Effective date: September 10, 2026

SportBoost AI Inc. (“SportBoost,” “we,” “us,” or “our”) built the SportLock app as a commercial iOS application. This Privacy Policy explains how we collect, use, store, share, and delete personal information when you use SportLock (the “Service”).

If you use the Service, you agree to this Privacy Policy. The terms used here have the same meaning as in the SportLock Terms of Use, unless defined otherwise.

This policy is written for SportLock specifically. It does not replace the Strava Privacy Policy. If this policy and Strava’s privacy policy conflict with respect to Strava’s handling of your Strava account data, the Strava Privacy Policy controls.

1. Who we are

SportBoost AI Inc.
6650 Rue Saint-Urbain
Montréal, QC H2S 3H1
Canada

Email: info@sportboost.ai

SportLock is provided by SportBoost AI Inc. We are a separate company from Strava, Inc. and Apple Inc. SportLock is not affiliated with, endorsed by, or sponsored by Strava or Apple.

2. What SportLock does

SportLock helps you earn screen time from movement. After you connect Strava, we use your activity moving time to calculate a daily allowance for apps you choose to restrict with Apple Screen Time. You can also connect one accountability buddy, request extra time, and subscribe for premium features.

SportLock is a training and habit tool. It is not a medical device and does not provide medical, health, or professional advice.

3. Information we collect and how we collect it

We collect only what we need to operate SportLock. We do not sell your information. We do not use your information for targeted advertising. We do not use Strava data to train, fine-tune, evaluate, or operate artificial-intelligence or machine-learning models.

3.1 Information you provide

Type Examples How collected Account Sign in with Apple user identifier; name and email if you share them with Apple; the buddy username you choose Sign in with Apple; in-app username field Buddy content Buddy invites, unlock-request minutes and optional reason, settings-change requests, app-removal requests You (and your buddy) create these in the app Feedback Messages you send us, plus optional device/app version details attached to feedback Email / in-app “Send Feedback” Purchase records Subscription or lifetime-unlock status associated with your Apple ID Apple App Store / StoreKit (Apple processes payment)

We do not receive your Apple ID password. If you hide your email with Sign in with Apple, we receive Apple’s private relay address instead of your real email.

3.2 Strava information (only after you connect Strava)

Connecting Strava is optional. Without it, SportLock can still run on your minimum daily allowance.

Before we access any Strava data, you must authenticate your Strava account and grant consent through Strava’s official authorization screen.

If you connect Strava, we collect:

• Athlete profile: Strava athlete ID, name / username, and granted OAuth scopes

• OAuth tokens: access token and refresh token, so we can keep the connection working

• Activity data needed to calculate your allowance: activity ID, sport type, name, moving time, elapsed time, distance, and start date/time

We request Strava scopes read and activity:read. We do not request write access. We do not upload activities to Strava. We do not access other athletes’ data, leaderboards, or maps for display to anyone but you.

How we collect Strava data:

1. You tap Connect with Strava in SportLock.

2. You log in to Strava and approve access.

3. Our servers exchange the authorization code for tokens (the Strava client secret is never stored in the iOS app).

4. Strava may send our servers webhook events when your activities are created, updated, or deleted.

5. We then fetch the specific activity details needed to compute daily moving-time totals.

Strava data provided by you is shown only to you in SportLock. We do not display or disclose another person’s Strava data, even if that data is public on Strava.

Activity data you record with a watch or bike computer (for example Garmin or Apple Watch) may flow to Strava first. Those devices and Strava have their own privacy policies.

3.3 Screen Time and on-device information

With your permission, Apple’s Family Controls / Screen Time APIs let SportLock apply shields to apps you select. That selection lives on your device (and, if you ask a buddy to approve removing apps, a description of the requested change may be stored so your buddy can approve it).

We do not read the content of your messages, photos, or browsing. Restricted-app usage shown in Progress is based on Apple Device Activity thresholds (for example 50% / 75% / 90% / 100% of your allowance), not second-by-second tracking.

Face ID / device passcode for emergency override is handled by Apple on your device. We never receive your biometric data.

