Mobile App Privacy Policy

This Policy applies to personal information collected through the TrainerStack client mobile app on iOS and Android. It applies to Clients who create an account and link to a Trainer using an invitation.

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). Where applicable, we also comply with the EU and UK General Data Protection Regulations (GDPR), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), the New Zealand Privacy Act 2020, and Canada's PIPEDA, to the extent they apply to our processing.

The App is a tool your Trainer uses to deliver personal training and coaching services to you. Your Trainer is the controller (or APP entity / business) of the coaching information about you that flows through the App — including your training data, check-ins, photos, and any health data you choose to share. TrainerStack acts as a processor (or service provider), handling that information only to operate the App and on your Trainer's documented instructions, as set out in our Terms of Service.

For a limited set of information we collect directly to run the App — such as your login credentials, device push token, and diagnostic data — TrainerStack is the controller. For questions about how a particular Trainer uses your information, please contact that Trainer directly. You can contact our Privacy Officer at privacy@trainerstack.pro.

3.1 Information you provide

• Account information — email address and password (stored hashed by our authentication provider);
• Profile information — your name and, if you add one, a profile photo (avatar);
• Training and coaching data — workout logs (sets, reps, weights, completion), program progress, calendar and session activity, exercise history and notes;
• Check-ins — the responses, measurements, and progress photos or videos you submit to your Trainer;
• Nutrition and wellness data — food and meal logs, water intake, and body metrics you enter (such as body weight);
• Communications — messages, feedback, and support requests you send.

3.2 Health and fitness data (with your permission)

If you connect a health source, the App reads the following categories to display your activity on your dashboard and share it with your Trainer:

• Steps and sleep data read from Apple Health (HealthKit) on iOS or Health Connect on Android;
• Steps and sleep that your wearables and other apps (for example Garmin, Fitbit, Oura, Samsung Health, Whoop, Polar) write into Apple Health or Health Connect and that then flow into the App.

The App only reads steps and sleep; it does not write data back to Apple Health or Health Connect. Access is granted by you through the operating system's permission prompt and can be changed or revoked at any time in your device's Health / Health Connect settings. See Section 6 for how we handle health data.

3.3 Camera and photos

• Camera — used to take progress photos for check-ins and to scan food barcodes. Barcodes are used only for a real-time product lookup and are not retained as images;
• Photo library — used, with your permission, to attach existing photos to your profile or check-ins.

3.4 Information collected automatically

• Device and connection data — device type, operating system, app version, language, and time zone;
• Push notification token — an identifier that lets us deliver notifications from your Trainer (for example session reminders);
• Log and diagnostic data — error reports and basic performance information used to keep the App working.

The App does not contain third-party advertising SDKs, and does not track you across other companies' apps or websites for advertising.

3.5 Information from third parties

When you use the barcode scanner or search foods, product information is retrieved from the public Open Food Facts database. Your search terms are sent to that service to return results; we do not send your identity.

The App requests the following permissions. Each is optional, is only used for the stated purpose, and can be changed at any time in your device settings. Declining a permission simply disables the related feature.

We use personal information collected through the App to:

• Create and secure your account and link you to your Trainer;
• Deliver your training program, workouts, calendar, and nutrition features;
• Let you submit check-ins, photos, and metrics to your Trainer, and let your Trainer coach you;
• Display your steps and sleep and make them available to your Trainer, where you have connected a health source;
• Send notifications you have enabled;
• Provide support, diagnose problems, and maintain the security and integrity of the App;
• Comply with legal, regulatory, and tax obligations, and to establish, exercise, or defend legal claims.

Where the GDPR applies, our legal bases are performance of a contract, our legitimate interests in operating and securing the App, your consent (for example, for health data and device permissions), and compliance with legal obligations.

Specifically, we commit that:

• We do not use health data for advertising, marketing, or any use-based data mining;
• We do not sell health data, and we do not disclose it to third parties for advertising or data brokerage;
• We do not use health data for any purpose other than your health, fitness, coaching, and, where you consent, related research or wellness features you opt into;
• We do not store health data obtained from HealthKit in iCloud;
• Health data is shared only with your Trainer (who is providing your coaching) and the infrastructure providers listed in Section 7 that store it securely on our behalf;
• You can disconnect a health source or revoke access at any time in the App's Connections screen or in your device's Health / Health Connect settings. Previously synced readings remain with your Trainer unless you delete your account.

7.1 With your Trainer

The purpose of the App is to share your training, check-in, nutrition, and (where connected) health data with the Trainer who invited you, so they can coach you. Your Trainer can view this information through their TrainerStack account.

7.2 Service providers (sub-processors)

We share personal information with trusted service providers who help us operate the App. They process information only on our instructions and under written agreements requiring appropriate security and confidentiality:

7.3 Legal disclosures

We may disclose personal information if we believe in good faith it is necessary to: comply with a law, regulation, subpoena, or court order; cooperate with law enforcement or a regulator; enforce our Terms; protect the rights, property, or safety of TrainerStack, our users, or the public; or detect, prevent, or address fraud, security, or technical issues.

7.4 Business transfers

If we are involved in a merger, acquisition, restructuring, sale of assets, financing, or similar transaction, personal information may be transferred to the successor or acquirer. We will notify you and update this Policy if your information becomes subject to a different privacy policy as a result.

7.5 No sale of personal information

We do not sell, rent, or trade personal information for monetary or other valuable consideration, and we have not done so in the preceding 12 months.

