Privacy Policy

We do not collect your payment card. When you pay a coach, or pay us on the web, the card details go straight to Stripe and never touch our servers. If you buy a plan in the iPhone app, Apple takes the payment and we receive a record of the purchase through RevenueCat. When you provide personal data to set up payments or payouts with Stripe, Stripe receives that personal data and processes it in accordance with Stripe's Privacy Policy.

• From you, when you sign up, log, upload, write or answer.
• From your coach, gym or company, about you as part of coaching you or running your membership.
• From devices and services you connect (Apple Health, Health Connect, Oura, Fitbit through Google Health, WHOOP, Garmin, Google Calendar), only after you approve it.
• From Apple or Google, if you sign in with them: your name and email.
• From a coach importing records they already held about you, or from a tool your coach connects (Manychat, Typeform, Jotform, Zapier).
• From Stripe and RevenueCat: whether a payment or purchase went through.
• Automatically, from your device and browser, as described under device and technical data.

To run the product: show your coach your progress, calculate your targets, let the two of you talk, and send the emails and notifications the product needs, such as invites, receipts, reminders and a weekly digest from groups you belong to. The digest, an invitation a coach sends you as a prospect and a coach's plan offers by email each carry a one-click unsubscribe (stopping one coach's invitations and offers stops only that coach's), and push notifications can be switched off by kind in settings. We also use data to keep the service secure, stop abuse and fraud, answer you when you ask for help, fix problems, and meet legal and tax obligations. That is the whole list.

We do not sell your data. We do not use it for advertising. We do not use health or fitness data for marketing or share it with data brokers. We do not use your data to train AI models.

Some features use AI, run by Anthropic: estimating a meal from a photo or a description, reading a nutrition label, turning a document, spreadsheet, photo or pasted text into a program, meal plan, recipe or form, building a program or meal plan for a coach, suggesting changes to a program from logged training, writing a coach's outreach messages, drafting a reply in a coach's client thread, summarizing a client's recent week for their coach, and Coach Copilot, which drafts a check-in message for a coach to edit and send. Only what that feature needs is sent. For a summary, a reply draft or a Copilot draft, that can include a client's name, logging totals such as workouts and calories, recent check-in answers and recent messages between the coach and the client. It never includes data from a connected device, body measurements, photos, a coach's private notes, health or intake forms, or payment details. A feature that sends a client's data runs only for a client who said yes to AI using what they log, the same answer that covers an AI assistant their coach connects; for anybody else the coach sees “Not shared with AI” and nothing is sent.

Anthropic does not use this content to train its models. AI features are optional and metered, and the app tells you how many you have left. Nothing an AI writes is sent to anyone until a person chooses to send it. The detail is in AI and Your Data.

A coach can connect an AI assistant, such as Claude (made by Anthropic) or ChatGPT (made by OpenAI), to their own CoachVana account, and approves it on a CoachVana page that shows which assistant is asking.

What the assistant can readis what that coach sees in CoachVana: their clients' names and status, the programs, plans, notes and messages the coach wrote, their calendar, their leads and their business figures. It reads what a client logged or wrote (workouts, typed weigh-ins, food, check-in answers, messages they sent) only if that client has said yes in their own CoachVana app. A client who has not said yes appears by name and status only. Email addresses and phone numbers are left out unless one is needed for what the coach asked.

Photos and clips. For a client who has said yes, the assistant can see their progress photos, check-in photos, posing photos and form-check videos, through links that stop working after ten minutes. If the client changes their answer, the next request is refused.

What it never receives: data from a watch, ring, smart scale or health app (Apple Health, Health Connect, Oura, Fitbit, WHOOP, Garmin), whoever connected it and whatever anybody chose; and passwords. This is enforced by our database on every request the assistant makes, not only by the assistant.

What it can do.It prepares messages, replies, assignments, posts, bookings, deletions and changes to the coach's own plans and prices, and each one happens only after the coach approves it in the assistant. On Claude it can also prepare a plan offer to a client already on the coach's roster; the client decides and pays in CoachVana themselves. It never charges anyone, issues a refund, pays out, or deletes an account.

Files a coach attaches(a program, meal plan, form or client list) are read the way CoachVana's own importers read them. A program, meal plan or form is read by CoachVana's own AI feature, run by Anthropic, even when the assistant is ChatGPT; a client list is read without AI. Nothing is saved until the coach approves it.

