Privacy Policy

1. Information we collect

We collect the following categories of personal data:

• Account info: name, email address, password (hashed), profile photo, role (coach or client).
• Health & fitness data: body measurements, weight, progress photos, workout logs, food logs, check-ins, and goals that you choose to enter.
• Coaching content: messages between you and your coach or clients, questionnaire responses, uploaded health documents.
• Device permissions you grant: camera (for progress photos and barcode scanning), photo library (for uploads), step count (if you enable HealthKit/Google Fit).
• Usage data: log-in times, feature interactions, crash reports, and technical info (device model, OS version, IP address).
• Payment info: if you subscribe, payment details are processed by Stripe; we do not store full card numbers.

2. How we use your information

• Provide and operate the coaching platform (account creation, workouts, nutrition tracking, messaging).
• Allow your coach to view your progress and provide feedback (client data only).
• Communicate with you about your account, updates, and support.
• Improve the Service, debug issues, and prevent abuse.
• Comply with legal obligations.

We do not sell your personal data. We do not use your data for advertising.

3. Who we share data with

We share data only with service providers necessary to run the Service:

• Supabase — database and authentication hosting.
• Vercel — web app hosting.
• Stripe — payment processing (if you subscribe).
• Resend — transactional email delivery.
• Open Food Facts — public food database used for barcode look-ups (we send the barcode only, no personal data).
• Your coach — if you are a client, your coach can see the data you log to support your training.

We may disclose data if required by law or to protect rights, safety, or property.

4. Data storage and security

Your data is stored on Supabase servers and encrypted in transit (TLS) and at rest. We use row-level security so that only you and your coach can access your records. No system is perfectly secure, but we take reasonable steps to protect your information.

5. Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data (request via the contact email below).
• Export your data.
• Withdraw consent for optional features (e.g., camera access, HealthKit).

If you are in the EU/UK, you also have rights under GDPR including the right to lodge a complaint with a supervisory authority.

6. Children

The Service is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe we have, contact us and we will delete it.

7. Data retention

We retain personal data for as long as your account is active. When you delete your account, we delete or anonymise your data within 30 days, except where retention is required by law (e.g., tax/accounting records).

8. International transfers

Our service providers may store data outside your country of residence (including the United States and European Union). Where required, transfers are protected by standard contractual clauses or equivalent safeguards.

9. Changes to this policy

We may update this policy. If we make material changes, we will notify you via the Service or by email. The "Effective" date at the top reflects the latest version.

10. Contact

Questions about this policy or your data? Email jarrodbarnettpt@gmail.com.