How Trainerflow handles your data

Who is responsible

The service at trainerflow.com and the Trainerflow apps for iOS and Android are operated by Gerasimos Athanasopoulos. For anything in this policy, write to support@trainerflow.com.

What we collect

• Account details: your email address, a username, your full name and the role you hold (trainer, athlete or trainee).
• Sign-in credentials. Passwords are stored hashed; we never see or store them in plain text. The mobile app keeps a sign-in token in your device's secure storage so you stay signed in for up to 30 days.
• Profile details you choose to add: a photo, date of birth, gender and a short bio.
• Training content: the programs you write, the runs of those programs, and every value you enter while running one — loads, repetitions, times, distances and other measurements. These values can say something about your health and fitness. We process them only to run your program and to show you and your trainer your history.
• Notes you post to a run: what you write and the photos and videos you attach. Photos are re-encoded on your device before they are uploaded, and videos are converted on our servers; both steps drop the location and other details a camera embeds in the file.
• Coaching links: which trainer works with which trainee, and the invitations that created the link.
• Conversations with the AI assistant in the program editor, including the program context you attach to them.
• Emails we send you (welcome, invitations, account notices) and whether they were delivered.
• Technical data in server logs: IP address, browser or device type, the pages and endpoints you call, and timestamps. Logs are rotated and deleted automatically.
• A session cookie and an anti-forgery token on the web. The editor also caches your working files and layout in your browser's local storage so it opens where you left it. None of this is used to track you across other sites.

Why we process it

• To provide the service you signed up for: sign you in, store and run your programs, connect you with your trainer or trainees, send the emails the service needs.
• Because you asked us to: the workout values you enter are health-related data that we process with your consent, given by entering them. You can stop at any time and delete them with your account.
• In our legitimate interest to keep the service secure and working: logs, abuse prevention, debugging.
• To meet legal obligations, such as accounting records once paid plans exist.

Who else sees your data

Within Trainerflow, a trainee's runs, progress and notes, with their photos and videos, are visible to the trainer who assigned the program, and a trainer's programs are visible to the trainees they assign them to. Nothing is public.

We use a small number of providers to run the service:

• Hetzner Online GmbH (Germany and Finland) hosts our servers, database, storage and backups. Your data stays in the European Union.
• OpenAI processes the messages you send to the AI assistant, together with the program context you attach. Those messages can include training and health-related details if you write them in. OpenAI is based in the United States, so this content leaves the European Union. Under OpenAI's API terms it is not used to train their models. The assistant is only available in the web editor; the mobile app never sends anything to OpenAI.
• Resend delivers the emails we send you, from its EU region.
• Grafana Labs stores our server logs and server health metrics, in its EU region in Germany.
• Stripe will process payments once paid plans launch. We never see your full card details.

We do not sell your data, we do not show advertising, and neither the site nor the apps include third-party analytics or tracking SDKs.

The mobile app

The iOS and Android apps use the same account and the same data as the website. They store your sign-in token in the device's secure storage, ask for access to your photo library only when you attach a photo or video to a note, and use the device's vibration for haptic feedback only. They contain no advertising, analytics or tracking.

How long we keep it

• Account and training data: until you delete your account.
• Notes and their photos and videos: until you delete the note or your account. A photo or video uploaded but never posted is deleted after a day.
• Server logs: up to 30 days, then deleted automatically.
• Encrypted backups: a daily snapshot is kept for 30 days and a weekly one for 8 weeks, so a deleted account leaves the last backup within about two months. Backups are never restored except to recover the service after a failure.
• Web sessions: 30 days of inactivity; mobile sign-in tokens: 30 days.

Your rights

You can access, correct, export or erase your data, restrict or object to its processing, and withdraw consent at any time. Most of it you can do yourself: your profile and preferences are editable in the app, and you can delete your whole account from your profile page. For anything else write to support@trainerflow.com and we will answer within 30 days. You may also complain to the data-protection authority where you live.

Deleting your account

Go to your profile on trainerflow.com and choose Delete account, or ask us by email. Deletion is immediate and permanent: your profile, programs, runs, workout values, notes with their photos and videos, chats and coaching links are removed. Trainees of a deleted trainer keep their own accounts but lose the programs that trainer assigned.

Security

Traffic is encrypted in transit with TLS. Passwords are hashed with a modern algorithm. Data is hosted in the European Union on servers only the operator can reach, and access is logged. If we ever learn of a breach affecting you, we will tell you without undue delay.

Children

Trainerflow is not directed at children under 16, and we do not knowingly hold their data. Trainers who work with minors must have the consent of a parent or guardian before inviting them.

Changes

When this policy changes we update the date at the top. If a change affects what we do with your data, we email you before it takes effect.