Privacy Policy

We collect what Trainzo needs to work. The product itself — the dashboard and the app — has no advertising cookies or trackers; on our public website, and only if you accept, Google Ads measures which of our ads bring coaches to Trainzo. We do not sell personal data. A coach’s clients, programming and notes are visible only to that coach. You can delete your account, and everything tied to it, from inside the product.

If you connect Apple Health or Health Connect, Trainzo reads a few daily totals from your phone, and no coach sees any of it unless you choose to share it with them, one coach and one kind of data at a time. How that works is set out under Health data from your phone.

For your own account — your name, email and billing — Cavrian FZE LLC is the controller.

For information a coach records about their clients, the coach decides what is collected and why; we process it on their instructions in order to run the service. If you are a client and want something changed or removed, your coach is the first place to ask, and you can also write to us.

Account. Name, email address, password (stored hashed, never in readable form), and optionally a photo, phone number, timezone, and a short profile.

Roster. The clients a coach adds: name, email, and whether an invitation has been accepted; any labels the coach gives a client, which the client never sees; and when the client last used Trainzo, which their coach sees on the roster.

Training. Workouts, programmes, scheduled sessions, and the sets, reps, weights, times and distances a client logs.

Body measurements. Weight and any other measurements a client chooses to record. These are optional and they belong to the coach-client relationship they were entered under: a client training with two coaches chooses which of them sees each reading, and neither coach sees what was shared only with the other.

Progress photos. Photos of a client’s progress, taken by the client or added by their coach. They are stored privately and only the client and the coach they were taken for can open them.

Habits, goals, tasks and check-ins. The habits, goals and tasks a coach sets for a client, or a client sets for themselves, with each day’s tick or number; and the answers a client gives to check-in and onboarding forms their coach sends, which can include their weight, measurements, photos and how they are sleeping, eating or feeling.

Health data from your phone. Only if you connect Apple Health or Health Connect: daily totals of steps, sleep, resting heart rate, active energy and weight, and your workouts. See below.

Messages. Messages between a coach and their client, including the photos, videos, files and voice notes sent in them, and private notes a coach writes about a client. Private notes are never shown to the client.

Saved. Messages you keep and notes you write for yourself in Saved, with any files attached. Saved is yours alone: no coach or client can read it, and a saved message stays even if the original is deleted.

Notifications. The notifications we send you, kept in your list of notifications for 90 days, and the token your phone gives us so that we can deliver them.

Tips and reminders by email. If you have a coach account, we send a few emails on our own: a welcome, help in your first week, a note if you have been away for a while, and good news when a client finishes their first session. You can stop them with the unsubscribe link in any of them, or on My Account under Notifications; emails about your account, billing, sign-in and invitations still arrive. We keep a record of which of these emails we sent you and, where your mail app reports it, whether you opened one; if an email to you bounces or is marked as spam, we stop sending them to that address.

Reports. If you report a message or a person, or block someone, we record who reported it, who it was about, the reason given and a copy of the message as it was at the time — the copy so that a report survives the message being deleted. A report is visible to us and to the person who made it, and never to the person it is about.

Technical. Ordinary server logs, including IP address and browser, kept to keep the service secure and working; and, when you sign up, sign in or reset a password, the bot check described under Who we use to run Trainzo.

What we read. If you connect Apple Health (on iPhone) or Health Connect (on Android) in the Trainzo app, Trainzo reads, for each day: your step count; how long you slept, and the time in each sleep stage where your phone or watch records it; your resting heart rate; the active energy you burned; your weight; and your workouts — the type, when it started, how long it lasted, the distance, the energy, and the name of the app that recorded it. We read daily totals, not the individual readings behind them, and nothing else in your health app.

Only when you ask, and only reading. Nothing is read until you tap Connect, see what will be read and why, and grant it in your phone’s own permission screen. You can switch off any type there at any time and Trainzo stops reading it. Trainzo never writes anything to Apple Health or Health Connect.

What it is for. To show you your own activity in the app; and, only if you choose, to show a coach you train with the data you pick, to fill in a habit your coach set for you (a daily step target, for example) on the days your phone has the number, and to let that coach see when your activity drops sharply or stops arriving.

Who sees it. You do. A coach sees nothing by default. You choose, for each coach separately and for each kind of data separately, what that coach may see, and you can change or withdraw it at any time in the app. A coach can ask you to share something; you see who asked, what for and why, and you decide. If you train with two coaches, sharing with one shows the other nothing. We keep a record of every time sharing was turned on or off, as proof of what you agreed to. When a coaching relationship ends, that coach’s access ends with it, and it does not come back unless you share again. Once you share with a coach, they are responsible for how they use what they see in their coaching of you.

What we never do with it. We do not sell it, use it for advertising or marketing, share it with data brokers, or use it to train AI models. It is not sent to any analytics or tracking service. It is not stored in iCloud. It is never used to decide anything about you automatically.

Where it is kept. With the rest of your data in Frankfurt, Germany, on Supabase’s infrastructure, encrypted in transit and at rest. Notifications never contain your health numbers: when a coach asks you to share, the notification carries their name and the reason they gave.

