Privacy Policy

When you use the JASHTONFIT app, we collect:

• Account information — your name, email address, and a securely hashed password managed by our authentication provider (Supabase Auth). We never see or store your password in plain text.
• Training data — the workouts, sets, reps, and weights you log, your check-in weight and body measurements, your daily step counts, and your nutrition/food log entries.
• Progress photos — any photos you choose to upload to track your physical progress over time.
• Messages — the content of messages you exchange with your coach through the in-app messaging feature.
• Push notification data — if you opt in to push notifications, we store the device subscription token needed to deliver them. You can disable this at any time in Account Settings.
• Payment information — if you subscribe via our self-signup plan, your card details are collected and processed entirely by Stripe. JASHTONFIT never receives or stores your full card number.

We use the information above only to run the coaching service, specifically to:

• Build and adjust your training programs and nutrition guidance.
• Let your coach review your logged workouts, weight, and photos to track progress and give feedback.
• Deliver messages between you and your coach, and send push or email notifications you've opted into.
• Process your subscription payment and manage billing (via Stripe).
• Maintain and troubleshoot the app itself.

We do not sell your personal information, and we do not share it with advertisers, data brokers, or any third party for marketing purposes. It is used only to deliver your coaching service.

A small number of trusted providers process data on our behalf:

• Stripe — handles all subscription billing and card payments. Stripe is PCI-compliant; JASHTONFIT never touches your raw card details.
• Supabase — hosts our database, authentication, and file storage (including progress photos). Your data is stored on Supabase's infrastructure with encryption at rest and in transit.
• Vercel — hosts the app and delivers it to your device.
• Resend — sends the emails the app sends (login codes, reminders and messages from your coach). Your email address and the email's content pass through it.
• Sentry — receives technical error reports when something breaks, so we can fix it. Reports can include the page you were on and your account ID, but not your messages or photos.
• Open Food Facts and USDA FoodData Central — public food databases. When you search for a food or scan a barcode, the search term or barcode is sent to look it up — not your name or account.
• Cloudflare Turnstile — an anti-spam check on public sign-up forms, where enabled, to tell people from bots.
• Your device's push service (Apple, Google or Mozilla) — delivers notifications if you turn them on.
• Vercel Analytics — provides aggregate, anonymised page-view analytics so we can see the app is working. It does not use cookies and does not track you individually.
• ElevenLabs — generates the spoken audio for guided meditation and relaxation sessions in the Recovery Toolkit. Only the script text for a session is sent for voice generation — not your personal or training data.
• Instagram / Meta — lets the app pull your coach's public Instagram reels to display in the app, if they've connected an account. This is a one-way feed of public content into the app; it does not read or access your personal Instagram account or data.

We do not use advertising networks, third-party trackers, or cookie-based analytics in this app.

All app data — your account, logs, photos, and messages — is stored with Supabase, a reputable database and infrastructure provider used by thousands of applications. We rely on Supabase's security controls (encryption in transit and at rest, row-level access rules) to keep your data protected, and we restrict access within the app so that only you and your coach can see your training data.

You can review or update most of your information yourself from within the app (Account Settings, your workout log, and progress photos). If you'd like a copy of your data, want anything corrected, or want your account and data deleted entirely, message your coach directly through Dashboard → Messages, or reach out via jashtonfit.com. We'll action deletion requests promptly, though we may need to retain minimal billing records where required by law (for example, tax and accounting purposes).

The JASHTONFIT app is intended for adult clients of the coaching business. It is not directed at children, and we do not knowingly collect information from anyone under 16.

If you are a coach, we also hold your name, email address, business and branding details (logo, colours, web address), your plan and billing status, and records of how you use the platform. Card payments for your subscription are handled by Stripe — we never see your card details — and if you connect a Stripe account to be paid by your clients, Stripe collects the identity and bank details it needs directly.

Your clients' information is held on your behalf so you can coach them: you decide how it is used, and we process it only to provide the platform, keeping each coach's clients separate from every other coach's. Our Coach Terms explain the responsibilities that come with that. Coaches can export their clients' information, and we delete or de-identify it within a reasonable time after a coach leaves and asks us to, unless we are required to keep it.

If this policy changes in a meaningful way, we'll update the date at the top of this page. Continuing to use the app after changes are posted means you accept the updated policy.

Questions about this policy or your data? Message your coach through the app, or visit jashtonfit.com for other ways to get in touch.