Where the data goes.When the coach asks the assistant something, the parts of the coach's CoachVana data it reads to answer are sent to the assistant's provider (Anthropic for Claude, OpenAI for ChatGPT), which processes them under its own terms and privacy policy and the coach's agreement with it. We send data only to answer the coach's request, never to an assistant the coach has not connected.

What we keep is a log of each request the assistant makes (which tool, when, whether it worked and how long it took), never the conversation and never what was asked, for 90 days, and each action the coach was asked to approve, until a day after it expires. Both are deleted with the account.

Your controls. A coach disconnects an assistant at any time under Settings, Connected AI assistants, and it stops at once. A client decides once whether an assistant may read what they log, and can change that at any time in their settings. Until a client says yes, it cannot.

Your coach, by design. That is the point of the product. Where your coach works inside a gym or company, that organization's owners and admins can see you too. Not the gyms you saved as private locations. If you are a gym member, the gym's staff see your membership, your class bookings and your check-ins.

Other people in a group you join see your name, photo, posts and comments, and your level and points on the group board unless you hide them. You appear on a leaderboard only if you opt in.

The publicsees what a coach publishes on their public page, including reviews. A client's before and after photos appear in a coach's gallery only after that client says yes in the app, and come down as soon as they withdraw it.

Service providers, each doing one job: Supabase (hosting, database, file storage and sign-in), Vercel (the website and its analytics), Stripe (payments and coaches' payouts), Apple and RevenueCat (plans bought in the iPhone app), Anthropic (AI features), Resend (email), Expo, Apple and Google (app updates and push notifications), and Apple or Google when you sign in with them. The full list, with what each one receives, is on our subprocessors page. They are contractually required to protect your data to the same standard set out in this policy, and to use it only to provide their service to us. PayPal is not in use today; if it is switched on, it will process payments for coaches who connect it.

AI assistants. If your coach connects an AI assistant, its provider (Anthropic or OpenAI) receives the data the assistant reads to answer the coach, as described above.

Services you choose to connect: Apple Health, Oura, Fitbit (through Google Health), WHOOP, and Google Calendar and Google Meet for a coach. We exchange data with them only because you connected them, and they handle it under their own terms. Exercise demo videos play from YouTube or Vimeo, and some food photos load from Open Food Facts, so those services receive a request from your device when you play or view one.

Tools your coach connects.If your coach connects Zapier, Manychat, Typeform or Jotform, details about you can pass between CoachVana and that service on the coach's instruction, for example your name, email, and the fact that you became a client, sent a check-in or finished a workout. Once there, it is held under the coach's own account with that service.

Our team, when you write to us. Messages sent through Talk to a person are read by the CoachVana team, and each one is also emailed to our founders so it is answered quickly.

We disclose data when the law requires it, such as a valid subpoena or court order, or to protect someone's safety or our legal rights. If CoachVana is ever merged or sold, your data would pass to the new owner under the promises in this policy, and we would tell you first.

Connecting Google Calendar is entirely optional, off unless you turn it on, and available to coaches only. Clients are never asked for it.

We ask Google for two permissions and no others: see and download the calendars you can access, and view and edit events on your calendars. We do not ask for permission to create, share or delete whole calendars, or to read or change who a calendar is shared with.

What we do with it is the whole of it. We read the events in a sixty-day window either side of today so your CoachVana calendar can show when you are already busy, and we write the sessions you book in CoachVana into your Google Calendar so they appear alongside everything else. Move or cancel a session in either place and the change follows to the other. We also write the other dates CoachVana keeps for you, such as client check-ins and lead follow-ups; moving one of those in Google moves it in CoachVana, and deleting one in Google deletes nothing in CoachVana. For a video session, we ask Google to add a Google Meet link to the event, and that link is shown to the people booked into the session.

We store the event title, times, location and description of events inside that window, so they can be drawn on your calendar. We do not read attachments, we do not read calendars outside that window, and we never show a client anything from your Google Calendar apart from the Meet link for a session they are booked into.

This data is never sold, never used for advertising, never used to train any AI model, never sent to an AI assistant you connect, and never shared with anyone. It is not passed to other service providers, and no human at CoachVana reads it.