3.4 Notifications

If you allow notifications, we store a push token so we can send:

• allowance / limit alerts

• buddy invite, unlock, settings, and app-removal requests

• optional local reminders you turn on in Settings (those are scheduled on-device)

You can change notification permission in iOS Settings at any time.

3.5 Diagnostics

If the app crashes, Firebase Crashlytics may collect device type, OS version, app version, stack traces, and similar log data so we can fix bugs. Crash reports are used for app functionality, not advertising.

3.6 Automatically collected technical data

When the app talks to our servers, standard server logs may include IP address, date/time, and request metadata needed to keep the Service secure and reliable.

4. How we use information

We use personal information to:

• create and secure your account

• calculate and enforce your daily allowance

• show you Progress (exercise minutes and restricted-app minutes)

• run buddy accountability (invites, approvals, unlocks)

• process and restore App Store purchases

• send the notifications you enabled

• provide support and respond to deletion / access requests

• keep the Service secure and debug crashes

• comply with law

We do not use Strava data for analytics products, advertising, resale, or AI training.

Strava API usage data. Strava may monitor and collect usage data about our access to the Strava API, and may use that usage data for any business purpose, including improving the Strava API or Strava platform, providing developer or user support, and ensuring compliance with the Strava API Agreement.

5. Legal bases (EEA, UK, and similar laws)

Where a legal basis is required, we rely on:

• Contract — to provide SportLock after you create an account

• Consent — Strava connection, Screen Time, notifications, and optional buddy features. You can withdraw consent as described below

• Legitimate interests — security, fraud prevention, and crash diagnostics, in a way that does not override your rights

• Legal obligation — when we must keep or disclose information to comply with law

Fitness / activity data can be treated as sensitive in some jurisdictions. We process it only with your express consent when you connect Strava, and only to operate SportLock for you.

6. How we share information

We do not sell, rent, or license your personal information.

We share information only as follows:

6.1 Service providers (subprocessors)

These providers process data on our behalf to run SportLock:

Provider Role Typical location Apple Inc. Sign in with Apple, App Store billing, Screen Time / Device Activity, APNs push, on-device Face ID United States and other Apple regions Google LLC (Firebase) Authentication, Firestore database, Cloud Functions, Cloud Messaging, Crashlytics United States and other Google regions Strava, Inc. / Strava Ireland Limited Your Strava account and the Strava API (Strava is an independent controller of Strava account data) United States / Ireland

Each provider is bound by its own terms and privacy policy. We require subprocessors that handle SportLock data to protect it no less carefully than we do.

6.2 Your accountability buddy

If you connect a buddy, that person can see your SportLock username and the requests you send (for example extra minutes and an optional reason). Your buddy does not receive your Strava activity feed, GPS, or tokens.

6.3 Legal and safety

We may disclose information if required by law, legal process, or to protect SportLock, our users, or others from harm.

6.4 Business transfers

If SportBoost is involved in a merger, acquisition, or asset sale, personal information may transfer as part of that transaction, still subject to this policy.

We do not transfer Strava data to advertisers, data brokers, or AI providers — even if you would consent — because the Strava API Agreement forbids it.

7. Independent controllers (Strava)

SportBoost and Strava are separate, independent controllers of the personal data each of us processes. We are not joint controllers.

• SportBoost controls the SportLock account, allowance, buddy features, and the copies of Strava-derived data we hold to run SportLock.

• Strava controls your Strava account under the Strava Privacy Policy and Strava Terms of Service.

If you send us a request that should go to Strava (or the reverse), we will point you to the right party.

Open your Strava account anytime at strava.com or manage connected apps at strava.com/settings/apps.

8. Retention

Data How long we keep it SportLock account, username, buddy relationship Until you delete your account / reset the app, or we close the Service Strava tokens Only while Strava is connected Strava activity details (cache) No more than seven (7) days, in line with the Strava API Policy. If an activity is no longer available from Strava, we remove it from our cache immediately Daily moving-time totals used to calculate today’s allowance As long as needed for that purpose, then refreshed or removed Screen Time settings and local Progress history on your device Until you reset the app or delete it Crash logs For a limited diagnostic period Purchase status As long as needed to honor your subscription or lifetime unlock

If you delete an activity on Strava, we stop using and displaying it in SportLock as soon as practicable, and in all cases within 48 hours.

