Privacy Policy

Last updated: 11 November 2026

1. Who we are and who is responsible

CoachOwl ("we", "us") runs the website at coachowl.fit and the app at app.coachowl.fit (the "Service"). Contact: contact@coachowl.fit. By creating an account or using the Service, you agree to our Terms of Service and this Privacy Policy; at sign-up you tick one box: "I agree to the Terms of Service and Privacy Policy." If you don't agree, you must not use the Service. The Terms' law and disputes section (section 26) also applies to this policy.

We are the controller for coach accounts and coach data, every user's account details (sign-in, agreement records, security and error records, support requests), the website, product analytics and subscription records.
We are a processor for coaches for their clients' coaching data: plans, logs, height and weight, steps, progress photos, check-ins, form answers, Train Live videos, messages, files, scheduled calls and the coach's notes. We only process it on the coach's behalf, under section 7 of the Terms of Service, and aren't responsible for how a coach uses it.
Coaches are the controllers of their clients' coaching data and are solely responsible for how they collect, use and share it, including their own privacy notice, the consents and lawful basis they need, answering their clients' requests and any breach they cause.
Clients: your coach decides how your coaching data is used. Ask them for their privacy notice, and direct every request, complaint or claim about your coaching and your coaching data to them. If you contact us instead, we may pass your request on to your coach.

2. What we collect

Some data, such as your email and, for clients, your date of birth, is needed to create an account or to be coached; without it we can't provide the Service.

Everyone

Account details: name, email and role. Passwords are stored only as a secure hash by our sign-in provider. With Google sign-in, Google gives us your name, email and profile picture.
Profile: an optional profile photo, unit preferences and theme.
Agreement records: which document and version you accepted, or which permission you gave or withdrew, when, the IP address and browser details at that moment, and your name and email then.
Messages and files you send: text, photos and voice notes.
Support requests and complaints.
Technical data: IP address and browser and device type, processed by our hosting and database providers; your browser's push address if you turn on notifications.
Bot check: at sign-up and sign-in, Cloudflare Turnstile may check your IP address and browser and device signals.
Error reports: what went wrong, the page address (without anything after a "?" or "#") and, if you're signed in, your account ID.
Product analytics in the app: screens opened, taps (with on-screen text removed), actions such as signing up, browser, device and approximate location from your IP, linked to a pseudonymous account ID and role, never your name or email. We don't record sessions.

Coaches

Your handle, bio, public page and published packages.
Your client roster and groups, programs and library content, automations, broadcasts, scheduled calls and meeting links, tasks and notes.
Subscription status: plan, renewal and cancellation dates, and Dodo Payments' reference numbers. Dodo Payments handles your card details; we never see them.

Clients: fitness and body data

We store only what you or your coach enter, or what you choose to sync:

date of birth, to confirm you are 18 or older;
goal, height and weight (BMI is calculated when shown, not stored);
steps, and calories from activity and food, entered or, in a CoachOwl phone app that offers it and only if you turn it on, synced from Apple Health or Health Connect;
workout logs (exercises, sets and reps), nutrition logs and habit logs;
progress photos, check-in answers and form answers;
Train Live videos you send your coach, and their feedback;
posts, comments and reactions on your coach's community wall;
when you joined, were approved, left or were removed by a coach.

We have no fields for body fat, other body measurements, heart rate, sleep, injuries, medical conditions, medication or medical questionnaires. Free text (forms, chat, check-ins, coach notes) holds whatever is written, and you are responsible for what you share there.

Fitness and body data may be considered sensitive, or health data, in some places. We use it only to run the Service for you and your coach, never sell it, never use it for advertising and never use it to train AI models.

Voice input. When you dictate, your device's speech service (such as Google or Apple) processes the audio under its own terms, and only the text reaches us.

From others

Your coach may invite you by email, and adds plans, notes, feedback and entries they log for you (marked as theirs). Google tells us your details if you use Google sign-in. Dodo Payments tells us when a coach's subscription starts, renews, changes or ends.

3. How we use it, and our legal bases

Running your account and the Service, including notifications in the app, by push and by email: our contract with you.
Clients' fitness and body data, processed for your coach (section 1), on your coach's lawful basis and consents; where the law requires consent for this data, the consent you give at sign-up and each time you log it. You can withdraw it by deleting entries or your account.
Confirming clients are 18 or older: legitimate interests and legal obligation.
Coach subscriptions, plan limits and billing reminders: our contract.
Security, bot checks, abuse prevention and fixing errors: legitimate interests.
Product analytics: legitimate interests. You can object (section 9).
Agreement and deletion records: legal obligation, and legitimate interests in defending legal claims.
Support and complaints: contract, legitimate interests and legal obligation.
Complying with the law and enforcing our Terms: legal obligation and legitimate interests.

