Privacy Policy

1. Who we are

Coacha is operated by Coacha LLC, a California limited liability company ("Coacha", "we", "us", "our"). Coacha is an AI-powered running, cycling, and strength-training coaching app. This Privacy Policy explains what personal information we collect through the Coacha iOS app and the website at coacha.fit (together, the "Service"), how we use and share it, and the choices and rights you have.

The data controller is:

Coacha LLC
c/o Northwest Registered Agent, Inc.
2108 N St, Ste N, Sacramento, CA 95816, USA
Email: hello@coacha.fit

Coacha is intended for users in the United States. See International users for our position on users outside the U.S.

2. Information we collect

Information you provide

• Account & identity: your name, email address, time zone, and the account identifier from our authentication provider (Clerk). You may sign in with Apple or Google, in which case we receive the identifier and email associated with that sign-in.
• Onboarding & coaching context: your training goals, history, injuries, preferences, constraints, program phase, and body statistics (e.g. height, weight, age) that you provide during onboarding or to the coach.
• Coach conversations: the text messages, voice messages, and images you send to the AI coach, and the coach's responses.
• Strength / workout logs: exercises, sets, weights, reps, and effort (RPE) you log manually.
• Feedback: anything you submit through the in-app feedback form (plus the app version and platform at the time).
• Your own API keys (optional, "bring your own key"): if you choose to supply your own Anthropic or Hevy API key, or your own OAuth client credentials, we store them encrypted and use them only to provide the feature you enabled.

Health & fitness data you connect or enter

With your permission, we collect activity and health data, including:

• Activities / workouts: type, name, start time, duration, distance, elevation, calories, pace, perceived effort, and notes.
• Health metrics: heart rate (average / max), power (watts), cadence, time-in-zone, and computed training load (e.g. TRIMP / TSS, CTL / ATL / TSB).
• Detailed streams & segments: per-lap / segment data and per-second time series (heart rate, power, speed, altitude / pace) for connected activities.
• Routes (GPS), where present: when you connect Apple Health, workout data may include route / location series originating from your device. We use it only to display and analyze the associated workout. The Coacha app does not request a device "Location" permission of its own.

This data may come from your manual entry or from a service you connect: Apple Health (HealthKit), Strava, Hevy, and (where offered) Garmin. See Connected services.

Information collected automatically

• Device & technical data: app version, platform / OS, identifiers used by our analytics and crash-reporting tools, and limited request / latency metrics.
• Usage / product analytics: in-app events such as completing onboarding, sending a coach message, connecting an integration, or viewing a plan. These events are linked to your account identifier but are designed not to contain your health values or message content. See Analytics.
• Crash & error data: when the app or our servers hit an error, our error-reporting tool records diagnostic data (stack traces, your numeric user id). It is configured not to capture message content, request bodies, or credentials.

Subscription & billing

Paid subscriptions are offered through Apple's App Store and managed via RevenueCat. We receive your subscription status and entitlements. We do not receive or store your full payment card details — payment is handled by Apple.

Push notifications

If you enable notifications, we store a device push token to deliver them. You can disable notifications in your device settings.

3. How we use information & California "Notice at Collection"

We use personal information for the business and commercial purposes below. This table is also our CCPA/CPRA Notice at Collection: the categories collected, their sources, the purposes, and the categories of third parties to whom they are disclosed for a business purpose.

We also use personal information to comply with legal obligations; enforce our terms; detect, prevent, and respond to fraud, abuse, and security incidents; and, where you have given any required consent, to send you communications about the Service. We do not use your health or fitness data for advertising, marketing, or use-based data mining, and we do not sell it.

4. How we share information

We share personal information only as described here. We use service providers ("sub-processors") that process data on our behalf, under contract, for the limited purpose of operating the Service. We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We may also disclose information: (a) for legal & safety reasons, if required by law or legal process, or to protect the rights, property, or safety of Coacha, our users, or the public; (b) in a business transfer (merger, acquisition, or sale of assets), subject to this Policy; and (c) with your direction, when you connect a third-party service or push your plan to your calendar.

