Privacy Policy

Last updated: September 6, 2026

This Privacy Policy explains how Coachito LLC, a limited liability company organised under the laws of the State of Wyoming, United States ("we", "us"), handles personal data when you use Onyx Coach: the website onyxcoach.com, the trainer web application, the Onyx Coach mobile apps, and the related services and interfaces (together, the "Service").

People use Onyx Coach in different ways, and this policy covers all of them: as a trainer, gym or coaching business, as a client who trains with one of them, as an independent app user, as a visitor to our website, or as a fitness professional we contact about our services. Where a section applies to only one of these groups, it says so.

1. Who is responsible for your data

Coachito LLC is the controller for your account, your relationship with us, billing, the website, marketing, analytics, security, and our own legal obligations.

Your own workout history. We act as controller when storing and displaying the workout records in your personal Onyx Coach account for your own use. Those records remain in your account when your trainer removes the link or closes their account, while their access through that relationship ends. This separate processing is subject to the legal bases in section 3 and your rights in section 11. Data held solely on a trainer's behalf remains subject to the Data Processing Agreement.

Your trainer is the controller for your coaching data. If you use Onyx Coach through a trainer, gym or coaching business, they decide what coaching data is collected about you (programmes, check-ins, measurements, photos, notes, messages) and they can see it. We process that data on their behalf as a processor under our Data Processing Agreement. Requests about that data should go to your trainer; if you send them to us, we forward them within five business days. When your link to a trainer ends, their access to your data ends and your own account continues as before.

2. Data we collect

Account and profile

Name, email address, and profile photo, plus a phone number if you add one
Sign-in method: email and password, Google, or Apple. Passwords are handled by Firebase Authentication and never stored by us in readable form
Language, time zone, and notification preferences
For trainers: business name, branding, pricing, and organisation membership

Body and health data

Onyx Coach can store data concerning your health, which is protected as a special category under the GDPR. You decide whether to enter it. By entering this data, or by asking your trainer to record it for you, you give your explicit consent to its processing for the purposes in section 3. Where you connect Apple Health, you grant that permission separately on your device. You can withdraw consent at any time by deleting the data or your account.

Date of birth or age, sex, and height
Body weight, body measurements, and body fat estimates calculated from them
Check-in answers about sleep, energy, soreness, injuries, and wellbeing, and the notes you or your trainer add
Progress and check-in photographs
Activity data from your device's health platform, such as Apple Health, if you grant permission: for example active energy and walking or running distance

Training and coaching data

Workout plans, templates, and scheduled sessions
Workout logs: exercises, sets, repetitions, load, duration, perceived effort, and completion
Goals, preferences, focus areas, nutrition notes where you enter them, and progress statistics derived from your logs
Messages between you and your trainer, and bookings of sessions or classes
For trainers: your exercise library, including videos and images you upload or embed from YouTube, and the content of your programmes

Payments and subscriptions

Subscription plan, status, trial and renewal dates, and purchase source (Apple App Store, Google Play, or Stripe)
Payment status and amounts for payments you make to a trainer through the Service, and referral credits. Card details go directly to Stripe, Apple, or Google and are never stored by us
For trainers: Stripe Connect account status and fee settings

Device and technical data

Device model, operating system, app version, and push notification tokens
IP address, browser type, and approximate country, kept in server logs for 30 days
Error reports, which may include your user ID and the state of the app when an error occurred

Usage data

Which features you use and when, collected through Firebase Analytics in the apps and Google Analytics on the website, in aggregated or pseudonymised form
Session recordings and heatmaps on the website through Microsoft Clarity, with form inputs masked
Opens and clicks in the emails we send you

Website leads, quizzes, and support

Name, email address, and answers you give in our quizzes, calculators, newsletter forms, or booking pages, together with campaign parameters that tell us which ad or link brought you to us
Messages you send to support and feedback you submit in the app

Fitness professionals we contact

To tell trainers and gyms about Onyx Coach, we collect business contact details of fitness professionals from publicly available sources, such as their websites, YouTube channels, and social media profiles: name, business name, public email address, and public profile links. We keep only what is needed to send a small number of introductory emails, and we stop as soon as you ask us to.

