Privacy Policy.

To provide the Service, we collect several categories of information. Under various regional data privacy laws (such as the California Consumer Privacy Act / CPRA), this section serves as our “Notice at Collection” of the categories of Personal Information collected, the purpose of collection, and how long it is retained.

🚫 What we do NOT collect

We do not collect your precise GPS location, your contacts list, microphone or ambient audio, device advertising identifiers (such as IDFA), or track your activity across third-party websites or applications.

🧬 Biometric data disclaimer

While you may upload progress photos or manual body-scan data, TSF Forge LLC does not utilize facial recognition, facial geometric mapping, or extract biometric identifiers from your photos or data. Your photos are stored in secure, private object storage and are never processed for biological or biometric identification.

⌚ Health & wearable platform data

When you choose to connect a wearable or health platform (Garmin Health API, Fitbit, Polar AccessLink, Google Fit, or Apple Health), you grant Coach374 read access to a specific, limited set of fields via the platform’s OAuth flow. We never receive your platform credentials — only a revocable authorization token. The specific fields we read are:

• Sleep — total duration, sleep stages (deep / REM / light, when available), and sleep score.
• Resting heart rate — daily value, used for recovery-day suggestions when it spikes above the user’s 30-day baseline.
• Heart rate variability (HRV) — overnight RMSSD reading, used as a redundant recovery signal.
• Workout sessions — activity type, start time, duration, and distance/calories where reported. Used to auto-complete the daily workout anchor.
• Daily activity totals — steps, walking distance, active minutes. Used to auto-complete the daily walk anchor and feed the weekly review.

How we use this data. Health-platform data is used solely to (a) display your own metrics to you in the Coach374 app, and (b) inform the personalized weekly review the AI coach generates for you. The data is never used for advertising, never sold or rented to third parties, never used to train AI models for any other purpose, and never combined with data from other users in any identifying way.

Storage & retention. Synced values are stored in your private user record in the United States (Supabase). They’re retained for the active life of your account so the coach can compare week-over-week trends. When you delete your account, all health values are deleted along with the rest of your data within 30 days; see Section 6 for the full deletion workflow.

User control. You can disconnect any health platform at any time from Settings → Devices inside the app. Disconnecting immediately stops all further data pulls and revokes our authorization token with that platform. Existing synced values remain in your account so your historical view stays intact; if you want them removed, request a deletion via /account/data.

Coach374 is a registered Garmin Health API developer (Garmin Developer Portal). We honor Garmin’s data-use policies in addition to the broader posture described above; the same commitments apply to Fitbit, Polar, Google Fit, and Apple Health connections.

If you reside within the European Economic Area (EEA) or the United Kingdom, we rely on the following distinct legal bases under the General Data Protection Regulation (GDPR) to process your data:

• Performance of a contract (Art. 6(1)(b)) — to create your account, manage your subscription, and operate the core functions of the Coach374 application.
• Explicit consent (Art. 9(2)(a)) — for tracking physical metrics, dietary records, and progress photos that may be classified as health-related or sensitive data. You grant this consent during onboarding and can withdraw it at any time by deleting your data or account.
• Legitimate interests (Art. 6(1)(f)) — to maintain server security, generate administrative audit logs, prevent fraudulent activities, and analyze structural bugs to optimize app performance.
• Legal obligation (Art. 6(1)(c)) — to preserve mandatory tax, transaction, and financial records required under corporate compliance laws (e.g., Stripe payment records).

We do not sell, rent, or lease your personal information to third parties. We do not share your data with advertisers or run ad tracking networks inside our app.

To host and operate the Service, we share specific data streams with the following trusted third-party subprocessors under strict data protection agreements:

Third-party data sources (health & device platforms)

Separately from the subprocessors above — which act on our behalf to operate Coach374 — we also readfrom third-party platforms that you explicitly authorize. These are data sources, not subprocessors: we send no user data to them; we only receive the fields described in Section 1 after you grant access via their OAuth flow.

