Privacy Policy — The Standard
This policy explains what The Standard (the “App”) collects, why, who it is shared with, and the choices you have. It is operated by 2110 Fitness, Calgary, Alberta, Canada.
Contact: chris@theathleticyou.com
Last updated: October 14, 2026
1. Roles
If you train with a coach through the App, your coach decides what information to collect about you and how to use it in their practice. We provide the software and process that information on their behalf, and on our own behalf for operating and securing the App. If you use the App without a human coach, we are the controller of your information.
2. What we collect
Account: your name, email address, a password hash, and your timezone. Optionally your sex and your birth year — the year only, never a full date of birth, because age-group comparisons need the year and nothing finer.
Training: your programme, every logged set, training maxes, session notes, day-level adjustments, and which sessions you marked done.
Nutrition: food diary entries, saved meals, calorie and macro targets, and any photographs of food you upload.
Body and health: body weight, body measurements, physique and body composition estimates, blood marker readings you or your coach record, and progress photographs.
Apple Health: if you grant permission on your iPhone, the App reads workouts and recovery metrics (such as resting heart rate, HRV, sleep and steps) from Apple Health. Permission is granted on your device and can be withdrawn there at any time, in Settings → Health → Data Access. We never write to Apple Health, and Apple Health data is never used for advertising.
Conversations: your messages with the in-app coach, direct messages with your human coach, check-in responses, journal entries, and facts the assistant files about you to give better advice. Every filed fact is listed in Settings under “What your coach knows”, and you can delete any of them.
Technical: IP address, device and browser information, and request logs used to operate and secure the service and to apply rate limits.
We never see your card details. Payments are handled by Stripe, which collects card data directly. We receive only whether a subscription is active and the amounts charged.
3. Why we process it
To run the App for you and your coach; to generate the coaching assistance the App is for; to secure the service and investigate abuse; and to meet legal obligations. Legal bases where GDPR applies: performance of a contract, our legitimate interests in operating and securing the App, your explicit consent for health-related data, and compliance with legal obligations.
4. Artificial intelligence — what is sent where
The App’s coaching assistance is produced by Anthropic’s Claude models. To answer you, the relevant context is sent to Anthropic for processing: your interview and profile, programme, recent training and food logs, agreed habits, check-in text, and the conversation itself. Progress photographs and food photographs are sent only when you invoke a feature that requires the image to be looked at.
Your content is not used to train models. We use Anthropic’s business API under terms that do not permit training on submitted content.
AI processing requires your explicit permission. This includes background summaries and AI-assisted plan drafting by your coach. You can allow or withdraw permission in AI data permission. Withdrawal stops new requests; it cannot recall requests already sent. Manual logging, saved plans and human-coach messaging remain available.
AI output is assistive and can be wrong. It does not replace medical advice.
5. Who else sees your data
- Your coach, if you have one — your training, food, measurements and check-ins. Your conversations with the AI are a separate choice: the “Coach can read my conversations” switch in Settings → Privacy controls whether summaries of those chats reach your coach, and you can turn it off at any time.
- Your training crew: if your coach adds you to a crew, its members can see your name, crew messages, comments and reactions. Finished-workout summaries are shared when “Share my finished sessions with the crew” is enabled. Session sharing is on by default; showing lifted weights is off by default. You can change both controls in the crew feed. Turning session sharing off hides your workout posts; it does not remove messages or comments you already sent. Turning weights off hides generated load details, including on older posts. It does not edit weights you typed yourself into captions, comments or messages. Your private food diary, health records, progress photos and direct conversations are not shared with your crew through this feature.
- Service providers acting on our instructions: Vercel (hosting), Neon (database), Vercel Blob (private file storage), our email provider, Stripe (payments), and Anthropic (AI).
- Lookups that leave the App without your identity: searching a food queries Open Food Facts and the USDA FoodData Central database, and exercise demo videos are embedded from YouTube. These receive the search term or the video request, never your account or your records.
- Authorities, where we are legally required to disclose.
We do not sell your personal information, and we do not share it for advertising.
6. Where data is stored
On infrastructure located in the United States. If you are in Canada, the EU/EEA or the UK, your information is transferred and processed there under appropriate safeguards, including standard contractual clauses where required.
7. Deleting your account
You can delete your account from inside the App at any time: Settings → Delete account. No email, no request form, no waiting on us.
Deleting is immediate and permanent. It removes your account and your training history, food diary, check-ins, measurements, blood markers, conversations, uploads and progress photographs — including the image files themselves, not merely the records pointing at them. Any unused invitation to the App tied to your email address is revoked at the same time. Linked subscriptions are cancelled before deletion completes; deletion does not issue a refund. There is no undo in the App. Provider backups may retain data until their retention periods expire, and Stripe may retain payment records to meet its financial and legal obligations.
If you are a coach with clients, you can transfer them first or explicitly end coaching and release them when deleting your account. Released clients keep their accounts, history and current programmes. Linked coaching subscriptions are cancelled; coaching and new messages pause. Another coach gets access only after the client accepts a new coaching invitation. Your clients’ own records are not erased when you delete your coach account.
8. Retention
We keep your data while your account exists. Deleted diary and log entries sit in a recoverable bin for two weeks so an accidental deletion can be undone, then go permanently. Progress photographs have no bin — a deleted photograph is erased immediately, because a photograph that is still on disk for thirty days has not been deleted.
9. Your rights
You may request access to your data, correction, deletion, a portable export, restriction of processing, or withdrawal of consent. Deletion you can do yourself (section 7); for anything else, email us and we respond within 30 days.
Where GDPR applies you may also lodge a complaint with your supervisory authority. In Canada, you may contact the Office of the Privacy Commissioner.
10. Security
Passwords are hashed and traffic is encrypted in transit. Progress photographs, uploads and documents are stored in private storage and served only through an authenticated route that checks your session first — a leaked link is a refusal, not a photograph. Session cookies are HTTP-only and cannot be read by page scripts. Access is scoped per client and enforced on the server, and coach access to client data is audit logged. No system is perfectly secure, but health and body-image data are treated as sensitive by default here.
11. Cookies
Only cookies strictly necessary to sign you in and keep you signed in. No advertising cookies, and no third-party tracking.
12. Children
The App is not intended for anyone under 16, and accounts are invitation-only. If you believe a child has provided us personal information, contact us and we will delete it.
13. Changes
We will post material changes here and, where they meaningfully affect you, tell you in the App or by email before they take effect.
14. Contact
Privacy questions, or to exercise any right above: chris@theathleticyou.com