Privacy Policy

1. Who controls your data

CoachOS is the controller of the information described in this notice. For privacy questions or requests, email support@coachos.dev.

Providing profile, chat, and media information is your choice, but some information is required to create an account, build a plan, save training, or provide a feature you request.

2. Information we collect

• Account — name, email address, and basic authentication information received through Google and Supabase Auth.
• Fitness and safety profile — age, height, weight, goals, experience, equipment, preferences, and injuries or limitations you provide.
• Training and coaching — generated or imported plans, workouts, sets, repetitions, loads, check-ins, challenges, chat messages, and the coach’s factual memory.
• Optional media and support — an image or a video frame you choose for form analysis, plus feedback text or a screenshot you choose to submit.
• Notifications and device — the push endpoint and preferences needed to deliver reminders you choose to receive.
• Billing — Lemon Squeezy processes the full payment method. We retain provider customer/subscription linkage, status, plan, billing or end dates, card brand, and last four digits.
• Usage and analytics — screen or path without the query string, language, viewport, browser/PWA mode, performance, attribution, and feature events. Events may use a random identifier and, after sign-in, the account identifier.
• Security — hosting providers may process an IP address and technical logs. CoachOS rate limits use a derived HMAC value and do not keep the raw IP address in the limiter store.

3. Why we use it

We process information as needed to perform our agreement with you, comply with law, protect the service and its users, and with consent where applicable law or an optional feature requires it.

• To provide the service you request: create and adapt plans, run workouts, retain progress, and answer in Coach.
• To protect safety, account security, abuse prevention, data integrity, and support.
• To manage subscriptions, billing, cancellation, refunds, and legally required records.
• To measure activation, usage, performance, and failures and improve the product without intentionally sending chat text, workout notes, medical text, tokens, or payment details to analytics.

4. Artificial intelligence

To generate a plan, adaptation, or Coach response, we may send an AI provider only the relevant prompt and context — for example goals, equipment, workout history, limitations, or media you attached for analysis.

AI output can be wrong and is not a diagnosis or medical advice. Account and subscription access decisions are not made from a model response.

5. Service providers that receive information

We do not sell personal information. Providers process data only to supply their service to us and under their own terms.

• Supabase — database, storage, and authentication. Privacy policy
• Vercel — hosting, traffic, and operational logs. Privacy policy
• Anthropic — Claude plan and Coach generation when selected. Privacy policy
• Google — sign-in and Gemini/Vertex capabilities when configured. Privacy policy
• PostHog — limited product analytics; autocapture and session recording are disabled. Privacy policy
• Lemon Squeezy — merchant of record and payment processing. Privacy policy
• Browser or operating-system push services — notification delivery only after you enable it.

6. Retention and deletion

Account and training information is retained while the account is active and as needed to operate the service. Media, chat, and feedback are retained while needed for the purpose for which they were submitted or until a valid deletion request. Billing, security, and backup records may remain longer when required by law or to protect legal rights.

To request account deletion, email us from the address linked to the account. After verification, we aim to remove personal information from active systems within 30 days, subject to required records and backup cycles.

7. Your choices and rights

• Request access, a copy or export, and correction of inaccurate information.
• Request deletion, restriction, or objection where applicable law provides that right.
• Update profile information in the app and remove media before sending it.
• Disable notifications in CoachOS, browser, or device settings.
• Email support@coachos.dev. We may request reasonable identity verification before disclosing or deleting data.

8. International transfers and security

Our providers may process information outside the country where you live. Where required, transfers rely on the provider’s appropriate legal safeguards.

We use HTTPS, environment separation, least-privilege access, Row Level Security, short-lived media links, and other controls. No system is perfectly secure, so protect your Google account and device.

9. Minimum age

CoachOS is for adults aged 18 and over. We do not knowingly collect information from children. If you believe a minor provided information, contact us so we can investigate and remove it.

10. Changes and contact

We may update this notice as the product, providers, or law changes. The date above will change, and we will provide an appropriate notice for a material change.

Privacy questions and requests: support@coachos.dev.