Schema Technologies LLC ("Schema", "we", "us") makes software products and films. This policy explains what personal information we collect through our products, how we use it, who we share it with, and the choices you have.
Questions or requests about this policy go to hello@schematech.co.
This policy applies to the following services, together "the Services":
If a Service presents its own more specific notice, that notice adds to this policy for that Service. This policy does not cover third-party services you connect to ours — Plaid, SnapTrade, Apple, Google, Oura and others have their own policies, linked in section 06.
Strata's health data is used for one thing: composing your training. Sleep, heart-rate variability and resting heart rate adjust the day's recommended load. They are never used for advertising, marketing or data mining, never sold, and never disclosed to third parties except a processor acting on our instructions to run the Service.
Readiness, HRV, sleep and resting heart rate are never shareable — not with friends, not on leaderboards, not through any social feature, regardless of how you set your other switches. This is enforced in code and covered by tests.
You can revoke Strata's Health permissions at any time in iOS Settings → Privacy & Security → Health. Doing so stops new reads; ask us to delete what has already been stored.
Where the law asks for a legal basis: we process data to perform our contract with you, with your consent where we ask for it (health data, connected accounts), and for our legitimate interests in running secure, working software.
We keep your information while your account is active. When you delete your account, or ask us to, we delete it within 30 days, except for what we must keep for legal, security or accounting reasons, and except in encrypted backups, which expire on their own schedule.
Unlinking a bank or brokerage removes the connection and its access token; transaction history already imported stays until you delete it or your account. Revoking Health permissions stops new reads; stored health data is deleted on request.
Data is encrypted in transit. Financial access tokens are encrypted at rest with a separately held key. Passwords are hashed with a memory-hard algorithm. Sessions rotate their refresh tokens on every use and can be revoked. Access to production systems is limited to the people who run them. No system is perfectly secure, and we will tell you if a breach affects you.
The Services are not directed to anyone under 16, and we do not knowingly collect personal information from children. If you believe a child has provided us information, email us and we will delete it.
You can ask us to access, correct, export or delete your personal information, and to stop a particular processing, by emailing hello@schematech.co. We will verify the request is yours and respond within 30 days. If you are in a jurisdiction that grants specific rights — the EEA, the UK, California and others — those rights apply and we will honour them.
Inside the products: unlink accounts in Spend Terminal and Market Terminal; adjust sharing switches and Health permissions for Strata; leave studios in Schema Creative.
Our servers are in the United States (Oregon). If you use the Services from elsewhere, your information is transferred to and processed in the US, where privacy law may differ from your own.
When this policy changes we will post the new version here with a new effective date, and for material changes we will tell you inside the affected Service or by email before they take effect.