Privacy Policy

1. INTRODUCTION

Welcome to Improof ("we," "our," or "us"). We provide a wellness and athletic performance platform designed for strength and conditioning coaches, personal trainers, and their athletes/clients. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services.

Our Platform Today

Currently Available:

• Mobile app for athletes to track nutrition, workouts, and recovery
• Web dashboard for coaches to manage athletes and create programs
• AI-powered meal and nutrition logging assistance (powered by Google Gemini)
• Secure authentication via Better Auth (email/password, Sign in with Google, and Sign in with Apple)
• Coach-athlete connection system via email invitations
• Coach discovery features (find coaches by location and specialty)
• Integrations with fitness wearables and health apps (Apple Health, Google Health Connect, Garmin, Fitbit)
• A coach marketplace where coaches sell programs, meal plans, and subscriptions, with payments and payouts processed by Stripe
• Push notifications on mobile devices
• In-app progress analytics and stats (Stats tab)

Coming Soon:

• Additional wearable and health-app integrations

2. INFORMATION WE COLLECT

Information You Provide

Account Information:

• Email address (required)
• Name
• Account type (Coach or Athlete)
• Password (hashed and managed securely by Better Auth; never stored in plain text)

Profile Information:

• Age, gender, height, weight
• Fitness goals and preferences
• Training experience level
• Dietary preferences and restrictions

Activity Data:

• Nutrition and meal logs
• Workout logs and exercise data
• Body weight and body measurements (such as body-fat percentage)
• Recovery metrics and subjective wellness scores
• Custom notes and comments

Coach-Specific Information:

• Professional certifications (optional)
• Business information (optional)
• Payment and payout information, including Stripe Connect account details (full payment card numbers are handled directly by Stripe and are not stored by us)
• Client roster and management data

Information Collected Automatically

Usage Data:

• App/website usage patterns
• Feature interaction data
• Session duration and frequency
• Device information (type, OS, version)
• IP address (anonymized for analytics, full for security)
• Browser type and language preferences
• Referring website URLs
• Pages visited and interactions with our website
• Push notification tokens (to deliver notifications to your device)
• Diagnostic and crash data (device state captured when an error occurs, via our error-monitoring provider)
• Approximate location (only with your permission, to power coach discovery)

Health and Wearable Data (from connected apps and devices):

If you choose to connect a wearable or health app (Apple Health, Google Health Connect, Garmin, or Fitbit), we collect the metrics you authorize, which may include:

• Heart rate
• Step counts and distance
• Sleep metrics
• Active energy / calories burned
• Workout and activity data

Connecting a device or app is optional. You control which devices you connect and what data you share, and you can disconnect them at any time in the app.

3. COOKIES AND TRACKING TECHNOLOGIES

Types of Cookies We Use

Essential Cookies (Always Active):

• Authentication cookies: Keep you logged in and secure your session
• Security cookies: Detect and prevent security threats
• Consent preference cookies: Remember your cookie consent choices

These cookies are necessary for our platform to function and cannot be disabled.

Analytics Cookies (Opt-In Required):

We use Google Analytics 4 (GA4) to understand how visitors interact with our website. These cookies are only set if you click "Accept All" in our consent banner.

Google Analytics 4:

• Purpose: Website analytics and performance measurement
• Provider: Google LLC
• Data Collected:
  • Pages visited and time spent on each page
  • How you arrived at our site (referral source)
  • Device type, browser, and screen resolution
  • Anonymized IP address (last octet removed)
  • General location (country/city level, not precise)
  • Interactions with website elements (clicks, scrolls)
• Duration: Up to 2 years
• GDPR Compliance: We have enabled IP anonymization and disabled data sharing with Google for advertising purposes
• Learn More: Google Privacy Policy

Your Cookie Choices

Managing Cookies:

• First visit: You'll see a consent banner asking for your preferences
• Accept All: Allows both essential and analytics cookies
• Reject All: Only essential cookies are set; analytics are blocked
• Change your mind: Clear your browser cookies to see the consent banner again

Browser Controls:

You can also control cookies through your browser settings:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Cookies and website data
• Edge: Settings → Cookies and site permissions

Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. We respect your choice and do not load analytics cookies when DNT is enabled. However, essential cookies are still required for the platform to function.

Google Analytics Opt-Out

You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.

