Privacy Policy

Who can join

The pilot is for athletes aged 13 and older who train at a gym that uses AthBuilder. We do not invite children under 13 during the pilot. If we learn that a child under 13 has an account, we will work with the gym’s staff and the child’s parent or guardian to remove it.

• Everyone gives a birth date at sign-up. After that, only gym staff can change it, because age decides who can message whom.
• Athletes under 18 must give an emergency contact.

Safeguarding contact: Talan Wright handles concerns about a young athlete’s safety. Write to support@athbuilder.com, or tell your gym’s staff. If someone is in immediate danger, call 911 first.

What we collect

• Account: your email address and a password, or Sign in with Apple. Passwords are stored only as a secure hash by our sign-in provider; we never see them. With Sign in with Apple, Apple may give us a private relay address instead of your real one.
• Profile you enter: name, date of birth, sport and positions, school or club team, pro organization, X and Instagram handles, shirt size, phone number, home address, a short bio, a profile photo, and an emergency contact (name, relationship, email, and phone).
• Training: the workouts your coaches assign you and what you log against them (sets, reps, weights, times, completion, and any reason you give for skipping, including pain you report), and the classes you book.
• Performance measurements your coaches record, for example peak force or throwing velocity, with the date, a note, and which coach recorded it.
• Messages: direct messages you exchange with members and coaches of your gym.
• Feed: posts and comments you write in your gym’s feed, and the posts you like.
• Reports and blocks: if you report a message, a post, a comment, or a person, we keep the report (your reason, any details you add, and a copy of what you reported; for a message, also the messages just before it), and the list of people you’ve blocked.
• Notifications: if you allow notifications, an identifier Apple gives your phone so we can send them, your choices about which kinds you want, and the list of notifications shown in the app.
• Coach website: a coach’s email address and password, and a sign-in cookie that keeps them signed in. The site also remembers a light or dark theme choice in the browser.
• Waitlist: the email address you give us on this site, and, only if you choose to add them, your name, your facility’s name, your sport, and your roster size.

Waivers are not currently signed in the app.

What we don’t collect

• No payment information. The app processes no payments.
• No location, no advertising identifiers, and no third-party analytics or advertising tools, in the app or on this site.
• No data from health apps or devices.

Who can see your information

• You can see and edit your own profile.
• Your gym’s coaches and staff can see your whole profile (including date of birth, home address, and emergency contact), your training and bookings, and your performance measurements, so they can coach you and run the gym. When a coach marks a dashboard item as handled (for example a workout you skipped because of pain), the gym keeps a copy of what the coach saw, including any pain details, for its staff.
• Other signed-in members of your gym can see your name and photo in the member directory, whether you accept direct messages, and what you post, comment, and like in the gym’s feed. Photos are not public: only signed-in members of your gym can load them, through short-lived links.
• Messages are visible only to the two people in the conversation. Coaches can’t read conversations they aren’t part of. The one exception is a report: when someone reports a message, the gym’s staff see a copy of it and up to 10 messages before it. A report about a staff member isn’t shown to that staff member.
• Reports about coaches and staff also go to AthBuilder’s operators, Talan Wright and Kevin Dark, so a concern about a coach always reaches someone outside the gym. They see the same report the gym’s staff see (what was reported, the reason and details, and who made it) and the reporter’s contact details, including their emergency contact, so they can follow up. An operator never sees a report about themselves. Reports between athletes stay with the gym’s staff.
• Feed moderation: the gym’s staff can see reports about posts and comments and can remove a post or comment.
• Who can message whom: coaches can message anyone. Athletes can message coaches and each other, except that athletes 18 and over can’t start a conversation with an athlete under 18 (the younger athlete can start one, and the older athlete can reply). Athletes 18 and over don’t see athletes under 18 in the list of people to message.
• Your controls: you can turn off messages from other athletes in your profile, which stops other athletes starting conversations with you (coaches can still message you). You can block an athlete, which stops messages both ways. You can report any message, post, comment, or person to the gym’s staff (and, for a report about a coach or staff member, to AthBuilder’s operators).
• AthBuilder’s operators, Talan Wright and Kevin Dark, can access the database to support the pilot and respond to incidents. No one else has that access.
• Waitlist: when you join the waitlist, your email address, and any optional answers you add, are emailed to AthBuilder’s operators so they can contact you. No one else sees them.
• Each gym is separate. People at one gym cannot see another gym’s members, training, messages, or feed.

