Privacy notice: [PRODUCT NAME] app and coach console

Version: v0.1 DRAFT (16 Oct 2026)

1. Who we are

[PRODUCT NAME] is made by SH Studios Digital Ltd ("SH", "we", "us"). We are a company registered in England and Wales, number [PLACEHOLDER: company number], at [PLACEHOLDER: registered address]. We are registered with the Information Commissioner's Office (ICO), number ZC225207.

Contact us about privacy at [PLACEHOLDER: privacy contact email].

[PRODUCT NAME] is a coaching app. Personal trainers and coaches ("coaches") use the console on the web to write training programmes, run check-ins and take bookings. Their clients use the app on their phone to see their programme, log their training and message their coach.

2. Two roles, in plain words

The law gives two roles: the controller decides why and how personal data is used. The processor handles it for the controller and only on their instructions.

• If you are a coach, we are the controller of your account details and our relationship with you. This notice covers that in full.
• If you are a coach's client, or you sent a coach an enquiry, your coach is the controller. Your coach decides what to collect and why. We are their processor: we host the app and the data and run the software for them. Your coach's own privacy notice explains how they use your data. You can find it on your coach's booking page and in the app under Settings. Section 4 below sums up what the app holds for your coach, so you know what is there.
• Payments you make to your coach go through Stripe, on your coach's own Stripe account. Your coach is the seller. Stripe also acts as a controller for its own legal duties. We do not see or store your card or bank details.

If you are not sure who to ask, write to us at [PLACEHOLDER: privacy contact email]. If your question is for your coach, we will pass it to them and tell you we have done so.

3. Coaches: what we collect and why

We sign you in with a 6-digit code sent to your email. There are no passwords, and we do not offer sign-in with Google, Apple or other social accounts.

4. Clients and enquirers: what the app holds for your coach

We hold this only for your coach and only to run the app for them. Your coach's notice is the one that applies to you.

• Your details: name, email address, mobile number, your goal and how you want to train.
• Your enquiry: what you wrote on your coach's enquiry form, and when. We do not keep your IP address. We keep only a scrambled code made from it (a salted hash) to stop spam.
• Your health check: your answers to your coach's own health questions, your typed name as a signature and the date. This is health data. We hold it only if you tick the separate health consent box. That box is never ticked for you.
• Injuries your coach or you record, so the programme can avoid certain exercises.
• Your training: your programme, the sets, reps, weights, times and effort ratings (RPE) you log, notes and skipped sessions.
• Check-ins: your answers, and if you add them, your body weight, sleep, how closely you followed the plan, and up to 3 photos a week.
• Messages between you and your coach, including photos you attach.
• Bookings: the time and type of your call or session with your coach.
• Your consents: which ones you gave or withdrew, the wording version and when.
• Technical data: a device ID and push token so the app can sync and send notifications, and the app version.

Your coach can see this data. Other coaches cannot. Each coach's data is kept apart in the database by access rules that are tested on every change.

5. Things we do not do

• We do not sell personal data.
• We do not show ads, and there are no advertising tools in the app or the console.
• We do not track you across other apps or websites.
• We do not run analytics tools in the app, the console or the booking pages.
• We do not build profiles of clients or coaches for marketing.
• We do not use one coach's client data for another coach, or for our own marketing.
• We do not send marketing emails to clients. We may email coaches about their account and the app. [DECIDE: if SH ever wants to email coaches marketing, add an unticked opt-in. None is planned.]

6. Google Calendar

Coaches can choose to connect a Google Calendar. We ask Google for two permissions only:

• See your free and busy times (calendar.freebusy). We read only whether a time is free or busy. We cannot see the titles, guests or details of your events.
• Make and manage a calendar that the app creates (calendar.app.created). We create one calendar called "Coaching bookings" and add your bookings to it. We cannot read or change your other calendars.

What we put in a booking event: the booking type, the client's first name, the time, and a link back to the console. For example: "Consult · Sam (phone)". We never put health answers, email addresses, goals or enquiry messages in your calendar.

We store a Google refresh token, encrypted, so the app can keep your calendar up to date. It is kept on our servers only and is never shown in the console. If you disconnect, we revoke access at Google and delete the token straight away. You can also remove access at any time in your Google Account settings.

We use data from Google only to show your free times and keep your bookings calendar up to date. We do not use it for ads, we do not sell it, and we do not use it to build or improve any other product. No person at SH reads it, unless you ask us to for support, we need to for security, or the law requires it.

[VERIFY WORDING] [PRODUCT NAME]'s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Videos

• Exercise videos your coach uploads are stored and streamed by Bunny Stream, in [PLACEHOLDER: Bunny storage region]. Playback links are signed and expire. When you watch, Bunny sees your IP address and device type, as any video service does.
• YouTube videos: some coaches link YouTube videos. We play them through YouTube's privacy-enhanced mode (youtube-nocookie.com). This reduces cookies, but when you press play YouTube (Google) still receives your IP address and device details. Google's own privacy policy applies to that.

