Privacy Policy

From everyone: account details such as your name, email address, and the password you set (stored only as a secure hash, never in plain text). We also collect basic usage and device information to keep the Service running and secure.

From coaches: your business name, branding, bio, invite code, client roster, programs, messages, and — if you enable payments — information needed to set up your Stripe connected account. We store a public encryption key for you, and your private key only in a form encrypted by your own password.

From clients: your goals, check-ins, workouts, habits, measurements, nutrition logs, messages, progress photos, and any health documents you upload. Progress photos are stored in private, access-controlled storage. Health documents are end-to-end encrypted on your device before they reach us.

Health documents are encrypted in your browser using strong encryption (AES-GCM) before they are uploaded. The key that protects them is derived from your encryption password and is never sent to us. We store only the encrypted file and encrypted key material. This means PowerfulU cannot read your health documents — the platform has zero access to their contents.

When you choose to share a document with your coach, your device additionally wraps that document’s key to your coach’s public key, so only your coach can decrypt it. We generate a one-time recovery key for you at setup so you can regain access if you forget your password; if you lose both, your documents cannot be recovered by anyone, including us.

• You can always access your own data and your own encrypted documents.
• Your coach can access standard coaching data (programs, check-ins, messages, progress) and can decrypt a health document only when you have shared it and the relationship is active.
• PowerfulU can access operational and account data to run the Service, but cannot decrypt your end-to-end encrypted health documents.

We log when a coach opens a shared document and show it to you as part of your audit trail.

We use information to provide and improve the Service, authenticate you, deliver coaching features, process payments (via Stripe), provide support, maintain security and prevent fraud, and comply with legal obligations. We do not sell your personal information.

AI-generated insights. Check-in responses and habit data may be processed by AI to generate coaching insights and reflections. Health documents are never processed by AI. We never send health-document contents, progress photos, or payment details to any AI provider.

Payments are processed by Stripe. Card and bank details are collected and stored by Stripe, not by PowerfulU — we never store your full card number on our servers. For client memberships, PowerfulU retains a 2% platform fee and the rest is routed to the coach via Stripe Connect. Stripe’s handling of payment data is governed by Stripe’s own privacy policy.

We rely on trusted providers to operate — including Supabase (database, authentication, and encrypted file storage) and Stripe (payments). They process data on our behalf under agreements that require appropriate safeguards, and only as needed to provide their services.

We keep your information for as long as your account is active or as needed to provide the Service. You can delete individual documents at any time (permanent, no recovery). Deleting your account permanently deletes your health documents, progress photos, and associated records. We may retain limited information where required for legal, tax, accounting, or fraud-prevention purposes, and backups may persist for a limited period before being overwritten.

You can access and update most of your information directly in the app. You may request a copy of your personal data, ask us to correct it, or ask us to delete it. You can delete your account yourself at any time from Settings. To make a request, contact us at the address below — we’ll verify your identity before acting.

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to request access to or deletion of your personal information; to correct inaccurate information; and to not be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law. To exercise your rights, contact us at privacy@powerfulu.app; you may use an authorized agent where the law allows.

We use industry-standard safeguards including encryption in transit, encrypted-at-rest storage, row-level access controls, and — for health documents — end-to-end encryption that even we cannot bypass. No system is perfectly secure, but we work hard to protect your data and to limit who can access it.

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we’ll revise the “Last updated” date and, where appropriate, notify you in the app or by email. Please review it periodically.

Questions or privacy requests? Email privacy@powerfulu.app.