Privacy Policy

This Privacy Policy explains what information Gainline ("Gainline," "we," "us") collects through the Gainline website and app (the "Service"), how it's used, and the choices you have. By using the Service, you agree to the collection and use of information as described here.

1. Information We Collect

Account information: name, username, email address, and password (stored only as a one-way bcrypt hash — we never store or can see your actual password).

Profile and coaching content: bio text, workout and diet sheets, check-in submissions (including any photos or videos you choose to upload), messages sent to your coach or clients, notes a coach keeps on a client (visible only to that coach), calendar events, and reviews.

Payment information: Gainline never sees or stores your card number or other payment details — those are entered directly with Stripe, our payment processor. We do store records of transactions (amounts, dates, which coach/client a payment relates to) and Stripe-issued identifiers needed to process payments and payouts.

Usage and cookie information: basic technical data collected automatically, like IP address and timestamps, used for security (e.g. rate-limiting abuse) and troubleshooting. The Service uses a single essential session cookie to keep you logged in — we do not use third-party advertising or tracking cookies, and we do not currently respond to browser "Do Not Track" signals since there is no third-party tracking to opt out of.

Apple Health data (iOS app only, optional): if you choose to connect Apple Health in the Gainline iPhone/iPad app, the app reads your weight, step count, active calories, and heart rate from the last 7 days (weight from the last 90 days) on your device. It sends a weekly summary — average daily steps, average active calories, average heart rate, and your latest weight — to Gainline only when you submit a check-in, where it's stored with that check-in and visible to you and your coach. When you submit a check-in with a weight, the app can also save that weight to Apple Health. Health data is never used for advertising or marketing, never sold, and never shared with anyone other than your coach. You can stop sharing at any time in the Health app (Sharing → Apps → Gainline), and it's deleted along with your check-ins if you delete your account.

Face ID login (iOS app only, optional): if you turn on Face ID or Touch ID login, your username and password are saved in your device's secure Keychain and never leave your device except to log you in. Gainline never receives your face or fingerprint data — that stays with Apple's Face ID / Touch ID system.

2. How We Use Information

We use the information above to: operate and provide the Service (connecting coaches and clients, delivering sheets/check-ins/messages); process payments and payouts through Stripe; send account-related emails (email verification, password reset); respond to support requests you submit; maintain security and prevent abuse (e.g. bot signups); and improve the Service. We do not send marketing or promotional emails, and the only outbound emails are the transactional ones described above.

3. Who We Share Information With

We do not sell or rent your personal information to anyone. We share it only as needed to run the Service:

The other party in a coaching relationship: a coach and their connected client(s) can see the sheets, check-ins, messages, and calendar events relevant to that relationship. Private notes a coach writes about a client are visible only to that coach, never to the client, and never carry over to a different coach if the client switches.

Service providers we use to run Gainline: Stripe (payment processing and payouts), Resend (transactional email delivery), and our hosting/infrastructure providers (currently Render and Cloudflare). Each only receives the information it needs to perform its function, and each has its own privacy practices. Our infrastructure is US-based, so your information is processed and stored in the United States regardless of where you access the Service from.

Legal reasons: if required by law, subpoena, or other legal process, or to protect the rights, safety, or property of Gainline or our users.

Business transfers: if Gainline is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction; we'll provide notice before it becomes subject to a different privacy policy.

The Service may contain links to third-party sites (e.g., Stripe's checkout page). We are not responsible for the privacy practices of any site we don't operate.

4. Data Retention and Deletion

We keep your information for as long as your account is active, and afterward only as needed for legitimate business or legal purposes (e.g. financial records). You can permanently delete your account and everything tied to it — sheets, check-ins (including any Apple Health summaries attached to them), messages, notes, payment plans, calendar data — at any time from your dashboard. This is immediate and cannot be undone. If you have any other request about your data, use the "Contact support" link on the site.

5. Security

Passwords are hashed with bcrypt and never stored or logged in plain text. All traffic to the Service is encrypted (HTTPS). Check-in videos and photos are stored privately and only accessible to the client who submitted them and their coach — never served as public files. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security; in the event of a breach affecting your information, we will notify you as required by applicable law.

6. Your Rights and Choices

You can review and update your profile information from your dashboard at any time, and delete your account (and all associated data) whenever you choose, as described in Section 4.

If you're in the EU or UK, you have rights under the GDPR/UK GDPR including the right to access, correct, delete, or export your data, restrict or object to certain processing, and lodge a complaint with your local data protection authority. Our basis for processing your information is performance of the contract with you (providing the Service), our legitimate interests (security, fraud prevention), and, where applicable, your consent.

If you're a California resident, you have rights under the CCPA/CPRA including the right to know what personal information we collect, request deletion, and opt out of the "sale" or "sharing" of personal information — we do not sell or share personal information as those terms are defined by California law.

You can exercise any of these rights through the "Contact support" link on the site.

7. Children's Privacy

The Service is intended for users 18 years of age or older, consistent with our Terms of Use. We do not knowingly collect information from anyone under 18, and if we learn we have, we will delete it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. Continued use of the Service after a change constitutes acceptance of the revised policy.

9. Contact

Questions about this policy or your data, including any request under Section 6, can be sent through the "Contact support" link available throughout the site.