8. Notifications

The app can send push notifications through Apple (iPhone) and Google Firebase Cloud Messaging (Android, and as a relay for iPhone). A notification uses your device token and a short text. We keep notification texts free of health details and never include the body of a message. For example: "New message from Adam". You can turn notifications off in your phone's settings.

9. Error reports

[DECIDE: keep this section only if crash reporting ships in v1 (M7 D4).]

When the app or console crashes, an error report goes to Sentry, in its EU region. We remove health fields, message text and form answers before a report leaves your device or our servers. We turn off IP address collection and screen recording.

10. Who else handles data

We use a small number of service providers (sub-processors) to run the app. Each one has a contract with us that limits what it can do with the data. The full list, with what each one handles and where, is in our Data Processing Agreement at https://pt.shstudios.uk/dpa. In short:

• Supabase: database, sign-in, file storage and server functions, in London.
• Netlify: hosts the coach console and booking pages.
• [PLACEHOLDER: email provider]: sends sign-in codes, booking confirmations and reminders.
• Bunny: exercise videos.
• Apple and Google Firebase: push notifications.
• Sentry: error reports [DECIDE: only if M7 D4 says yes].
• Stripe: coach billing, and client payments on each coach's own account.
• Google: Calendar for coaches who connect it.
• [PLACEHOLDER: backup host]: encrypted backup copies.

We may also share data if the law requires it, for example a court order, or to protect someone's safety.

11. Where your data is stored

Our main database and files are in London, UK (Supabase, eu-west-2). Some providers are US companies or have staff outside the UK. Where data leaves the UK, we rely on the UK's data bridge with the US or the ICO's approved contract terms (the IDTA or the UK Addendum). The DPA lists the safeguard for each provider. [VERIFY: the safeguard for each provider, see dpa.md Annex 3.]

12. How long we keep data

Coach accounts (we decide):

• Your account data: while your account is open. After you close it, we delete it within 30 days, except what the law makes us keep.
• Our billing and tax records: 6 years after the end of the financial year they relate to. [VERIFY with the accountant]
• Agreement records (what you accepted and when): 6 years after your account closes. [DECIDE]
• Support emails: 2 years after the last message. [DECIDE: recommended default]
• Backups: rolling copies, overwritten after [DECIDE: recommended 35 days]. See the note in README.md on the current backup plan.

Client data (your coach decides): your coach sets how long they keep it. Unless they change them, these defaults apply [DECIDE: H-13 / 05 D13, the build default until the founders decide]:

• Training logs, programmes, check-ins, messages and photos: 24 months after your coach archives you.
• Your health check and health consent record: 6 years after your last session. Your coach may need them if there is ever an injury claim.
• Enquiries that never became clients: 12 months.

A nightly job deletes data that has reached its date and logs what it deleted.

13. Keeping data safe

• All connections use HTTPS.
• Data is encrypted at rest by our hosting providers.
• Database access rules keep each coach's data apart, and are tested on every change.
• Google tokens are encrypted, and secret keys never leave our servers.
• Staff access to production is limited to SH's directors, with two-factor sign-in. [VERIFY: 2FA is on for Supabase, Netlify, Stripe, Bunny and Google before launch]
• The app saves your logged sets on your phone first so nothing is lost offline. That copy stays on your phone until it syncs and is removed when you sign out. [VERIFY: sign-out clears the local database, M2]

14. Your rights

You have the right to:

• get a copy of your data;
• have wrong data corrected;
• have your data deleted;
• restrict or object to some uses;
• take your data to another service (data portability);
• withdraw a consent at any time. Withdrawing is as easy as giving it.

Clients: your coach is the controller, so send requests to them. You can also do some things yourself in the app:

• Download my data (Settings) makes a ZIP of everything you can see in the app. The link works for 24 hours.
• Your consents (Settings) lets you withdraw your health consent in one tap and a confirm.
• Delete account (Settings), or without the app at https://pt.shstudios.uk/delete-account.

When you delete your account, we delete your training log, check-ins, photos, messages and injuries. Your signed health check and your health consent record are kept, locked, for the retention period your coach set (6 years by default), because your coach may need them if there is ever an injury claim. Payment records the law requires are kept without your name.

Coaches: email [PLACEHOLDER: privacy contact email]. You can also export all your data from the console and close your account there.

We answer within one month. If a request is complex we may need up to two more months, and we will tell you why within the first month. There is normally no fee.

15. Age

The app is for adults. Clients must be 18 or over. [DECIDE: how the app checks this, M7 D3 / 05 D8.]

16. Cookies and storage on your device

• The console and booking pages use only the cookies needed to keep you signed in and secure. No tracking or advertising cookies.
• The enquiry form saves what you type on your phone (local storage) so you don't lose it if you leave the page. It is cleared when you send the form.
• The app stores your programme, logs and queued changes on your phone so it works offline.

Because these are strictly necessary, we do not show a cookie banner.

17. Complaints

Please tell us first at [PLACEHOLDER: privacy contact email], and we will try to put it right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or call 0303 123 1113. [VERIFY: ICO phone number and link on the day of publishing]

18. Changes to this notice

We will update this notice when the app changes. The version and date are at the top. If a change affects how we use your data in a significant way, we will tell coaches by email and show a notice in the app before it applies.