Privacy

The short version

• We keep what a coach and a client need in order to train together: accounts, programs, check-ins, photos, messages, and a record of payments made offline.
• Access is enforced inside the database, not just in the interface. A coach sees their own clients. A client sees their own record. Nobody sees anything else.
• There are no analytics scripts, no advertising networks, no trackers and no payment processor. Nothing about you is sold or shared with anyone for marketing.
• You can delete your account from inside the app at any time, and it takes your data with it.

Who is responsible for your data

CoachRocket is run by an individual, not a company — there is no registered office to publish. Write to support@coachrocket.app with a question about anything on this page and a person will answer you. If you need a postal address for a formal or legal purpose, ask at that address and one will be provided.

If you are a client, your coach also decides a great deal about your data: they choose what to record about you and what to write to you. For that part, your coach is responsible alongside us.

What we hold

Grouped the way the product actually stores it.

Your account

Your email address and a password, held by the sign-in service; and, in your profile, your name, your avatar photo, whether the account is a coach or a client, your chosen language, your calendar preference (Gregorian or Jalali) and your time zone. Coaches can also add a bio, a specialty, years of experience and a personal handle used in the join link they share.

Who you train with

The link between a coach and a client and its status (pending, active, paused or ended), invite codes a coach has generated, client groups, and — where a gym uses CoachRocket — gym membership, which coaches belong to that gym, class schedules, who enrolled in a class, and door passes including the time of the last check-in.

Training and nutrition content

Routines, their sessions and their exercises with instructions, images and videos; the exercise library and a coach's favourites; meal plans and their meals; and the shared food catalogue plus any foods a coach adds.

What a client records

Completed sessions and exercises with any notes; per-set logs of reps, weight and perceived effort; a daily food log with servings, calories, macros and an optional photo; and the answers to any intake form a coach asked to be filled in, including photos attached to it.

Weekly check-ins and body measurements

A weekly check-in stores body weight, height, a rating from 1 to 5 for energy, sleep and pain, a free note to the coach, and any photos attached. Separately, body measurements store weight, height, body-fat percentage and chest, waist and hip girths, dated. A coach can write a weekly review note back.

Photos, video and files

Progress photos, chat attachments (images, voice notes and PDFs), routine images and videos, and avatars. All four storage buckets are private: there is no public link to any file, and every read is checked against the same rules described below.

Messages

The one-to-one thread between a coach and a client: message text up to 4,000 characters, any attachment, when it was sent and when it was read.

The payment ledger

Money is arranged between a coach and a client outside CoachRocket. What we store is the record of it: the amount, the currency, the method (cash, transfer, card in person, or other), the date, a reference number if one is entered, a free note, and who recorded it. We never see a card number, a bank login or an account balance, because no payment ever passes through the product.

Coach billing

For coaches: which plan you are on with its status and end date, the packages you activated for your clients, and — where the arrangement calls for it — your prepaid deposit balance and its ledger, your monthly invoices, and any revenue-share percentage agreed in advance. Clients are never billed by us and have no billing data of their own here.

What other signed-in people can see about you

If a coach publishes a listing in the coach marketplace, that listing — its headline, city, languages and specialties — and the star ratings and review text clients have written about them are readable by anyone signed in. So are avatars, and the display name, colours and logo of a coach's or a gym's brand. Nothing at all is readable by somebody who is not signed in.

Push notifications

There is a place to store a device push token so the app can notify you. The feature is not finished and the app does not currently register one. When it does, the token identifies a device rather than a person, and it is deleted with your account.

Technical records

The server keeps ordinary web-server and database logs — an IP address, a timestamp, the request — for security and debugging. They are not used to build a profile of you and they are not shared.

Health information

Some of what a client enters is health information: a pain score, body weight and girths, progress photos, and whatever is written in a check-in note or an intake form. This is sensitive, and CoachRocket treats it that way.

It is entered by the client, not collected by us in the background, and it goes to one place: the coach that client is actively working with. It is never used for anything else.

What we do not do

This list is short on purpose, and it is exhaustive.

