Privacy Policy

We do not collect your payment card. When you pay a coach, the card details go straight to Stripe and never touch our servers.

To run the product: show your coach your progress, calculate your targets, and let the two of you talk. That is the whole list.

We do not sell your data. We do not use it for advertising. We do not use health or fitness data for marketing or share it with data brokers.

If you use an AI feature (scanning a meal photo, or a coach generating a weekly read), the relevant content is sent to Anthropic to produce that result. It is not used to train their models. AI features are optional and metered, and the app tells you how many you have left.

Your coach, by design. That is the point of the product. Not the gyms you saved as private locations.

Service providers, each doing one job: Supabase (hosting and database), Stripe and PayPal (payments), Anthropic (AI features you choose to use), Expo and Apple/Google (push notifications), and WHOOP or Garmin if you connect them. They are contractually required to protect your data to the same standard set out in this policy, and to use it only to provide their service to us.

You can delete your account in the app: Profile → Delete account. It is immediate and cannot be undone.

That erases your workouts, weigh-ins, progress photos, food logs, messages, device tokens and connected health accounts, and your sign-in is destroyed so the account can never be used again.

Two things are kept, with your name removed from them. Payment records, because we are legally required to retain financial records (Stripe holds its own copies regardless). And, if you were a coach, the record of what your organisation paid its coaches. That is a record about other people, not about you. Neither is linked to your name, email or photo once you delete.

You can disconnect a health provider at any time in Connected apps, which stops the sync and deletes the tokens.

If someone bothers you, you can block them from the ⋯ menu on their post. You stop seeing each other immediately, and you can undo it in Profile → Blocked people. You can also report content for us to review. Reports are private: the person you report is not told who reported them.

Wherever you live in the US, you can ask us to: tell you what personal information we hold about you and who it has been shared with; give you a copy of it; correct it if it's wrong; or delete it. Account deletion is available to you directly, in the app or on the web, and takes effect immediately.

We do not sell your personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising. There is no opt-out to offer you because we don't do any of it. We also don't use your data for automated decisions that produce legal or similarly significant effects about you.

Health data — measurements, photos, nutrition, symptoms, supplements, labs and anything synced from a wearable — is treated as sensitive and is covered in more detail by our Consumer Health Data Privacy Policy, which also explains the additional rights Washington residents have.

To make a request, email privacy@coachvana.com. We'll verify it's really you before acting, respond within 45 days, and never treat you differently for asking. An authorised agent can make a request on your behalf with written permission.

While your account is open, we keep your data so the product works — your history is the product. When you delete your account, your personal data is deleted immediately and permanently, apart from anonymised payment records we're required to retain for tax and accounting purposes.

If an account sits unused for 24 months we'll email you first, then delete it and its data if there's still no activity 30 days later. Backups roll off on their own schedule and are fully replaced within 90 days. Support emails are kept for 24 months.

Data is encrypted in transit (TLS) and at rest. Access is enforced at the database level by row-level security, so the rules about who can see what are applied by the database itself rather than trusted to app code — a client's data is unreadable to another coach even if a bug in the app asked for it. Progress photos and documents live in private storage reachable only through short-lived signed links.

Card details never touch our servers; Stripe and PayPal handle them directly. Access to production data is limited to the people who need it. No system is perfectly secure, but if a breach ever affects your data we'll notify you, and the regulators we're required to notify, without undue delay.

The app uses cookies and local storage only for things it can't work without: keeping you signed in, remembering your preferences, and holding a draft you haven't submitted. There are no advertising cookies and no third-party ad pixels on the app.

If we add analytics to the marketing site, it will be limited to aggregate traffic measurement, and this section will say so specifically before it goes live.

CoachVana is offered to residents of the United States and our data is processed there. We don't currently direct the service to users in the EU, UK or elsewhere.

You must be 18 or older to use CoachVana. It is not for children, and we do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email privacy@coachvana.com and we'll remove it.

Questions, or want a copy of your data? Email privacy@coachvana.com.