We don't sell personal data, use it for advertising or give it to others for their own marketing, and we make no automated decisions with legal or similarly significant effects.

Your coach, while you're their client or have asked to join: your profile, goal, logs, height and weight, steps, photos, check-ins, form answers, Train Live videos, community activity and messages. Your coach is responsible for what they do with it (section 1). Access ends when you stop working with them, except as section 6 describes.
Other members of shared spaces (your coach's community wall and group chats) see your posts, name, profile photo and messages there.
Clients, if you're a coach: your name, profile photo and what you send them.
Everyone, for public pages and profile photos (section 5).
Our service providers and the services you choose, listed below.
Authorities, when the law requires it or to protect someone's safety, rights or property.
A buyer or successor if CoachOwl is sold, merged or reorganised; where the law requires, we tell you.

Our service providers (sub-processors)

Each is bound by a data processing agreement. Coaches get advance notice of a new or replaced sub-processor that handles their clients' data, with a right to object (Terms of Service, section 7).

Supabase, Inc.: database, sign-in, file storage and backend. All account and Service data, including files. Company in the United States.
Vercel: hosting the website and app, and relaying app analytics to PostHog. IP addresses, request details and content in transit. United States, global network.
Cloudflare, Inc. (Turnstile): bot check at sign-up and sign-in. IP address and browser and device signals. United States, global network.
Plus Five Five, Inc. (Resend): account emails such as sign-up confirmation and password reset. Email address, name and content. United States.
PostHog: product analytics and error tracking in the app. Pseudonymous ID and role, screens and actions, device, approximate location and errors. United States.
Browser push services (Google, Apple, Mozilla or Microsoft, as your browser uses): push notifications, if you turn them on. Push address and the encrypted notification. United States and other countries.
GoDaddy.com, LLC: our email inbox. What you write to us and your email address. United States.

Our service providers may process data outside your country; where the law requires, we use appropriate safeguards, and you can ask us for a copy of them.

Services you choose to use

These act as independent controllers under their own terms and privacy policies.

Dodo Payments (Dodo Payments Inc., United States, and affiliates) sells coach subscriptions as Merchant of Record: checkout, payment details, taxes, invoices, refunds and chargebacks. It never receives client data.
Google: Google sign-in, if you choose it, and YouTube videos that coaches add.
Your Move B.V. (ymove), Netherlands: our exercise video library. We send ymove only exercise ids, never who is watching. After you tap play, ymove and its video network (Bunny.net) receive your IP address.
Video-call and booking services (such as Zoom or Google Meet), when you follow a coach's link.

5. Public information

Coach pages. A published page at coachowl.fit/trainers/ followed by the coach's handle is visible to anyone: handle, name, photo, bio, the sections the coach builds and published packages with prices, which our public interface returns even where the page doesn't show them. Clients, plans and messages are never public. Handles are listed in our sitemap, so search engines can index pages. An unpublished page is no longer shown, but search engines and archives may keep copies.

Photos. Profile photos (of coaches and clients), group photos and gallery photos are kept in public storage so the app and pages can show them. Anyone with a photo's link can view it, even after a page is unpublished. Only add a profile photo you accept being public.

6. How long we keep data

Account and profile: while your account exists.
Client workout, nutrition and habit logs: deleted automatically after 95 days, counted from the log's date.
Other client records (height, weight, steps, photos, goals, check-ins, form answers, messages): while the account exists, unless deleted sooner.
Train Live videos: a client's video is scheduled for deletion once the coach has opened it and it is 8 hours old, and in any case 24 hours after it was sent. A coach's reply video is scheduled for deletion after 8 hours. Written feedback stays.
Notifications: 90 days. Reminder records: 30 days. Error reports: 90 days (14 days before sign-in).
Agreement records: for the life of the account and 3 years after it is deleted, as evidence.
Deletion record: the account ID and date, with no name or contact details.
A coach's client history: the client's display name and relationship dates, deleted with the coach's account.
Subscription records: deleted with the coach's account. Dodo Payments keeps invoices under its own legal obligations.
Backups: up to 7 days, until they roll off.
Legal requirements: we keep data longer only where the law requires it, and only for that purpose.