• No analytics, no tracking pixels, no session recording and no advertising network — on the website or in the app.
• No third-party payment processor. No card numbers, ever.
• No selling, renting or sharing of anyone's data for marketing, by us or by anyone else.
• No external AI service. Workout and meal drafts are generated by the product itself; nothing you write is sent to an AI provider.
• No location tracking. A gym door pass records the time you checked in, not where you are.
• No data broker, no enrichment service, no CRM sync.

Who can see what

Access is enforced by row-level security inside PostgreSQL — a rule attached to each table that the database applies to every single query, whichever screen or device the request came from. Hiding part of the interface is not what protects your data; these rules are.

• A client can read and write their own record and nothing belonging to another client: their check-ins, measurements, photos, food log, set logs and messages.
• A coach can read a client's logs, check-ins, measurements, progress photos and intake answers only while a coaching relationship exists between them. The client's profile itself is visible to the coach only while that relationship is active, so pausing or ending it closes the door again.
• A client can read the routines, meal plans, exercises and offerings of their own coach, and no other coach's.
• A message thread and its attachments are readable only by the two people in it.
• Progress photos are readable by the client who uploaded them and, while the relationship is active, by their coach. Chat files are readable only by the two people in the thread. Neither has a public link.
• Avatars are readable by anyone signed in, because coaches and clients need to see each other's profile photo. Do not use an avatar you would not show to another user of the product.
• A gym owner and the coaches attached to that gym can see that gym's membership, classes and enrolments.
• We — the operators of the platform — can see account records including email addresses, plans, subscriptions, invoices and the payment ledger, because coach plans are activated by hand after an offline payment and because somebody has to be able to answer a support request. We do not read message threads, check-ins or photos as a matter of course, and we do not use anyone's data for any purpose other than running and supporting the service.

Somebody who is not signed in has no access to anything. The database role used by anonymous visitors is granted nothing at all.

Where it is kept

Everything runs on a single server that we operate ourselves, at OVHcloud, on a server in the United States, using a self-hosted Supabase stack: PostgreSQL for the data, GoTrue for sign-in, and Supabase Storage for files. There is no other company holding a copy. Traffic between your device and the server is encrypted.

Backups are taken so that a failure does not lose your work. They are held for 7 days and then overwritten.

How long it is kept

Your data stays for as long as your account exists. There is no automatic expiry, because a training history that quietly deletes itself is worse than useless to a coach.

When an account is deleted, everything hanging from it goes with it — profile, relationships, check-ins, measurements, photos, messages, logs and subscriptions all cascade. Where a coach wrote something that outlives the relationship, such as a routine they built and assigned to you, that routine stays with the coach and your name is detached from it.

Financial records — the payment ledger, invoices and deposit entries — may need to be kept for accounting for 7 years even after an account closes. Deleted data can also survive in a backup until that backup is overwritten.

What you can do

You can see and correct almost everything about yourself from inside the app: your profile, your language and calendar, your check-ins, your measurements, your photos and your food log. Coaches can export their client list and payment ledger to CSV.

You can delete your account yourself, at any time: Settings, then Delete account. You confirm by typing your email address. This runs a deletion on the server that removes your login and, through the database's own cascade rules, your profile and the data attached to it. It is immediate and it cannot be undone.

If you would rather have a full copy of your data, or want us to delete something specific, write to support@coachrocket.app from the address on your account and we will do it.

If you are a client and want something your coach recorded about you removed, ask your coach first — it is their record of your work together. If that goes nowhere, write to us.

Age

CoachRocket is meant for adults. Accounts are not for anyone under 16. If a coach trains a minor, the account should belong to a parent or guardian, who is responsible for what is entered.

Changes to this page

If what we hold or how it is protected changes, this page changes with it and the date at the top moves. A change that materially affects you will be announced in the app rather than quietly published here.

Contact

Write to support@coachrocket.app. CoachRocket is operated by an individual rather than a company, so that address is the formal contact point as well as the everyday one; a postal address is provided on request.

Read the terms of service