This Privacy Policy explains how Tracklete ("we", "us", "our") collects, uses, and protects your personal information when you use the Tracklete mobile app, web dashboard, and marketing website (collectively, the "Service").
By using Tracklete, you agree to the practices described in this policy. If you do not agree, please do not use the Service.
1. Who We Are
Tracklete is a fitness coaching platform that connects professional coaches with their clients. Coaches use the platform to manage clients, build training programs, schedule sessions, and track progress. Clients use the platform to view their assigned programs and track their workouts.
Contact: support@tracklb.com
2. Information We Collect
2.1 Information you provide directly
- Account information: email address, password (stored as a hashed value, never in plain text), display name, role (coach or client).
- Profile information: avatar image; date of birth and gender for clients; specialty, biography and phone number for coaches. Phone numbers are currently optional — see section 3 for how we use them.
- Coaching content (coaches only): clients' display names, training programs, exercise data, session schedules, payment records, motivational quotes, private notes.
- Workout data (clients only): workout completion status, the exercises performed and the repetitions, weights and effort recorded for each set, personal records, and goals.
- Health and fitness information (clients only): bodyweight and body measurements recorded over time, and — where your coach has enabled check-ins and you choose to answer them — your ratings of sleep quality, muscle soreness, readiness and session effort. This is information about your body and how you feel. We treat it as sensitive, and it is deleted outright if you delete your account (see section 6).
- Coaching notes you provide about a client (coaches only): when you use the AI program generator, you may enter free-text instructions. Coaches commonly use this to describe injuries or movements to avoid. That text is sent to our AI provider — see section 4.
- Subscription information: subscription tier, payment method used (Whish, Apple In-App Purchase, cash, other), amount paid, dates.
- Feedback: content of any feedback or support requests you send through the app.
2.2 Information collected automatically
- Device information: device model, operating system version, app version, time zone.
- Push notification tokens: if you enable push notifications, we store an Expo push token to deliver notifications.
- Authentication tokens: session tokens used to keep you logged in.
- Email verification & password reset codes: temporary codes stored only as long as needed for verification.
2.3 Information we do NOT collect
- We do not use behavioral tracking or cross-site tracking (no Google Analytics, Mixpanel, etc.). The only analytics we use is Vercel Web Analytics — a privacy-friendly, cookieless service that measures aggregate site traffic without using cookies, storing personal data, or tracking you across other sites.
- We do not collect location data.
- We do not access your device's contacts, photos (except when you explicitly upload an avatar), camera, or microphone.
- We do not sell, rent, or trade your personal information.
3. How We Use Your Information
We use the information we collect to:
- Provide the Service: authenticate you, store your data, allow coaches to manage clients and programs, allow clients to view their workouts.
- Communicate with you: send transactional emails (verification codes, welcome, subscription receipts, renewal reminders, password reset).
- Contact you directly: if you have given us a phone number, a member of the Tracklete team may contact you on it — by phone or on WhatsApp — about your account, a support request, or occasionally about changes to the service. These are messages from a person, not automated texts, and we do not use an SMS or bulk-messaging platform. We do not share your number with anyone else.
- Process subscriptions: track which tier you're on (Free Trial, Lite, Pro, Max), grant or restrict access to features accordingly.
- Send push notifications: notify clients of scheduled workouts, new programs, motivational quotes, etc. (only with your permission).
- Improve the Service: review feedback to fix bugs and prioritize features.
- Prevent abuse: apply rate limiting, detect suspicious activity, enforce our Terms of Service.
We will never use your data for advertising or share it with advertisers.
4. Third-Party Services
Tracklete relies on the third-party services below to operate. For each we list what it is for and what it receives. We keep this list current; if we add a service that handles your data, we will add it here and update the date at the top of this page.
