Privacy Policy

Effective date: September 27, 2026 · Last updated: October 6, 2026

1. Who is responsible

• For coaches' own account data, and for visitors to lyftr.co, we are the data controller.
• For the data coaches collect about their clients through LYFTR, the coach is the controller and we act as a processor on the coach's behalf. Clients should contact their coach first about that data; we will help coaches respond to requests.

2. Data we collect

• Account data: name, email address, password (stored hashed by our authentication provider), language and unit preferences.
• Coach workspace data: business name, logo, programs, exercises, templates, packages and notes.
• Client data entered by clients or their coach: training logs, body measurements and weight, progress photos and videos, nutrition and supplement logs, habits, check-in answers and messages. Some of this can be health-related information.
• Billing data: plan, billing period and payment status. Payments are handled by Paddle; we never see or store your full card details.
• Technical data: device and browser type, app version, IP address, error reports and basic usage logs used to keep the service secure and working.
• Consent records: which document you accepted, its version and when.
• Coach pages and applications: what a coach chooses to publish on their public page (lyftr.co/c/...: name, photo, title, bio, specialties, certifications, packages and links) is public, and published pages are listed in our sitemap so search engines can find them (a page that is turned off is removed). An application sent through that page (name, email, Instagram handle, goal, health answers given with explicit consent, package and budget) goes only to that coach. To prevent abuse we keep a non-reversible hash of the sender's IP address and email in a counter that is deleted within a few hours; we do not store the IP address or email in that counter. The coach receives the application by email and phone notification without the health answers or the free-text goal.
• Reviews: a client who reviews their coach gives a star rating, optional text and a name format (first name and last initial, or full name). If the coach shows reviews on their page, the rating, text, name, review date and how many months the client has worked with the coach are public there. To confirm the review is genuine we check, without showing it, that the client's account is linked to the coach, has a verified email address and has finished workouts, and that it does not use the coach's own email address. To limit abuse we keep a small daily counter (number of review edits, date of the last notification to the coach). The client can edit or delete the review at any time, can delete it also after leaving the coach, and it is deleted with their account.
• Coach agreements: if your coach asks you to accept their own agreement or waiver in the app, we store the text you accepted, your name, the date, the version, your account ID and basic device information (browser) as a record that cannot be changed. Your coach can see it. Like your consent records, it is kept as evidence after you delete your account.

3. How we use it

• To provide the service: create accounts, sync data between coach and client, send notifications you enable (performance of a contract).
• To process subscriptions and handle support requests (contract, legal obligation).
• To keep LYFTR secure, fix bugs and improve features (legitimate interests).
• Health-related data is processed only to provide the coaching and tracking features, based on your explicit consent (see section 4).
• To keep records of the consents you give (legal obligation, establishing and defending legal claims).

We do not sell your personal data, we do not share it for cross-context behavioral advertising, and we do not use it to train third-party AI models.

4. Health data and explicit consent

Weight, body measurements, body fat, progress photos and videos, nutrition and supplement logs, training and recovery logs (load, reps, effort, sleep, pain notes), injury and health notes and check-in answers are health data. We process them only with your explicit consent:

• Clients: to record them and share them with your coach so your coach can coach you and follow your progress.
• Individual users: so you can follow your own progress and the app can calculate suggestions such as loads and calories.
• Applicants: health answers in a coaching application are shared only with the coach you apply to, so they can review your application.

The app asks for this consent on first sign-in and records it with the date and version. Giving consent is your choice, but the client and individual panels cannot work without this data. You can withdraw consent at any time by emailing support@lyftr.co or (as a client) your coach; after that we stop processing the data and close the related account or client profile. Withdrawal does not affect processing before it. Clients under 18 need the consent of a parent or legal guardian as well. US residents: see also our Consumer Health Data Privacy Policy.

