Privacy Policy

1. Who we are

CoachWarrior ("we", "us", "our") is a UK-based platform that helps fitness coaches manage their clients — workouts, nutrition, check-ins, messaging, scheduling and a public coaching page. This policy explains what personal data we collect, why, who we share it with, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).

For the data described here, CoachWarrior is the data controller. You can contact us about anything in this policy at coachwarriorofficial@gmail.com.

2. What we collect

• Account details: name, email address, password (stored only in hashed form by our authentication provider), and role (coach or client).
• Profile and branding: profile pictures and, for coaches, any logo, banner, brand name and coaching page content you add.
• Health and fitness data you choose to log: weight entries, goal weight, progress photos, nutrition targets, meal logs and barcode scans, and check-in responses (such as energy, sleep, mood, adherence and notes).
• Onboarding forms, including a pre-activity health screening — see section 4.
• Coaching content: workout and nutrition plans, exercises, recipes, assignments, calendar sessions and session feedback.
• Messages between coaches and clients in the app, including attachments.
• Enquiries through a coach's public page: if you contact a coach through their CoachWarrior page, the name, email, phone number and message you submit are passed to that coach's leads inbox.
• Demo requests: if you request a demo on our website, the name and email you enter, so we can send you the demo link and follow up about CoachWarrior.
• Billing details (coaches): your plan, subscription status, trial dates and a Stripe customer reference. Card details are entered directly with Stripe and never reach our servers.
• AI requests: the instructions you type into the AI workout or nutrition builders, and any file you attach to them — see section 7.
• Technical data: IP address, browser and device information and timestamps, recorded in server logs by our hosting providers to run the service and keep it secure.
• Demo usage: if you try the public demo, we record which demo steps are used against a random ID that lasts only for that browser tab. It doesn't identify you.
• Advertising measurement: if you accept cookies, the pages you visit and your sign-up (see section 10). If you're a coach who starts a free trial, we tell Meta about the trial whether or not you accept cookies (see section 10).

3. Why we use it, and our lawful basis

• To provide the service you signed up for — accounts, coaching tools, messaging, AI plan builders, billing: performance of our contract with you.
• Health information in onboarding forms and logs: your explicit consent (see section 4).
• Keeping the service secure and working, preventing abuse, fixing bugs, understanding how the demo is used, and emailing you about your account: our legitimate interests in running a safe, reliable product.
• Measuring our Meta (Facebook/Instagram) ads: your consent via the cookie banner for advertising cookies, which you can withdraw at any time. Telling Meta that a coach started a free trial relies on our legitimate interests in measuring which ads bring us customers; you can object (see section 10).
• Keeping billing and tax records: legal obligation.

We don't sell your personal data, and we don't use your coaching, health or message data for advertising.

4. Health information and onboarding forms

Before starting with a coach, clients are asked to complete an onboarding form. This includes general information (goals, experience, availability, emergency contact) and a standard pre-activity health screening — questions covering things like heart conditions, chest pain, dizziness, bone or joint problems, blood pressure medication, current injuries and medications.

Health information is a special category of data under UK GDPR. We only collect it because you choose to provide it, on the basis of your explicit consent given when you submit the form. It exists so your coach can train you safely and is used for no other purpose.

It is visible only to you and the coach you're linked with — never to other coaches or clients. You can review and update your answers at any time from your account, and withdraw consent by deleting them or your account.

5. Who can see your data

Your health, fitness, onboarding and message data — including progress photos — is only visible to you and the coach or client you're linked with. Coaches can only see data belonging to clients linked to them. Access rules are enforced in the database itself, not just in the app.

If you're a coach and turn on leaderboards or your public coaching page, the details you choose to show there (such as your name, brand, ranking and page content) are visible to other users or to the public.

6. Service providers we share data with

We use trusted providers to run CoachWarrior. They process data on our instructions and only for the purpose listed:

• Supabase — database, login and file storage (all account, coaching, health and message data, and uploaded images).
• Vercel — website and app hosting (technical data and all requests passing through the app).
• Stripe — subscription payments and billing (coach name, email, payment details entered on Stripe's checkout).
• Anthropic — generates plans in the AI workout and nutrition builders (the instructions and any file you give the builder). Anthropic does not use this data to train its models.
• Resend — sends emails such as new-enquiry notifications and account emails (name, email, email content).
• Meta Platforms — measures how our Facebook and Instagram ads perform: browsing data only if you accept advertising cookies, and a record of each coach free-trial start (see section 10).
• Open Food Facts — looks up products when you scan a food barcode (only the barcode number is sent).
• Google Fonts — serves some fonts on our website, which means your browser requests them from Google's servers (your IP address and browser details).

