Privacy Policy

• Your training is private by default. Your coach, if you have one, receives the coaching information you share. Our service providers process data to operate Spot, and authorised staff may access it when necessary for support, security or legal obligations.
• We don’t sell data, run ads, or train AI models on your videos or photos.
• Payments go through Stripe on the web, and through Apple or Google if you subscribe to Spot Pro in the app. We never see your full card number.
• You can export or delete your data from Settings, any time.

Account data. Name, email, password (hashed), timezone, and for coaches a handle, bio, and payout details held by Stripe.

Training data (coached and solo users). What you enter or upload for training: workouts logged, bodyweight, measurements, check-in answers (sleep, energy, nutrition, steps, notes), progress photos, form-check videos, messages, and onboarding answers such as goals, equipment, and injuries. Some of this is health-related information; we treat all of it as sensitive.

Apps and devices you connect (optional). If — and only if — you connect a health app or a wearable from your profile, we read one summary per day: steps, sleep, resting heart rate, heart-rate variability, active energy and readiness scores where available. Supported connections can include Apple Health, Android Health Connect and Oura, depending on your device and which integrations are enabled. We never store the underlying readings, so there is no minute-by-minute heart-rate or location trail in these daily summaries. We ask for this separately from everything above, and agreeing to it is not a condition of being coached. Disconnecting takes one tap in your profile and deletes the days we already collected — stopping is not the same as keeping, and we do both.

Sending workouts out (optional). With separate export permission, Spot can write session times, duration and recorded energy to your phone’s health store. It does not write weights, reps, photos or body measurements there. If you also connect Strava, Spot sends the session title, start time, duration, number of sets and total weight lifted. Strava visibility follows your Strava settings and may include other people or the public. Other apps with your phone-health permissions may read exported workouts. Turning export off stops future transfers; delete existing copies in the destination service. Disconnecting Spot does not delete those copies automatically.

Business data (coaches). Programs, templates, products and prices, client lists, revenue and payment history, library content.

Optional AI assistance. When a coach requests an AI check-in summary, selected answers from your current and previous check-ins are sent to Anthropic. These can include weight, sleep, energy, stress, nutrition and written notes. Programme drafting sends the coach’s brief, selected template and exercise information. These coach tools do not attach photos, videos or connected-device records. Free-text inputs can still contain personal or health information; removing contact fields does not make them anonymous. Results are stored in Spot for the coach to review. AI can make mistakes and does not replace professional judgment.

Technical data. IP address, browser and device type, pages visited, and error logs — the minimum to keep the service running and secure. There are no advertising cookies, no cross-site tracking, and no third-party analytics or advertising SDKs in the website or the phone app. If we ever add product analytics we will name it here first, and it will never carry your health data.

Cookies and local storage. Essential cookies keep web sessions signed in. The mobile app stores session credentials and caches training data and unsent workout changes on your device so offline features can work. Secure your device and avoid sharing an unlocked account. Email and push notifications also involve delivery providers; notification contents may include information you or your coach supplied.

• To run Spot — showing your coach your check-in, playing back a video, sending a message, charging a subscription.
• To keep it working — fixing bugs, preventing abuse, security monitoring.
• To talk to you — transactional emails (receipts, failed payment, check-in reminders) and, for coaches, occasional product updates you can turn off.
• To meet legal obligations — tax records, responding to lawful requests.

Legal bases where they apply (EU/UK): performance of a contract for the service itself; legitimate interest for security and improvement; consent for anything optional, which you can withdraw. Where EU/UK health-data rules apply, we seek explicit consent for health processing, in addition to the applicable general legal basis. Device imports, exports and optional publication have separate controls. You can withdraw consent without affecting prior lawful processing; withdrawing essential training consent may prevent us providing that part of the service. We do not make solely automated decisions with legal or similarly significant effects about you.

Your coach (if you’re a client) sees everything you share in the app. Your clients (if you’re a coach) see the programs, messages, and feedback you send them and your public page.

Processors that help us run the service, under contracts that limit them to that purpose: Vercel (application hosting, and photo, PDF and voice-note storage), Neon (the database), Mux (video storage and transcoding), Anthropic (optional AI programme drafts and coach-requested check-in summaries), Resend (transactional email), and Expo (push notifications, with Apple and Google delivering them). Stripe handles payments and payouts as a processor for some services and an independent controller for others, such as its own fraud prevention and regulatory obligations, under its applicable terms and privacy policy. RevenueCat records subscriptions bought inside the app and tells our servers when one starts, renews, lapses or is refunded. If you subscribe in the app, Apple or Google takes the payment as the seller of record under their own terms, and neither they nor we pass your card details to the other: what reaches us is your Spot account identifier, which product you hold, its status and its renewal date. The current list, with what each one can see and where, is on our sub-processors page, and we keep it current there rather than only here.

Where it is processed. Spot’s application servers and database are hosted in the United States. Uploaded files such as photos, PDFs and voice notes are currently stored in Frankfurt, Germany. Mux video processing and Resend account data, including email metadata and logs, also involve the United States, and other providers may use other countries for service delivery and support. See the provider list for details. If you use Spot from the EU, UK or another country with transfer rules, your data is transferred to the United States. Applicable transfer safeguards may include adequacy decisions or contractual safeguards; contact us for information about the safeguards applicable to your data. We do not claim that Nick Squared LLC is Data Privacy Framework certified.

Sharing you choose. The optional weekly board shares your first name, session count and XP with other Spot users. Testimonials you approve are public, with your chosen attribution. Content you deliberately publish or share may be copied by its recipients. Optional connected services receive the information described above under their own policies. We may also disclose information as necessary for legal requests, protecting rights and security, or a business transfer, with the notices and safeguards required by law. We do not sell personal or consumer health data or share it for targeted advertising.

• Account and coaching data: for as long as your account is open, then deleted within 30 days of closure through our deletion process, subject to necessary legal retention. Restricted backups may persist until their scheduled expiry; we must also honour any shorter applicable legal deadline.
• Form-check videos: 6 months, or 24 months if your coach starred the clip — then the video file is deleted. The written review, drawings, load and reps, and the thumbnail are kept with your account.
• Payment and consent evidence: only for applicable accounting, legal claims and compliance needs. Account deletion removes or anonymises account links where possible; Stripe retains its own records under its policies. There is no single worldwide tax-retention period.
• Billing notification contents: removed after sending or account deletion. Unsent messages expire after seven days; retrying messages stop within 23 hours of their first attempt. Expired contents are removed by scheduled cleanup. Account links and operational error details are removed by cleanup after 30 days from completion or expiry. We retain a hashed event identifier and delivery outcome to prevent duplicate notifications, without retaining the message contents or recipient address in that record.
• Technical logs and provider backups follow the applicable service retention settings. We restrict their use to operations, security and recovery; contact us for retention details. We review retention against necessity and applicable law.

Wherever you live, you can export your data (Settings → Export), correct it, and delete your account. In the EU, UK, California, and other places with privacy laws you also have rights to restrict or object to processing, to data portability, and to complain to your local regulator. We don’t discriminate against you for using them. Email [email protected]. We may verify your identity using proportionate account information. We aim to respond within 30 days and meet the deadline applicable to your request; we will explain any permitted extension or refusal and available appeal.

A note on the coach–client relationship: your coach also holds a copy of what you shared, as any coach would. Deleting your Spot account starts our deletion process. We notify relevant recipients where the law requires; you can also ask your coach directly about copies they keep elsewhere and their lawful retention obligations.

We use HTTPS, password hashing and account access controls. Private media access is restricted. Authorised access is limited to legitimate service, support, security and legal needs. Local device copies depend on your device protections. No system is perfectly secure. We investigate incidents and notify affected people, coaches and authorities when required by applicable breach-notification laws.

You must be 18 or over to use Spot, as a coach or as a client — the same rule as our Terms. Spot handles health information and we deliberately do not run the parental-consent machinery a minor’s account would need, so there is no parental-consent route: we don’t offer accounts to under-18s at all. If you think someone under 18 has an account, tell us and we’ll close it and delete the data.

Nick Squared LLC · 7901 4th St N STE 300, St. Petersburg, FL 33702, USA · [email protected]

If we change this policy in a way that matters, we’ll email account holders before it takes effect.