Privacy Policy

Version 1.0 · Effective 2026-10-29

This policy explains what personal data Coach App collects, why, who can see it, how long we keep it and what your rights are. We wrote it in plain language. If something is unclear, write to us at [email protected].

1. Who we are

Coach App is a web app for strength and weightlifting coaches and their clients. It is run by Ageng Suhada ("we", "us"). For the app, we are the personal data controller under Indonesia's Personal Data Protection Law (Law No. 27 of 2022, "PDP Law") and its implementing regulation (Government Regulation No. 33 of 2026).

Your coach's role. If you are a client, your coach creates your profile, decides what is recorded about you, writes your training and can see everything in your client profile and training log. Your coach is responsible for the training he or she publishes to you.

Contact for anything about your data: [email protected].

2. What we collect

Account data

• Your name, as your coach (or, for coaches, the admin) entered it.
• Your username.
• Your password, stored only as a secure hash. We cannot read it.
• If you sign in with Google: your email address and your Google account ID.
• Your app language and settings.

Client profile (entered by your coach)

• Date of birth, sex, height and body weight.
• Training level, goals, schedule and training history.
• Where you train and what equipment you have there.
• Notes from your coach. You can't see your coach's private notes.

Health information. The PDP Law treats this as specific personal data and protects it more strictly.

• Injuries and current pain level (0–10).
• Weak points.
• Any health remarks in your coach's notes or your comments.

Training data

• Your program, your maxes and personal records.
• The sets you log (weight, reps, effort), your comments and feedback.
• When you completed each workout.

Technical data

• Session cookies that keep you signed in.
• The IP address and device or browser type of each session, used for security and the sign-in attempt limit.
• Your push notification subscription, if you allow notifications.
• Data the app keeps on your own device so it works offline: recent pages and unsent drafts.

For coaches, additionally

• Business name.
• Your answers about your coaching style and the edits you make to AI drafts, used to make future drafts match your style.
• Your gyms, templates, exercise library and the video links you add.

What we don't collect: payment details, your location, contacts, photos, or access to your camera or microphone. The app has no advertising or analytics trackers.

3. Why we use it

Purpose

Running your account and the app: programs, logging, comments, notifications

Data

Account, client profile, training, technical

Legal basis (PDP Law, Article 20)

Performing our agreement with you (the Terms), and your consent

Purpose

Planning safe training around injuries and pain

Data

Health information

Legal basis (PDP Law, Article 20)

Your explicit consent

Purpose

Drafting training weeks with AI for your coach to review (section 4)

Data

Client profile, health information, training data, coach style

Legal basis (PDP Law, Article 20)

Your explicit consent

Purpose

Keeping accounts secure: sign-in limits, sessions, preventing abuse

Data

Technical data

Legal basis (PDP Law, Article 20)

Our legal obligations and legitimate interest in a secure service

Purpose

Answering your requests and meeting legal duties

Data

Whatever the request concerns

Legal basis (PDP Law, Article 20)

Legal obligation

We do not sell your data. We don't use it for advertising or marketing profiles, and we don't share it with anyone beyond what this policy describes.

4. AI drafts

Coaches can ask the app to draft a training week with an AI model. The draft is only a suggestion. Your coach reviews and edits every draft, and nothing reaches you until your coach publishes it. The AI never publishes anything and makes no decision about you on its own.

What the AI receives:

• your age (not your date of birth), sex, height and body weight;
• training level, goals and schedule;
• maxes and recent training history;
• injuries, pain level and weak points;
• available equipment;
• your coach's notes and coaching style.

It does not receive your name, username, email or contact details.

Who runs the AI. The provider is OpenAI, through its API, in the United States. OpenAI does not use API data to train its models. It may keep request logs for up to 30 days to monitor abuse. We ask OpenAI not to store the drafts. In our own system we keep AI requests and drafts for 90 days, for troubleshooting.

You can withdraw your consent to AI drafts at any time (section 9). Your coach then plans your training without AI.

5. Who can see your data

• Your coach sees the profiles and training of his or her own clients only. Other coaches can never see you. The database enforces this, not only the screens.
• You see your own program, logs and profile, but not your coach's private notes.
• The admin (us) manages coach accounts and the shared exercise library. The admin screens don't show client data. Technical access to the database is limited to maintenance, backups, security incidents and answering your requests.
• Service providers that process data on our behalf, only as needed to run the app:

Provider

Our technical contractor

What for

Develops, hosts and maintains the app on our behalf; access to data only for maintenance, backups, security incidents and your requests

Where

Indonesia

Provider

OVH

What for

Server that runs the app and the database

Where

Singapore

Provider

Cloudflare

What for

Secure network connection to the app; encrypted backup storage

Where

Global network; backups in Asia-Pacific

Provider

OpenAI

What for

AI drafts (section 4)

Where

United States

Provider

Google

What for

Sign-in with Google, only if you choose it

Where

Global

Provider

Your browser's push service (Google, Apple or Mozilla)

What for

Delivering notifications, only if you allow them. The notification content is end-to-end encrypted

Where

Global

• Authorities, only when Indonesian law requires us to disclose data.