5. AI coaching (automated processing)

Your coach is AI, not a human. Coacha's coaching, plans, reviews, and in-chat responses are generated by a large language model (Anthropic's Claude). When you interact with the coach, your relevant data — your profile and goals, activities and health metrics, workout logs, plans, and your messages (including transcribed voice and any images) — is transmitted to Anthropic to generate a response.

• You are notified at the start of a coaching session that you are interacting with AI.
• Your data is not used to train AI models. By default, Anthropic does not use inputs or outputs from its commercial API to train its models, and it automatically deletes those inputs and outputs within 30 days — except where a longer period is required to comply with law or enforce its usage policies (e.g. content flagged for trust-and-safety review). We do not enable any setting that would permit your coaching data to be used for model training.

6. Health & fitness data

We take special care with health and fitness data, which we treat as sensitive personal information.

• We use it only to provide and improve your coaching (plans, reviews, trends, and chat) and to operate the Service.
• We do not use health or fitness data for advertising or marketing.
• We do not sell it, and we do not share it with any third party except the sub-processors above that are necessary to provide the Service to you.

Apple HealthKit. Coacha reads workout and health data from Apple Health only with your permission, on a read-only basis (we never write to Apple Health). Consistent with Apple's requirements, we do not use HealthKit data for advertising or other use-based data mining, we do not sell it, we do not share it with third parties except as needed to provide the Service to you, and we do not store HealthKit data in iCloud. You can revoke Coacha's access at any time in iOS Settings → Privacy & Security → Health.

7. Connected services & integrations

Coacha can connect to third-party services with your authorization. Each integration is optional and can be disconnected at any time in the app. When you connect a service, you authorize Coacha to access the data described, and that service's own privacy policy governs its handling of your data on its side.

Apple Health (HealthKit)

See above. Read-only; revoke via iOS Settings.

Strava

With your authorization, we sync your Strava activities and associated data and store the access credentials needed to keep them in sync. Disconnecting Strava in Coacha revokes our access. Strava's privacy policy: strava.com/legal/privacy.

Hevy

With your authorization (via a Hevy API key you provide), we sync your strength-training data. Hevy's privacy policy: hevyapp.com/privacy.

Garmin

(Applies if and when you connect a Garmin account.) If you connect Garmin Connect, you expressly consent to Coacha accessing and transferring your Garmin device data (such as activities, laps, power, heart rate, and per-second metrics) to provide your coaching, including processing that data with our AI provider to generate coaching. Insights derived in part from Garmin device-sourced data are identified as such, and Garmin data is labeled as originating from your Garmin device.

• Garmin's privacy notice: garmin.com/en-US/privacy/connect/policy.
• Consent: we request your express consent before transferring your Garmin data.
• Deletion / deregistration: you can disconnect Garmin in the app at any time, which deregisters Coacha with Garmin, stops syncing, and removes the stored Garmin credentials. On deletion of your account, or on termination of our Garmin developer relationship, we erase Garmin-sourced data as required.

Google (Calendar & Sign-In)

If you enable calendar export, we use Google Calendar to write your training plan as calendar events; we do not read your other calendar data. If you use Google Sign-In, we receive your sign-in identifier and email. Google's privacy policy: policies.google.com/privacy. Coacha's use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements.

8. Your privacy rights

You can exercise the following rights regardless of where you live. We will not discriminate against you for exercising them.

• Access / know: the categories and specific pieces of personal information we hold, the sources, the purposes, and the categories of recipients.
• Correct: correction of inaccurate personal information.
• Delete: deletion of your personal information.
• Portability: a copy of certain information in a portable format.
• Opt out of sale / sharing: we do not sell or share your personal information for cross-context behavioral advertising, so there is nothing to opt out of; this will be updated if that ever changes.
• Limit use of sensitive personal information: we only use sensitive personal information (your health / fitness data and coach conversations) to provide the Service to you; we do not use it for incompatible purposes.
• Withdraw consent: where we rely on your consent (e.g. connecting a service, notifications), you can withdraw it at any time.