We may also disclose data if required by law, or to protect the rights and safety of our users or others.

7. How we use AI

CoachWarrior includes two optional AI features for coaches: the AI workout builder and the AI nutrition builder. They're powered by Claude, an AI model made by Anthropic.

What is sent to the AI: only what's needed to build the plan — the request you type, the earlier messages in that same builder conversation, any image or PDF you attach (for example a photo of an existing plan), and the names of the exercises or recipes in your library so the plan uses them. Client records, health screenings, progress data and messages are not sent automatically. If you type or attach a client's personal details yourself, that content is sent too, so we recommend leaving out anything the plan doesn't need.

How it's handled: the request goes from our servers to Anthropic over an encrypted connection, the generated plan is returned to your account, and Anthropic acts as our processor. Under its commercial terms Anthropic does not use this data to train its models, and it keeps it only for a limited period for safety and abuse monitoring before deleting it.

Your control: AI output is always a draft. Nothing is assigned to a client until the coach reviews, edits and saves it, and the AI never makes decisions about anyone automatically. AI can make mistakes, so coaches remain responsible for checking every plan is safe and suitable for their client.

We don't use your data, or your clients' data, to train any AI model. You can simply not use the AI builders if you'd rather your requests weren't processed this way.

8. International transfers

Some of these providers store or process data outside the UK, including in the United States and the European Economic Area. Where that happens, we rely on the UK's adequacy regulations (including the UK–US data bridge) or on the UK International Data Transfer Addendum and equivalent safeguards in our providers' data processing terms.

9. How long we keep it

• Account and coaching data: for as long as your account is open. When you delete your account (Profile → Delete account), your profile and associated data — including photos and onboarding/health information — are deleted, and any active subscription is cancelled.
• Billing records: kept for up to 6 years after the transaction, as UK tax law requires. Stripe keeps its own records under its privacy policy.
• Public-page enquiries: kept in the coach's leads inbox until the coach deletes them or closes their account.
• Server logs: kept by our hosting providers for a limited period for security and troubleshooting.
• Backups may hold deleted data for a short period until they are overwritten.

10. Cookies and similar technologies

We use a small amount of storage on your device. Essential storage is needed for the site to work and is always on. Advertising cookies are only set if you choose Accept in our cookie banner — if you choose Reject or ignore the banner, they are never set.

With your consent, the Meta Pixel sends Meta the pages you visit on our site and whether you signed up or started a free trial, along with technical data such as your IP address and browser. Meta may combine this with information it holds about you if you have a Facebook or Instagram account, to measure our ads and show them to people likely to be interested. Meta acts as a joint controller with us for this collection; see Meta's Privacy Policy.

Free-trial starts. When a coach starts a CoachWarrior free trial, our server tells Meta (using Meta's Conversions API) that a trial started, with your email address and account ID in hashed (scrambled) form, your IP address and browser type. This happens whether or not you accept cookies, so we can measure which ads bring us coaches; no cookies are set for it, and we never send coaching, client, health or message data. It relies on our legitimate interests, and you can object at any time by contacting us (section 17).

When you pay, Stripe's checkout page (on stripe.com) sets its own cookies for fraud prevention, covered by Stripe's Privacy Policy.

You can change your mind at any time: Cookie settings. You can also clear or block cookies in your browser settings.

11. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict or object to how we use your data, including where we rely on legitimate interests
• receive your data in a portable format
• withdraw consent at any time — for health information or advertising cookies — without affecting anything done before

To use any of these rights, email coachwarriorofficial@gmail.com. We'll respond within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 — though we'd appreciate the chance to sort it out first.

12. Coaches and their clients

Coaches use CoachWarrior to manage their own clients. The information a coach adds about a client, or receives through their public page, is handled by the coach as part of their own business, and coaches are responsible for using it lawfully. CoachWarrior stores and protects that data on their behalf as described in this policy.

13. Security

Data is encrypted in transit, passwords are hashed, and database-level access rules stop users seeing data that isn't theirs. No system is perfectly secure, but if we become aware of a breach that affects you, we'll tell you and the ICO where the law requires it.

14. Automated decisions

We don't make decisions about you with legal or similarly significant effects based solely on automated processing. AI-generated plans are drafts for your coach to review and edit.

15. Children

CoachWarrior isn't intended for children under 16, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.

16. Changes to this policy

We'll update this policy as CoachWarrior evolves and change the date at the top when we do. If a change significantly affects how we use your data, we'll let you know in the app or by email.

17. Contact us

Questions about this policy or your data: coachwarriorofficial@gmail.com.