Privacy policy

Who we are

Phase is run by Alec Daly, trading as Phase (“we”), registered with the UK Information Commissioner's Office (ICO) under number [ICO registration number]. Contact us about anything on this page at support@train-phaseperformance.com.

Who is responsible for your data

Under UK data protection law (UK GDPR and the Data Protection Act 2018), it depends on how you use Phase:

• You train with a coach or personal trainer (in a team, or as their client): your coach decides what they record about you and why, so your coach is the controller of that data. We run Phase for them as their processor: we only use it to provide the app, following their instructions and our agreement with them.
• You're a coach or trainer: we're the controller of your own account details (name, email and password).

Either way, you can contact us and we'll help, or pass your request to your coach.

Other coaches on a team. A team's head coach can invite other coaches by email. An assistant can see and change the team's programmes, calendar and athletes' training; a viewer can only see them. Both can see athletes' training, health data (if the athlete has agreed), and under-18 status. They only see the teams they're invited to, and the head coach can remove them at any time. A personal trainer's clients are not shared.

Who can use Phase, and under-18s

You need to be 13 or over to use Phase. We ask for your date of birth when you sign up; it's private (only you and your coaches can see it).

13 to 17 year olds need a parent or guardian's consent first. Until then the account is locked: we email the parent or guardian what we keep and who the coach is, and they choose “I give consent” or “I don't consent”. The links work once, for 7 days.

• If they consent, we record their name, when, the network address they used and which version of this policy they agreed to.
• If they don't consent, or don't answer within 7 days, the account and its data are deleted.
• They can withdraw consent at any time with the link in their confirmation email. The account is locked straight away, and they (or the coach) can have the data downloaded or deleted.
• A coach can mark an athlete as under 18, or correct their date of birth, and a coach can make a team an “under-18 / school team”, where everyone who joins needs consent. The coach's answer overrides the athlete's.

Following the ICO's Children's Code, under-18s get the most private settings: their profile and training are seen only by them and their coaches, they're left off leaderboards, they can't make share images unless their coach allows it, their date of birth is never shown to other athletes, and they get no marketing emails. When they turn 18 these end automatically and we email them to say so.

What we keep, and why

• Your name, email and password (stored scrambled, so nobody can read it, not even us): to give you an account and let your coach know who you are. Basis: providing the service (contract).
• Two-factor login, if you turn it on (staff must): the secret key your authenticator app shares with us, your unused backup codes, and a cookie if you choose “Trust this device”. Basis: keeping your account secure.
• Your date of birth, to check you're old enough and whether you need a parent or guardian's consent, and your height if you add it in My account, so your coach can plan for you. Only you and your coaches see them. Basis: providing the service; for under-18s, also a legal obligation (UK GDPR Article 8).
• For under-18s: their parent or guardian's name and email, and the record of their consent (see above). Basis: consent, and the legal obligation to keep a record of it.
• Your team or trainer, and the training you log: dates, exercises, weights, sets and reps. Basis: providing the service; for teams and clients, your coach's legitimate interest in coaching you.
• Health data, only if you agree: see below.
• For coaches and trainers: your teams, clients (name, email, goals and private notes you write), programmes, team badge and exercise demo videos. Basis: providing the service.
• Emails we send (password resets, client invites, parent/guardian consent): the address and the message.
• Server logs: your IP address and the pages requested, kept briefly to keep Phase secure and working. Basis: our legitimate interest in running a secure service.

We don't collect your address, phone number or location. We never sell your data, use it for advertising, or share it with anyone not listed on this page, unless the law requires it.

Health data needs your explicit consent

Some things you can log count as health data, which the law protects more strongly: body weight, injuries and limitations, session RPE (how hard a session felt) and session notes such as soreness. We only keep these if you've explicitly agreed. Phase asks you once, and until you agree they're switched off.

You can withdraw consent at any time in My account → Health data. We then delete the health data we hold about you; your sets, reps and weights stay. Withdrawing doesn't affect what was done before.

Only you and your coaches can see your health data.

Services that process data for us

These companies run parts of Phase. Each only gets what it needs, under a contract that requires it to keep data safe and only use it for us.

Render

Hosting the app and its database: everything on this page that we keep.

Stored: EU (Frankfurt, Germany)

Cloudinary

Storing team badges and exercise demo videos.

Stored: US

Brevo

Sending emails: your address and the message.

Stored: EU (France and Germany)

Anthropic (Claude API)

Only when a coach chooses AI import: reading their uploaded programme file. Only the file's text and name are sent: no client or athlete data. Anthropic doesn't use it to train its models.

Stored: US

YouTube (Google), Vimeo, Instagram (Meta)

Playing exercise demo videos a coach has linked. Nothing loads until you press play. YouTube uses its privacy-enhanced mode (youtube-nocookie.com) and Vimeo “do not track”; once a video plays, that service receives your IP address and may set its own cookies.

Stored: US

Google Fonts, jsDelivr, unpkg

The app's font and code libraries, which your browser downloads from them, so they see your IP address.

Stored: Worldwide (content delivery networks)

Transfers outside the UK. Data stored in the EU is covered by the UK's adequacy regulations for the EU. Where data goes to the US, the provider is certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”), or we rely on the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, plus the provider's own security measures.

Cookies

Phase only uses essential cookies: one keeps you logged in, one protects forms from misuse (CSRF), one briefly carries messages such as “Saved” to the next page, one remembers whether you chose light or dark mode, and, if you choose “Trust this device” at two-factor login, one remembers that for 30 days. There are no tracking, analytics or advertising cookies, so we don't ask you to accept any. Video services can set their own cookies only when you play a demo video (see above).

How long we keep it

• Your account and training: while you have an account. Deleting it (you, your coach for their team or client, or a parent/guardian) deletes your profile and training straight away. An under-18's account still waiting for consent is deleted after 7 days.
• Health data: until you withdraw consent or delete your account, whichever is first.
• Teams, clients and programmes: until the coach deletes them. Archived ones are kept, hidden, so the coach can restore them.
• Badges and demo videos: deleted from Cloudinary when the coach removes or replaces them.
• Files for AI import: we don't keep the file; Anthropic deletes it after a short period under its API terms.
• Emails and server logs: kept by Brevo and Render for a limited time (usually weeks) for delivery and security.
• Backups: deleted data can stay in database backups for up to 7 days until they're overwritten.

Your rights

You have the right to:

• see the data we hold about you, and download it: My account → Download my data;
• correct it if it's wrong;
• delete it: My account → Delete my account (it's permanent);
• withdraw consent to health data at any time: My account → Health data;
• object to or restrict how we use it, and take it to another service (portability).

For anything you can't do in the app, contact us at support@train-phaseperformance.com. We'll reply within one month. If your coach is the controller of your data, we'll pass your request to them and help them answer it.

Complaints

If you're unhappy with how your data has been handled, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

When we change this policy we update the date at the top, and show a notice in the app the next time you log in.