Effective date: June 13, 2026
This Privacy Policy explains how Social Concept LLC DBA Coach OS ("CoachOS," "we") collects, uses, and shares information when you use os-coach.com and app.os-coach.com (the "Service"). It applies to Coaches, Clients, and visitors.
1. Summary
- We collect information you give us (account, profile, programs, messages, payments) and information collected automatically (device, usage, cookies).
- We use it to run the Service, bill you, support you, improve the product, and comply with law.
- We share information with service providers who help run the Service, with your Coach or Clients as part of the coaching relationship, and when legally required.
- We do not sell your personal information.
- You have rights over your data, including access, correction, export, and deletion.
2. Information we collect
2.1 Information you provide
- Account: name, email, password (hashed by our auth provider), role (Coach or Client), coaching business name.
- Profile and intake: body measurements, training history, goals, sleep and stress self-reports, dietary preferences, injuries, and any other information you add to your profile or onboarding questionnaire.
- Programs and content: workouts, nutrition templates, notes, check-in responses, messages, automations, and media you upload.
- Billing: payment method details are handled by Stripe; we receive billing metadata (last four digits of card, subscription status, invoices) but not full card numbers.
- Support: information you include when you contact support.
2.2 Information collected automatically
- Usage: pages viewed, features used, clicks, session duration, device type, operating system, browser, approximate location (from IP), and referring URL.
- Logs: server logs including IP address, timestamps, and error reports (via Sentry) for debugging and security.
- Cookies and similar:authentication cookies (required), CSRF cookies (required); on the marketing site at os-coach.com, Google Analytics cookies after you click "Accept all"; and, in the app at app.os-coach.com, product-analytics and session-replay storage set by PostHog only after you opt in via the in-app consent banner.
- Product analytics and session replay (app): If you opt in, we use PostHog to record product usage — pages viewed, features used, and clicks (heatmaps) — and to capture session replays that reproduce how the interface was used. Session replays mask all text and form inputs; client health data, intake details, and message content are never recorded, and client names are stripped from captured interactions. If you decline, no analytics or replay data is collected.
2.3 Information from third parties
- Supabase (auth and database) — identity records.
- Stripe (payments) — subscription status, checkout outcomes, payout status for Coaches using Stripe Connect.
- OAuth providers (Google) — name, email, and profile picture if you sign in with Google.
- Health integrations (Oura, and any other wearables you explicitly connect) — sleep, heart-rate variability, activity, and similar metrics that you authorize us to read. You can disconnect at any time.
- Email providers (Resend) — delivery, bounce, and complaint events for messages we send.
3. How we use information
- Provide, maintain, and secure the Service.
- Create and manage your account.
- Process payments and subscriptions (including Coach-to-Client payments via Stripe Connect).
- Connect Coaches and Clients and deliver programs, messages, and reminders.
- Generate AI-assisted insights, summaries, and suggestions where you use AI features (see §5).
- Send service communications (e.g. confirmations, receipts, reminders, and security notices). These cannot be opted out of while your account is active.
- Send product updates or marketing only if you opt in; you can unsubscribe from those at any time.
- Analyze usage to improve the Service.
- Comply with law, enforce our Terms, and protect users.
Legal bases (EEA/UK users). We rely on a different basis depending on the purpose:
- Contract (Art. 6(1)(b)): to create your account, deliver the coaching relationship, and process your subscription.
- Legitimate interests (Art. 6(1)(f)): to keep the Service secure, prevent fraud, and improve the product, balanced against your rights.
- Consent (Art. 6(1)(a)): for optional marketing, product analytics and session replay, and any wearable integrations you connect. You can withdraw consent at any time, as easily as you gave it, without affecting processing already carried out.
- Legal obligation (Art. 6(1)(c)): to keep financial records and respond to lawful requests.
Health and fitness data. Body measurements, training history, sleep and stress self-reports, injuries, and the wearable metrics you connect are special-category data under Article 9. We process them only with your explicit consent (Art. 9(2)(a)), which you provide when you choose to add them to your profile or connect a wearable, and which you can withdraw at any time by deleting the data or disconnecting the integration.
Some fields are needed to provide the Service: if you do not provide account and billing details, we cannot create or maintain your account. Profile, intake, and wearable data are optional, but the coaching features that depend on them will not work without them.
5. AI features — what happens to data
When you use AI features, the relevant context (e.g. the current client's program summary, recent check-ins) is sent to our AI provider (OpenAI) over an encrypted connection. We instruct OpenAI not to use this data to train their foundation models, consistent with their API terms. Do not submit protected health information (PHI), highly sensitive identifiers, or confidential third-party data to AI features.
No solely-automated decisions. AI outputs are suggestions that a person — typically your Coach — reviews before acting on them. We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, within the meaning of Article 22.
6. Data retention
We retain account data for as long as your account is active. After deletion or prolonged inactivity, we retain backups and minimal records (e.g. billing history) for legitimate business and legal reasons, typically up to seven years for financial records and ninety days for operational backups, after which data is deleted or anonymized. Log data is retained for up to one year.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Delete your data (subject to limits such as legal retention).
- Export your data in a portable format.
- Object to or restrict processing, including an absolute right to object to direct marketing.
- Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects (we do not make such decisions; see §5).
- Withdraw consent for processing based on consent, at any time and as easily as you gave it.
- Lodge a complaint with your local data-protection authority (in the UK, the Information Commissioner's Office; in the EEA, the authority where you live or work).
To exercise any right, email support@os-coach.com. We will respond within the timeframe required by applicable law (e.g. 30 days under GDPR, 45 days under CCPA).
California residents: you have additional rights under the CCPA/CPRA, including the right to know, delete, correct, and opt out of sale or sharing (which we do not do). Nevada residents: you may opt out of any future sale of your information.
8. Children's privacy
The Service is not intended for children under 13 (or under 16 in the EEA). We do not knowingly collect their personal information. If you believe a child has given us data, contact support@os-coach.com and we will delete it.
9. Security
We protect your data with industry-standard measures: TLS in transit, encryption at rest (including application-level encryption for sensitive fields such as intake notes), role-based access, logging, and regular reviews. No system is perfectly secure. In the event of a breach affecting your personal information, we will notify you as required by law.
10. International transfers
CoachOS operates on Cloudflare's global edge and Supabase's US-based infrastructure. If you are outside the United States, your data will be transferred to and processed in the US. Where required, we rely on the European Commission's Standard Contractual Clauses (and, for recipients that are certified, the EU-US Data Privacy Framework and its UK Extension), together with supplementary measures where appropriate. You can request a copy of the relevant safeguard by emailing support@os-coach.com. Our product-analytics provider, PostHog, also stores data on US-based infrastructure.
12. Third-party links and integrations
The Service may link to or integrate with third-party sites (e.g. Stripe Checkout, OAuth providers, wearable vendors). Their privacy practices are governed by their own policies; we are not responsible for them.
13. Changes to this Policy
We may update this Policy from time to time. Material changes will be announced by email or in-product at least 30 days before they take effect. The "Effective date" at the top reflects the most recent version.
14. Contact
The data controller is Social Concept LLC DBA Coach OS, 8 The Green, Suite A, Dover, DE 19901. Questions or requests? Email: support@os-coach.com. For EU/UK users, you may also contact your local data-protection authority.