Clients can choose Delete my account in the app. It permanently erases your account and data, starts deleting your files, and ends any coaching. Your one-to-one conversation with your coach is deleted for both of you, and so are your community posts, comments, reactions and poll votes. Messages in group chats stay, shown as "Deleted user". The records above remain. It can't be undone.

If you stop working with a coach, they keep your one-to-one messages with them and their notes about you, and they are responsible for what they do with them (section 1).

Coaches: a closed account is deleted after 30 days, unless you sign in again before then (Terms of Service, section 21). Former clients keep their messages with you, shown as "Deleted user".

Files are then removed through our storage provider. We can't delete copies other people have made, such as screenshots.

These times are best-effort targets we may not meet (section 7).

7. Security and reliability

We use appropriate technical and organisational measures to protect your data, including access controls, encryption in transit and at rest, and security testing. We don't claim any security certification. Report vulnerabilities as the Terms of Service, section 14, describes.

Best effort only. The Service is provided on a best-effort basis. Technical failures, outages, delays, data loss and security incidents can happen despite our measures, and fixing them is best effort only. Where the law requires, we update you about a security incident that affects your data. Every time in this policy is a target we may not meet, not a guarantee, apart from time limits the law sets for us and the notice periods listed in the Terms of Service, section 22. To the fullest extent permitted by law, we aren't liable for any loss these events cause to coaches, clients or anyone else; the binding terms are in sections 20, 22 and 23 of the Terms of Service. Nothing in this policy limits liability that the law doesn't allow to be excluded or limited, or your rights under data protection law. If you don't accept this, you must not use the Service.

8. Your rights

You can ask us for access to or a portable copy of your data, to correct it, delete it or restrict how we use it, and you can complain to us or to a data protection authority. You can object to our use of your data based on our legitimate interests, such as analytics. Where we rely on your consent, you can withdraw it at any time, which doesn't affect what we did before; as using CoachOwl depends on your agreement to our Terms and this policy, withdrawing that agreement means closing your account. Depending on where you live, the law may give you other rights over your data; contact us to use them.

How. Edit your profile in the app; clients can also delete their account there. For anything else, email contact@coachowl.fit from your account's address, subject "Privacy request", or "Complaint" for a complaint. We may confirm your identity. We aim to reply within 120 hours, on a best-effort basis (Terms of Service, section 22). We complete requests within the time the law sets. It's free unless a request is clearly unfounded or excessive. Where the law allows us to refuse or limit a request, we may do so and, where the law requires, tell you why. Send requests about coaching data to your coach (section 1).

9. Cookies and similar storage

"Cookies" here includes browser local and session storage. We use no advertising cookies and no cross-site tracking.

Our website sets no cookies and runs no analytics. It remembers your light or dark theme. Coaches' pages load photos from our storage provider, which receives your IP address.

The app uses storage for:

Necessary purposes: keeping you signed in and your account secure, joining a coach and completing sign-up, completing a checkout, and turning on notifications if you choose to.
Preferences: remembering choices such as your theme and what you've already seen.
Analytics: a first-party identifier, provided by our analytics provider (section 4), that helps us understand how the app is used and improve it.

Analytics runs without a separate prompt; you can object to it, or ask us to delete the analytics data linked to your account, by emailing contact@coachowl.fit. The app doesn't respond to Do Not Track or Global Privacy Control signals. Most storage lasts only as long as it's needed; the analytics identifier lasts up to about a year.

Third-party content. A coach's YouTube video shows a preview image from YouTube, which receives your IP address; the video loads only when you tap play, and YouTube may then set cookies. Library videos load nothing until you tap play (section 4). Dodo Payments' checkout and booking links use their own cookies.

Control. You can clear cookies and site data in your browser at any time, but necessary storage is needed for CoachOwl to work.

10. Adults only

CoachOwl is for people aged 18 and over. Clients confirm their date of birth, and anyone under 18 is blocked from coaching. If we learn someone under 18 has an account, we end their coaching and delete the account and its data. Coaches are responsible for checking that their clients are 18 or over (Terms of Service, section 2).

11. Links and other services

The Service links to sites we don't control, such as booking pages, video-call links and Dodo Payments' checkout. Their own privacy policies apply.

12. Changes

We may change this policy at any time. The current version, with its date, is always on this page. Where the law requires, we tell you about a material change before it takes effect or ask for your agreement to it. By continuing to use the Service after a change takes effect, you accept it. If you don't agree, you must stop using the Service and close your account. The binding rules for changes are in the Terms of Service, section 25.

13. Contact

Email contact@coachowl.fit.