Privacy policy

COACH team is the controller for COACH and is based in Sweden. Contact COACH team at tellanfosho@gmail.com.

• Account data: email address, name, verification status, sessions, security settings, and consent history. Passwords are stored only as salted hashes.
• Profile data: name, age, sex, height, weight, language, goals, experience, equipment, diet, and injuries or limitations.
• Training data: programs, completed and skipped sessions, weights, repetitions, recovery feedback, and progression.
• Nutrition and measurements: meal descriptions, estimated calories and nutrients, bodyweight, and other measurements you choose to log.
• Coaching data: chat messages, permanent memories, and saved agent workspace files.
• Limited technical security data: server logs, timezone, version details, and hashed device information recorded with consent.
• Operational and product analytics: page views, registration and payment funnel steps, chat-message counts, completed features, AI token usage, and estimated cost. The analytics ledger does not contain chat text, meal contents, body measurements, IP addresses, or user-agent strings.
• Payments when enabled: plan, subscription status, and payment events. COACH does not store full card or bank details.

Photos are prepared on your device and sent to the configured AI provider for the active analysis. COACH does not retain the photo file in its database. Chat history may retain a text note stating that an image was used.

• Contract: authentication, programs, workout logging, coaching, and account features.
• Explicit consent: health-related information including injuries, body measurements, training, and nutrition.
• Legitimate interests: limited security, fraud prevention, and service reliability where those interests do not override your rights.
• Legitimate interests: privacy-minimal first-party analytics to understand registration, reliability, product use, and operating cost without advertising or third-party tracking.
• Legal obligation: records that applicable law requires the operator to retain.

Chat text, relevant profile and training context, and images you actively attach may be sent to the AI provider configured by the operator. Better Auth runs inside COACH infrastructure and does not send account data to a separate identity provider. The email provider processes addresses and security messages. When payments are enabled, Stripe processes payment, invoice, and tax data. Database, server, and infrastructure providers process data only to operate the service. Current providers, processor agreements, and international transfer safeguards must be documented before public launch.

Account data is kept while the account exists or as legally required. Privacy-minimal product and AI analytics events are automatically removed under the configured analytics retention period; their account ID is detached on account deletion. Verified payment accounting records may be retained separately for the period required by law. COACH does not sell personal information, use third-party advertising, or use an analytics cookie. Backups must rotate under the published retention schedule, and deleted accounts must disappear when that backup cycle expires.

You can download your data and delete your account in Settings. You may also request access, correction, restriction, portability, object to certain processing, or withdraw consent. Withdrawing health-data consent prevents COACH from providing its core service. You may complain to the Swedish Authority for Privacy Protection, IMY.

COACH is for people aged 18 or older. Material policy changes require a fresh, active acknowledgement before the service can be used again.