Privacy Policy
Last updated 24 June 2026
This Privacy Policy explains how PowerCoach collects, uses, shares, and protects your personal data when you use our website at powercoach.fi, our web application at app.powercoach.fi, and our mobile apps for Android and iOS (together, the “Service”).
We’ve tried to write this in plain language. If anything is unclear, email us at mariusz@kuchta.dev and we’ll explain.
Who we are
The data controller responsible for your personal data is:
Mariusz Kuchta, sole trader, operating PowerCoach from Finland. Contact: mariusz@kuchta.dev
Because we operate from the European Union, we process personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection law.
A note on coaches and athletes
PowerCoach connects coaches with the athletes they train. If you are a coach, you may enter or upload information about your athletes (for example, their programs, training notes, or measurements). You are responsible for making sure you have the right to share that information with us, and for telling your athletes how their data is used. For that athlete-related content we act on your instructions.
For everything involved in actually running the platform — accounts, security, hosting, and the Service itself — we act as the controller.
The data we collect
Account and profile information. Your name, email address, a securely hashed password, your role (coach or athlete), and any profile details you choose to add.
Coaching relationship data. Invitations you send or accept, and the links between coaches and their athletes.
Training data. The programs, workouts, exercises, sets, reps, loads, training logs, notes, and progress metrics you create or log. This may include body measurements such as body weight that you choose to record (see “A note on fitness data” below).
Messages. The content of messages exchanged between coaches and athletes through the Service’s messaging features.
Media. Any images or files you upload, such as exercise demonstration media.
Technical and usage data. Information needed to operate the apps reliably: device and operating-system type, app version, language, IP address, and basic log and diagnostic data. On mobile, this includes a push notification token if you enable notifications.
Payment records. PowerCoach includes optional bookkeeping for the fee an athlete pays their coach. If your coach uses it, we store the monthly rate they set for you and the payments they mark as received — the amount, currency, the date paid, and any note. If you are a coach, we also store the issuer details you enter for receipts: your business name, address, and tax ID, which are printed on the sequentially numbered PDF receipts you issue. This is bookkeeping between a coach and an athlete — no money moves through PowerCoach, we are not a payment processor, and we never see card or bank details.
Subscription billing. Our own billing is currently switched off and the Service is free, so we do not charge you or collect payment credentials today. When subscription billing is introduced, payments will be handled by a third-party payment processor and we will not store full card details on our own systems. We will update this policy before that happens.
How we use your data, and our legal basis
| What we use it for | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account and providing the Service | Performance of a contract |
| Storing and syncing your training data across web and mobile | Performance of a contract |
| Delivering messages and (if enabled) push notifications | Performance of a contract; consent for push notifications |
| Keeping the Service secure and preventing abuse | Legitimate interests |
| Maintaining, debugging, and improving the Service | Legitimate interests |
| Sending essential account emails (invites, password resets, important notices) | Performance of a contract |
| Billing, once subscriptions are introduced | Performance of a contract |
| Meeting legal and accounting obligations | Legal obligation |
We do not sell your personal data, and we do not use it for advertising or third-party profiling.
A note on fitness data
PowerCoach is a strength-training and coaching tool, not a medical service. The training metrics and body measurements you record are treated as ordinary personal data used to deliver coaching, and are not intended as medical or clinical health records. You decide what you record, and you can delete it at any time.
Where your data is stored
Your data is hosted on servers operated by Hetzner in their Finnish data centre, within the European Union. PowerCoach is offline-first, which means a copy of your data is also stored locally on your own device so you can keep working without a connection; it syncs to our servers when you’re back online.
Sharing and service providers
We share personal data only with the providers needed to run the Service, and only as much as each one needs:
- Hetzner — cloud hosting and database storage (Finland, EU).
- Self-hosted email — transactional emails (invites, password resets, account notices) are sent from our own mail server. We do not use a third-party email marketing provider.
- Firebase Cloud Messaging (Google) — the default way we deliver push notifications to your Android device, if you enable them. The contents of each notification are encrypted before they reach Google (see International transfers), so Google relays them without being able to read them.
