← Back to Homepage

Privacy Policy

Last updated: May 26, 2026

1. Introduction & Scope

Welcome to CoachRift ("we", "our", "us"). We respect your privacy and are committed to protecting the personal data of both personal trainers who subscribe to our platform and the clients they invite. This policy explains how we collect, process, and protect your information when using our multi-tenant SaaS application.

2. Data We Collect

Depending on your role on CoachRift, we collect the following categories of information:

  • Account Credentials: Email addresses, password hashes, and display names (managed securely via Supabase Auth).
  • Trainer Profiles: Bio, specializations, branding photos, custom logos, and Instagram links.
  • Client Health & Fitness Data: Workout templates, completion logs, calorie/macronutrient logs, body weight, measurements, progress photos, injuries/pain logs, and supplements list.
  • Real-time Communication: Direct chat logs, announcements, and image/video sharing within the secure message boards.

3. Data Protection & Tenant Isolation

We implement industry-standard database safeguards:

  • Row-Level Security (RLS): PostgreSQL RLS policies isolate all tenant data. A trainer can never query or view files belonging to clients of another trainer.
  • Media Storage Encryption: Progress photos and trainer branding assets are stored in private Supabase Storage buckets, accessible only via short-lived signed URLs (1-hour expiration).
  • Medical Data Policy: We do **not** collect official medical or electronic health records. Pain and injury logs are strictly for fitness planning.

4. GDPR & International Users

For users in the European Union (EU), United Kingdom (UK), and Switzerland, we process data in compliance with the General Data Protection Regulation (GDPR). Your rights include:

  • Right to Access & Portability: You can request a full export of your personal data (workouts, meals, and measurements) in JSON/CSV format at any time.
  • Right to Erasure (Right to be Forgotten): Deleting your account initiates a soft-delete grace period followed by a permanent purge of all profile logs, messages, and photos.
  • Data Processor Details: Trainers act as the Data Controllers for their client logs. CoachRift acts as the Data Processor.

5. Cookie Policy

We use standard session cookies to preserve authentication states and load trainer themes. Non-essential tracking cookies (such as analytics via PostHog) only initialize after you grant explicit consent in our Cookie Banner.

Contact & Support

If you have any questions about your data privacy or wish to request immediate manual account purging, please contact us at privacy@coachrift.com.