6. Data stored or processed outside Indonesia

The app's server and backups are in Singapore and the Asia-Pacific region; AI drafts are processed in the United States, and Cloudflare and Google operate globally.

We protect these transfers by:

• using providers bound by data protection terms;
• encrypting data in transit (HTTPS);
• encrypting the offsite backups at rest;
• sending the AI only what a draft needs, without your name or contacts.

By giving your consent when you join, you agree to these transfers. Indonesia's data protection authority is still setting up its transfer mechanisms. We will adopt them and update this policy as they become available.

7. How long we keep it

Data

Account, client profile, health information, training data

How long

While the account is active

Data

After your coach removes you as a client

How long

Your client card with its training data is deleted from the live system 30 days after the removal; your coach can delete it sooner. Your account stays meanwhile, so a new invite link can connect it to another coach. If it isn't connected to another coach when the card is deleted, your account is deleted with it.

Data

After your coach's account is deleted

How long

Your client card with its training data is deleted at once. Your account stays, not connected to a coach, for 30 days so a new invite link can connect it to another coach; otherwise it is then deleted.

Data

After you delete your account in the app (Profile → Privacy), or ask us to delete your data

How long

Your account and every client card linked to it, with all their training data, are deleted from the live system at once. Your coach is told that you deleted your account.

Data

Backups

How long

Deleted data leaves our backups within a further 30 days, as old backups expire automatically.

Data

Sessions

How long

Up to 60 days, or until you sign out

Data

Sign-in attempt records (IP address)

How long

A few minutes

Data

Push subscription

How long

Until you turn notifications off or sign out on that device

Data

AI requests and drafts in our system

How long

90 days

Data

A coach's edits to AI drafts, used to learn the coach's style

How long

While the coach's account is active. When a client is deleted, the free-text comments in the edits made for that client are removed.

Data

Data on your own device

How long

Until you clear it or uninstall the app

8. How we protect it

• All traffic is encrypted (HTTPS).
• Passwords are stored only as secure hashes.
• The database can't be reached from the internet.
• Each coach's data is separated inside the database itself.
• Backups are made every night, and offsite copies are encrypted at rest.

If a personal data breach happens, we will notify you and the authority in writing within 3×24 hours of becoming aware of it. We will tell you what data was affected, when and how it happened, and what we are doing about it.

9. Your rights

Under the PDP Law you can:

• get information about how we use your data;
• see and get a copy of your data;
• correct or complete it;
• have it deleted or destroyed;
• withdraw your consent, including for health information and AI drafts;
• restrict or pause processing;
• object to decisions made only by automated processing. Our AI only drafts; your coach decides;
• complain to Indonesia's data protection authority;
• claim compensation for a breach of the law.

How to use them. Email [email protected] from your account email, or ask your coach to pass on the request. We may ask you to confirm it is really you. We respond within 3×24 hours where the law sets that deadline, and otherwise as quickly as we can.

Some changes you can make yourself in the app, such as your password, language and notifications. You can also delete your account yourself: Profile → Privacy → Delete my account. If you withdraw consent for health information, your coach can no longer record it, and your training may be less tailored. Withdrawing consent doesn't affect what we did before.

10. Children

The app can be used by clients under 18 only with the consent of a parent or legal guardian. Before inviting a client under 18, the coach must get that consent and record it in the app. A parent or guardian can exercise the child's rights on his or her behalf, using the contact above. When the client turns 18, he or she takes over these rights.

11. Cookies and local storage

We use only necessary cookies, to keep you signed in and secure. The app also stores data on your device so that it works offline and keeps unsent drafts. We don't use analytics or advertising cookies.

12. Google sign-in

If you sign in with Google, we receive your Google account ID, email address, name and profile picture link. We use only the account ID and email: to sign you in, and as your account email. We don't use your Google name or picture; the name shown in the app is the one your coach entered.

We never sell Google user data, never use it for advertising and never share it except as this policy describes. You can disconnect Google in your profile. Deleting your account deletes this data.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

13. Changes to this policy

We will tell you in the app before a change takes effect. Where a change needs your consent again, we will ask for it. Each version has a version number and an effective date.

14. Contact

Ageng Suhada · [email protected]