Privacy policy

Who is responsible

Coach Phialo, Sample area, Aruba. Sophia is the coach and the person responsible for your data.

Questions or requests about your data: sample@fixtures.test.

What we collect and why

• Account and contact. Name, email, phone, language and time zone, so you can sign in with an emailed code (no password) and Sophia can reach you. Basis: the coaching agreement.
• Health and training. Your health and goal answers, body measurements, progress photos, workouts, food logs, habits, check-ins and messages, so Sophia can plan and adjust your training safely. This is health data. Basis: your explicit consent, which you give in the app and can withdraw at any time under Privacy and my data. Progress photos are optional, and Sophia sees them only if you switch that on. Location data is removed from photos when they are uploaded.
• Payments. The amount, date and plan Sophia records when you pay her directly. We never see your card or bank details. Basis: the agreement and bookkeeping law.
• Website enquiries. The name, email, phone and message you send through the form on the home page. We use them only to answer you.
• Reminders. If you turn on notifications, your device’s push address. Otherwise reminder emails, which you can switch off in your profile.
• Security records. Sign-in sessions, devices and an activity log, kept to protect your account.

Who processes it for us

• Supabase: database, sign-in and files. Servers in the United States (Oregon).
• Cloudflare: hosting and server functions. United States and worldwide.
• Resend: sign-in codes, invitations and reminder emails. United States.
• Apple, Google or Mozilla: they deliver push notifications to your device. They see your device address, not your training.
• Unsplash: example photos on the public pages load from their servers, which see your IP address.
• Open Food Facts: a barcode lookup sends the barcode only, not who you are.
• YouTube or Vimeo: if Sophia adds a video from one of them, it loads from that service when you play it.

We use these services only to run the app. We do not sell data and we do not use advertising or analytics trackers.

Transfers outside Aruba and the EU

The services above keep data in the United States. Where the law asks for a safeguard for that transfer, we rely on the standard contractual clauses in the providers’ data processing terms.

How long we keep it

• Website enquiries: 12 months, then they are deleted.
• Clients: while you are a client and for 24 months after your access ends, so you can come back. After that we open a deletion request for Sophia to confirm. Nothing is deleted automatically.
• Payment records: as long as bookkeeping law requires.
• The record of what you agreed to and when: kept after deletion, without your health details.

You can ask us to delete your account at any time.

Your rights

You can see, download, correct or delete your data, withdraw your consent, object to how it is used, or take it elsewhere. In the app, Privacy and my data gives you a download and a deletion request straight away. You can also write to us: sample@fixtures.test. We answer within one month.

If you live in the EU you may complain to your national data-protection authority.

Cookies and storage on your device

We set no cookies. The app keeps these on your own device so it works: your sign-in, your colour theme, small preferences you chose (such as hiding a tip or a timer sound), a workout in progress, and offline copies of your workouts. Nothing is used for tracking.

Children

The service is for people aged 18 or over.

Changes

When this policy changes, the date and version above change with it. We will show you the new version in the app and ask you to accept it again if the changes affect you.