Privacy policy

Who we are

PocketAthlete ("we") provides a training and recovery app at pocketathlete.com. We are the data controller for the information described here. You can reach us at info@pocketathlete.com.

PocketAthlete is currently a trading name. The operator's full legal name and postal address must be added here before public launch; email is not a substitute for that required controller identity information.

What we collect

Only what the app needs to function. In practice that is:

• Account details — your email address, and a name if you give one.
• Health and training data — daily check-ins covering sleep, fatigue, soreness and a body pain map; body weight and body-fat entries; training sessions, benchmark tests and nutrition logs.
• Video and photos — training clips and progress photos you choose to upload.
• Payment records — your subscription tier and status. Card details are handled by Stripe and never reach our servers.
• Referral source — if you arrived through an affiliate link, the code that brought you.

Health data, specifically

Pain, injury, sleep, fatigue, body-composition and some training and nutrition entries can reveal health information, which the law treats more strictly than ordinary personal data. Before personalised processing starts, we ask you to make a separate express statement of explicit consent. Merely entering data is not treated as consent.

You can withdraw that consent from Profile. Personalised processing then stops until you opt in again. Withdrawal does not make earlier lawful processing unlawful. You can delete your account to erase its data, or email us if you want to make a narrower deletion or restriction request.

We do not sell it, share it with advertisers, or use it to make automated decisions with legal or similarly significant effects. Your readiness score is guidance, not a decision about you.

Why we use data and our legal bases

We use each category only for the purpose described below:

• Contract — to create and secure your account, provide the features you request, save your training history, administer a subscription and provide support.
• Explicit consent — in addition to an ordinary UK GDPR lawful basis, for health and other special-category data used to personalise readiness, recovery, nutrition, injury and training guidance.
• Legitimate interests — to prevent fraud and abuse, secure and debug the service, and understand a small set of non-sensitive product milestones. Our interests are running and improving a safe service; we do not use this basis for health-data profiling or advertising.
• Legal obligation and legal claims — where records must be retained for tax, accounting, dispute or regulatory purposes.

Where your data goes

We keep the number of third parties deliberately small. As of the date above:

• Supabase — hosts the database, authentication and private file storage in the project region selected by us.
• Cloudflare — runs the API and scheduled notification jobs.
• Groq, OpenRouter and NVIDIA — our configured AI-provider chain. A provider receives the coach question or generation request plus the relevant athlete context needed to answer it. Depending on the feature, that can include age, height, weight, sex, goals, training history, nutrition preferences, fatigue, sleep, pain or injury details. They do not need your payment-card details. Only the provider that handles a request processes that request.
• Stripe — processes payments. They receive your email and payment details directly.
• GitHub Pages — serves the website itself.
• Google Apps Script/Gmail or Resend — whichever sender we configure sends account, training and billing emails.

International transfers

Some suppliers may process information outside the UK. Before relying on such a supplier we must verify its processing locations and contract, and use a lawful transfer mechanism where required — for example UK adequacy regulations or the UK International Data Transfer Agreement/Addendum — together with a transfer risk assessment. You can ask us for the current supplier and safeguard details.

What happens to your videos

Video analysis runs entirely in your browser. Clips are never sent to an AI service or analysed on our servers — the pose model downloads to your device and the measurements are computed there. The file itself is stored privately so you can watch it back, readable only by your account.

Legacy free-plan clips are deleted automatically after 14 days and current Pro clips after 180 days. You can delete any clip yourself at any time, and doing so removes the file as well as the record.

How long we keep things

Training and health entries are kept while your account is open, because their value is the history. Delete your account and we delete them.

Videos follow the period above. Progress photos remain private until you delete them or the account. Notification records and Ask Coach conversations remain with the account so the history works; we should set and document shorter operational limits before public launch. Waitlist emails are kept until launch or until you ask us to remove them.

Payment, fraud, complaint and legal-claim records may be kept after account deletion for the period required by law or reasonably needed to establish or defend a claim. They are not kept in the live training profile.

Notifications and email

Profile lets you switch training reminder categories and in-app training reminders on or off. Trial-ending, payment, security and other essential service messages are still sent when needed to administer your account. We keep those messages factual and do not add promotions to them.

A notification record shows whether an email was accepted by the sender. Delivery, bounce and complaint events may also be retained to protect sender reputation and avoid repeatedly contacting a bad address.

Your rights

Under UK and EU data protection law you can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or ask for it in a portable format. Most of this you can do in the app directly. For anything else, email us and we will respond within one month.

You can also complain to the Information Commissioner's Office (ico.org.uk) if you think we have got something wrong. We would rather you told us first.

Security

Data is protected by row-level security in the database, meaning access is checked per row on every request rather than trusted from the app. Videos and photos sit in private buckets readable only by their owner. Payment card details never touch our systems.

No system is perfect. If you find a security problem, email us and we will take it seriously.

Cookies

We do not use advertising or analytics cookies, and there is no third-party tracker anywhere in the app — no Google Analytics, no advertising pixel, nothing that reports you to another company. The app stores your login session in your browser so you stay signed in, plus a referral code if you arrived through one. That is all.

How we measure the product

When you are signed in we record a small number of product milestones — that an account was created, that onboarding finished, that a check-in happened, that a paid feature was viewed, that checkout was opened or completed. We use them to find where the app confuses people, and nothing else.

These records hold the fact an event happened and its shape, such as which plan a button belonged to. They never contain your training data, your injuries, what you ate, or anything you typed. Signed-out visitors are not recorded at all, and we do not store any identifier on your device to follow you between visits.

Nothing is shared with anyone. Delete your account and these records go with it.

Children

You must be at least 16 to create an account. The service is not directed at children under 16. If we learn that an under-16 has created an account, we will stop processing it and arrange deletion.

Changes

If we change this policy materially we will tell you in the app before it takes effect.