Disconnecting is one control on the calendar screen. It deletes the access tokens and every mirrored event immediately. Disconnecting inside CoachVana does not revoke the grant on Google's side, which only you can do, at myaccount.google.com/permissions. Both screens say so.

If you connect a Fitbit through Google Health, we ask Google only for read access to your activity, sleep and health measurements, and use it only to show you and your coach your recovery, sleep and activity in CoachVana. The same rules apply to Oura, WHOOP, Garmin, Apple Health and Health Connect: the data is shown to you and your coach, it is never sold, never used for advertising, never used to train any AI model, never sent to an AI feature or an AI assistant, and no human at CoachVana reads it except to fix a problem you report or where the law requires. Disconnecting stops the sync and deletes the tokens.

CoachVana's use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

The use of information received from Google Health API and/or Developer Tools will adhere to the Google Health API Developer and User Data Policy, including the Limited Use requirements.

Some of what we hold is sensitive under US state privacy laws: health data (measurements, photos, nutrition, symptoms, supplements, labs, injuries and anything from a connected device), precise location if you turn on gym check-in, and your account login. We collect it only with your consent or because you chose a feature that needs it, and we use it only to provide that feature, keep the service secure and meet the law. We never use it to infer things about you beyond what the feature needs, and never for advertising.

We ask for your consent to collect health and fitness information separately from the Terms, at sign-up or the next time you open CoachVana, and you can withdraw it in Settings; if you do, logging new health information pauses and the rest of your account keeps working. Before you connect a device we ask whether your coach may see what it syncs, and your coach sees nothing from it until you say yes. We keep a record of each of these answers, which is in your data export.

Health data is covered in more detail by our Consumer Health Data Privacy Policy, which also explains the rights Washington, Nevada and Connecticut residents have.

CoachVana is a coaching and fitness tool, not a health care provider. It is not a HIPAA covered entity or business associate, so HIPAA does not apply to the data in it. It is not built for providers who bill insurance, and should not be used to store protected health information on a provider's behalf. The protections in this policy and in the state health-data laws above apply instead.

You can delete your account in the app (Profile, then Delete account) or at coachvana.com/account. It is immediate and cannot be undone.

That erases everything you logged: your workouts, sets and personal records, form-check videos, the check-ins, assessments and form answers you sent a coach, weigh-ins, progress, check-in and meal photos (the files as well as the records), food, meal and water logs, habits, symptom, supplement and lab records, data from connected devices and the connections themselves, programs you made or bought for yourself, saved places, notifications and device tokens. Messages, posts and comments you wrote are emptied of their words and files. Your sign-in is destroyed so the account can never be used again, and what is left of your profile reads “Deleted user”, with no name, email or photo. Any AI assistant you connected is disconnected.

Any plan you pay for, or that clients pay you for through CoachVana, is canceled right away with no refund. A plan bought through the App Store is the exception: Apple bills it, so turn it off in your iPhone's settings.

Some records are kept, with your name removed from them. Payment records, because we are legally required to retain financial records (Stripe holds its own copies regardless). If you were a coach, the record of what your organization paid its coaches. If you were coached, documents you signed (keeping the record is what a signature is for) and what your coach wrote themselves, such as their notes and the programs they built. A review you wrote stays on your coach's page as “A former client”. And any support conversation you had with us. None of these is linked to your name, email or photo once you delete. The connections you made to other services (Google Calendar, a wearable, Manychat, Typeform or Jotform, Zapier) are deleted from CoachVana; remove CoachVana's access in that service's own settings too.

You can disconnect a health provider at any time in Connected apps, which stops the sync and deletes the tokens. Anything we wrote to Apple Health stays there until you remove it in the Health app. For each option in detail, see delete your data.

If someone bothers you, you can block them from the menu on their post or message. You stop seeing each other immediately, and you can undo it in Profile, then Blocked people. You can also report content for us or the group's coach to review. Reports are private: the person you report is not told who reported them. Our Acceptable Use & Community Guidelines say what happens next.

Wherever you live in the US, you can ask us to: tell you what personal information we hold about you, where it came from, why, and who it has been shared with; give you a copy of it in a portable format; correct it if it's wrong; or delete it. You can also withdraw a consent you gave. Some of this you can do yourself at coachvana.com/account or in the app: download a copy of your data, remove part of it and keep your account, or delete your account, which takes effect immediately. These rights apply to you even if you never made an account, for example if you filled in a form on a coach's page.

