Legal

Privacy Policy

Last updated: [date]

This Privacy Policy explains how [Legal entity name] (“Liftscribe”, “we”, “us”) collects, uses, shares, and protects information when you use the Liftscribe training and nutrition coaching platform (the “Service”), whether you use it directly as a self-coached athlete or as a client of a coach who uses Liftscribe to manage you.

1. Who this applies to

Liftscribe serves two kinds of accounts: independent coaches who manage their own clients, and self-coached athletes who use the AI-assisted tools directly with no human coach involved. Both are covered by this policy. If you are a client of a coach who uses Liftscribe, your coach is generally the one who invited you and directs how your training/nutrition data is used day to day; Liftscribe processes that data on the coach's behalf and, for the platform-level items below (your own account, security, billing where applicable), as a controller in its own right.

2. What we collect

Depending on how you use the Service, we collect:

• Account data — email address, display name, authentication data (handled by our authentication provider, Supabase), and for coaches, business-related settings.
• Profile & fitness data — date of birth, sex, height, weight, training goals, experience level, available equipment, and training schedule preferences, collected through the intake questionnaire.
• Health data (special category data) — diagnosed conditions, medications, injuries or movement limitations, sleep and stress levels, and (where relevant) pregnancy/postpartum status. This is only collected with your explicit, separate consent, tracked as a timestamp on your record, and used solely to personalize training and nutrition guidance and flag anything that should prompt you to see a medical professional before training. You can decline to provide this information; some personalization will simply be more generic as a result.
• Activity data — workout logs, sets/reps/weights, food and meal logs, body-weight and other progress measurements, and progress photos you choose to upload.
• Communications — messages between you and your coach inside the Service, and, if your coach has connected it, messages sent via WhatsApp/Meta's messaging platform.
• Payment data — if you subscribe to a paid feature, payment is handled entirely by Stripe; we receive a subscription/customer reference, not your card details.
• Technical data — standard request metadata (IP address, timestamps, basic device information) generated by using the Service, kept for security and abuse-prevention purposes.

3. How we use it, and our legal basis

We use your data to:

• Provide the Service — display your plans, log your activity, and let you and your coach communicate.
• Generate AI-assisted training plans, nutrition guidance, and check-in responses personalized to your profile and activity history.
• Process payments for paid features, via Stripe.
• Maintain the security and integrity of the Service and prevent abuse.
• Comply with legal obligations where applicable.

For users in the EU/EEA and UK, our legal bases are: performance of a contract (running the Service you asked for), legitimate interests (security, service improvement), explicit consent (health data specifically, and any optional communications), and legal obligation where applicable.

4. AI processing and international data transfers

Training plans, nutrition guidance, and check-in reply drafts are generated using third-party large language model providers. Depending on configuration this may include providers based outside the EU/EEA. Only the data needed to generate the specific plan or reply (e.g. your goals, stats, equipment, recent activity, or the message being drafted) is sent for that purpose — it is not used by us to train any model. Where data is transferred internationally, we rely on the transfer mechanisms available under applicable law (such as the provider's standard contractual clauses); [confirm and name the specific safeguard(s) actually in place with counsel].

5. Who we share data with

• Your coach, if you have one — that is the point of the Service; they see the training, nutrition, and check-in data needed to coach you.
• Service providers who process data on our behalf: Supabase (authentication and database hosting), Stripe (payments), the LLM providers described above, and, only if your coach enables it, Meta/WhatsApp (messaging).
• Your gym, if you join one in the app — the gym's managers can see your name and membership status (to approve or manage members), and any machines or machine photos you submit for that gym are attributed to you for their review. They do not see your training, nutrition, health, or check-in data. You can leave a gym at any time from the app, which removes you from its member list.
• We do not sell your personal data, and we do not use it for third-party advertising.

6. Data retention

We keep your data for as long as your account is active, so the Service can function (your history, progress charts, and coach relationship all depend on it). If you delete your account, we delete your data as described in Section 8 below. [Confirm any specific retention periods required for financial/tax records related to Stripe payments.]

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, to object to or restrict certain processing, and to withdraw consent at any time (this does not affect processing already carried out). This applies whether you are in the EU/EEA/UK (GDPR), California (CCPA/CPRA), or elsewhere with similar protections — we apply the same rights globally rather than by jurisdiction.

• Access & export — download your logged workouts and measurements any time from Account → Your data.
• Rectification — edit your profile and intake answers any time from Account → Your profile.
• Erasure — self-coached accounts can permanently delete their account and all associated data from Account → Delete account. If you have a coach and don't have that option yet, contact us using the details below and we will action the request.
• Contact us (below) for any other request, including if you believe your data is inaccurate or misused.

8. What deleting your account actually does

Deleting your account permanently removes your profile, training plans, workout history, food logs, progress photos, messages, and check-ins from our systems, cancels any active subscription, and deletes your login credentials. This is irreversible. Aggregated or anonymized data that can no longer identify you may be retained for analytics.

9. Children's privacy

The Service is not directed at, and is not intended for use by, anyone under the age of 16 (or the higher age of digital consent in your country, where applicable). We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

10. Cookies and local storage

We do not use advertising or analytics cookies. We use strictly necessary local storage/cookies to keep you signed in and remember your session across visits — nothing that tracks you across other sites.

If you arrive via a referral link from one of our affiliate partners, we set one additional first-party functional cookie (ls_aff) that remembers the referring partner's code for 90 days, so we can credit them if you sign up. It contains only that code — no identifier about you — is never shared with third parties, and does not track you on other sites. Click statistics for referral links are stored only as daily totals, with no IP addresses or device information.

11. Security

We use industry-standard measures (encrypted connections, access controls, hashed credentials) to protect your data, but no system is completely secure. If we become aware of a breach affecting your data, we will notify you and relevant authorities as required by law.

12. Changes to this policy

We may update this policy as the Service changes. We'll update the “Last updated” date above; for material changes we'll make reasonable efforts to notify active users directly.

13. Contact

Questions, requests, or complaints about this policy or your data: [privacy contact email].
[Legal entity name and registered address].