Privacy Policy

We collect information you provide directly when you:

• Fill out the contact or enquiry form (name, email, phone, goal)
• Register for a client account (name, email, password hash)
• Submit weekly check-ins, progress measurements, or daily logs
• Book a training session or send a message through the portal
• Subscribe to the newsletter

We also automatically collect limited technical data such as your IP address, browser type, and pages visited for security and analytics purposes.

Your information is used solely to:

• Deliver and personalise your training and nutrition coaching
• Communicate with you about sessions, check-ins, and progress
• Send you workout plans, meal plans, and coaching materials
• Process session bookings and invoices
• Improve the website and client portal experience
• Send transactional emails (session reminders, feedback notifications)

We will never use your data for unrelated marketing without your explicit consent.

We do not sell, rent, or trade your personal information. We may share data only with:

• Service providers — e.g. email delivery (SMTP), database hosting (MongoDB Atlas), and deployment infrastructure. These providers are contractually bound to protect your data.
• Legal requirements — if required by law or to protect our rights.

No third-party advertisers or analytics platforms receive your personal data.

We use a single session cookie to keep you logged in to the client portal. This cookie:

• Is HTTP-only and cannot be accessed by JavaScript
• Expires after 4 hours of inactivity
• Is not used for tracking or advertising

No third-party tracking cookies are set on this website.

We take reasonable technical measures to protect your data, including:

• Passwords are hashed using Werkzeug's PBKDF2-SHA256 — never stored in plain text
• All connections are served over HTTPS
• Security headers (CSP, X-Frame-Options, HSTS) are applied on every response
• Rate limiting is applied to login and form submission endpoints

No system is 100% secure. If you suspect a breach, please contact us immediately.

We retain your data for as long as your account is active or as needed to provide services. You may request deletion of your account and associated data at any time by contacting us. Anonymised analytics data may be retained indefinitely.

You have the right to:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate data
• Deletion — request that we delete your account and data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing of your data

To exercise any of these rights, contact us using the details below.

Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal information, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of our services after changes constitutes acceptance of the updated policy.

For any privacy-related questions or requests, please reach out: