Privacy Policy

Effective Date: September 19, 2026

Last Updated: September 19, 2026

1. Introduction

Trainary Inc. ("Trainary," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application (the "App"), website at trainary.fit (the "Website"), and related services (collectively, the "Services").

By accessing or using our Services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with the terms of this Privacy Policy, please do not access or use our Services.

2. Information We Collect

2.1 Information You Provide Directly

We collect information that you voluntarily provide when you register for, or use, our Services, including:

• Account Information: Name, email address, and authentication credentials (via Apple Sign-In).
• Profile Information: Role and account type (coach, client, studio owner, or self-coached), fitness goals, physical limitations or injuries you choose to record, and profile preferences.
• User-Generated Content: Workout programs, exercise definitions, workout notes, custom exercises, body measurements, and other content you create within the App.
• Coach-Client Data: Invitation codes, connection data, workout assignments, workout results, and session logs exchanged between coaches and clients.
• Body Measurements: Weight, chest, waist, arm circumference, and other body composition data you voluntarily enter, including BIA (Bioelectrical Impedance Analysis) data.
• Communications: Information you provide when contacting our support team.
• Progress Photos: Photos of a client's body from up to four angles on a given date, added by the client or by their coach. See Section 2.6.
• Messages: Chat messages, photos and videos exchanged between a coach and a client. See Section 2.7.
• Public Coach Page: If you are a coach and create a public alias, the name, social links and activity statistics you choose to show on your page. See Section 6.1.
• Studio Data: For studio owners and seated coaches: the studio name, seat assignments and invite codes, and prepaid session entries recorded for clients.

2.2 Information Collected Through Photo Import

When you use an import or extraction feature, the images, documents or spreadsheets you capture or select are processed to extract structured data: photos of handwritten programs (exercises, sets, reps), photos of notes from a completed workout (what was actually lifted), spreadsheets, and BIA body composition reports as PDF or images. Images are processed using third-party AI services and are not stored permanently on our servers after processing is complete. We do not use imported images for any purpose other than extracting workout data at your request.

2.3 Health and Fitness Data (Apple HealthKit)

With your explicit permission, Trainary integrates with Apple's HealthKit framework to:

• Read: Workout data, heart rate, active energy burned, and related health metrics to display analytics and insights within the App.
• Write: Workout data (start time, end time, calories burned, duration) to HealthKit when you complete a workout in Trainary, so your Activity Rings and health records are updated.

Apple HealthKit Data Protections:

• HealthKit data is never used for advertising, marketing, or data mining purposes.
• HealthKit data is never sold, shared with, or disclosed to third parties, including advertising platforms, data brokers, or information resellers.
• HealthKit data is never used to determine insurance eligibility, lending decisions, or for any purpose other than providing health and fitness functionality within the App.
• HealthKit data is stored only on your device and in your secure, authenticated cloud account. It is not stored in any third-party analytics or advertising system.

2.4 AI-Processed Data

Trainary uses artificial intelligence for session summaries and reports, for extracting data from photos and documents, and for comparing progress photos. Depending on the feature, the following may be sent to our AI provider:

• Session data: exercises, sets, reps, weight, RPE, tempo, rest, duration and volume of the workout being analysed.
• Client context you or your coach have entered, when it is available and relevant to the report: age, sex, height, weight, body measurements, BIA results, and any physical limitations or injuries recorded on the profile. Limitations and injuries are health data; we process them for this purpose only on the basis of the explicit consent you give when you record them and use an AI feature.
• Documents and images you submit for extraction: photos of handwritten programs or workout notes, spreadsheets, and BIA reports (Section 2.2).
• Progress photos, only when you or your coach request an AI comparison of two dates, and only the angles being compared. Faces are blurred on your device before any photo is uploaded, so the AI provider never receives an unblurred face (Section 2.6).

Session summaries (the muscle map and muscle-balance radar) are generated when a session is completed. Written reports, extractions and photo comparisons run only when you or your coach start them.

• Our AI provider is Google (Gemini API), used under Google's paid API terms, under which Google does not use the content of requests to train its models. We do not use your data to train AI models either. Images and documents submitted for extraction are not retained by us after the extraction completes.
• AI-generated reports, comparisons and extracted data are provided for informational purposes only and can be inaccurate. They are not medical, nutritional or professional health advice, whatever a report is called in the App.

2.5 Automatically Collected Information

We automatically collect certain information when you use our Services:

• Device Information: Device model, operating system version, unique device identifiers, and mobile network information.
• Usage Data: App interaction metrics (screens visited, features used, buttons tapped), session duration, and frequency of use.
• Crash Data: Crash logs, stack traces, and diagnostic information to help us improve App stability.
• Log Data: IP address, browser type, access times, and referring URLs when you visit our Website.

2.6 Progress Photos

A coach or a client can add progress photos to a client's record — up to four angles (front, back, left, right) per date — to review changes in body composition over time.

• Face blurring on the device: before a photo leaves your device, the App detects faces and blurs them. If face detection fails, the upload is refused rather than sending an unredacted photo. Photos remain personal data even with the face blurred (body, tattoos, surroundings), and we treat them as such.
• Storage and access: photos are stored in Google Cloud Storage (Firebase) under your account and are visible only to the client, their coach, and, where the coach works in a studio, the studio owner and a covering coach as described in Section 5.1.
• AI comparison: only when requested, and only for the two dates being compared (Section 2.4). The resulting reading is stored on the later photo record so it does not have to be regenerated.
• Retention and deletion: photos are kept until you delete the record or your account; deleting your account deletes the photo files as well as the records.
• Consent: a coach may add photos of a client only with that client's permission, and never of a person under 16 without a parent's or guardian's consent (see the Terms of Usage).

2.7 Messaging

Coaches and clients can message each other in the App. We process the messages, photos and videos you send (video uses the camera and microphone with your permission), read receipts, and the time of each message. Conversations are stored in Cloud Firestore and Cloud Storage and are visible to both participants. Deleting your account removes your conversations from your side; the other participant keeps their copy until they delete it. Message previews may appear in push notifications on the recipient's device.

2.8 Push Notifications

With your permission we send push notifications — for example when a session is assigned, handed over or completed, when you receive a message, or when a studio seat changes. To deliver them we store a device token issued by Firebase Cloud Messaging. You can turn notifications off in your device settings at any time; the token is removed when you delete your account.

3. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom (UK), or Switzerland, we process your personal data based on the following legal grounds:

• Contract Performance: Processing necessary to provide you with the Services you requested (account management, workout tracking, coach-client features).
• Consent: Processing based on your explicit consent (HealthKit integration, photo import, AI features). You may withdraw consent at any time.
• Legitimate Interests: Processing necessary for our legitimate business interests (analytics, App improvement, security), provided these interests do not override your fundamental rights.
• Legal Obligation: Processing necessary to comply with applicable laws and regulations.

4. How We Use Your Information

We use the information we collect for the following purposes:

• Provide, operate, maintain, and improve the Services.
• Facilitate the coach-client relationship, including workout assignment, session logging, and progress tracking.
• Generate AI-powered session reports and workout insights.
• Process photo and spreadsheet imports to extract workout data.
• Sync your data across devices using Firebase Authentication and Cloud Firestore.
• Monitor and analyze usage trends and preferences to improve user experience.
• Detect, prevent, and address technical issues, fraud, and security incidents.
• Communicate with you regarding your account, updates, security alerts, and support.
• Comply with legal obligations and enforce our Terms of Usage.

5. Coach-Client Data Relationship

Trainary facilitates a coach-client relationship where coaches create and assign workout programs to clients:

• Coaches can view their connected clients' workout results, body measurements, progression data, and session summaries. This data sharing is necessary for the coaching functionality and is consented to by the client when they accept a coach's invitation.
• Clients can disconnect from a coach at any time, which will revoke the coach's access to their future data.
• Coaches are responsible for their own use of client data and must comply with all applicable privacy laws in their jurisdiction.
• Trainary acts as a data processor on behalf of coaches (data controllers) with respect to client workout and health data managed through the coaching relationship.

5.1 Studios

A coach may work as part of a studio run by another Trainary user (the studio owner). When your coach holds a seat in a studio:

• The studio owner can see the list of everyone training at the studio, each client's coach and basic activity, and the prepaid session entries recorded for clients.
• When the studio owner assigns a colleague to cover your coach's day, the covering coach can see and run those sessions.
• If your coach leaves the studio, the owner may move you and your training history to another coach in the same studio.
• The studio owner also sees activity statistics for the coaches seated in the studio.

For client data processed within a studio, the studio owner and the coaches are the data controllers and Trainary acts as their processor. The owner and coaches are responsible for informing clients about the studio and for having a lawful basis for this sharing.

5.2 Self-Coached Accounts and Session Handover

• A self-coached (solo) account uses the coach tools for its own training and shares nothing with anyone. If you later join a coach with an invitation code, your profile and your training data from that point on become visible to that coach.
• When a coach hands a session over to a client, the client finishes logging it on their own device; what the client logs is added to the same session record and is visible to both.

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: We share data with trusted third-party service providers who assist us in operating the Services, subject to confidentiality obligations:
  • Google/Firebase: Authentication (Firebase Auth), database hosting (Cloud Firestore), file storage for photos and chat media (Cloud Storage), server-side processing (Cloud Functions), push delivery (Firebase Cloud Messaging), analytics (Firebase Analytics), and crash reporting (Firebase Crashlytics). Google's privacy policy: policies.google.com/privacy.
  • Apple: Authentication (Sign in with Apple) and health data sync (HealthKit). Apple's privacy policy: apple.com/privacy.
  • Google (Gemini API): Our AI provider for session reports, extraction from photos and documents, and progress-photo comparison, as described in Section 2.4. Data sent is limited to what the specific feature needs.
  • Meta Platforms: The App includes the Facebook SDK for iOS so we can measure the performance of our advertising campaigns: it reports app installs and standard in-app events (launches and in-app purchases) to Meta. Advertiser ID collection is disabled in the SDK and we do not use it to track you across other companies' apps or websites. Meta's privacy policy: facebook.com/privacy/policy.
• Coach-Client Sharing: Workout data, measurements, and session results are shared between connected coaches and clients as part of the core Service functionality.
• Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice within the App before your information becomes subject to a different privacy policy.
• With Your Consent: We may share your information for any other purpose with your explicit consent.

6.1 Public Coach Pages, Leaderboard and Shared Links

• Public coach page: a coach can create a public alias, which publishes a page at trainary.fit/t/<alias> showing the coach's name, the social links they add, and activity statistics (numbers of clients, completed sessions, programs and exercises). The page is visible to anyone on the internet. Clearing the alias in Profile takes the page down.
• Coach leaderboard: coaches are ranked against other Trainary coaches by training activity; the ranking shows a coach's name and activity totals to other coaches, never client data. You can leave the leaderboard at any time with the switch in Profile.
• Shared workout links: when a coach shares a workout as a link, a copy of that workout (exercises and prescription, no client data) becomes readable by anyone with the link.

7. Data Storage, Security, and International Transfers

Your personal data is stored on Google Cloud Platform (Firebase) servers. These servers may be located in the United States or other countries outside your country of residence.

If you are located in the EEA, UK, or Switzerland, your data may be transferred to and processed in countries that may not provide the same level of data protection as your home country. In such cases, we rely on:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions by the European Commission for certain countries.
• Your explicit consent where applicable.

We implement industry-standard security measures to protect your information, including:

• Encryption in transit (TLS/SSL) and at rest.
• Firebase Security Rules restricting data access to authenticated users.
• Apple Sign-In for secure authentication without password storage.
• Regular security reviews and monitoring.

However, no method of electronic transmission or storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee its absolute security.

8. Data Retention

• Account Data: We retain your personal data for as long as your account is active or as needed to provide you with our Services.
• Workout and Session Data: Retained for the duration of your account to provide progression tracking and historical analytics.
• Analytics Data: Aggregated and anonymized analytics data may be retained indefinitely for product improvement purposes.
• Photo Import Data: Images submitted for photo import are processed in real-time and are not retained after the extraction is complete.
• After Deletion: When you delete your account, we will delete or anonymize your personal data within 30 days, except where retention is required by law or for legitimate business purposes (e.g., fraud prevention, legal disputes). Backup copies may persist for up to 90 days before being purged.
• Progress Photos: Kept until you delete the photo record or your account.
• Messages: Kept until a conversation or account is deleted; the other participant's copy remains until they delete it.
• Public Page and Shared Links: Public until you clear your alias or delete your account; shared workout copies are removed with the account that shared them.

9. Your Rights and Choices

9.1 All Users

Regardless of your location, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Delete your account and associated data via the "Delete Account" option in the App's Profile settings or by emailing us.
• Withdraw Consent for HealthKit integration at any time via your device's Settings.
• Opt Out of analytics data collection by contacting us.
• Leave the Coach Leaderboard with the switch in Profile.
• Take Down Your Public Page by clearing your alias in Profile.
• Remove Progress Photos or Messages at any time from the record or the conversation.

9.2 EEA, UK, and Swiss Residents (GDPR)

In addition to the rights above, you have the right to:

• Data Portability: Receive your personal data in a structured, commonly used, machine-readable format.
• Restrict Processing: Request restriction of processing of your personal data under certain circumstances.
• Object to Processing: Object to processing based on legitimate interests.
• Lodge a Complaint: File a complaint with your local data protection authority.

To exercise these rights, contact us at support@trainary.fit. We will respond to your request within 30 days.

9.3 California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Opt-Out of Sale: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Correct: You may request correction of inaccurate personal information.

To submit a request, email us at support@trainary.fit. We will verify your identity before processing your request and respond within 45 days.

10. Children's Privacy

You must be at least 18 to use Trainary as a coach or studio owner, and at least 16 to use it as a client. A client aged 16 or 17 may use the Services only with the consent of a parent or legal guardian. We do not knowingly collect personal information from anyone under 16, and coaches may not record health information or progress photos of a person under 16 without a parent's or guardian's consent. If you believe a child has provided us with personal information, or a coach has recorded information about a child without such consent, contact us at support@trainary.fit and we will delete it.

11. Cookies and Tracking Technologies

Our Website may use cookies and similar tracking technologies to enhance your experience. These include:

• Essential Cookies: Necessary for the Website to function properly.
• Analytics Cookies: Help us understand how visitors interact with the Website (Firebase Analytics).

You can control cookie preferences through your browser settings. Disabling cookies may affect Website functionality.

12. Do Not Track Signals

Some browsers transmit "Do Not Track" (DNT) signals. We currently do not respond to DNT signals, as there is no industry standard for compliance. However, we do not engage in cross-site tracking of our users.

13. Third-Party Links

Our Services may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party services you access.

14. Data Breach Notification

In the event of a data breach that compromises the security of your personal data, we will:

• Notify affected users via email and/or in-App notification without undue delay and within 72 hours of becoming aware of the breach (as required by GDPR where applicable).
• Notify the relevant supervisory authority where required by law.
• Provide details about the nature of the breach, the data affected, and the steps we are taking to address it.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Notify you via email or in-App notification for material changes.
• Where required by law, obtain your consent before applying changes to the processing of your data.

Your continued use of the Services after changes are posted constitutes your acceptance of the updated Privacy Policy.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Trainary Inc.
Email: support@trainary.fit

For GDPR-related inquiries, you may also contact your local data protection authority.