Privacy Policy

Version 1.0 · Last updated: October 2, 2026

This policy describes which personal data Limitless collects, how it is used, who it is shared with, how long it is kept and how you control it. Limitless is a personal performance system operated by P1ONE, available at solonlife.com.

This policy follows Brazil's General Data Protection Law (LGPD, Law 13.709/2018).

1. Controller and data protection officer

Controller: P1ONE · [RAZÃO SOCIAL] · CNPJ [CNPJ]

Data protection officer (DPO): Bruno Lopes

Privacy contact: privacidade@solonlife.com

2. Who can use it

Limitless is intended for people aged 18 or older. We do not knowingly collect data from minors. Accounts belonging to minors are deleted once identified.

3. Data we collect

3.1 Account and profile

• Name, email and login data.
• Profile data used to personalize training and nutrition: date of birth, gender, height and weight.
• Occupation and profile photo (the photo is optional).
• Selected language.

3.2 Initial assessment

• Your scores and answers across four pillars: personal, professional, physical and mental.
• The score calculated from those answers.

3.3 Conversations with the agents

The system has four AI agents: Performance, Training, Nutrition and Mental Health. We store the conversation history and what is recorded from it:

• Performance: goals, non-negotiable actions, routine and commitments.
• Training: weekly training schedule, running and strength plans, injuries and physical restrictions you report, reported workouts.
• Nutrition: preferences, dietary restrictions, budget, generated meal plans and your food logs.
• Mental Health: assessment scale answers, reported emotional state and practiced protocols.

Part of this is health data. See section 5.

3.4 Daily check-in and daily confirmations

• Your energy, sleep and physical recovery scores, and whether you trained the day before. Without a connected device, also the type and distance of the workout.
• The confirmations you make on the dashboard: today's workout, Mental Health practice, food log and completed non-negotiable actions.

3.5 Wearable data, if you connect a device

• Garmin, through SweatStack: sleep, resting heart rate, heart rate variability (HRV) and activities (type, duration, distance, pace, heart rate, elevation and laps).
• Polar, through Open Wearables: sleep and activities recorded by the device.

GPS routes of your activities are not stored. Connecting a device is optional. The system works without one, based on check-ins and conversations.

3.6 Google Calendar, if you connect it

Access is limited to the calendar.events scope and is used to:

• display your events on the dashboard;
• create, edit or remove routine events you define with the Performance agent.

When you delete your account, the events the system created in your calendar are removed. We do not access email, contacts, files or any other Google Account data.

3.7 Score and usage

Points, level, milestones, usage streak and the log of events that generated points. Technical access and error logs used to keep the system running.

3.8 Acceptance record

Date, time, language and version of the Terms of Service, of this policy and of the health data authorization you accepted.

3.9 Payment

Payments are processed by [PROVEDOR DE PAGAMENTO]. We never receive or store your card number. We keep only the plan, subscription status and transaction ID.

4. Data we do not collect

• Continuous location from your phone.
• GPS routes of your physical activities.
• Contacts, camera or microphone, and photos other than the profile photo you choose to upload.
• Email content or Google Drive files.
• Credit card numbers or banking passwords.
• Data from other apps on your phone.

We do not sell data, use it for advertising or use it to train AI models.

5. Sensitive health data

Sleep, heart rate, HRV, physical activity, injuries, dietary restrictions, food logs and everything you share with the Mental Health agent are sensitive personal data (LGPD, art. 5, II).

We process this data based on your specific and highlighted consent (LGPD, art. 11, I), recorded on the consent screen before first use, with the date and version accepted.

You can withdraw this consent at any time (section 9). Your health data is the foundation of how the agents work. Withdrawing this authorization deletes your account and all your data.

The agents generate routine, training, nutrition and self-care recommendations. They do not diagnose and do not replace a physician, dietitian, trainer or psychologist.

6. How we use data

No change to your training, nutrition or routine is applied without your confirmation. The agents propose, you decide.

7. Who we share data with

We share data only with the technology providers needed to run the system. Each one receives only what its function requires.

Under its commercial API terms, Anthropic does not use data sent by Limitless to train its models.

International transfer. The system runs on technology servers, some of them outside Brazil, which process your data only to run the system. This transfer is based on your specific consent (LGPD, art. 33, VIII) and on the providers' contractual clauses requiring equivalent protection.

We may also share data when required by law or court order.

8. Retention

• We keep your data while your account is active.
• When you delete your account, all your data is removed from the database immediately, including your profile photo and your acceptance record. Provider backups are overwritten in the normal cycle, within [PRAZO_BACKUP] days.
• Payment data required for tax purposes is kept for the period required by law.

9. Your rights

You can, at any time (LGPD, art. 18):

Email requests are answered within 15 days.

10. Security

• Each user can only access their own data, enforced by row-level security in the database.
• Integration credentials (Google, Garmin, Polar) are kept server-side, encrypted, and never exposed to the browser.
• All traffic is encrypted (HTTPS) and the database is encrypted at rest by the provider.

No system is fully immune to incidents. If an incident creates relevant risk to you, we will notify you and the ANPD as required by law.

11. Changes to this policy

When this policy changes in a relevant way, we will announce it inside the system and ask for a new acceptance. Version and date are always at the top.

12. Contact

privacidade@solonlife.com