Privacy Policy

The controller of your personal data is Michał Zych, residing at ul. Józefa Wybickiego 5C, 31-261 Kraków, Poland, email: comfycoaching.eu@gmail.com (the “Controller”, “we”).

Contact regarding personal data: contact@comfycoaching.com.

Depending on your role and how you use the app, we process:

• Account data: full name, email address, role (trainer / client), an encrypted password (handled by the authentication provider), an optional profile photo.
• Training data: workout plans, completed sets (weight, reps, notes), session history, calendar.
• Nutrition data: meal log, logged meals and products, calorie and macronutrient goals.
• Health data (special category, Art. 9 GDPR): body measurements and circumferences, weight, physique goal, body (progress) photos, trainer notes that may concern health (e.g. injuries). We process this data solely on the basis of your explicit consent.
• Activity: daily step count and water intake. You enter steps manually or — if you turn this on in the mobile app — we import them from Apple Health (iPhone) or Health Connect (Android). From these services we read only your daily step count for the last 7 days, and only after you grant permission in your phone’s system settings; we do not read any other health data and do not write anything to them. Your trainer sees your steps. We do not use them for advertising, do not sell them and do not share them with anyone other than the parties listed in section 4. You can turn importing off in the app (the steps window in the meal log), where you can also delete imported steps; you can withdraw permission in the Health or Health Connect settings.
• Communication: the content of messages and attachments exchanged between trainer and client.
• Sign-in with Google or Apple: if you choose this method, the provider gives us your name, email address and an account identifier. When signing in with Apple you can hide your address, in which case we receive a relay address from Apple. We never receive your Google or Apple password.
• Bug reports and feature requests: the content of your report, your account email address and the technical data needed to reproduce the problem (device and browser type, app language).
• Requests sent via a trainer’s page: when you send a request through a trainer’s public page (without creating an account) — your full name, email address, optionally a phone number, the chosen offer item, your goal and the content of your message.
• Email conversation about a request: the content of messages the trainer sends you from the app to the email address you provided, and the content of your replies to those messages. A reply to such an email is delivered to the app, where we store it with the request and show it to the trainer. We do not store attachments from your replies — only their number.
• Trainer subscription data: the chosen plan, the subscription status, and the customer and subscription identifiers at our payment provider. We do not receive card details.
• Trainer–client billing: amounts due that a trainer issues in the app (amount, title, due date, status) and the transfer details provided by the trainer (account number, payee name, optionally a tax ID). The payment itself happens outside the app.
• Technical data: essential cookies (login session, chosen language); your IP address and the approximate location derived from it (country, region, city) when you sign up and log in; your IP address when limiting the number of attempts (e.g. logins); and — if you enable notifications — the technical identifier of your browser’s or device’s push subscription.

Providing data is voluntary, but the app cannot be used without account data.

• Providing the service (running the account, plans, log, progress, communication, billing with clients, the trainer’s subscription) — Art. 6(1)(b) GDPR (performance of a contract).
• Processing health data (measurements, photos, goal) — Art. 9(2)(a) GDPR (explicit consent, which you can withdraw at any time).
• Reading steps from Apple Health / Health Connect — Art. 9(2)(a) GDPR (explicit consent: the switch in the app and the permission in your phone’s system; you can withdraw it at any time).
• Security and abuse prevention (including recording the IP address and approximate location at sign-up and login, attempt limits, protecting forms from bots), handling complaints — Art. 6(1)(f) GDPR (legitimate interest).
• Sending push notifications — Art. 6(1)(a) GDPR (consent granted in the browser, revocable).
• Reviewing and answering bug reports and feature requests — Art. 6(1)(f) GDPR (legitimate interest: developing and improving the app).
• Handling a request sent via a trainer’s page and contacting you about it, including the email conversation with the trainer — Art. 6(1)(a) GDPR (consent given in the request form, revocable).

We do not sell your data. We entrust it to trusted providers necessary for the service to work:

• Supabase — database hosting, authentication and file storage (servers in London, United Kingdom).
• Vercel — application hosting (servers in London, United Kingdom).
• Cloudflare (Turnstile) — protecting the sign-up and login forms from bots; it processes your IP address and technical browser data.
• Sentry (sentry.io) — application error monitoring (EU region). It collects error messages and technical diagnostic data (e.g. page URL, browser type) to keep the service stable; we do not intentionally send it your personal data or IP address.
• Resend (resend.com) — sending account-related emails (e.g. a password reset link) and request-related emails (the request confirmation, messages from the trainer), and receiving replies to the trainer’s messages. It processes your email address and the content of such messages, including the ones you send back; emails are sent from the EU region (Ireland), and the provider’s account data is stored in the USA.
• Payment provider — payment and subscription processing as the merchant of record. For payments, taxes and invoicing, the provider acts as an independent controller and processes billing data (e.g. payment method, billing address and country). We do not store full payment-card details — the provider handles them. You will see its name at checkout before you buy. Applies to accounts with an active payment/subscription.
• Apple (the APNs notification service) and browser push services (e.g. Google, Mozilla, Apple) — delivering notifications if you enable them. They receive the device or subscription identifier and the notification content.
• Google and Apple — signing in to your account, if you choose this method. The provider then learns that you are signing in to ComfyCoaching.
• Open Food Facts — a public food-product database; we send it only product queries (code / name), without your personal data.

Where necessary, data may also be disclosed to our professional advisers (e.g. accountants, lawyers) and, in specific cases, to authorized bodies where required by law.

Some providers process data outside the European Economic Area:

• United Kingdom (Supabase, Vercel) — on the basis of the European Commission’s decision finding an adequate level of data protection in that country.
• USA (Resend, as well as Cloudflare and the notification services where they process data in the USA) — on the basis of the European Commission’s standard contractual clauses or certification under the EU-U.S. Data Privacy Framework.

We keep data for as long as you have an account and use the service. After you delete your account, the data is removed without undue delay, except for data whose longer retention is required by law (e.g. for accounting) or necessary to establish/pursue claims.

IP addresses and locations from sign-ups and logins are kept for 90 days, and entries used to limit the number of attempts for at most 2 days.

Requests sent via a trainer’s page and the email conversations about them are kept until the trainer’s account is deleted or an earlier deletion request. A person who sent a request without creating an account can ask for their data to be deleted, or withdraw consent, by writing to the trainer or to contact@comfycoaching.com.

You have the right to:

• access your data and obtain a copy of it,
• rectify (correct) your data,
• erase your data (“right to be forgotten”),
• restrict processing,
• data portability (export),
• object to processing,
• withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

You can exercise some rights yourself in the app (Profile → export and delete account). Send any other request to contact@comfycoaching.com — we respond without undue delay and within one month at the latest. You also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO).

We do not make decisions about you based solely on automated processing, including profiling.

We use only essential cookies: to keep your logged-in session and remember your chosen language. We also store interface settings (e.g. light or dark theme) and unsent message drafts in your browser’s storage. The sign-up and login forms are protected by Cloudflare Turnstile, and the payment window is run by our payment provider — both may use their own technical files needed to work and to prevent fraud. We do not use marketing cookies or tracking/analytics tools, which is why we don’t show a cookie consent banner.

We apply safeguards appropriate to the risk: transport encryption (HTTPS/HSTS), data isolation between users at the database level (Row Level Security), private buckets for photos and attachments accessible only to authorized people, and browser security headers.

We may update this policy. We will announce material changes in the app. The date of the last update is shown at the top of the page.