The data controller responsible for your personal data on Coachiny is Yahya Bahloul, founder and operator of Coachiny, based in Sfax, Tunisia. Contact: support@coachiny.tn · +216 54 15 28 28 (postal address available upon request). You may exercise your data protection rights by contacting us at this address.
Coachiny holds health information: training, nutrition, body measurements and, if you choose, progress photos. We collect only what coaching needs, show it only to the people involved, and never sell it or use it for advertising.
1. What we collect
- Account: your Google account’s email address and identifier; your name and photo, taken from Google once and editable in the app.
- Coaches: your profile, your plan and its limits, the price agreed with you, the dates of your subscription, the payments you make to the platform (amount, method, period covered), your library (templates, exercises, foods, demo videos), your athletes’ membership terms and the payments you record, your private notes, and a phone number if you gave one to the platform.
- Coach applications: if you ask to join Coachiny while signup is by invitation, what you fill in (name, phone, city, number of athletes, Instagram account, message), together with your Google account’s address. It is emailed to us so that we can call you back.
- Athletes: your height, the sessions and sets you log, the meals you tick and the foods you add, your check-ins (weight, measurements, notes, and how your week felt: energy, sleep, stress, hunger, digestion, motivation, following the plan), progress photos if you consent to them, personal records, and the targets your coach sets.
- Invitations: when a coach invites you, they give us your name, your email address and, if they wish, your phone and your membership terms; we write to that address to invite you.
- Messages and photos exchanged in the in-app chat.
- Devices and preferences: the push-notification token of each device where you enable notifications, its language, and your notification and language settings.
- Technical data: when one of the apps hits an error it sends us the page path, the error message and its technical trace, the browser type and your account identifier, never what you typed. Our hosting providers keep standard security logs (such as IP addresses) for a limited time.
Only your Google account’s email address and identifier are required: without them there is no account. Everything else is optional, but without your logs and check-ins your coach cannot follow you, and without photo consent no photo is ever asked for.
On your own device the apps store your theme, language, palette and shopping-list ticks. We use no advertising or analytics trackers and no third-party cookies.
2. Why, and on what basis
- To provide the service you signed up for: planning, logging, follow-up, messaging and notifications between a coach and their athletes (performance of the contract, that is, these terms).
- To process health information (training, nutrition, measurements, how you feel, photos) and share it with your coach: on the basis of your express consent, given through a separate box when your account opens and recorded (Organic Law 2004-63, art. 14, 47 and 62), and one more consent for progress photos.
- To host your data outside Tunisia (section 4): on the basis of your express consent, given through a separate box; the transfer is also subject to the INPDP’s authorization (art. 52).
- To keep the service secure and working: preventing abuse, fixing errors, answering support requests (our legitimate interest).
- To review your coach application and call you back, at your request (steps before a contract).
- To meet legal obligations, where they apply, including keeping records of payments.
We do not use your data for advertising, we do not sell it, and we do not use it to profile you for anyone else.
3. Who sees your data
- Your coach: only while you train with them. When the membership ends, their access ends automatically; if you move to another coach, the new coach sees your history from then on.
- You: always, including after a membership ends.
- The platform administrator: only to provide support, keep the data consistent and investigate abuse.
- Service providers who host and run Coachiny for us, bound by contract and by confidentiality: Google (Google Cloud and Firebase for the database, sign-in, hosting, functions, push notifications and abuse protection with reCAPTCHA, and Gmail, where emails to support and coach applications arrive), Cloudflare (storage of photos and videos, receiving the emails written to our contact address), and Resend (sending invitation emails and coach applications).
- The people you show a share card to yourself (a session or a week, with your coach’s name): you choose to post it.
We disclose data to authorities only when the law requires it.
4. Where it is stored
The database, the functions and the files are in the European Union: in Belgium (Google Cloud, europe-west1) and Western Europe (Cloudflare R2). Sign-in (Firebase Authentication) is run by Google in the United States: your Google account’s email address, name and photo are processed there. Push notifications, abuse protection, page delivery and incoming email go through Google’s and Cloudflare’s global networks; Resend, a US company, sends our emails from Ireland.
Data is encrypted in transit and at rest. Body photos and chat photos are kept in private storage and shown only through links that expire after 15 minutes, to the people allowed to see them.
Because Coachiny is operated from Tunisia, your data is therefore transferred to the European Union and the United States. This happens with your express consent, with providers bound by contract that apply recognised security safeguards, under Organic Law 2004-63 (art. 50–52), which makes the transfer subject to the INPDP’s authorization.
5. How long we keep it
- While your account exists, we keep your data so you can use the service.
- When a membership ends, the athlete keeps their history (read-only) and the former coach loses access.
- Withdrawing photo consent deletes all your progress photos immediately.
- Deleting your account: after a 14-day grace period during which you can cancel, we erase your profile, logs, check-ins, photos, the messages you sent, your devices and your acceptance records. Messages the other person wrote stay with them.
- A coach who deletes their account can choose to keep their library for 12 months; it is then erased unless they come back.
- An invitation an athlete has not accepted yet is kept until the coach withdraws it, or the invited person asks us to erase it.
- A coach application is kept while it is useful to contact you, and erased with your account or whenever you ask.
- Payments made to the platform are kept as accounting records for as long as the law requires accounting documents to be kept, including after the account is deleted.
- Technical error reports and security logs are kept for a short period (typically 30 days) by our hosting provider.
6. Your rights
You can access your data and get a copy of it, correct, complete or erase it, object to its processing on legitimate grounds, and withdraw any consent you gave at any time (Organic Law 2004-63, art. 27, 32, 38 and 42). Most of this is in the app: edit your profile, withdraw photo consent, delete your account. For anything else, write to us and we will answer within one month.
Withdrawing your consent to the processing of health data ends coaching on Coachiny: we then erase that data, which amounts to deleting your account.
Contact: support@coachiny.tn. You can also lodge a complaint with the Tunisian data protection authority, the Instance Nationale de Protection des Données à Caractère Personnel (INPDP).
7. Minors
Coachiny is only for people aged 18 or older, who confirm it when accepting these documents. Tunisian law makes processing a child’s data subject to their guardian’s consent and a family judge’s authorization (Organic Law 2004-63, art. 28), so we do not open accounts for minors. If we learn that an account belongs to someone under 18, we close it and erase its data; a parent or guardian can tell us at any time.
8. Security
Access to every piece of data is checked on the server for every request; a coach can only reach their own athletes. Requests must come from our apps (App Check), sign-in is through Google, and photos are private. A backup copy of the database is made every week and kept four weeks, in the same region; the administrator’s repair operations are logged. No system is perfectly secure: if a breach affecting you happens, we will tell you and the authority as the law requires.
9. Changes
We will update this policy when what we do changes. The date at the top shows the version. When a change is material, the apps will ask you to accept the new version before you continue.
See also: Terms of service