- Apple Push Notification service (Apple) — how we deliver push notifications to your iPhone or iPad, if you enable them. The contents of each notification are encrypted before they reach Apple (see International transfers), so Apple relays them without being able to read them.
- A UnifiedPush distributor of your choice (optional) — if you switch from Firebase to UnifiedPush, notifications are relayed by the distributor app you pick, or by a server you run yourself, instead of Google. Contents are encrypted, so the distributor sees only an opaque blob; that provider’s own privacy terms apply to it, not ours.
We may also disclose personal data if required to do so by law, or to protect the rights, safety, and security of our users or the Service.
International transfers
Your account, messages, and training data are stored within the EU.
If you enable push notifications, we deliver them to your Android device through Google’s Firebase Cloud Messaging (FCM) relay, and to your iPhone or iPad through Apple’s Push Notification service (APNs) — either of which may involve processing on servers outside the EU (for example, the United States). Before a notification leaves our servers, we encrypt its entire contents — the sender’s name, the message preview, and which conversation it belongs to — to a key held only by your device. Google and Apple relay an opaque encrypted blob neither can read: they see only the metadata inherent to delivering any notification, such as your device’s push token and the approximate size and timing of the message. Your full message history is never sent through the notification — it stays on our servers and on your device, and the app fetches it directly from us. Where transfers of this delivery metadata occur, they rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses. You can avoid them entirely by leaving push notifications turned off.
A Google-free option. If you’d rather not involve Google at all, PowerCoach also supports UnifiedPush — an open, decentralised push standard. In the app’s notification settings you can choose a UnifiedPush distributor — a separate app that delivers your notifications, such as a privacy-focused service like ntfy, or a distributor connected to a server you host yourself — to be used instead of Firebase. Notifications sent this way are encrypted to your device using Web Push encryption (RFC 8291: P-256 ECDH + AES-128-GCM), so the distributor relays only an opaque encrypted blob, exactly as Google does on the Firebase path. Which provider relays your notifications — and where its servers are — then becomes your choice, and with a distributor you host yourself, no third party is involved at all. The privacy practices of any distributor you pick are governed by that provider, not by us.
How long we keep your data
We keep your personal data for as long as your account is active. If you delete your account, or ask us to delete your data, we remove it from our active systems within a reasonable period. Residual copies may persist in encrypted backups for a limited time before those backups cycle out. We may retain certain information for longer where the law requires it (for example, accounting records once billing is active).
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you;
- Rectify data that is inaccurate or incomplete;
- Erase your data (“right to be forgotten”);
- Restrict or object to certain processing;
- Port your data — you can export your data at any time;
- Withdraw consent where we rely on it (such as push notifications), without affecting processing done beforehand.
To exercise any of these, email us at mariusz@kuchta.dev. We’ll respond within the time limits set by the GDPR. For erasure specifically, you can also use our Erase my data page to delete all — or just part — of your data.
You also have the right to lodge a complaint with a supervisory authority. In Finland this is the Office of the Data Protection Ombudsman (tietosuoja.fi).
Data security
We protect your data using industry-standard measures, including encryption of data in transit (HTTPS/TLS), securely hashed passwords, access controls, and EU-based hosting with regular backups. No system can be guaranteed perfectly secure, but we work to keep your data safe and to address any issues promptly.
Children
The Service is intended for users aged 16 or over. If an athlete is under 16, their parent or legal guardian must consent to their use of the Service, and it is the responsibility of the coach inviting them to obtain that consent. We do not knowingly collect personal data from children under 16 without such consent. If you believe a child has provided us data without it, contact us and we’ll delete it.
Cookies and the marketing website
Our marketing website (powercoach.fi) does not use analytics or advertising cookies, and we do not track you across the web. All fonts and assets are served directly from our own servers — the marketing site makes no requests to third-party services such as Google Fonts, so loading a page does not reveal your IP address to anyone but us.
The web application (app.powercoach.fi) uses only the cookies and local storage that are strictly necessary to keep you logged in, maintain your session, and store your data locally for offline use.
Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we’ll update the “Last updated” date at the top of this page and, where appropriate, notify you through the Service. Please check back periodically.
Contact us
Questions, requests, or concerns about your privacy? Email us at mariusz@kuchta.dev.