Privacy policy

Draft for approval by the controller (coach) and legal counsel. Fields in square brackets must be completed before publication.

Who is the controller

The controller is the coach who gave you access to the app: [coach's name / company], [address], [email]. The server and the app are operated on the coach's behalf by a processor: [processor details].

What data we process and why

Your coach runs the app so that you can both see your training plan, set results, body measurements and messages. This is health data. We process your name, goal, plan and workout notes, set results, body measurements, messages, the date of your consent and the clause version, and technical device data (device name, last use). Your coach's private notes about you (for example about an injury) are visible only to the coach. We do not sell data and do not use it for advertising.

Legal basis

We process health data on the basis of your consent (Art. 9(2)(a) GDPR). You can withdraw it at any time by writing to your coach. The coach may then revoke your access or delete your data.

Access period

Access to the app lasts 30 days from your first sign-in and may be extended by your coach if you use training sessions or a training plan. After access expires, your data is kept until the coach deletes it or you withdraw consent.

Recipients and transfers outside the EEA

Your device connects to the server through Cloudflare, which helps secure and deliver the traffic. For this purpose Cloudflare may process technical connection data (for example your IP address) and can technically see transmitted data in transit, but does not retain it for any purpose other than delivering the connection and protecting against abuse. Data may be transferred outside the European Economic Area on the basis of standard contractual clauses and the Data Privacy Framework. [to be confirmed against the current Cloudflare DPA]

The coach accesses the data through a private network (Tailscale). [to be confirmed whether to name Tailscale as a recipient]

How long we keep data

Until the coach deletes it or you withdraw consent. Database backups are kept for 14 days.

Your rights

You have the right to access, rectify and erase your data, to data portability (you can get a JSON copy from your coach) and to lodge a complaint with the supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO). To exercise your rights, write to your coach: [email].

Cookies

This website does not use analytics or advertising cookies. The app uses a single session cookie to keep you signed in.