How long, and deleting it. What has synced is kept while your account exists, so your history stays with you. In the app, Disconnect stops syncing straight away and lets you delete everything that was synced at the same time. Deleting your account deletes it all. A day the phone filled in on a habit becomes part of that habit’s record, as a number you typed would. Backups roll off within 30 days.

The legal basis. Health data is special category data under the UK and EU GDPR. We process it only with your explicit consent, which you give by connecting and by each choice to share, and which you can withdraw as easily as you gave it. Withdrawing does not affect what was done before.

Apple and Google. Data from Apple HealthKit is used only to provide the features described here and is never used for advertising or disclosed to third parties except as you direct. Trainzo’s use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements.

If you live in Washington State, Nevada, or anywhere else with a consumer health data law, our Consumer Health Data Privacy Policy sets out the same in the form those laws ask for, with your rights.

We do not sell personal data. We do not use your data or your clients’ data to train advertising models. We do not show one coach another coach’s clients, programming or messages.

Your data lives in Frankfurt, Germany, on Supabase’s infrastructure — database, authentication and file storage. Coaches and clients in the UK and the EEA can therefore use Trainzo without their data leaving the European Economic Area.

Because Cavrian FZE LLC is a UAE company, our staff access to that data happens from the UAE.

A few service providers run parts of Trainzo for us. Each acts on our instructions under its own data-processing agreement and receives only what its job needs:

• Supabase — the database, sign-in and file storage, in Frankfurt, Germany.
• Vercel — serves the website and the coach dashboard from a global content network.
• Resend — sends our emails, such as client invitations, notices about a coach’s plan, and tips and reminders.
• Cloudflare Turnstile — checks that a person, not a bot, is signing up, signing in or resetting a password. It looks at signals from your browser or phone for that one check.
• Expo, Apple and Google — their push services deliver the app’s notifications. A notification may carry a name and a short line, such as a message from your coach; it never carries the numbers synced from your phone.

Payments for coach plans are taken by Paddle, our reseller and merchant of record. Paddle handles the card details, tax and receipts under its own privacy policy; card details never reach us. We keep the plan you are on and the state of your subscription.

If you choose Continue with Google or Sign in with Apple, Google or Apple tells us your name and email address so that we can create your account or sign you in.

Some exercise videos, and links shared in messages, play from YouTube or Vimeo. When you play one, that service can see that you are watching it, under its own privacy policy. They are not our providers and we send them nothing about you.

Inside the product — the coach dashboard, a client’s pages and the app — Trainzo sets cookies for one purpose: keeping you signed in. They hold your session so that you are not asked for your password on every page. Signing out clears them. There are no advertising cookies and no third-party trackers there.

On our public website (the home page, pricing, the comparison and legal pages, and signing up) we use Google Ads conversion tracking to measure how our ads perform — for example, that someone who clicked an ad went on to create an account. Its cookies are set only if you press Accept on the cookie banner. Until then Google’s consent mode keeps them off, and Google receives only signals that carry no cookie and no identifier. Google acts as an independent controller for this measurement under its own privacy policy. We do not use it to build a profile of you, and none of your coaching data, health data or messages ever reaches it.

You can change your answer at any time with Cookie settings at the foot of every public page. We ask again after about six months.

If you reach us from one of our ads, the ad’s campaign name travels in the page address and is saved with your account when you sign up, so we can tell which ads bring coaches to Trainzo. No cookie is set for it and nothing about you is sent to the advertiser.

We keep your data while your account exists. Delete your account and we remove your profile, your roster, and the training data, messages and notes attached to it. If you are a client, your coach keeps their record of the coaching they delivered — the sessions, the sets logged against them and your messages — no longer linked to any login; our Delete your account page says exactly what goes and what stays. Backups roll off on their own schedule, normally within 30 days.

An archived client is not a deleted one: archiving keeps their history and frees the roster slot. Deleting a client removes their sessions and logs.

Reports and blocks are kept while we may still need them — a pattern of behaviour is only visible over time. Deleting your account removes the reports you made; a report about you remains, with your identity removed from it.

You can see and change your profile at any time, and delete your account from Account settings in the web dashboard or the mobile app. You can ask us for a copy of what we hold, ask for a correction, or object to a particular use.

You must be old enough to enter into a contract where you live — eighteen in most places — to hold an account of your own. We never knowingly collect anything about a child under 13.

Coaches do train young athletes, and we have not made that impossible. Where the client is under that age, the account belongs to their parent or guardian, who agrees to the terms and consents to what is recorded; the coach is responsible for having that consent before they invite them, under the law where they practise.

If you believe a child holds an account of their own, write to privacy@trainzo.com and we will remove it and everything recorded under it.

Every row of data is scoped to the coach who owns it, and that separation is enforced by the database rather than by application code. Traffic is encrypted in transit. No system is perfectly secure, and if a breach affects you we will tell you.

We will update this page when our practices change, and the date at the top will say when. Material changes will be announced before they take effect.

Questions about this document can go to privacy@trainzo.com, or by post to Cavrian FZE LLC, Business Centre, Sharjah Publishing City Free Zone, Sharjah, United Arab Emirates.