privacy policy.

Account details: your name, email address, and role (client, coach, or company admin).

Body data: check-in readings such as weight and body-fat estimates, and your goals over time.

Coaching data: diets, assigned training programs, logged sets, reported compliance, and the notes exchanged between a coach and their client.

Library data: the foods, exercises, and program templates a coach creates, tagged as shared or private.

Visibility is enforced by row-level security in the database itself. A client sees only their own data. A coach sees only the clients assigned to them and their own private library items. A company admin sees data within their own company.

This is the factual behaviour of the shipped system today, described in depth on the security page. How it is expressed as policy language is part of the counsel review.

Data is stored in a Supabase-hosted Postgres database in Sydney, Australia, and reached over encrypted connections.

To be defined with counsel: the circumstances under which Trainbase operators may access data for support or maintenance, and the controls around that access.

To be defined with counsel: the formal process for requesting a copy of your data or its deletion. Until then, requests sent to hello@trainbase.io are handled directly.

To be defined with counsel: an inventory of any cookies and analytics in use, and the basis for each.

To be defined with counsel: how changes are published and how users are notified.