1. Introduction
This Privacy Policy explains how CoachBrag (“CoachBrag”, “we”, “us”, or “our”) collects, uses, stores and shares personal data when you use CoachBrag, including our website, mobile applications, web application, APIs and related services (the “Service”).
CoachBrag is operated by Mateusz Hobot, an individual operator trading under the CoachBrag name, with correspondence address at 61 Kilnside Road, Paisley, PA1 1RP, United Kingdom.
The data controller for CoachBrag is Mateusz Hobot, operating CoachBrag.
For privacy questions, contact privacy@coachbrag.com.
2. Who this policy applies to
This Privacy Policy applies to trainers who create CoachBrag accounts, clients invited by trainers, users who access the website or app, people who contact us for support, and people who interact with our emails or services.
3. Our role
For account, billing, security, support, analytics and general operation of CoachBrag, Mateusz Hobot, operating CoachBrag, normally acts as the data controller.
Correspondence relating to data protection may be sent to 61 Kilnside Road, Paisley, PA1 1RP, United Kingdom.
For some client information entered by a trainer, the trainer may also be an independent controller or we may process information on the trainer’s instructions, depending on the circumstances. Trainers are responsible for ensuring that they have a lawful basis and required consent to upload or manage client information through CoachBrag.
4. Personal data we collect
Account data
•
Role, such as trainer or client.
•
Login and session information.
Client and training data
•
Trainer-client relationship.
•
Sets, reps, weight, time, distance, rest time and completion status.
•
Achievements and badges.
•
Notes or descriptions entered into the app.
Communication data
•
Messages between trainers and clients.
Billing and subscription data
CoachBrag does not directly process card payments through the web app. Eligible trainers may receive one backend-managed 14-day free trial with no payment method, while paid mobile subscriptions are purchased through the Apple App Store or Google Play where available and synced through RevenueCat. Apple, Google and RevenueCat may provide subscription, entitlement and transaction metadata needed to operate billing access.
•
CoachBrag free-trial access state, including start, end and revocation timestamps.
•
Payment provider identifiers.
•
Transaction or purchase metadata.
Technical and usage data
•
Approximate location derived from technical data.
•
Security and authentication events.
Support data
•
Messages you send to support.
•
Screenshots or attachments you provide.
•
Feedback and bug reports.
5. How we collect personal data
•
Directly from you when you create an account, update your profile, use the app or contact us.
•
From trainers who invite or manage clients.
•
Automatically when you use the Service.
•
From payment providers, app stores, email providers, analytics providers, hosting providers and security tools.
•
From cookies, device storage or similar technologies where applicable.
6. Why we use personal data
•
To create and manage accounts.
•
To provide trainer and client features.
•
To create and manage workout plans.
•
To log workouts and progress.
•
To enable trainer-client communication.
•
To manage subscriptions and billing.
•
To send account, security, support and transactional emails.
•
To process invitations and password resets.
•
To provide customer support.
•
To improve, debug and secure the Service.
•
To prevent fraud, abuse, unauthorised access and misuse.
•
To comply with legal, tax, accounting, app store and regulatory obligations.
•
To enforce our Terms of Service.
7. Lawful bases for processing
Contract
We process personal data where necessary to provide the Service, manage accounts, deliver features, process subscriptions, provide support and perform our Terms of Service.
Legitimate interests
We process personal data for legitimate business interests, including securing the Service, preventing fraud and misuse, improving performance and reliability, debugging errors, understanding how users use the Service, communicating with users about service-related matters, and managing business records. We consider and balance these interests against user rights and freedoms.
Consent
We rely on consent where required, such as for certain optional communications, cookies, or where sensitive health-related information is provided and consent is required.
Legal obligation
We process personal data where necessary to comply with legal, tax, accounting, consumer, regulatory or law enforcement obligations.
Vital interests
In rare cases, we may process personal data to protect someone’s vital interests, for example in an emergency.
8. Sensitive personal data
CoachBrag is a fitness and training platform. Some information entered into the Service may relate to health, injuries, physical ability, fitness progress or wellbeing.
We do not require users to enter medical information. Trainers and users should avoid entering unnecessary medical or sensitive information.