5. Service providers

We use trusted providers to run LYFTR. They process data only on our instructions:

• Google Firebase (Google LLC): authentication, database, file storage, push notifications.
• Cloudflare: website hosting, content delivery, security and aggregate website analytics (no cookies, no cross-site tracking).
• Sentry (Functional Software, Inc.): error logs (technical data used to detect crashes and bugs).
• Paddle.com: checkout, payments, invoicing and tax, as Merchant of Record (see Paddle's privacy notice).
• Open Food Facts and USDA FoodData Central: food search queries and scanned barcode numbers (only the search term or the barcode number is sent, not your identity). The camera image used to read a barcode stays on your device.
• Your browser's speech recognition (Apple or Google, depending on your device): only if you tap the microphone to add food by voice. Your browser sends the audio to its own speech service and returns text; LYFTR receives only the text, never the audio.
• jsDelivr and cdnjs (public content delivery networks): exercise illustrations and open-source code libraries (QR codes, spreadsheet export). Like any website you visit, they see your browser's IP address; they receive no account data.
• Resend: service emails (for example a new application to a coach or an account deletion confirmation).
• Your browser's push service (Apple, Google, Mozilla or Microsoft, depending on your device): delivers phone notifications you turn on. The content is encrypted, so the push service cannot read it.
• YouTube (privacy-enhanced mode) and Vimeo: only if your coach links an exercise video and you choose to play it.

Fonts are served from our own servers.

6. International transfers

Our providers may store and process data in the United States, the European Union and other countries. Where required, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and the safeguards under Article 9 of Turkey's KVKK; for incidental transfers without such safeguards we rely on your explicit consent.

7. Retention

We keep your data while your account is active. When you delete your account in the app, your account and the data we hold for it are deleted from our active systems right away. When a coach removes a client, or we delete an account on request, the related data is deleted from our active systems within 30 days. Deleted data leaves our backups within 90 days. We keep certain records (for example, billing records and consent records) where the law requires it.

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR, Turkey's KVKK or California's CCPA/CPRA), you may have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent at any time. You can edit most data directly in the app. To delete your account and data, use Terms and permissions > Delete my account and data in the app: deletion happens right away. For a client, this deletes the LYFTR account and the link to the coach; the records in the coach's dashboard are controlled by the coach, whom we notify and who can delete them. You can also email us. For other requests, email support@lyftr.co; we reply within 30 days. You also have the right to complain to your local data protection authority. We will not discriminate against you for exercising your rights.

9. US state privacy rights

This section applies to residents of US states with consumer privacy laws, including California (CCPA/CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others.

Notice at collection (California)

We collect these categories from you, your coach and your use of the app, for the purposes described in section 3, and keep them for the periods in section 7. We disclose them only to the service providers in section 5 for business purposes.

• No sale or sharing: we do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the past 12 months. We do not knowingly sell or share personal information of consumers under 16.
• Sensitive personal information is used only to provide the service you request, so no "limit the use" right applies.
• Global Privacy Control: we honor GPC signals as an opt-out request; since we do not sell or share, no further action is needed.

Your rights

Depending on your state, you may have the right to know and access, correct, delete and receive a portable copy of your personal information, to opt out of sale, sharing, targeted advertising and profiling (we do none of these), and not to be discriminated against for exercising these rights. You can use an authorized agent; we may ask the agent for proof of authorization and verify your identity through your account. Email support@lyftr.co from your account email with the subject "Privacy request". We respond within 45 days (extendable once by 45 days with notice). If we decline, you can appeal by replying with the subject "Appeal"; we answer within 45 days (60 in Colorado), and if the appeal is denied you can contact your state Attorney General.

Other US notes

• Consumer health data: see our Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut and similar laws).
• Biometrics: we do not collect biometric identifiers; progress photos are not used for face recognition.
• HIPAA: LYFTR is not a healthcare provider and is not a covered entity or business associate under HIPAA.

10. Cookies and local storage

LYFTR does not use advertising or tracking cookies. We use your browser's local storage and cache to keep you signed in, remember your preferences (such as language and units) and let the app work offline. Our hosting provider may use strictly necessary cookies for security.

11. Children

LYFTR is not for children under 13, and we do not knowingly collect personal information from children under 13. Coach and individual accounts require age 16 or older. Clients aged 13 to 17 may use LYFTR only with the consent and supervision of a parent or legal guardian. If you believe a child under 13, or a minor without such consent, has given us personal information, contact us and we will delete it.

12. Security

Data is encrypted in transit (HTTPS) and at rest by our infrastructure providers, and access is restricted by account-level security rules. The LYFTR team views a coach's panel and client data only when the coach grants support access, and every access is shown to the coach. Data is backed up daily. No system is completely secure, so please use a strong, unique password.

13. Changes to this policy

We may update this policy. If changes are material, we will notify you in the app or by email before they take effect.

14. Contact

Privacy questions or requests: support@lyftr.co