Privacy Policy

Account: name, email, password (stored only as a bcrypt hash — we cannot read it).

Coaches: handle, bio, photo, social links, and a Stripe account identifier. We never see or store your bank details.

Intake answers: when you use a coach's start link, the goal, experience level and equipment you select — plus your email if you choose to give it. This is shared with that coach so they can help you.

Purchases: what you bought, when, and the amount. Card numbers go directly to Stripe and never touch our servers.

Messages and progress photos: what you send to your coach, including any images you attach.

Progress photos are the most sensitive thing on this platform, and we treat them accordingly:

• stored in a private bucket that is never publicly readable
• served only through links that expire after five minutes, generated fresh each time
• accessible only to the two people in that conversation — the key alone is useless without an authenticated request
• deleted when you delete your account

Your coach must not share or reuse your photos without your explicit written permission. If a coach does, report it and we will act on the account.

To run your account, deliver what you bought, process payments, show coaches their own sales, and answer support requests. We do not sell your data, and we do not share it with advertisers.

Stripe — payments, payouts and identity verification for coaches.

Your coach — your name, email, intake answers, and what you purchased from them. Coaches never see your payment details, your address, or your activity with other coaches.

Infrastructure — hosting, database and file storage providers who process data on our behalf under contract.

We use local storage to keep you signed in. We do not use advertising cookies or third-party trackers.

If you arrive through a coach's link we record which link it was, so the coach can see which of their posts worked. That is a source label, not a profile of you.

You can, at any time:

• see and correct your data in Settings
• ask for a copy of everything we hold about you
• ask us to delete your account and personal data
• cancel a subscription without giving a reason

Deletion caveat: we keep transaction records where the law requires it, and coaches retain their own record of the sale. We remove your personal details from it.

Depending on where you live, you may have additional rights under GDPR or the CCPA. We honour those requests regardless of location.

Account data for as long as your account exists. Transaction records for seven years, as tax law requires. Messages and photos until you delete your account. Abandoned intake answers for 24 months.

Encrypted in transit and at rest. Passwords are bcrypt-hashed. Paid content and progress photos live in private storage reachable only through short-lived signed links after an ownership check.

No system is perfectly secure. If a breach affects your data we will tell you promptly and explain what happened.

365Coachly is not for anyone under 18. We do not knowingly collect data from children; if we learn we have, we delete it.

Material changes will be emailed to you at least 14 days in advance. For any privacy request, use the support page — we respond within 30 days.