4. HOW WE USE YOUR INFORMATION

Primary Uses

We use your information to:

• Provide and maintain our platform
• Enable coach-athlete connections and data sharing
• Power AI-assisted meal and nutrition logging
• Process payments, payouts, and marketplace transactions
• Sync data from connected wearables and health apps
• Generate insights and progress tracking
• Send push notifications and important service updates
• Monitor, secure, and improve the platform, including diagnosing crashes and errors
• Provide customer support

We Do NOT:

• Sell your personal data to third parties
• Share your data with advertisers
• Use your health data for marketing purposes
• Share athlete data with coaches without explicit consent

Aggregated Data

We create and own anonymized, aggregated data to:

• Improve our services and develop new features
• Conduct research on training and nutrition patterns
• Generate industry insights and benchmarks
• Create success stories (only with explicit permission)
• Demonstrate platform effectiveness

5. COACH-ATHLETE DATA SHARING

How It Works

Athlete Control:

• Coaches must request access using your email address
• You must explicitly accept each coach request
• You can revoke coach access at any time
• You control what data coaches can see

Coach Access:

When you accept a coach connection, they can view:

• Your tracked nutrition, workout, and recovery data
• Body weight and measurements (if you choose to share)
• Your training history and trends
• Notes and comments you add to your logs

Coach Limitations:

• Coaches cannot access your account credentials
• Coaches cannot modify your data without your knowledge
• Coaches cannot prevent you from disconnecting
• Coaches cannot export bulk athlete data

6. DATA SECURITY

Our Security Measures

We implement industry-standard security practices including:

• Encryption in transit (TLS)
• Encryption at rest for stored data
• Secure authentication via Better Auth, with support for Sign in with Google and Sign in with Apple
• Access controls and audit logging
• Secure cloud infrastructure

Your Security Responsibilities

• Use a strong, unique password
• Enable multi-factor authentication (recommended)
• Keep your account credentials confidential
• Report any suspicious activity immediately
• Review coach access permissions regularly

7. THIRD-PARTY SERVICES

Current Service Providers

We work with trusted service providers:

Google Analytics 4:

• Purpose: Website analytics and performance measurement (opt-in only)
• Data: Anonymous usage statistics, page views, user interactions
• Privacy: IP anonymization enabled, advertising features disabled
• Learn More: Google Privacy Policy

Convex (Database and Backend):

• Purpose: Data storage, real-time sync, and backend infrastructure
• Data: All user data, workout logs, nutrition data, coach-athlete connections
• Security: SOC 2 Type II, GDPR, and HIPAA compliant infrastructure
• Note: While Improof is not HIPAA-regulated, we choose infrastructure with healthcare-grade security

Authentication (Better Auth, with Google and Apple sign-in):

• Purpose: User authentication and session management
• Data: Email, authentication tokens, session data. Credentials are managed within our own Convex backend using Better Auth.
• Social login: If you choose "Sign in with Google" (Google LLC) or "Sign in with Apple" (Apple Inc.), that provider confirms your identity and shares basic profile information (such as your email) with us.

Google Gemini (AI Assistance):

• Purpose: AI-assisted meal and nutrition logging
• Data: The text you submit for analysis (for example, a natural-language description of a meal). We do not use this data to train third-party AI models.
• Provider: Google LLC

USDA FoodData Central:

• Purpose: Looking up nutritional information for foods
• Data: Food search terms only; no personal information is sent
• Provider: U.S. Department of Agriculture (public database)

Stripe (Payments and Payouts):

• Purpose: Processing marketplace payments and paying out coaches via Stripe Connect
• Data: Payment and payout details, transaction records, and Stripe account information. Full card details are collected and stored by Stripe, not by us.
• Security: PCI DSS compliant
• Learn More: Stripe Privacy Policy

Resend (Transactional Email):

• Purpose: Sending authentication, invitation, and notification emails
• Data: Email address and the contents of the email being sent

Sentry (Error and Crash Monitoring):

• Purpose: Diagnosing crashes and errors to keep the app reliable
• Data: Diagnostic data such as device type and OS, app state, and error/stack-trace information when a problem occurs

Expo (Push Notifications):

• Purpose: Delivering push notifications to your mobile device
• Data: Push notification token and the content of notifications sent to you

Health and Wearable Integrations:

• Purpose: Syncing the health and activity metrics you authorize
• Providers: Apple Health, Google Health Connect, Garmin, and Fitbit
• Data: Only the metrics you choose to share (for example, heart rate, steps, sleep, calories burned, and workouts). You can disconnect at any time.

