removed.

Changes

If this policy changes in a way that matters, the date above changes and, for anything significant, Kadiio tells you in the app or the bot before it applies.