Privacy Policy

From everyone: account details such as your name, email address, and the password you set (stored only as a secure hash, never in plain text). We also collect basic usage and device information to keep the Service running and secure.

From coaches: your business name, branding, bio, invite code, client roster, programs, messages, and information associated with any previously connected Stripe account. New payment setup is disabled during free access. We store a public encryption key for you, and your private key only in a form encrypted by your own password.

From clients: your goals, check-ins, workouts, habits, measurements, nutrition logs, messages, progress photos, and any health documents you upload. Progress photos are stored in private, access-controlled storage. Health documents are end-to-end encrypted on your device before they reach us.

Health documents are encrypted in your browser using strong encryption (AES-GCM) before they are uploaded. The key that protects them is derived from your encryption password and is never sent to us. We store only the encrypted file and encrypted key material. This means PowerfulU cannot read your health documents - the platform has zero access to their contents.

When you choose to share a document with your coach, your device additionally wraps that document’s key to your coach’s public key, so only your coach can decrypt it. We generate a one-time recovery key for you at setup so you can regain access if you forget your password; if you lose both, your documents cannot be recovered by anyone, including us.

• You can always access your own data and your own encrypted documents.
• Your coach can access standard coaching data (programs, check-ins, messages, progress) and can decrypt a health document only when you have shared it and the relationship is active.
• PowerfulU can access operational and account data to run the Service, but cannot decrypt your end-to-end encrypted health documents.

We log when a coach opens a shared document and show it to you as part of your audit trail.

We use information to provide and improve the Service, authenticate you, deliver coaching features, process payments (via Stripe), provide support, maintain security and prevent fraud, and comply with legal obligations. We do not sell your personal information.

AI-generated insights. Check-in responses, habit and workout data, training goals, and injuries or limitations you record may be processed by AI to generate coaching insights, reflections, and workout programming that trains around your injuries.

What we never send to an AI provider: health-document contents, progress photos, payment details, and email addresses.

Health signals are sent without your name.Where we process anything health-related - check-in answers, injuries or limitations, body measurements - the request carries no name, so it reaches our AI provider as an anonymous coaching signal rather than an identifiable health record. Free-text clinical notes on an injury stay on our servers; only the structured injury title, body area, and severity are used for programming. When AI drafts a coach’s reply to your check-in, your name is not part of the request - your coach personalizes it before sending.

One exception, and it involves no health data: when a coach asks their assistant about their own roster, it receives client first names alongside engagement information only - consistency score, how recently someone checked in, and assigned program. Injuries, check-in answers, and body measurements are never included there.

Optional PowerfulU coaching subscriptions and existing payment arrangements are processed by Stripe. PowerfulU stores subscription status, Stripe customer and subscription identifiers, billing-period dates, cancellation status, and records of your agreement to membership terms. Coaching preferences you submit are shared with your coach to prepare your coaching. Card and bank details are collected and stored by Stripe, not by PowerfulU - we never store your full card number on our servers. Stripe’s handling of payment data is governed by Stripe’s own privacy policy.

We rely on trusted providers to operate - including Supabase (database, authentication, and encrypted file storage) and Stripe (payments). They process data on our behalf under agreements that require appropriate safeguards, and only as needed to provide their services.

Exercise tutorials from YouTube. Movement guides use YouTube’s official player in privacy-enhanced mode. Visible tutorials may play automatically with sound muted. Loading the player and playing a video shares device, network, and playback information with Google/YouTube; privacy-enhanced mode does not make playback anonymous. Your coaching records are not passed to the player. Browser settings can block playback. Source links let you open the original tutorial on YouTube. See Google’s Privacy Policy and YouTube’s Terms of Service.

We keep your information for as long as your account is active or as needed to provide the Service. You can delete individual documents at any time (permanent, no recovery). Deleting your account permanently deletes your health documents, progress photos, and associated records. We may retain limited information where required for legal, tax, accounting, or fraud-prevention purposes, and backups may persist for a limited period before being overwritten.

You can access and update most of your information directly in the app. You may request a copy of your personal data, ask us to correct it, or ask us to delete it. You can delete your account yourself at any time from Settings. To make a request, contact us at the address below - we’ll verify your identity before acting.

If you are a California resident, you have the right to know what personal information we collect and how we use and disclose it; to request access to or deletion of your personal information; to correct inaccurate information; and to not be discriminated against for exercising these rights. We do not sell or share your personal information as those terms are defined under California law. To exercise your rights, contact us at privacy@powerfulu.app; you may use an authorized agent where the law allows.

We use industry-standard safeguards including encryption in transit, encrypted-at-rest storage, row-level access controls, and - for health documents - end-to-end encryption that even we cannot bypass. No system is perfectly secure, but we work hard to protect your data and to limit who can access it.

The Service is intended for adults (18+) and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make material changes, we’ll revise the “Last updated” date and, where appropriate, notify you in the app or by email. Please review it periodically.

Questions or privacy requests? Email privacy@powerfulu.app.