Effective Date: March 23, 2026  |  Last Updated: March 23, 2026

1. Introduction

SURGE Coach ("we," "us," or "our") is a fitness coaching application developed by an independent developer based in the United States. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the SURGE Coach mobile application (the "App") on iOS and Android devices.

By downloading, installing, or using the App, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not use the App.

2. Information We Collect

2.1 Information You Provide Directly

Data Category	Examples	Purpose
Account Information	Email address, display name, date of birth	Account creation, age verification, personalization
Fitness Profile	Fitness objectives, equipment available, experience level	Generating personalized workout programs
Workout Data	Workout history, timer usage, personal records (PRs), RPE ratings	Training load management, progress tracking, coaching adjustments
Body Composition	Weight logs (optional)	Progress tracking, nutritional guidance
Nutrition Data	Calorie tracking, meal logs	Nutritional coaching, daily targets
Profile Photo	Camera or photo library image (optional)	Profile personalization

2.2 Information Collected Automatically

Data Category	Examples	Purpose
Device Information	Device model, operating system version, unique device identifiers	App compatibility, crash reporting
Usage Analytics	Feature usage patterns, session duration	Improving app experience
Crash Reports	Error logs, stack traces	Bug fixing, stability improvements

2.3 Information From Third-Party Sources

Source	Data	Purpose
Apple Health / Google Health Connect	Health and fitness metrics (with your explicit permission)	Holistic fitness tracking, readiness scoring

2.4 Location Data

When you use the run-tracking feature, we collect GPS location data to measure distance traveled. Location data is collected only during active run sessions and only with your explicit permission. We do not track your location in the background for any purpose other than active run tracking. You can revoke location permissions at any time through your device settings.

2.5 Information We Do NOT Collect

• We do not collect or store images from the barcode scanner. Barcode scanning is processed in real-time on your device and no images are saved or transmitted.
• We do not collect social media data or contacts.
• We do not sell, rent, or trade your personal information to third parties.
• We do not use your data for targeted advertising.

3. How We Use Your Information

We use the information we collect for the following purposes:

• Provide Core Services: Generate personalized workout programs, track progress, manage training load, and deliver coaching cues.
• Account Management: Create and maintain your account, authenticate your identity, and verify age eligibility.
• Improve the App: Analyze usage patterns to identify bugs, improve features, and optimize performance.
• Subscription Management: Process and manage in-app subscriptions through RevenueCat.
• Communication: Send service-related notifications (e.g., account security, feature updates). We do not send marketing emails without your consent.
• Legal Compliance: Comply with applicable laws, regulations, and legal processes.

4. How We Share Your Information

We do not sell your personal information. We share data only with the following categories of service providers, solely to operate the App:

Service Provider	Purpose	Data Shared
Supabase	Authentication, database, cloud storage	Account data, workout history, nutrition logs
RevenueCat	Subscription management	Anonymous user ID, purchase transactions
Sentry	Crash reporting and error tracking	Device info, error logs (no personal workout data)

Each service provider is bound by their own privacy policies and data processing agreements. We require all service providers to protect your data and use it only for the purposes we specify.

We may also disclose your information if required by law, subpoena, or other legal process, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

5. Data Storage and Security

Your data is stored in Supabase-hosted PostgreSQL databases with the following security measures:

• Encryption in Transit: All data transmitted between the App and our servers is encrypted using TLS 1.2 or higher.
• Encryption at Rest: Database storage is encrypted at rest using AES-256 encryption.
• Row Level Security: Database access is restricted using Supabase Row Level Security (RLS) policies, ensuring users can only access their own data.
• Secure Authentication: Passwords are hashed and salted. Sensitive tokens are stored using device-level secure storage (iOS Keychain / Android Keystore).
• Rate Limiting: Authentication endpoints are rate-limited to prevent brute-force attacks.

While we implement industry-standard security measures, no method of electronic storage or transmission over the Internet is 100% secure. We cannot guarantee absolute security.

6. Data Retention

• Active Accounts: We retain your data for as long as your account is active and as needed to provide you with our services.
• Workout History: Synced workout history is retained for 90 days in the cloud. Older data remains available on-device.
• Deleted Accounts: When you delete your account, all associated data is permanently purged from our servers within 30 days. This includes account information, workout history, nutrition logs, body composition data, and any other personal data.
• Crash Reports: Anonymized crash reports may be retained for up to 90 days for debugging purposes.

7. Your Rights and Choices

7.1 All Users

• Access: You can view all data we hold about you within the App.
• Correction: You can update your personal information in the App's Settings.
• Deletion: You can delete your account and all associated data at any time from within the App (Settings > Account > Delete Account). Deletion is permanent and irreversible.
• Permissions: You can revoke location, camera, photo library, and health data permissions at any time through your device's system settings.
• Opt-Out of Analytics: You can opt out of crash reporting via the App Tracking Transparency prompt on iOS.

7.2 California Residents (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: You may request details about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• No Sale of Data: We do not sell personal information as defined by the CCPA. We do not share personal information for cross-context behavioral advertising.

To exercise these rights, contact us at the email address listed in Section 12.

7.3 European Economic Area, UK, and Swiss Residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Legal Basis: We process your data based on (a) your consent, (b) performance of a contract (providing our services), and (c) legitimate interests (improving and securing the App).
• Right of Access: You may request a copy of your personal data.
• Right to Rectification: You may request correction of inaccurate data.
• Right to Erasure: You may request deletion of your personal data.
• Right to Restrict Processing: You may request that we limit how we use your data.
• Right to Data Portability: You may request your data in a structured, machine-readable format.
• Right to Object: You may object to processing based on legitimate interests.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time.

To exercise these rights, contact us at the email address listed in Section 12. We will respond within 30 days.

International Data Transfers: Your data is stored on servers in the United States. By using the App, you consent to the transfer of your data to the US. We rely on standard contractual clauses and service provider agreements to ensure adequate data protection.

8. Children's Privacy

SURGE Coach is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13 in compliance with the Children's Online Privacy Protection Act (COPPA).

Age verification is performed during account creation via date of birth. If we learn that we have collected personal information from a child under 13, we will promptly delete that information. If you believe a child under 13 has provided us with personal information, please contact us at the email address listed in Section 12.

Users between 13 and 17 may use the App with parental or guardian consent.

9. Apple Health and Google Health Connect

If you choose to connect SURGE Coach with Apple Health (iOS) or Google Health Connect (Android):

• Health data is accessed only with your explicit permission and only for the specific data types you authorize.
• Health data read from these platforms is used solely within the App to provide readiness scoring and fitness insights. It is not transmitted to our servers, shared with third parties, or used for advertising.
• Workout data may be written to Apple Health or Health Connect with your permission, so your training appears alongside your other health data.
• You can disconnect health data integration at any time through your device's system settings.

This usage complies with Apple's HealthKit and Google's Health Connect developer guidelines.

10. Push Notifications

We may send push notifications related to your workout schedule, rest reminders, or account security. You can enable or disable push notifications at any time through your device's system settings.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this page.
• Notify you via in-app notification or email for significant changes.
• Post the updated policy at this URL.

Your continued use of the App after changes are posted constitutes your acceptance of the updated Privacy Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at:

Email: privacy@surgecoach.app

We will respond to all privacy-related inquiries within 30 days.