Privacy Policy

Coachero (the “Service”) is a SaaS application for personal trainers, operated by Individual Entrepreneur (ФОП) Zhura Serhii Serhiiovych, Ukrainian taxpayer number (РНОКПП) 3636304790, registered address: 52 Ihor Sikorsky St., Novovolynsk, Ukraine (the “we”, “us”, “Coachero”, or “controller”).

For any privacy matter, contact support@coachero.app.

We collect only the data we need to deliver the Service.

Account data:

• phone number (used for authentication via SMS one-time code);
• email address (optional, for receipts and account notices);
• display name, locale (uk / en), time zone;
• profile photo (if you upload one).

Student data you upload about your students:

• display name and optional phone;
• training history, programs, workout logs, measurements, photos, and notes you record;
• booking history.

Usage and technical data:

• booking and program activity, Spark AI interactions;
• device type, browser, IP address, log timestamps;
• product-analytics events (see section 11) and error reports (with personal identifiers redacted).

Payment data:

• web payments are processed by Monobank; we do not store full payment details (your full card number is never shared with us);
• if you opt into auto-renewal, Monobank tokenizes your card and shares with us an opaque payment token and a masked card number (e.g. 537541******0123), used solely to charge your subscription automatically for future periods — you can turn auto-renewal off at any time by cancelling your subscription;
• for purchases made through the App Store or Google Play, the payment is processed by Apple or Google; we receive only subscription identifiers and receipts (purchase tokens) needed to activate your plan.

We collect data directly from you when you sign up, complete your profile, add students, schedule bookings, generate programs, or message Spark AI. Some data is collected automatically as you interact with the Service (logs, device, IP). Some data may come from your students if they connect via the per-student portal link or the Telegram bot.

We process personal data on the following lawful bases under Ukrainian law:

• Performance of contract — to deliver the Service you have subscribed to (these Terms);
• Legal obligation — tax, accounting, and other Ukrainian regulatory requirements;
• Legitimate interest — operating, securing, and improving the Service, preventing fraud and abuse;
• Consent — where required (e.g. marketing emails, optional analytics).

For data of your students that you upload, you act as the controller in relation to your students; we act as a processor on your behalf and process that data only as needed to provide the Service to you.

• Providing the Coachero Service (bookings, programs, progress tracking, messaging).
• Authenticating you via phone OTP.
• Processing payments and renewing subscriptions.
• Generating Spark AI responses based on the context you provide.
• Sending booking reminders, support replies, and account-related notices.
• Detecting fraud, abuse, and security incidents.
• Improving the product through aggregated, non-identifying usage analytics.
• Complying with Ukrainian law.

We use the following service providers (sub-processors). We have signed appropriate agreements with each and share only the data needed for their specific role:

• Hetzner — hosting for the application server, database, Redis, and background workers (an EU virtual private server in Germany).
• Cloudflare — object storage (R2) for uploaded photos and files plus database backups, hosting for our web frontends (Pages), and CDN, DNS, TLS, and inbound email routing.
• Monobank — payment acquiring for Pro subscriptions purchased on the web (UAH), including card tokenization for auto-renewal (recurring wallet payments).
• TurboSMS (turbosms.ua, Ukraine) — SMS delivery for phone one-time codes and booking confirmations; Twilio may be used as an international fallback.
• OpenRouter — AI request router: every request to an AI model passes through it along with the context sent, including voice recordings from the watch. OpenRouter does not use that data to train models.
• Google (Gemini) — the model behind Spark AI chat and voice recognition, and the backup provider for every AI feature when OpenRouter is unavailable. Google does not use paid Gemini API requests to train its models, per the Gemini API terms.
• OpenAI — the model behind the training-program, nutrition-plan, and exercise-suggestion generators. OpenAI does not use API request data to train its models, per the OpenAI API terms.
• PostHog — product-usage analytics for our web and booking apps, hosted in the EU. Not an advertising service.
• Plausible — cookieless pageview analytics for our marketing website.
• Telegram — optional bot integration for student communication, governed by Telegram’s own privacy policy.
• Sentry — error monitoring with PII scrubbing applied before any event leaves our servers.
• Resend — transactional email (receipts, security notices).
• Apple & Google — push notification delivery to our mobile app (APNs / FCM), and processing of Pro subscription in-app purchases in the mobile apps (App Store / Google Play): the store bills you directly and shares with us only subscription identifiers and receipts (purchase tokens) needed to activate your plan.