3. Why we use your data and on what legal basis

Providing the Service (contract): creating and running your account, storing and showing your training and coaching data, delivering messages, bookings, and notifications, processing payments and subscriptions, and providing support.
Health data (explicit consent): storing and displaying the body and health data described above so that you, and your trainer if you have one, can track your progress.
AI features (contract and legitimate interest): generating exercise metadata, powering search, and answering trainers' questions about their clients' training, as described in section 4.
Improving and securing the Service (legitimate interest): analysing usage, fixing errors, preventing fraud and abuse, and supporting trainers during onboarding based on how they use the platform.
Marketing (consent for consumers, legitimate interest for business contacts): sending newsletters, product news, and offers, measuring how our campaigns perform, and contacting fitness professionals about our services.
Legal obligations (legal obligation): keeping accounting and tax records, responding to lawful requests, and enforcing our terms.

4. AI features

Onyx Coach uses Google's Gemini models to generate metadata for exercises, to power search, and to run the AI assistant that trainers can ask about their clients' training. When a trainer uses the assistant, the training and check-in data needed to answer the question is sent to Google under Google's data processing terms. Photographs are never sent. Google does not use this data to train its models. AI output can be inaccurate and is never medical advice; trainers review it before acting on it.

Trainers can also connect a third-party AI assistant of their choice to their Onyx Coach account. In that case, the data the trainer asks for is sent to that provider under the provider's own terms and privacy policy, on the trainer's instruction. Trainers can revoke such a connection at any time in their settings.

5. Who we share data with

We do not sell your personal data. We share it only as follows.

Your trainer or organisation. If you train with a trainer through Onyx Coach, they see the coaching data described in section 1. If your trainer belongs to a gym or organisation account, its administrators may see it too.
Infrastructure. Google Cloud and Firebase for databases, backend services, authentication, notifications and storage, and Amazon Web Services for media. Processing locations differ by service, as described in section 8.
AI. Google (Gemini API) as described in section 4.
Video playback. Exercise videos embedded from YouTube are played through YouTube, so when you watch one Google receives your device data and may set its own cookies under its privacy policy.
Payments. Stripe for subscriptions bought on the web and for payments between trainers and clients; Apple and Google for in-app purchases; RevenueCat for validating app subscriptions.
Communication. Brevo for email, OneSignal and Firebase Cloud Messaging for push notifications.
Marketing and analytics. Google Analytics and Google Tag Manager, Microsoft Clarity, Meta (Pixel and Conversions API) for measuring ad campaigns on the website, Mautic hosted in the European Union for lead nurturing, an email verification service that checks whether an address you enter is deliverable, and email outreach tools for contacting fitness professionals.
Monitoring. Sentry, in its EU data region, for error reporting.
Partners. If you redeem a partner offer, for example through a health insurer or employer, we may confirm to that partner that the offer was redeemed, and nothing more.
Legal and corporate. Authorities where the law requires it, advisers under confidentiality, and a successor if Coachito LLC is sold or merged, who must honour this policy.

The providers that process client data on behalf of trainers, with their locations and safeguards, are listed in Annex III of our Data Processing Agreement.

6. Marketing, email, and notifications

Email. As a consumer you receive marketing email only if you opted in, for example by subscribing to a newsletter, taking a quiz, or accepting an offer. Trainers and gyms receive product news and onboarding tips about the Service they use, and fitness professionals we found through public sources receive a short introduction. Every marketing email has an unsubscribe link, and we measure opens and clicks to see what is useful. You can object to marketing at any time at [email protected].

Push notifications. The apps send notifications about your training: workout and check-in reminders, new messages from your trainer, booking confirmations, and similar. You control them in the app and in your device settings.

7. Cookies and website tracking

The website uses cookies and similar technologies from Google (Analytics and Tag Manager), Microsoft Clarity, and Meta (Pixel) to measure traffic, understand how visitors use the pages, and attribute ad campaigns. Which ones, why, and how to control them is described in our Cookie Policy. You can block or delete them in your browser settings at any time.

