Privacy Policy

1. Information We Collect

When you use the app we collect:

• Account information: name, email, phone number, hashed password, profile photo (if you upload one).
• Fitness data you provide: weight, height, age, gender, training goals, dietary restrictions, allergies, workout logs (sets, reps, weight, RPE), check-in entries (sleep, energy, mood, body weight).
• Coaching activity: sessions scheduled / attended / cancelled, payments logged, notes between you and your coach.
• Device information: app version, operating system version, push notification token if you opt in to notifications.

We do not collect: your location, contacts, photo library, microphone, or camera unless you explicitly authorize a specific feature that requires it.

2. How We Use Your Information

• To deliver the coaching service: showing your program, tracking progress, scheduling sessions, recording payments.
• To send notifications you opt in to (session reminders, coach messages, weekly recaps).
• To compute aggregate consistency statistics visible only to you and your assigned coach.
• To improve the app via anonymized usage metrics.

3. Sharing

Your data is visible only to:

• You.
• Your assigned coach (one coach at a time).
• Anthropic (Claude API), if you use the AI progress insight or report features — only the relevant context for that single request, processed and not retained beyond the request lifecycle.
• Service providers required to operate the app: Supabase (database hosting), Vercel (application hosting), Resend (transactional email if enabled).

We do not sell your data to third parties. We do not share your data with advertisers. We do not use your data to train AI models.

4. Connected Devices and Health Data

Connecting a device is optional. Nothing below is collected unless you connect it yourself, and you can disconnect at any time.

• WHOOP: if you connect a WHOOP account (you sign in with WHOOP and approve the access), we read your daily recovery score, heart-rate variability, resting heart rate, strain, and sleep. We store one summary per day. It is shown to you and to your assigned coach so recovery can be read alongside your training. Disconnect from Settings: we delete the access tokens we hold and stop syncing. You can also revoke access from your WHOOP account.
• Apple Health (iPhone app only): if you allow it in the iOS Health permission prompt, we read your daily step count. We read nothing else from Apple Health. Steps are shown to you and to your assigned coach for the step goal. Turn this off at any time in iOS Settings → Health → Data Access & Devices; steps already stored stay until you ask us to delete them (section 6).

We never write to WHOOP or Apple Health. Health data from either source is stored with the same protections as the rest of your data, is shared only with the service providers listed in section 3, is neversold, never used for advertising, and neverused to train AI models.

5. Data Retention

Account data is retained while your account is active. Archived clients remain in the database (read-only for the coach) until deletion is requested. To delete your data, email us at the address in section 11 — we will remove your account and personal data within 30 days.

6. Your Rights

• Access all your data through the app at any time.
• Edit your profile, training data, and check-ins from the Settings screen.
• Export your data on request.
• Request deletion of your account and all associated personal data.

7. Security

Data is encrypted in transit (HTTPS / TLS) and at rest (Supabase Postgres encryption). Passwords are hashed using bcrypt. Row-level security at the database layer prevents one user from accessing another user's data, including across coach accounts. We follow industry-standard practices, but no system is 100% secure.

8. Children

The app is not intended for users under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has registered, contact us and we will remove the account.

9. International Transfers

Your data is processed and stored on servers operated by our service providers (currently Supabase in the Asia Pacific region and Vercel in the Asia Pacific region). By using the app you consent to this transfer and processing.

10. Changes

We may update this policy from time to time. Material changes will be communicated through the app and the date above will be updated.

11. Contact

Questions, requests, or complaints? contact@ahmedsaleh.fit