We don’t sell your information or share it with advertisers.

Services we use

• Supabase hosts the database, sign-in, file storage (profile photos), and live message delivery.
• Cloudflare hosts this website and the coach website. Like any web host, it processes each request, including the visitor’s IP address. It also delivers the waitlist email described above, and email sent to our contact address, to the operators’ inbox.
• Google (Gmail) provides the operators’ inbox, where those emails are received.
• Resend delivers the sign-in emails Supabase sends, such as password reset links, to the address on your account.
• Apple provides Sign in with Apple, TestFlight, and delivery of notifications to your phone.
• Google (YouTube): exercise demonstration videos are YouTube videos played in YouTube’s embedded player. When you open one, your device contacts YouTube, and Google’s privacy policy applies to that request. YouTube learns which video you opened; the app doesn’t send your name, your account, or your gym.

Keeping and deleting your data

• Deleting your account: in the app, go to Account → Delete Account, type DELETE, and sign in again. Your account is erased right away. There is no waiting period and no undo. We delete your account, profile, profile photo, workout history, bookings, performance measurements, group memberships, blocks, feed posts, comments and likes, notification settings, the copies your coaches kept of your workout logs and pain reports, and the messages you sent, which disappear from everyone’s conversations. The other person’s own messages stay with them, shown with “Deleted user.”
• Safety reports: a report you made, or one about you, is kept for the gym’s staff (and, for a report about staff, AthBuilder’s operators), with your identity removed from it. A report stays until staff review it, and is deleted 3 months after it’s reviewed.
• Coach and staff accounts are deleted by us on request, so a gym is never left without an owner by accident. Write to the contact below.
• Waitlist: write to the contact below and we’ll remove your waitlist entry.
• Backups: during the pilot we occasionally save a copy of the database to an encrypted computer that only our operators use, so we can recover from a mistake or an outage. We keep only recent copies and delete older ones. If you delete your account, your data can remain in a copy made before then until that copy is deleted. We use a copy only to restore lost data, and we never use one to bring back an account that was deleted. Profile photos and other uploaded files are not in these copies. Our hosting provider may also hold short-lived copies as part of running its service, under its own policies.
• When the pilot ends: if you keep using AthBuilder, your account and data carry on. If you don’t, delete your account as described above, or ask us to, and it is erased.
• On your phone: workout sets you log without signal are kept on your phone (protected, and left out of device backups) until they reach our servers. Logging out removes them; if your session ends some other way, they stay until you sign back in, or until someone else signs in on that phone.
• Otherwise, we keep your data while your account is active.

Forgotten passwords

Use “Forgot your password?” on the sign-in page. We email a one-time link to the address on your account, and you choose a new password; saving it signs you out everywhere. If you can no longer open that email, athletes contact their coach or gym staff, and coaches write to the contact below. We confirm your identity before resetting a password that way, and never send a new password over the same channel you asked on.

Security

Every request travels over encrypted connections (HTTPS). Database access rules limit each person to their own gym’s data and their own records, and passwords are stored only as hashes. No system is perfectly secure. If something goes wrong that affects your data, Talan Wright or Kevin Dark will email the people affected within 72 hours of confirming it, and say what happened and what we’re doing about it.

Changes

We’ll update this policy when the app or site changes what it collects or who can see it, and change the effective date above.

Contact

Privacy questions, deletion requests, and safety concerns: support@athbuilder.com