Legal

Privacy Policy

Version 1.0Effective: Not yet in effectLast updated: 2026-10-31DRAFT

This document is a draft. It has not been reviewed by legal counsel, is not in effect, and does not bind anyone. Final language will be published after attorney review.

DRAFT — NOT IN EFFECT. Written for TRAINCND and awaiting counsel's review [ATTORNEY REVIEW REQUIRED]. Brackets mark choices for counsel [COUNSEL] or facts to confirm [CONFIRM].

This policy explains how JR Strength and Fitness LLC, doing business as TRAINCND ("TRAINCND," "we"), handles personal information in the TRAINCND platform: the coach portal gyms use and the training apps gyms give their athletes, often under the gym's own name.

1. Who is responsible for your information

Your gym decides what it collects about its athletes and why. For athlete records, your gym is responsible for the information, and we handle it on the gym's behalf and on its instructions. Requests about your gym's records may go to your gym or to us; we will help your gym answer them. [COUNSEL: controller and processor roles]
TRAINCND is responsible for the information we handle for our own purposes: running and securing accounts, gym billing, our website and signup, and improving the platform.

2. What we collect

Category	Examples	Comes from
Account	Name, email, password (stored encrypted), phone if given	You, or your gym when it invites you
Training	Programs, logged sets and sessions, check-ins, readiness, testing results (for example sprint or force-plate data)	You, your coaches, your gym's testing system
Health and body	Intake answers (injuries, health history, goals; optionally sex, pregnancy or postpartum questions), measurements, progress photos	You, your coaches
Communications	Messages with coaches, attachments, voice notes	You, your coaches
Signed forms	Waivers and consents, the signer's name, and for a minor the parent or guardian who signed; time, browser and a hashed network address as evidence	You, your parent or guardian
Payments	What you bought from your gym and its status; card details stay with Stripe	Stripe, your gym
Gym customers	Business name, staff contacts, subscription and billing status	The gym
Device and usage	Pages used, errors, device type, approximate time; cookies needed to sign in	Your device

3. Children and teens

Under 13. Children under 13 cannot have an account. A gym may keep a coach-managed training record for a younger athlete; the gym must first obtain a parent's or guardian's consent, and the child never uses the app. We use that record only to provide the service to the gym. [COUNSEL: COPPA]
13 to 17. A teen may use the app only with a parent's or guardian's consent, collected by the gym through its consent form. A parent or guardian may ask the gym or us to see, correct or delete their teen's information.
We do not sell minors' information, show them advertising, or use their information to build profiles for anyone else.

4. How we use information

To provide the platform: deliver programs, record training, show progress, run messaging, forms and signing.
To let your gym's coaches coach you, including AI-assisted drafting that a coach reviews.
To keep accounts and the platform secure, prevent abuse and fix problems.
To bill gyms for their subscriptions and to process payments a gym takes through its own Stripe account.
To send service messages (invitations, password resets, reminders you can turn off).
To improve the platform using aggregated or de-identified information.

We do not sell personal information and do not use athletes' information for advertising.

5. Health information

Health and body information is used only to provide coaching through your gym. It is shared with your gym's staff and our service providers, not with advertisers or data brokers. Where state law requires consent for health data, we or your gym will ask for it before collecting. [COUNSEL: Washington My Health My Data Act and similar laws]

Your gym and its staff, who can see your training and the information you enter.
Service providers that run the platform for us: Vercel (hosting), Supabase (database and sign-in, US region), Resend (email), Stripe (payments), OpenAI (AI-assisted drafting and photo reading for coaches) [CONFIRM], and web push services for notifications. They may use the information only to provide their service.
Your gym's own Stripe account, if you pay your gym through the app.
When the law requires it, to protect someone's safety, or in a sale or reorganization of our business (with this policy continuing to apply).

7. How long we keep it

We keep information while the account or the gym's workspace is active. When a gym cancels we keep its records for [CONFIRM: 30] days so it can export them, then delete them. Signed forms may be kept longer where the gym or the law needs them. Backups age out on their normal schedule.

8. Your choices and rights

You can see and export your records, correct them, turn off optional notifications, and ask for deletion of your account. Depending on where you live you may have further rights (to know, access, correct, delete, or appeal a decision). Contact your gym or us; we will answer within the time the law sets and will not treat you differently for asking. [COUNSEL: Oregon OCPA, California and other state rights]

9. Security

We use encryption in transit, access controls that keep each gym's data separate, limited staff access, and logging of sensitive actions. No system is perfectly secure; we will notify gyms and, where required, you of a breach affecting your information.