All service providers are bound by data protection agreements.

8. YOUR PRIVACY RIGHTS

Access and Control

You have the right to:

• Access your personal data
• Correct inaccurate information
• Delete your account and data
• Export your data in a portable format
• Opt-out of non-essential data collection
• Manage coach connections

Data Deletion

You can delete your account at any time through the app settings. Upon deletion:

• Your personal data is deleted immediately and permanently
• Coaches will lose access to your data
• Some anonymized, aggregated data may be retained
• Legal obligations may require limited data retention

Regional Rights

California Residents (CCPA):

Additional rights including:

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of sale (we don't sell data)
• Right to non-discrimination

EU/UK Residents (GDPR):

Additional rights including:

• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to lodge complaints with supervisory authorities

9. DATA RETENTION POLICY

Retention Periods

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected and to comply with legal obligations. Our retention periods vary based on the type of data and how it's used:

Active Account Data:

Inactive Account Data:

• Accounts inactive for 12 months: We may send reminder emails about account status
• Accounts inactive for 24 months: Account and associated data may be scheduled for deletion
• Coach accounts: Retained for 36 months of inactivity due to potential client relationships

Post-Deletion Retention:

When you delete your account, your personal data is removed from our active systems immediately, subject to the limited backup and legal-retention exceptions below:

• Payment records: Retained by our payment processor (Stripe) as required by law, typically up to 7 years
• Encrypted backups: Our database provider's routine backups, which cycle out automatically (within 30 days)
• Anonymized, aggregated data: May be retained, as it cannot identify you
• Legal compliance data: Only where retention is required by applicable law

Data Deletion Process

User-Initiated Deletion:

• You can delete individual workout logs or meals at any time
• Account deletion takes effect immediately
• Coach-athlete connections can be terminated immediately
• Deletion is permanent and cannot be reversed

Automated Deletion:

• Temporary files and caches: Cleared every 7 days
• Session data: Cleared after 30 days of inactivity
• Failed upload attempts: Deleted after 24 hours
• Email verification codes: Expire after 10 minutes

Special Circumstances

Legal Holds:

We may retain data longer than stated if:

• Required by law enforcement or court order
• Necessary for legal proceedings or disputes
• Required to establish, exercise, or defend legal claims
• Needed to investigate potential terms of service violations

Coach Data Responsibilities:

Your Rights Regarding Data Retention

You have the right to:

• Request information about what data we retain and for how long
• Request early deletion of your data (subject to legal requirements)
• Export your data before deletion
• Object to retention for specific purposes

Data Portability

You can export your data from the app at any time as a JSON file. The export includes:

• Activity and workout history
• Meal and nutrition logs
• Sleep records
• Profile information

Third-Party Data Retention

Our service providers have their own retention policies:

• Convex (Database): Follows our retention instructions; maintains backups for 30 days
• Better Auth (Authentication): Authentication and session records are stored in our Convex backend and retained per our retention policy
• Stripe (Payments): Retains transaction records per PCI compliance (typically 7 years)

10. CHILDREN'S PRIVACY

Our services are not intended for children under 13. We do not knowingly collect information from children under 13. Athletes ages 13-17 should have parental consent to use our platform.

11. HIPAA DISCLAIMER

While we implement strong security measures, coaches and trainers using Improof are responsible for determining if their practice requires HIPAA compliance.

12. INTERNATIONAL DATA TRANSFERS

Your data may be transferred to and processed in the United States. We ensure appropriate safeguards are in place for international transfers in compliance with applicable laws.

13. CHANGES TO THIS POLICY

We will update this policy as our platform evolves. We will notify you of material changes via:

• Email notification
• In-app announcement
• Website notice

Continued use after changes indicates acceptance of the updated policy.

14. CONTACT US

For privacy questions or concerns:

Email: contact@improof.app
REPS Technologies LLC
Address: 90 Woodbridge Center Dr #900, Woodbridge, NJ 07095

For data protection inquiries (EU/UK):
Email: contact@improof.app