Last updated: 21 April 2026 Effective date: 21 April 2026
This policy explains what data Coachly collects, how it's used, who it's shared with, and the rights you have over it. It covers the iPhone app ("the App") and the backend service at coachly-backend-mu.vercel.app ("the Service").
Coachly is operated by Kevin McEnaney ("we", "us"). You can reach us at privacy@getcoachly.fit.
If you prefer the short version: we keep your data on your device, you control what syncs, we don't sell anything, and we don't use your data to train AI models.
Every field below is only collected when the corresponding feature is turned on. Coachly ships with everything defaulting to off except the local workout / nutrition log (which is what the app is for).
localStorage as coachly_device_id. Used to meter your per-user coach budget.This data is stored in your device's local storage. Uninstalling the app erases all of it.
Read: steps, active calories, heart rate, body-mass samples, workouts other apps have logged (Apple Fitness, Strava, Runna, Peloton, etc.). Write: nutrition entries and weight entries you log in Coachly.
HealthKit data is processed entirely on your device. It is never transmitted to our servers.
You can revoke any HealthKit permission at any time in iOS Settings → Privacy & Security → Health → Coachly.
When you send a message to the coach, we transmit to Anthropic's API (the "Claude" model):
We do not transmit:
Anthropic processes the request, returns a reply, and under our agreement does not retain it for training. We do not keep the message content server-side beyond the per-request lifetime.
If you create an account, we collect via Supabase (our auth + database provider):
With an account, we also sync — at your choice — the data in section 1.1 to your Supabase-hosted account so you can access it on another device.
You can delete your account and all synced data at any time from Profile → Account → Delete account.
If you opt in to "Help improve Coachly" in Profile, we collect via PostHog (product analytics) and Sentry (crash reports):
workout_completed, coach_message_sent, onboarding_completed, etc.We do not opt anyone in by default. You can turn this off again at any time.
We track the cost of your AI coach usage, keyed by your device ID or (when signed in) your Supabase user ID. This is solely to enforce the $0.50/month cap — we don't use these counters for anything else.
We do not use App Tracking Transparency because we don't track you across other apps.
Under UK GDPR / EU GDPR, our legal bases are:
| Processing | Legal basis |
|---|---|
| Running the app on your device | Performance of a contract — you asked us to provide a fitness app |
| Your account + sync | Performance of a contract — you asked us to sync |
| HealthKit read/write | Explicit consent — your in-app toggle |
| Sending coach messages to Anthropic | Performance of a contract + consent (the coach consent gate) |
| Analytics + crash reports | Consent — opt-in only |
| Enforcing the coach budget | Legitimate interests — keeping the service sustainable |
You can withdraw consent at any time by flipping the relevant toggle in Profile. Withdrawal doesn't affect processing that happened before.
We use these service providers ("data processors") and share only what section 1 lists:
| Provider | What | Where |
|---|---|---|
| Anthropic, PBC (US) | Coach messages → Claude API | US |
| Supabase, Inc. (US) | Account + optional data sync | EU region available |
| Upstash, Inc. (US) | Rate-limit + quota counters (Redis) | EU region available |
| Vercel, Inc. (US) | Backend function hosting | EU region available |
| RevenueCat, Inc. (US) | Subscription management (if you subscribe) | US |
| PostHog, Inc. (US) | Analytics (opt-in) | EU instance available |
| Sentry, Inc. (US) | Crash reports (opt-in) | EU instance available |
Transfers to the US rely on Standard Contractual Clauses (SCCs) and, where applicable, the UK Addendum.
We do not sell your data. We do not share it with advertisers. We do not share it with data brokers.
| Data | Retention |
|---|---|
| On-device data | Until you uninstall the app or reset it from Profile |
| Supabase account data | Until you delete your account (at which point it's hard-deleted within 30 days) |
| Coach message content | Not retained beyond the per-request processing window (Anthropic applies a 30-day safety-moderation retention window per their terms; we don't receive it back) |
| Coach budget counters | 40 days (daily) / 30 months (monthly backstop), then auto-expired |
| Analytics events | 12 months, then aggregated and stripped of session IDs |
| Crash reports | 90 days |
| Rate-limit counters | 24 hours maximum |
Under UK / EU GDPR and similar laws, you can:
To exercise any of these rights, email privacy@getcoachly.fit. We respond within 30 days.
You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
No system is 100% secure. If a breach affects your data, we'll notify you within 72 hours per GDPR Article 34.
Coachly is intended for users aged 18 and over. Our onboarding asks for your age and refuses to proceed if you're under 18. If you believe a child under 18 has created an account, email us and we'll delete it.
The Service is operated from the UK. If you use Coachly outside the UK, your data is transferred to the UK and to the US-based processors listed in section 4, with appropriate safeguards.
If we change this policy materially, we'll:
Non-material changes (spelling fixes, clarifications) we'll make silently.
Kevin McEnaney — privacy@getcoachly.fit
Postal address (for GDPR-required correspondence only): available on request via the email above.