The state laws that give these rights include those of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and Washington. We offer the same rights to everyone in the US, whether or not a law requires it.

We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it for targeted advertising or profiling. We have not done so in the past 12 months. There is no opt-out to offer you because we don't do any of it, and we honor a Global Privacy Control signal from your browser as a request not to sell or share and to turn off optional analytics. We also don't use your data for automated decisions that produce legal or similarly significant effects about you, and we use sensitive information only for the purposes the law allows without a right to limit it, which is why there is no “limit the use” link. We do not share personal information with third parties for their own direct marketing.

To make a request, email support@coachvana.comfrom the address on your account, or write to us at the address below. We'll verify it's really you before acting, usually by confirming you control the account's email, respond within 45 days (we may extend once by 45 more days, and will tell you why), and never treat you differently for asking. An authorized agent can make a request on your behalf with your signed permission, and we may ask you to confirm it. If we decline a request, you can appeal by replying to our answer; we'll respond to an appeal within 45 days, and if you still disagree you can contact your state's attorney general.

If your coach, gym or company holds your data and you ask us about it, we may pass your request to them, since they decide how it is used, and help them answer it.

In the past 12 months we collected these categories of personal information, from the sources listed above, for the purposes listed above: identifiers (name, email, account ID, IP address); customer records (contact and payment status); characteristics such as sex, if you or your coach enter it; commercial information (plans and purchases); internet activity on our own service; precise geolocation (only with gym check-in); audio and visual information (photos, videos and voice notes); professional information (a coach's credentials and business); inferences we draw only to run your coaching, such as targets; and sensitive personal information (health data, precise location and account login). We disclosed each category for a business purpose to the service providers on our subprocessors page, to your coach, gym or company, and to services you or your coach chose to connect. We sold or shared none of it. How long we keep each category is in “How long we keep things”, below.

Data is encrypted in transit (TLS) and at rest. Access is enforced at the database level by row-level security, so the rules about who can see what are applied by the database itself rather than trusted to app code; a client's data is unreadable to another coach even if a bug in the app asked for it. Progress photos, videos and documents live in private storage reachable only through short-lived signed links.

Card details never touch our servers; Stripe, or Apple for a purchase in the iPhone app, handles them directly. Access to production data is limited to the people who need it. No system is perfectly secure. If a breach of security affects your data, including any disclosure of your health data that you did not authorize, we'll notify you without unreasonable delay and within the deadlines the law sets (for example, 30 days under Florida law and 60 days under the Federal Trade Commission's Health Breach Notification Rule), and notify the regulators, and where required the media, that we're required to notify.

The app uses cookies and local storage only for things it can't work without: keeping you signed in, remembering your preferences, and holding a draft you haven't submitted. There are no advertising cookies and no third-party ad pixels anywhere. The phone app keeps the same kind of things on your phone.

The website measures traffic in aggregate with Vercel Web Analytics, and only after you choose “Allow analytics” in the cookie notice, and never while your browser sends a Global Privacy Control signal. It records which pages are visited, from which country and on what kind of device; it sets no cookies, stores no IP address and does not identify you. Choosing “Essential only” turns it off, and “Cookie preferences” in the footer changes the answer at any time. The detail is in our Cookie Policy.

A coach’s public pages (their page, DM link, free tools, lead magnets and website embed) also count visits for that coach on CoachVana itself: the page, the site that sent the visitor (its name only, never the address it came from) and any campaign tags in the link. No cookie is set, no IP address or device identifier is stored, and nothing identifies the visitor. The count is shown only to the coach or business that owns the page.

CoachVana is offered to residents of the United States and our data is processed and stored there, by us and by our service providers. We don't currently direct the service to people in the EU, the UK or elsewhere. If you use it from outside the United States, your data is transferred to and processed in the United States, where privacy law may differ from yours.

You must be 18 or older to use CoachVana, and every sign-up asks you to confirm it. It is not for children, and we do not knowingly collect data from anyone under 18. If you believe a minor has created an account, or a coach has added one, email support@coachvana.comand we'll delete it.

When this policy changes, we post the new version here with a new date. If a change materially affects how we use your data, we tell you in the app or by email before it takes effect, and where the law requires your consent, we ask for it.

Questions, a request about your data, or a complaint? Email support@coachvana.com, or write to us: