Privacy policy.

1. Who we are

Teshape is a fitness coaching platform connecting personal trainers with the people they coach. We operate a mobile app (iOS, Android), a web portal at app.teshape.com, and this marketing site at teshape.com. This policy covers all three surfaces.

If you have questions about anything in this policy, email support@teshape.com.

2. What we collect

2.1 Account data

When you create an account you give us an email address, a display name, and (optionally) a profile photo. If you sign in with Apple or Google, we receive only the email and name those providers choose to share. We never see your provider password.

2.2 Profile data you choose to add

Coaches and trainees can fill in profile fields: bio, goals, certifications, location, time zone, language. None of this is required — what you skip stays blank.

2.3 Training, nutrition, and progress data

If you use Teshape as a trainee, the app stores: workouts you log, meals you log, measurements (weight, body composition), progress photos, personal records, and check-in responses. If you connect a coach, the data you log is visible to that coach — that is the point of the product.

If you use Teshape as a coach, the app stores: plans you build (training, nutrition), messages you send to clients, your client roster, and your published profile.

2.4 Messages

Messages between you and your coach (or your clients) are stored on our servers so you can read them across devices. They are not end-to-end encrypted — we can read them if law-enforcement or a court order requires it. We do not read them otherwise, and we do not use message content for advertising or model training.

2.5 Payments

We do not process payments between coaches and trainees inside the app. If your coach charges for their services, they handle the transaction themselves (bank transfer, cash, or whatever method they prefer). We never see your payment details for those transactions.

For coach subscriptions to Teshape itself (the platform fee a coach pays us), we use RevenueCat, which in turn uses Apple’s App Store or Google Play. Apple/Google handle the card processing; we only receive the subscription status (active / lapsed / refunded) and the transaction ID.

2.6 Analytics

We use PostHog to understand which features people use and where they get stuck. PostHog receives a pseudonymous user ID (not your email), the events you trigger inside the app, and basic device info (OS, app version, screen size). You can opt out from Settings → Privacy inside the app.

The marketing site (this one) and the web portal at app.teshape.com both use Google Analytics 4 to see which pages people land on and where they leave. It records the page you viewed, the referring site, an approximate location derived from your IP (city level, the IP itself is not stored), and basic device info. It does not receive your name or email, and we do not run advertising or remarketing tags — no Facebook Pixel, no Google Ads conversion tag. You can block it entirely with Google’s opt-out add-on or any tracker-blocking extension.

Inside the portal, page addresses are stripped of identifiers before anything is sent: a page you open as /coach/clients/<id> is reported to Google as /coach/clients/:id. Google never receives a client ID, an account ID, or an invite link, and it never sees the content of a plan, a message, or a check-in.

The other third party loaded here is Zoho SalesIQ, which powers the support chat bubble in the bottom-right corner. It loads with the page so the bubble is there when you need it, and it receives the page you are on plus basic device info. Anything you type into the chat goes to Zoho along with whatever contact details you give the agent.

2.7 AI features

When you use an AI feature inside the app (e.g. asking the assistant to draft a program), the relevant prompt is sent to OpenAI via our server. We do not send your email, your full message history, or any unrelated personal data — only the specific input needed for that single request. OpenAI does not use this data to train its models on our API tier.

2.8 Health data (optional)

If you opt in, the app can read step counts, heart rate, sleep, and workouts from Apple Health (iOS). We ship iOS-first; Health Connect (Android) support is on the roadmap and this policy will be updated when it lands. Health data you sync is stored in your Teshape account and visible to your connected coach. You can revoke access at any time from your device’s health settings.

2.9 Technical data

Every request to our servers carries an IP address, a user-agent string, and a timestamp. We use this for security (rate-limiting, abuse detection) and to debug errors. We retain server logs for 30 days.

3. How we use your data

• To run the product — deliver workouts, sync progress, send messages.
• To keep your account secure and prevent abuse.
• To send you transactional emails (account verification, password reset, refund confirmation). You cannot opt out of these without closing your account.
• To send you product updates and tips, only if you opt in via the newsletter signup. You can unsubscribe from any newsletter email.
• To improve the product — understanding which features are used.

We do not sell your data. We do not share it with advertisers. We do not use your training or message content for any other purpose.

4. Who we share data with

We share data only with the service providers needed to run Teshape:

• Google Firebase (Authentication, Firestore database, Cloud Functions, Storage) — primary backend.
• RevenueCat — coach subscription state.
• Apple App Store / Google Play — subscription billing.
• OpenAI — AI feature requests, on a per-request basis.
• PostHog — product analytics (opt-out).
• Google Analytics — traffic measurement on this site and the web portal, with identifiers stripped from page addresses. Not used in the mobile app.
• Zoho Mail — transactional and support email delivery.
• Vercel — marketing-site hosting (you’re reading this page from Vercel right now).

We also share data with law-enforcement when required by a valid legal request, and with a future acquirer if Teshape is acquired (you’ll be notified and given a choice to export and delete your data first).

5. Where your data lives

Our primary database (Firestore) is hosted in Google’s europe-west region. If you sign up from outside Europe, your data still lives in that region.

6. How long we keep it

• Account data: until you delete your account.
• Training, nutrition, and progress data: until you delete it or close your account.
• Messages: until you or your conversation partner deletes them, or you close your account.
• Server logs: 30 days.
• Payment records: 7 years (legal requirement for accounting).
• Backups: 30 days. After you delete your account, your data lingers in backups for up to 30 days before being purged.
• Data export files: 7 days after they are ready, then deleted.
• Accounts a coach imported: deleted after 60 days if the coach never invites you, or 60 days after the last invite if you never accept it.
• Import records: the counts and the coach’s confirmation are kept with the coach’s account; the per-record details used to undo an import are deleted after 30 days. Files uploaded for an import are read on the coach’s device and never stored by us.

7. Your rights

Under GDPR, UK GDPR, and most other modern privacy frameworks, you can:

• Access: get a copy of everything we have on you. In-app: Settings → Data export. It is free, ready within minutes in most cases, and always within the legal deadline where you live (one month under GDPR and UK GDPR, 45 days under the CCPA, 15 days under Brazil’s LGPD).
• Correct — update anything that’s wrong. Most fields are editable in Settings → Profile.
• Delete — remove your account and all associated data. In-app: Settings → Delete account. This is irreversible.
• Restrict / object — tell us to stop using your data for a specific purpose. Email support@teshape.com.
• Portability: the same export is a ZIP of CSV and JSON files plus your original photos, so another service can read it.
• Withdraw consent — opt out of analytics, marketing emails, health-data sync. Each is a separate toggle in Settings → Privacy.
• Complain — to your local data-protection authority. In the UK, that’s the ICO.

8. Coach imports and data exports

When a coach moves to Teshape from another service, they can import their clients and those clients’ history (profile details, body stats, workouts, nutrition). For that data the coach is the controller and Teshape processes it on their behalf. Before importing, the coach confirms they have the right to move it and will tell their clients.

• Imported accounts are created quietly. We send you nothing until your coach chooses to invite you.
• The invite tells you who your coach is, what was imported and from where, and how to object or ask us to delete it. Reply to it or email support@teshape.com.
• Imported body, nutrition, photo and health data stays hidden from your coach until you accept and choose to share it.
• A coach can undo an import for 30 days. Accounts that are never invited, or never accepted, are deleted (see section 6).

Data exports are delivered inside the signed-in app; the email we send only tells you the file is ready. When a coach exports a client’s data, it covers only what that client shares with them, and the export appears in the client’s access history.

9. Children

Teshape is not intended for anyone under 16. If you’re a coach and a client under 16 wants to use the app, a parent or legal guardian must create and operate the account.

10. Cookies and similar technologies

The marketing site sets these cookies:

• ts_session — a presence flag set by the web portal when you log in, so the marketing site’s “Sign in” CTA can switch to “Dashboard”. Contains no personal data.
• Google Analytics cookies (_ga, _ga_*) — a random visitor ID so a return visit isn’t counted as a new person. Expires after 2 years; see §2.6 for how to block it.
• Zoho SalesIQ chat cookies — set when the support chat bubble loads, so a conversation survives a page change.

The web portal uses Firebase Authentication cookies to keep you signed in, plus the same Google Analytics cookies described above — they are set on teshape.com itself, so moving between this site and the portal counts as one visit rather than two. The mobile app uses native Keychain (iOS) and EncryptedSharedPreferences (Android) for the same purpose.

11. Security

All connections are HTTPS. Passwords are hashed with Firebase Authentication’s scrypt implementation — we never see your plaintext password. Sensitive operations (account deletion, payment verification, AI calls) run on Cloud Functions with per-user authentication checks.

No system is perfect. If you discover a security issue, please email support@teshape.com with the subject line “Security report”.

12. Changes to this policy

We’ll update this page when our data practices change. We’ll bump the “Last updated” date at the top. For material changes (new data category, new third-party processor), we’ll also notify you by email or in-app.

13. Contact

Questions, requests, or complaints: support@teshape.com. We aim to respond within one working day, and at most within 30 days for formal data-subject requests.