Privacy Policy

This Privacy Policy explains how TrainerX ("TrainerX", "we", "us", or "our") collects, uses, shares, and protects information in connection with our coaching workflow platform, websites, and related services (the "Service"). TrainerX is a business tool for fitness coaches and agencies. By using the Service, you agree to the practices described here.

Information we collect

We collect the following categories of information:

• Coach account data. Name, email address, authentication identifiers, billing details, and account preferences for the coaches and agency staff who use the Service.
• Athlete health & biometric data. When an athlete connects a wearable or health source (for example WHOOP or Apple Health), we ingest the metrics they authorize, such as recovery, heart-rate variability, resting heart rate, sleep, strain, workouts, respiratory rate, and body measurements. This is sensitive personal data and is processed only on the basis of the athlete's explicit consent.
• Coaching content. Notes, tags, and decisions coaches record about their athletes within the Service.
• Usage & device data. Log data, IP address, device and browser information, and analytics about how the Service is used, to operate, secure, and improve it.

How we collect it

We collect information directly from coaches when they create and use an account; from athletes when they grant access to a connected provider through that provider's authorization (OAuth) flow, including data delivered to us via provider webhooks; and automatically through logs and analytics as you use the Service.

How we use information

We use information to:

• provide, operate, and maintain the Service;
• compute attention insights, scores, and narratives that help coaches prioritize their roster;
• send the alerts and digests a coach configures;
• enable the data connections a coach or athlete chooses (for example WHOOP or Apple Health);
• provide support, secure the Service, prevent abuse, and comply with legal obligations.

Legal bases for processing

Where data-protection laws such as the GDPR apply, we process personal data to perform our contract with you, on the basis of our legitimate interests in operating and improving the Service, to comply with legal obligations, and, for athlete health and biometric data (which is special-category data), on the basis of the athlete's explicit consent, which can be withdrawn at any time.

How we share information

We do not sell personal data. We share information only as needed to run the Service:

• Service providers / subprocessors who host and support the Service, including Google Firebase and Google Cloud Platform (hosting, authentication, database), WHOOP (wearable data), PostHog (product usage analytics), and messaging providers used to deliver alerts.
• Within the coaching relationship: an athlete's daily summaries and logged workouts are shared with their coach as part of the Service.
• Legal & safety disclosures where required by law or to protect rights, safety, and the integrity of the Service.
• Business transfers, if TrainerX is involved in a merger, acquisition, or sale of assets, subject to this Policy.

Data retention

Disconnecting a provider stops TrainerX from collecting new data from that provider, but does not delete data already shared. Leaving a coach revokes access and removes the athlete from active coaching surfaces. Previously shared data remains in a restorable coach archive. Permanent deletion removes the athlete account, coaching relationships, provider credentials, and athlete-identifiable history. Active athlete account data, provider credentials, coaching relationships, and athlete-identifiable history are removed after verified deletion. Firestore recovery versions may remain for up to 7 days. Operational application and service logs may remain for up to 30 days. Required Google Cloud audit logs may remain for up to 400 days. Identifying deletion-request records are deleted or stripped of identifiers within 30 days after verified completion. A non-identifying deletion completion receipt may remain. These restricted records do not keep an active account, provider connection, or restorable coaching relationship.

Security

We protect data with encryption in transit and at rest, scoped access controls, and a backend that owns all writes to protected records. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your rights & choices

Depending on your location, you may have the right to access, correct, delete, export, or restrict the processing of your personal data, and to withdraw consent. Athletes can disconnect a provider at any time to stop future collection without leaving their coach. Disconnecting a provider or leaving a coach does not permanently delete an account. During the managed beta, email us from your account address to request permanent deletion. Our initial-response target is within two business days. This target covers our first reply, not completion of the verified deletion process. Completion follows our deletion process and applicable legal timelines. To exercise these rights, email privacy@trainerx.io; we will respond within the timeframe required by applicable law.

International transfers

We may process and store information in the United States and other countries. Where required, we use appropriate safeguards for cross-border transfers of personal data.

Children's privacy

The Service is intended for coaches and their adult clients and is not directed to children under 16. We do not knowingly collect data from children; if you believe a child has provided data, contact us and we will delete it.

Third-party services

Connected providers and integrations (for example WHOOP and Apple Health) handle data under their own privacy policies. We encourage you to review the policies of any service you connect.

Changes to this Policy

We may update this Policy from time to time. Material changes will be posted here with a new "Last updated" date.

Contact us

Questions about privacy or your data? Email privacy@trainerx.io.