App privacy policy

Controller :

Morad, personal fitness coach, publisher of TrainLikeMorad

Country :

Morocco

Contact :

trainlikemorad@gmail.com

The app is for adults (18 and over) invited by a coach.

Account :

name, email address, date of birth, language and time zone.

Training :

programs, workouts, sets, loads, records, cardio and habits.

Health, with your explicit consent :

weight, measurements, body fat, heart rate, blood pressure, blood glucose, resting pulse, check-ins and progress photos, food and water log, supplements.

Messages :

messages, photos, voice notes and reports.

Appointments :

booked slots, their status and, for video sessions, the room link.

Coach content :

programs, meal plans, comments and documents.

Technical :

the device's notification token, if you turn notifications on.

Apple or Google sign-in, when offered :

the identifier Apple or Google provides; the Apple token is kept so it can be revoked when the account is deleted.

We collect no location, contacts or advertising data, and the app reads neither Apple Health nor Health Connect: everything is entered by you or your coach. Photos are saved again without their metadata (including location) before upload.

• Running your account and providing the coaching (programs, tracking, messaging, appointments and reminders): performance of the contract.
• Processing your health data: your explicit consent, given separately from the terms of use and withdrawable at any time in your Profile.
• Securing the service and handling reported messages: legitimate interest.
• Answering requests to exercise your rights: legal obligation.

This processing falls under Moroccan Law No. 09-08 and, for people living in the European Union, the GDPR. We do not sell your data and never use it for advertising.

• Your coach sees the data needed to follow you, including adherence statistics, while the coaching is active. Other coaches cannot see it.
• The publisher and the person in charge of technical administration can access all accounts and conversations, solely to run the service, provide support and handle reports.
• Documents your coach sends to "all clients" are visible to every active client of the service.
• If you turn on calendar sync, a private link publishes your appointments (date, time, type): anyone with the link can read them, and you can reset it at any time.

Supabase :

database, authentication and files; European Union (Paris).

Vercel :

hosting of the web apps; server-side processing in the European Union (Paris).

Resend :

sending emails (sign-in codes, invitations); European Union (Ireland).

Jitsi Meet :

video calls for video sessions on meet.jit.si, a third-party service under its own policy; anyone with a room's link can join it.

Push notifications, when turned on :

Expo, Apple (APNs) and Google (FCM), in the United States. Notifications only carry generic text ("Your coach sent you a message."), never message content or health data.

Crash reports, when turned on :

Sentry, in the European Union, without an account identifier.

Online food search, when turned on :

Open Food Facts, without any identifier.

Account and data :

as long as the account exists.

After coaching ends :

deleted automatically 24 months after your last coaching ends.

Account deletion :

immediate for the account, data and files; any technical backups are erased within 7 days.

Unused invitations :

valid for 7 days, deleted 30 days after they expire.

Sent emails :

delivery logs kept by Resend for a limited time.

You have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw your consent at any time.

• Download your data: Profile → Download my data (a JSON file with links to your files, valid for 7 days).
• Delete your account: Profile → Delete my account. A coach who still has active clients must end those coachings first.
• Withdraw your health consent: in your Profile.
• Any other request: trainlikemorad@gmail.com. We answer within one month.

You can contact the CNDP (www.cndp.ma) in Morocco or, if you live in the European Union, the data protection authority of your country (in France, the CNIL: www.cnil.fr).

The app keeps your session (encrypted on mobile) and a copy of your own data on the device so it works offline. Both are erased when you sign out, except what you entered offline and has not been sent yet. The coach space only uses sign-in cookies; no advertising cookies or trackers.

Encrypted connections (HTTPS), access rules enforced on every record (a coach only sees their clients), private files served through temporary links, and invitations usable only by the invited address.

The last-update date is shown at the bottom of this page. We will tell you about any significant change; if it concerns your health data, we will ask for your consent again.

For any question about your data or to exercise your rights: trainlikemorad@gmail.com