8. Where your data is stored and accessed

The location depends on the service and the data involved:

Coaching databases and backend: Google Cloud EU regions, including the Firestore EU multi-region, messaging in Belgium and the backend in Frankfurt.
Photographs, videos and other media: primarily Amazon S3 in Frankfurt, Germany, with a minority of uploads in Google Cloud Storage in the EU.
Authentication: Firebase Authentication processes sign-in data in the United States. Firebase Cloud Messaging, Remote Config and App Check may process their service data globally, including outside the EU.
AI and notifications: Gemini API processing can take place globally, including in the United States; OneSignal processes push notification data in the United States.
Email and error reporting: Brevo hosts its databases in France, Germany and Belgium; Sentry uses its EU data region in Frankfurt. These storage locations do not exclude other processing or provider access outside the EU, including in the United States, under the providers' data processing terms.
Payments: Stripe processes payment data in the EU and the United States under its data processing terms.

Our legal entity and administrative access. Coachito LLC is incorporated in Wyoming, United States. Our owner operates Onyx Coach from Thailand and may access personal data from Thailand where necessary to administer, maintain and support the Service.

Processing on behalf of trainers is subject to the international transfer conditions in clause 9 and Annex IV of our Data Processing Agreement. Annex III describes the providers, their processing locations and their contractual transfer safeguards. A provider's EU-US Data Privacy Framework certification applies only to transfers covered by that certification. Other transfers require an applicable safeguard, such as standard contractual clauses, and any necessary additional measures. You can request details or copies of the applicable safeguards at [email protected].

9. How long we keep data

Your account and personal workout history: for as long as you keep your account, subject to deletion requests and legal retention duties. Ending your link to a trainer does not delete your own workout history. You can request deletion under section 11.
Data held solely on your trainer's behalf: returned or deleted at the trainer's choice when processing on their behalf ends, within the 90-day period in our Data Processing Agreement. This does not delete the workout history retained for your own personal account.
Payment records: for as long as accounting and tax law requires, even after account deletion.
Leads and marketing contacts: until you unsubscribe or object, or after 24 months without any interaction from you.
Server logs: 30 days. Error reports: 90 days. Website analytics: according to the retention settings of Google Analytics and Microsoft Clarity, at most 14 months.

You can delete your account in the app settings or by emailing [email protected]. Aggregated statistics that no longer identify you may be kept.

10. Security

All data is encrypted in transit with TLS and at rest by our hosting providers
Database rules restrict every trainer to their own clients and every client to their own data, and every backend request is authenticated
Progress and check-in photographs live in a private bucket and are served only through short-lived signed links
Trainers and clients can sign in using email and password, Google or Apple through Firebase Authentication. Onyx Coach does not require two-factor authentication for customer accounts; Google and Apple sign-in use the respective provider's account security settings
Two-factor authentication is enforced on all our internal Google Cloud, Amazon Web Services and GitHub administrator accounts. Credentials are kept in a secrets manager, and production is deployed only through an automated pipeline
The database has point-in-time recovery and weekly backups
If a personal data breach affects you, we notify you and, where required, the supervisory authority without undue delay

11. Your rights

Under the GDPR and similar laws you have the right to:

Access the personal data we hold about you and receive a copy
Correct inaccurate data and complete incomplete data
Delete your data, subject to legal retention duties
Restrict processing, or object to processing based on legitimate interest, including any marketing
Receive the data you provided in a portable, machine readable format
Withdraw consent at any time, without affecting processing that happened before
Lodge a complaint with a supervisory authority, in particular in the EU country where you live or work

To exercise these rights, use the settings in the app or email [email protected]. We answer within one month. For coaching data held by your trainer, we forward your request to them and help them respond. If you live in California or another jurisdiction with its own privacy law, you have the equivalent rights under that law, and we never sell or share your data for cross-context advertising.

12. Children

Onyx Coach is not intended for anyone under 16. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.

13. Changes to this policy

We update this policy when the Service or the law changes. For material changes we notify you in the app or by email before they take effect. The date at the top shows the current version.

14. Contact

Coachito LLC
Wyoming filing ID: 2025-001823358
Principal office and mailing address:
30 N Gould St Ste N
Sheridan, WY 82801
USA
[email protected]

EU representative under Article 27 GDPR:
Coachito s. r. o.
Oravská 7597/8
080 01 Prešov
Slovakia
Company ID (IČO) 55903681
[email protected]
You can contact the representative instead of us on any matter concerning your personal data.