The App operates internationally. Personal information may be transferred to, stored in, and processed in countries other than the one in which it was collected, including the United States, Australia, and the European Union, where our service providers operate. These countries may have data protection laws different from those in your country.

Where we transfer personal information out of the European Economic Area, the United Kingdom, or Switzerland, we rely on appropriate safeguards such as the Standard Contractual Clauses or another lawful transfer mechanism. You may request a copy by contacting us. By using the App, where permitted by law, you consent to these transfers.

We implement and maintain reasonable physical, technical, and administrative safeguards designed to protect personal information, including:

• TLS encryption for data in transit and encryption at rest for stored data;
• Hashed and salted password storage;
• Row-level access controls so a Trainer can only access their own Clients' data, and a Client can only access their own;
• Principle of least privilege for staff access, with audit logging;
• Regular security updates, dependency scanning, and vulnerability monitoring.

No method of electronic storage or transmission is completely secure. While we strive to protect your information, we cannot guarantee absolute security. You are responsible for keeping your password confidential and for the security of your own device (Section 12).

We retain personal information only for as long as necessary for the purposes in this Policy, or as required by law.

Deleting your account. You can request deletion of your account and personal data at any time from within the App (Profile → Delete account). Deletion is scheduled and processed within 30 days; signing back in before it is processed cancels the request. Once processed, your data cannot be recovered by you or your Trainer, except for the limited records described above.

Depending on where you live, you may have rights to: access the information we hold about you; have it corrected; request its deletion; restrict or object to certain processing; obtain a portable copy; and withdraw consent where we rely on it. You will not be treated in a discriminatory way for exercising these rights.

Because your Trainer is the controller of most of your coaching data, requests about that data are usually best directed to your Trainer, and we will assist them in responding. For information we control directly, or if you cannot reach your Trainer, contact privacy@trainerstack.pro. We may need to verify your identity, and we will respond within 30 days (45 days for California residents, with possible extensions).

By using the App, you agree that you are responsible for how you use it and for the information you put into it. In particular, you agree that:

• You will provide accurate information and keep it up to date, and you understand that your Trainer relies on it to coach you;
• You will keep your login credentials confidential, and you are responsible for all activity that occurs under your account;
• You will only access your own account and will not attempt to access another person's data;
• You will only upload photos, videos, and content that you have the right to share, and that are lawful and appropriate;
• You will not upload content depicting other identifiable people without their consent;
• You will use the App only for its intended personal fitness and coaching purpose, and in compliance with all applicable laws.

Always consult a qualified healthcare professional before starting or changing any exercise or nutrition program, and stop and seek medical attention if you experience pain, discomfort, or any adverse symptoms. You participate in any training program at your own risk. TrainerStack does not provide medical or allied-health services and is not responsible for the coaching, advice, or programs delivered by your Trainer, who is an independent provider.

TrainerStack provides the App as a platform. To the maximum extent permitted by law:

• Misuse by a Client. If a Client misuses the App or the information in it — for example by entering inaccurate or unlawful information, uploading content they do not have the right to share, sharing their account, accessing data they are not authorised to access, or using the App for any unlawful or unintended purpose — that Client is solely responsible and liable for that misuse and its consequences.
• Misuse by a Trainer. Your Trainer is an independent business and the controller of your coaching data. Your Trainer is solely responsible for how they collect, access, use, disclose, retain, and secure your information, for obtaining any consents required for their use of it, and for the coaching, advice, and programs they provide. TrainerStack is not responsible or liable for a Trainer's acts, omissions, advice, or misuse of your information.
• Allocation of liability. Liability arising from the misuse of the App or of any information within it rests with the party (Client and/or Trainer) responsible for that misuse, and not with TrainerStack. Each user agrees to indemnify and hold harmless TrainerStack, its affiliates, and its personnel from claims, losses, liabilities, and expenses arising out of that user's misuse of the App, breach of this Policy or our Terms, or violation of any law or the rights of another person.
• No warranty of security. While we maintain the safeguards described in Section 9, we cannot guarantee that the App or any transmission will be error-free or completely secure, and, to the extent permitted by law, we are not liable for unauthorised access resulting from a user's failure to safeguard their credentials or device.

This Section is subject to, and does not exclude or limit, any rights or guarantees you have under laws that cannot lawfully be excluded — including the consumer guarantees under the Australian Consumer Law and equivalent protections in other jurisdictions. Nothing in this Policy excludes liability that cannot be excluded by law. Our full liability terms are set out in our Terms of Service, which govern in the event of any conflict on questions of liability.

The App is intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18. If a Trainer coaches a minor, the Trainer is responsible for obtaining any consent required from a parent or guardian. If we become aware that we have collected information from a child without appropriate consent, we will delete it as soon as reasonably practicable.

If a data breach occurs that is likely to result in serious harm, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC) within the timeframes required by the Notifiable Data Breaches scheme, and, where applicable, the relevant supervisory authorities under the GDPR (within 72 hours of becoming aware) and other jurisdictions. Where TrainerStack acts as a processor for your Trainer, we will notify your Trainer without undue delay so they can meet their own obligations.

We may update this Policy from time to time. The "Last updated" date above reflects the most recent version. If we make a material change, we will notify you by in-app notice or email at least 14 days before it takes effect. Your continued use of the App after the effective date constitutes acceptance.

For privacy-related questions or to exercise your rights:

• Privacy Officer: privacy@trainerstack.pro
• Security: security@trainerstack.pro
• Support: support@trainerstack.pro

If you are not satisfied with our response, you may escalate to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or to the data protection authority in your jurisdiction.