| Service | Purpose | Data processed |
|---|
| Supabase (AWS) | Database & file storage | All app data, including account info, programs, workouts, payments, avatars |
| Railway | API server hosting | Data passes through Railway during transmission |
| Resend | Transactional email | Email addresses + email content |
| Expo Push | Mobile push notifications | Push tokens + notification content |
| Whish Money | Subscription payments | Whish processes payment outside Tracklete; we record amount + date only |
| Anthropic (Claude AI, USA) | AI program generation | The instructions a coach types when generating a program, plus the requested goal, duration and equipment. Coaches often use this free-text box to describe a client's injuries or movements to avoid, and that text is sent to Anthropic. We do not send your name, email or any other identifier with it, and Anthropic receives no other data from Tracklete. Only coaches on plans that include the AI generator can trigger this. |
| Bunny.net (Bunny Stream) | Hosting and delivering coach exercise videos | Video files a coach uploads to demonstrate exercises, which may show the coach. Playback links are signed and time-limited |
| Apple | In-app purchases on iOS | Purchase and subscription status. Apple processes the payment; we store the resulting subscription state |
| Google Play | In-app purchases on Android | Purchase and subscription status, and an anonymous account identifier used to match a purchase to your account |
| Sentry | Crash and error monitoring | Technical details of errors, which can include your account identifier and the screen you were on. Used only to diagnose faults |
| Vercel | Hosting the web dashboard and this website | Data passes through Vercel in transit; cookieless aggregate traffic analytics for this website |
We do not control these third parties' privacy practices. You can review their respective policies on their websites.
5. Data Storage and Security
- All data is stored on Supabase servers (AWS infrastructure).
- All connections to the API and database use TLS (HTTPS) encryption.
- Passwords are hashed using bcrypt; we never see or store plain-text passwords.
- Authentication tokens use industry-standard JSON Web Tokens (JWT) with short expiration.
- Access to the database is restricted to authorized administrators only.
While we take reasonable security measures, no method of data transmission or storage is 100% secure. We cannot guarantee absolute security.
6. Your Rights
You have the following rights regarding your personal information:
- Access: view all your account data through the app.
- Correction: edit your profile, name, and account settings at any time.
- Deletion:delete your account from the app's settings at any time. It is immediate and cannot be undone. What happens depends on whether you are a client or a coach.
If you are a client: your name, photo, date of birth, gender and any notes about you are permanently erased, your check-in answers are deleted outright, and your account can no longer be used to sign in. Your training record is not deleted. The sessions you completed, the weights you logged and your recorded measurements remain in your coach's account, shown as "Deleted client" with your name removed — because that record is also your coach's record of the work they delivered for you. If you want that history removed as well, email us at support@tracklb.com and we will discuss it with you and your coach.
If you are a coach: your profile, programs, exercise library, client notes and payment records are permanently deleted. Your clients are not deleted — each keeps their own account and their full training history, and is simply disconnected from you, free to join another coach.
- Portability: request a copy of your data by emailing support@tracklb.com.
- Withdraw consent: disable push notifications, opt out of non-essential emails, or delete your account at any time.
- Lodge a complaint: contact us first; if not resolved, contact your local data protection authority.
7. Data Retention
- Active accounts: we retain your data for as long as your account is active.
- Deleted accounts: the personal information described in section 6 is erased at the moment you delete your account. A client's training record is retained in their coach's account with the client's identity removed, as explained there. Backups may retain data for up to 30 days for disaster recovery, after which they are wiped.
- Subscription / payment records: anonymized records may be retained for tax and accounting purposes for up to 7 years, even after account deletion.
- Email logs: delivery logs from Resend are retained per Resend's policy (typically 30 days).
8. Children's Privacy
Tracklete is intended for users 16 years of age or older. We do not knowingly collect personal information from anyone under 16. If you are under 16, please do not use the Service. If we learn we have collected information from a child under 16, we will delete it immediately.
9. International Users
Tracklete is operated from Lebanon. By using the Service, you consent to the transfer and processing of your data in Lebanon and other countries where our service providers operate (including the United States).
10. Cookies (Web Dashboard)
The web dashboard uses only essential cookies and local storage to:
- Keep you logged in (session token storage)
- Remember your theme preference (light/dark mode)
- Store the unit preference for weights (kg/lbs)
We do not use tracking cookies or advertising cookies. Our analytics (Vercel Web Analytics) is cookieless and collects no personal data.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will:
- Update the "Last updated" date at the top.
- Notify users of significant changes via email or in-app notice.
- Continue to honor the previous policy for data already collected, where required by law.
Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
12. Contact Us
For any questions, concerns, or requests regarding this Privacy Policy or your data:
Email: support@tracklb.com
We aim to respond to all privacy-related inquiries within 7 business days.