9. Security

We use commercially reasonable administrative, technical, and organizational measures to protect personal information, including:

• Strava client secret stored only on our servers, not in the iOS app

• OAuth tokens in the iOS Keychain and in access-restricted server storage

• HTTPS for API traffic

• Firebase security rules that block client access to Strava token and webhook collections

No method of transmission or storage is 100% secure. You use the Service at your own risk.

10. International transfers

SportBoost is based in Québec, Canada. Our providers (including Apple, Google, and Strava) may process data in the United States and other countries. Those countries may not have the same privacy laws as your home country.

Where required (including transfers from the EEA, United Kingdom, or Switzerland), transfers rely on appropriate safeguards such as the European Commission Standard Contractual Clauses and the UK International Data Transfer Addendum, as used by us or by our providers.

11. Your choices, consent, and deletion

11.1 Access the data you generated

You can see your allowance, Progress, buddy status, and connected-Strava athlete name in the app. You may also email info@sportboost.ai to request a copy of personal information we hold about you.

Your own Strava data can also be exported from Strava, free of charge, using Strava’s Bulk Data Export tool.

11.2 Withdraw Strava consent

You can withdraw consent and stop SportLock’s access to Strava at any time by:

• tapping Disconnect next to Strava in SportLock Settings, or

• revoking SportLock at strava.com/settings/apps

After withdrawal, we stop accessing your Strava account.

11.3 Delete your data

You can request deletion by:

• using Reset All Data in SportLock Settings, and/or

• emailing info@sportboost.ai with the subject SportLock data deletion

We will delete, from systems we control:

• SportLock account information we stored

• buddy requests associated with you (to the extent they are not still needed for the other person’s account integrity)

• all Strava data and personal data derived from Strava data relating to you

We do this promptly, and in any event within 30 days, unless a longer legal retention period applies. We will email you written confirmation that deletion was completed.

Deletion also happens when you revoke SportLock’s Strava authorization, delete your Strava account, or we stop using the Strava API.

Resetting the app or deleting SportLock from your iPhone removes on-device settings, tokens, and local history. To also delete Apple’s copy of Sign in with Apple for SportLock, use iOS Settings → [your name] → Sign in with Apple.

11.4 Other rights

Depending on where you live (including Québec Law 25, PIPEDA, GDPR, and UK GDPR), you may also have the right to:

• correct inaccurate information

• withdraw consent

• restrict or object to certain processing

• data portability

• lodge a complaint with a supervisory authority (in Québec: the Commission d’accès à l’information; in the EEA/UK: your local data protection authority)

To exercise these rights, email info@sportboost.ai. We may need to verify it is you.

12. Children’s privacy

SportLock is not directed to children under 13 (or the higher age required in your country). We do not knowingly collect personal information from children under 13. If we learn that we have, we will delete it. Parents or guardians who believe a child provided information should contact us at info@sportboost.ai.

13. Cookies

SportLock is an iOS app and does not use browser cookies itself. Our website, sportboost.ai, and some third-party libraries (including Google/Firebase) may use cookies or similar identifiers as described in those parties’ policies. You can control website cookies in your browser.

14. Links to other sites

SportLock and sportboost.ai may link to Strava, Apple, or other sites we do not operate. Their privacy practices are their own. Review those policies before you provide information there.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the effective date. If we change the type of Strava data we collect, we will notify you and obtain your consent before collecting the new category.

Your continued use of SportLock after a posted update means you accept the revised policy. If you do not agree, disconnect Strava, stop using the Service, and request deletion.

16. Contact us

Questions, access requests, deletion requests, or privacy complaints:

SportBoost AI Inc.
6650 Rue Saint-Urbain
Montréal, QC H2S 3H1
Canada

info@sportboost.ai

Please put SportLock in the subject line so we can route it quickly.

This policy is effective as of September 10, 2026.