Where sensitive information is entered, the trainer or user responsible for entering it must ensure that they have a valid legal basis and any required explicit consent.
We process this information only as necessary to provide the Service, secure the Service, comply with law or as otherwise described in this Privacy Policy.
9. How we share personal data
We do not sell personal data.
CoachBrag uses service providers for specific operations. Profile images may be processed and stored through Cloudinary. Transactional emails may be sent through Brevo. Push notifications use Expo’s notification delivery infrastructure. RevenueCat and the Apple App Store or Google Play may process subscription and entitlement information for mobile billing. Sentry may receive sanitized error and performance information for monitoring and debugging; CoachBrag does not intentionally send passwords, access tokens, message content or full profile data to Sentry.
•
Hosting and cloud infrastructure providers.
•
Email and notification providers.
•
Payment processors and app stores.
•
Analytics and monitoring providers.
•
Security and fraud prevention services.
•
Professional advisers, such as lawyers or accountants.
•
Regulators, law enforcement, courts or authorities where required by law.
•
Business buyers or successors if we sell, merge, restructure or transfer part of our business.
10. Trainer-client visibility
If you are a client, your assigned trainer may see information related to your training relationship, such as your profile information, workout plans, progress, logged workouts, achievements and messages.
If you are a trainer, your clients may see information you choose to share with them, such as your name, profile image, messages and workout plans.
11. International transfers
We may use service providers located outside the United Kingdom or European Economic Area.
Where required, we use appropriate safeguards, such as adequacy decisions, standard contractual clauses, UK international data transfer agreements, or other lawful transfer mechanisms.
12. Data retention
We keep personal data only for as long as necessary for the purposes described in this Privacy Policy.
Retention periods depend on the type of data, the reason it was collected, legal obligations, user settings, account status and operational requirements.
•
Account data is kept while your account is active.
•
Billing and transaction records may be kept for legal, tax and accounting purposes.
•
Logs are kept for security, debugging and operational purposes for a limited period.
•
Messages and workout data may be kept while the account or trainer-client relationship exists.
•
Deleted or deactivated account data may be retained where needed for legal, security, backup, dispute or fraud prevention reasons.
13. Your privacy rights
Depending on where you live, you may have rights to access your personal data, correct inaccurate data, delete personal data, restrict processing, object to processing, receive a portable copy of your data, withdraw consent where processing is based on consent, and complain to a data protection authority.
You can request account deletion or a data export from your profile settings while logged in, or contact privacy@coachbrag.com. We may need to verify your identity before responding. Some rights may be limited where we need to retain data for legal, security, contractual or legitimate business reasons.
Account deletion requests are reviewed before processing so trainer-client relationships, workout records, messages, billing history, audit records and legal retention obligations are handled safely.
14. UK data protection authority
If you are in the United Kingdom and are unhappy with how we handle your personal data, you may complain to the UK Information Commissioner’s Office. We encourage you to contact us first so we can try to resolve the issue.
15. Cookies and similar technologies
We may use cookies, local storage, device storage or similar technologies to keep you logged in, remember preferences, secure sessions, measure usage, improve the Service and detect fraud or abuse.
Where required by law, we will ask for consent before using non-essential cookies.
16. Security
We use reasonable technical and organisational measures to protect personal data, including authentication, access controls, encryption in transit, secure cookies, role-based access controls, logging, monitoring and restricted access to production systems.
No system is completely secure. You are responsible for keeping your password and devices secure.
17. Children
CoachBrag is not intended for direct use by children under 13.
Trainer accounts must be created by adults. If a client is under 18, the trainer or responsible adult must ensure that the required consent and legal basis exists.
If you believe a child has provided personal data without proper consent, contact privacy@coachbrag.com.
18. Marketing
We may send service emails, account emails, billing emails, security emails and support emails.
We will only send marketing communications where permitted by law. You can opt out of marketing emails at any time. You may still receive essential service, billing and security messages.
19. Automated decision-making
We do not currently use personal data for automated decisions that produce legal or similarly significant effects.
20. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. If changes are material, we will take reasonable steps to notify you. The updated version will apply from the date shown at the top of this page.