How to exercise your rights

• Delete your account and data in-app: open the app → Me tab → Settings → Account → Delete account and confirm. This calls our DELETE /api/account endpoint, which deletes your synced activities, chat threads, and coaching log, revokes and purges your third-party integration tokens (and deauthorizes Strava and, where applicable, deregisters Garmin), and removes or nulls your account identifiers. See Retention for what may briefly persist in backups.
• Other requests: email hello@coacha.fit. We verify your identity (typically by confirming control of your account email) before acting.
• Timing: we respond to verifiable requests within the timeframes required by applicable law (generally within 45 days under California and Washington law, extendable as permitted).
• Authorized agents (California): you may use an authorized agent; we may require proof of authorization and verification of your identity.

California residents (CCPA / CPRA)

The categories of personal information we collect, their sources, the purposes, and the categories of third parties to whom we disclose them are described in sections 2–4 above. In the preceding 12 months we have not sold or shared personal information for cross-context behavioral advertising, and we have not sold or shared consumers' personal information. We collect and use sensitive personal information (health / fitness data and coach conversations) only to provide the Service.

Washington residents (My Health My Data Act)

If you are a Washington resident, the health and fitness data you provide may be "consumer health data" under the Washington My Health My Data Act. We maintain a separate Consumer Health Data Privacy Policy describing how we collect, use, share, and let you control that data, including your right to withdraw consent and to have consumer health data deleted. Residents of other states with similar consumer-health-data or comprehensive privacy laws (e.g. Nevada, Connecticut) have comparable rights.

9. Analytics & crash reporting

• Product analytics (PostHog): we record in-app product events to understand how the Service is used and to improve it. Events are linked to your account identifier but are designed to exclude your health values and the content of your coach messages. We use PostHog for product analytics only — not for advertising.
• Crash & error reporting (Sentry): we capture diagnostic data when something breaks. It is configured to exclude message content, request bodies, cookies, and credentials; it attaches your numeric user id so we can correlate and fix issues.

10. Data retention

We retain personal information for as long as your account is active and as needed to provide the Service, and thereafter as required for legitimate business or legal purposes.

• On account deletion: we delete your per-account records (activities, health metrics, streams, coach conversations, plans, logs) and remove or null your account identifiers and stored credentials, ordinarily within 30 days. Residual copies may persist in encrypted backups for up to 35 days after deletion, then age out on our backup rotation. Limited operational / cost-and-usage metadata that does not contain your message content or health values may be retained for up to 24 months.
• AI processing: our AI provider (Anthropic) automatically deletes the inputs and outputs sent to its commercial API within 30 days (subject to limited legal / trust-and-safety exceptions).
• Voice messages: audio you record is sent for transcription transiently and is not retained by us as audio after it is transcribed.
• Product analytics (PostHog): retained for up to 24 months, then deleted or aggregated.
• Crash & error data (Sentry): retained for up to 90 days.

11. Security

We use technical and organizational measures to protect personal information, including encryption in transit (HTTPS / TLS) and encryption at rest, access controls, credential rotation, and provider-managed infrastructure. Connected-service credentials and your bring-your-own API keys are stored encrypted. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your personal information, we will notify you and the authorities as required by law.

12. International users

Coacha is intended for and directed to users in the United States. We do not target users in the European Economic Area, the United Kingdom, or Switzerland, and we do not monitor the behavior of individuals in those regions. If you access the Service from outside the United States, your information will be processed in the United States.

13. Children's privacy

The Service is not directed to children. You must be at least 16 years old to use Coacha. We do not knowingly collect personal information from anyone under that age. If you believe a child has provided us personal information, contact hello@coacha.fit and we will delete it.

14. Changes to this Policy

We may update this Policy from time to time. When we do, we will revise the "Last updated" date above and, for material changes (for example, a new third-party data flow), provide additional notice in-app or by email before the change takes effect. We review this Policy at least every 12 months.

15. Contact us

Questions, requests, or complaints about this Policy or your data:

Coacha LLC
Email: hello@coacha.fit
Mail: Coacha LLC, c/o Northwest Registered Agent, Inc., 2108 N St, Ste N, Sacramento, CA 95816, USA

If you are a California resident with an unresolved privacy concern we have not addressed, you may contact the California Attorney General's office. If you are a Washington resident, you may contact the Washington Attorney General's office.