Train with Ky ("we", "us", "our") provides a personal training and coaching platform. This Privacy Policy explains what data we collect, how we use it, and your rights under the UK GDPR and Data Protection Act 2018.
We process your personal data on the basis of contract (to deliver coaching services you have signed up for) and your explicit consent for special category (health) data. You may withdraw consent at any time by contacting us.
Inside the platform your data is shared only with your assigned coach. Outside the platform we use the processors listed in section 5, each under a data processing agreement. We do not sell your data and we do not use it for advertising.
These are every company that processes data on our behalf, what they receive, why, and the legal basis for it.
| Processor | Data shared | Purpose | Legal basis |
|---|---|---|---|
| Supabase (database, auth, storage, hosting) | All account, coaching and health data, uploaded files | Runs the application, stores and secures your data | Contract; explicit consent for health data |
| Stripe | Name, email, billing and payment details | Processes subscription payments | Contract; legal obligation (financial records) |
| Google (Sign-In / OAuth) | Email address, name, profile picture, Google account ID | Optional sign-in method | Consent (only if you choose Google sign-in) |
| Google Places API | No personal data. Our business listing ID only | Displays public Google reviews on the website | Legitimate interests (showing genuine reviews) |
| FatSecret | Food search terms and barcodes you enter | Nutrition database lookups | Contract (delivering food tracking) |
| USDA FoodData Central | Food search terms you enter | Nutrition database lookups | Contract |
| Open Food Facts | Barcodes and food search terms you enter | Nutrition database lookups | Contract |
| AI meal recognition provider (via Lovable AI Gateway) | The meal photo you submit for scanning | Estimates foods and macros from a photo | Explicit consent (you choose to scan a photo) |
| Apple Web Push / browser push services | Your device push endpoint and notification content (or a masked title if you enable Hide Message Preview) | Delivers reminders and message alerts | Consent (you enable notifications) |
| Email delivery provider (notify.trainwithky.com) | Your email address and message content | Sends verification, password reset and service emails | Contract |
Some processors operate outside the UK/EEA. Where that happens, transfers are covered by the UK International Data Transfer Addendum or Standard Contractual Clauses. This list is kept current; if we add a processor we update this page.
We use only essential cookies and browser storage. See our Cookie Policy for the full list.
We keep your data for as long as your account is active. If you delete your account, everything is erased immediately and irreversibly, including uploaded files. We retain a minimal, immutable audit record of the deletion itself, and any billing records we are legally required to keep.
You have the right to access, rectify, erase, restrict, port, and object to processing of your data. Two of these are self-service inside the app under Settings → Privacy & Security:
For anything else, email Trainwithky@outlook.com. You may also lodge a complaint with the UK Information Commissioner's Office (ICO).
Health information is special category data. We ask for your explicit consent during onboarding before collecting it, and store an unchangeable record of when you agreed and to which version of this policy. You can withdraw consent at any time by deleting your account or contacting us.
Data is encrypted in transit (TLS) and at rest. Access is controlled by row-level security and role-based permissions. Passwords are hashed and checked against known breach databases.
Data controller: Train with Ky. Email: hello@trainwithky.com.