Our current sub-processor list, with regions, is published at coachero.app/legal/subprocessors. We do not sell, rent, or share your personal data with advertisers or data brokers.

Coachero’s application server and database run on a single virtual private server hosted in the European Union (Hetzner, Germany). Uploaded files (profile photos, exercise images, support screenshots) and database backups are stored in Cloudflare R2, and static content is delivered through Cloudflare’s global network — so some personal data may be stored or cached on Cloudflare’s global infrastructure, which can place data outside the EU. All processors that handle personal data are engaged under contractual safeguards equivalent to Ukrainian and EU data-protection standards. We will move data to a Ukrainian-region provider when an equivalent option becomes commercially available.

When you use Spark AI or the program, nutrition, or exercise generators, the relevant context (your notes, sessions, and the basics of the student in question) is sent as a single API request through OpenRouter — a router that forwards the request to the chosen model. Voice commands from the watch travel the same path as an audio recording.

Which provider serves the request depends on the task:

• Google (Gemini) — Spark AI chat and voice recognition;
• OpenAI — the training-program, nutrition-plan, and exercise-suggestion generators.

If OpenRouter is unavailable, the request goes directly to Google (Gemini) instead. Neither provider uses paid API requests to train its models, per their respective terms.

We sanitize inputs against prompt injection and never pass user-controlled text directly into tool arguments. AI output is a suggestion: you remain responsible for reviewing and approving anything it produces before applying it to a student.

Retention. Personal data is retained for the lifetime of your account. Closed accounts are deleted within 30 days of closure, except where retention is required by Ukrainian law (e.g. tax records for up to three years). Encrypted backups are retained for up to 30 days, then overwritten.

Security. Personal data is encrypted in transit (TLS 1.2+). Uploaded photos, files, and backups are held in Cloudflare R2 object storage, which encrypts objects at rest. Progress photos are kept private and served via short-lived signed URLs; profile avatars and exercise-library images are served from a public bucket. Trainers and students sign in with a one-time SMS code — there is no password to set; internal administrative accounts use email/password with two-factor authentication, stored only as salted hashes. We follow industry-standard access control, logging, and incident response. We will notify affected users without undue delay if a personal data breach is detected. To report a suspected security vulnerability or data breach, contact security@coachero.app.

Under the Personal Data Protection Law of Ukraine you have the right to:

• know what data we hold about you;
• access and obtain a copy (by emailing support@coachero.app);
• correct inaccurate data (edit your profile in the app);
• request deletion (from the account menu in the app, or by emailing support@coachero.app — deletion cascades and no shadow copies remain);
• restrict or object to processing in specific circumstances;
• withdraw consent where processing is based on consent;
• lodge a complaint with the Ukrainian Parliament Commissioner for Human Rights (Ombudsman) at ombudsman.gov.ua.

We aim to respond to verified requests within 30 days.

Coachero is not directed at children under 14. Trainers using the Service to coach minors must obtain a parent’s or guardian’s informed consent before adding the child’s data to the platform.

Cookies. We use essential cookies for authentication and session management. Our web and booking apps also use a first-party analytics cookie (set by PostHog) to measure aggregate usage; our marketing website uses Plausible, which is cookieless. You may clear cookies any time via your browser; clearing them signs you out.

Analytics. To understand and improve how the Service is used, our web app and booking app send product-usage analytics to PostHog, a third-party analytics provider hosted in the EU (and used server-side as well); our marketing site uses Plausible, a privacy-friendly, cookieless tool. PostHog is not an advertising service and we do not use it for ad targeting. We do not embed advertising pixels or advertising cookies, and we do not sell your data. Analytics data tied to your account is deleted when your account is deleted.

Marketing. We email you about service-related matters (account, billing, security) regardless of consent. Marketing emails are opt-in and you can unsubscribe at any time via the link at the foot of each marketing email.

We may update this Policy from time to time. Material changes will be communicated by email at least 14 days before they take effect.

Privacy questions, data requests, or complaints: support@coachero.app. If you are not satisfied with our response, you may file a complaint with the Ukrainian Parliament Commissioner for Human Rights at ombudsman.gov.ua.