For every platform above: we never sell, rent, transfer, or license the data to any other party. We never use it for advertising. We never use it to train AI models, beyond passing your own aggregated weekly numbers into the prompt that generates your own weekly review. We do not combine it with other users’ data in any identifying way.

Legal compulsion

We may disclose your information to law enforcement, government officials, or private litigants only when we are legally compelled to do so by a valid, binding subpoena, court order, or search warrant, or if we believe in good faith that disclosure is necessary to prevent imminent physical harm or financial fraud.

Coach374 relies on the Claude API provided by Anthropic to generate its personalized responses and guides.

• No model training: your conversations, workout logs, nutritional inputs, and prompts sent to the AI API are used strictly to generate real-time responses back to you. Your data is never used by us or by Anthropic to train, tune, or improve third-party machine learning models.
• Retention: inputs transmitted to Anthropic are kept securely by the provider for a maximum of 30 days solely for security, anti-abuse monitoring, and compliance purposes, after which they are deleted.

We implement rigorous administrative, technical, and physical security controls to safeguard your data:

• All data transmitted between your device and our servers is strictly encrypted using HTTPS / TLS 1.3.
• All user records and files are encrypted at rest using industry-standard AES-256 encryption.
• We utilize passwordless email one-time-password (OTP) authentication. Because we do not store traditional passwords, your account is naturally insulated from credential-stuffing hacks.
• Internal administrative access to databases is locked behind multi-factor authentication, limited to essential founding staff, and fully recorded in an immutable compliance audit log.

We respect data privacy choices globally. Regardless of your physical location, you can access comprehensive automated data tools directly inside your account dashboard:

• Data export (access): you can download a complete, machine-readable JSON archive of all your logs, profile details, and account data at any time via your /account/data dashboard.
• Rectification: you can directly modify, update, or correct your personal metrics, display names, and goals at any time within the App Settings panel.
• Data erasure (deletion): you can trigger a full account deletion request from your dashboard. Upon confirmation, we securely delete all identifiable personal records, history, logs, and progress photos within 30 days.

Depending on your jurisdiction (such as the EU/UK under GDPR, or US states like California, Virginia, and Colorado), you may have specific statutory rights enforceable under those laws. The tools above are provided universally as a matter of customer service, independent of any statutory entitlement.

Note for financial records: if you are a paying subscriber, we are required by financial and corporate tax laws to retain transactional receipts and billing logs for a statutory period (typically 7 years). These records are retained separately from your deleted app data and are scrubbed of personal identifiers where feasible.

If you are a resident of California or states with comparable consumer privacy frameworks:

• No sale or sharing: we have not “Sold” or “Shared” (for cross-context behavioral advertising) any user personal information in the preceding twelve (12) months.
• Sensitive data limits: we collect and process “Sensitive Personal Information” (health metrics) solely to perform the services expected by an average consumer requesting fitness tracking. We do not use SPI for any separate tracking or downstream monetization purposes.
• Non-discrimination: we will never deny services, charge different prices, or provide a lower quality of service if you choose to exercise your legal data privacy rights.

Our operations and third-party servers are situated primarily within the United States. If you access the Service from the European Union, United Kingdom, or regions with distinct localized data sovereignty requirements, your data will be transferred to and processed in the U.S. We secure these cross-border data flows with our subprocessors using European Commission-approved Standard Contractual Clauses (SCCs).

Per our Terms of Service, Coach374 is strictly built for and restricted to individuals 18 years of age and older. We do not knowingly market to or collect data from children or individuals under 18. If we discover that an account has been created by a minor, we will immediately terminate the account and completely erase all corresponding data from our production databases.

We reserve the right to modify this Privacy Policy at any time. If we introduce material alterations that alter how we process your personal data, we will provide you with clear notice at least fourteen (14) days before the changes take effect via a prominent pop-up notification inside the application or via an explicit email broadcast to your registered account address. Minor structural optimizations or typographical corrections will take effect immediately upon posting.

If you have any questions, wish to lodge an inquiry, or require assistance regarding your data privacy choices, please reach out:

• Data protection desk: privacy@coach374.app
• General operations: hi@coach374.app