Privacy Policy
1. Data Controller
The controller of your personal data is the operator of the MyCoach service ("we", "us"). For all privacy matters contact: support@mycoach.fitness.
Given the nature and scale of our data processing, we are not required to appoint a Data Protection Officer (DPO) under GDPR Art. 37. However, you may direct all data protection inquiries to the email address above.
2. Data We Collect
2.1 Account Data
- Email address, display name, optional profile photo
- Account type (coach or athlete)
- Password stored as a cryptographic hash — never in plain text
2.2 Fitness and Health Data
Workout metrics such as distance, duration, pace, heart rate, cadence, elevation, lap splits, and body measurements may constitute special category (health) data under GDPR Art. 9. We process this data exclusively on the basis of your explicit consent (Art. 9(2)(a)) granted when you create an account and log activities. You may withdraw consent and delete all health data at any time from within the app.
- Workout sessions: type, date, distance, duration, pace/speed, heart rate, cadence, elevation
- Training plan data and progress tracking
- Body measurements (weight, height, and other metrics you choose to enter)
- AI coaching suggestions derived from your activity history
2.3 Communication Data
- Coach–athlete real-time chat messages
- Push notification tokens (Firebase device tokens for delivering reminders and messages)
2.4 Device and Technical Data
- Device type, operating system, app version
- IP address, time zone
- App interaction logs for error diagnostics and performance monitoring
- Language preference stored in device local storage
2.5 Third-Party Integration Data
If you connect Strava or Polar, we import activity data (GPS tracks, heart rate, performance metrics) via their official APIs, exclusively based on your explicit OAuth authorisation. We do not access data beyond the scope you authorise.
2.6 Payment Data
We do not store or process payment card details. All billing is handled by Paddle.com Market Ltd as Merchant of Record under Paddle's own privacy policy at paddle.com/legal/privacy.
3. Legal Basis for Processing
| Processing activity | Legal basis (GDPR Art. 6) |
|---|---|
| Providing the app, managing your account, delivering the purchased subscription | Art. 6(1)(b) — performance of contract |
| Processing fitness and health data | Art. 9(2)(a) — explicit consent; Art. 6(1)(b) — contract |
| Push notifications | Art. 6(1)(a) — consent |
| Security and fraud prevention | Art. 6(1)(f) — legitimate interest |
| Legal obligations (tax records via Paddle) | Art. 6(1)(c) — legal obligation |
| Product analytics and improvement | Art. 6(1)(f) — legitimate interest |
4. How We Use Your Data
- To create and maintain your account
- To operate the coaching platform (calendar, workout tracking, analytics, chat)
- To generate AI coaching insights from your training history
- To sync activities from Strava and Polar
- To deliver push notifications (reminders, coach/athlete messages)
- To manage your subscription via Paddle
- To diagnose errors and improve app performance
- To respond to support requests
- To comply with applicable legal obligations
We do not sell your personal data. We do not use your data for third-party advertising or marketing profiling.
5. Third-Party Processors
| Processor | Purpose | Location |
|---|---|---|
| Paddle.com Market Ltd | Payment processing, subscription billing, tax compliance | UK / EEA |
| Google Firebase (Alphabet Inc.) | Push notifications, crash analytics, authentication infrastructure | EEA / USA (SCCs) |
| Strava, Inc. | Activity import (only on your explicit OAuth authorisation) | USA (SCCs) |
| Polar Electro Oy | Device data import (only on your explicit OAuth authorisation) | Finland / EEA |
All processors are bound by data processing agreements. Transfers to the USA rely on Standard Contractual Clauses (SCCs) under GDPR Art. 46. Transfers to the UK are covered by the European Commission's adequacy decision for the United Kingdom. We will notify you of any material changes to our sub-processors via email or in-app notification at least 14 days in advance.
6. Data Retention
- Account and fitness data: retained while your account is active. Upon deletion, all personal data is permanently erased within 30 days, unless retention is legally required.
- Chat messages: retained for the duration of the coach–athlete relationship; deleted upon account deletion.
- Technical logs: maximum 12 months for security and diagnostic purposes.
- Billing records: retained by Paddle for the period required by applicable tax law (typically 5–7 years).
7. Your Rights Under GDPR
You may exercise any of the following rights by contacting support@mycoach.fitness. We respond within 30 days (extendable to 90 days for complex requests with prior notice).
- Access (Art. 15): request a copy of all personal data we hold about you.
- Rectification (Art. 16): request correction of inaccurate data.
- Erasure (Art. 17): request deletion of your data. You can also delete your account directly in the app.
- Portability (Art. 20): receive your data in a structured, machine-readable format.
- Restriction (Art. 18): request that we limit processing in certain circumstances.
- Objection (Art. 21): object to processing based on legitimate interest.
- Withdraw consent: where processing is consent-based, you may withdraw at any time without affecting the lawfulness of prior processing.
- Supervisory authority complaint: you have the right to lodge a complaint with the Polish Data Protection Authority (UODO), ul. Stawki 2, 00-193 Warsaw, or with the supervisory authority in your country of residence.
8. Cookies and Local Storage
The MyCoach website uses no tracking or advertising cookies. We use browser localStorage solely for:
- Language preference (EN/PL)
- Session authentication tokens required for app functionality
9. Children
MyCoach is not intended for individuals under 16. We do not knowingly collect data from children. Contact support@mycoach.fitness immediately if you believe a child has provided us with personal data.
10. Security
We apply appropriate technical and organisational measures including TLS/SSL encryption in transit, encrypted storage at rest, industry-standard password hashing, and access controls limiting data access to authorised personnel. In the event of a breach likely to affect your rights and freedoms, we will notify the supervisory authority within 72 hours and inform affected users without undue delay (GDPR Art. 33–34).
11. Artificial Intelligence and Machine Learning
MyCoach uses AI and machine learning to generate personalised training suggestions, performance predictions, and coaching insights. These features process your workout history, fitness metrics, and training patterns to provide recommendations. AI-generated content is provided for informational and motivational purposes only and does not constitute medical or professional advice.
We do not use your personal data to train general-purpose AI models. AI processing is limited to generating recommendations specific to your individual training within the Service.
12. Automated Decision-Making (Art. 22)
MyCoach does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you. AI coaching suggestions are recommendations only and do not restrict your access to the Service or affect your contractual rights. You always retain full control over your training decisions.
13. Geolocation Data
If imported from Strava or Polar, activity data may include GPS tracks and location information. This data is stored within your account and is only visible to you and your connected coach. We do not publish, aggregate, or share geolocation data with third parties. If you work in a sensitive profession or environment, consider using Strava's or Polar's privacy zones before syncing activities.
14. Do Not Track
Some browsers transmit a "Do Not Track" (DNT) signal. There is no industry-wide standard for honouring DNT. Since MyCoach does not use tracking or advertising cookies (see Section 8), this is functionally equivalent to honouring DNT.
15. Marketing Communications
We may send you service-related emails (subscription confirmations, password resets, security alerts). These are transactional and do not require consent. We will only send promotional emails with your explicit opt-in consent. You can unsubscribe from promotional communications at any time via the unsubscribe link in any email or by contacting us.
16. Changes
We will notify you of material changes by email or in-app notification at least 14 days before the changes take effect. Continued use after the effective date constitutes acceptance.