Privacy policy | Train Smart

Train Smart (“we”, “us”) is operated by Jack Noonan, trading as Train Smart Group, Newport, Victoria, Australia. We provide the Train Smart app and the coach console at trainsmartt.com. This policy explains what we collect, why, and how you can control it.

What we collect

Account info: your email address, and — if you sign in with a third-party provider — your name and public profile, used only to create and identify your account.
Training data you enter: sport, sessions, workout logs, RPE and feedback, schedule and recovery inputs.
Optional health data: where you explicitly grant it, readings from Apple Health (iPhone) or Health Connect (Android). Each type has its own permission and nothing is read that you have not granted — see Health data below.
Optional location: when you check in at a gym or venue, your phone’s precise location at that moment, used to confirm you are there. If the venue has no location on the map yet, your position at that check-in becomes the venue’s map location, which other users see. Your location is also used to work out your suburb for town leaderboards.
Injury and rehab information you enter: the injury area, pain ratings, what a clinician told you, any return-to-play date they gave you, and rehab exercises you type in or photograph — see AI processing below.
Optional photos, videos and voice messages: a profile photo, photos you add to posts, and anything you send in coach messaging.
Messages: the messages you and your coach send each other in the app, and the ones sent in a coach’s group if you are in one, including reactions and read receipts.
Calls: for a voice or video call with your coach or client, a record that the call happened — who called, when, whether it was answered and how long it ran. Calls are never recorded, and their sound and picture are not stored anywhere.
A notification address for your phone: if you turn on notifications on an iPhone, the device token Apple issues for the app on that phone, so a notification can be sent to it. Turning notifications off in your phone’s settings, or signing out, stops them.
Optional social data: posts, comments, reactions and venue check-ins.
Nutrition: your meal-plan settings and the meals you add. If you scan a barcode or search for a food, that barcode or search text is sent to Open Food Facts to look it up.
Purchases: whether you have an active membership, from the App Store or Google Play through our subscription provider. If you pay a coach or a club pays for a plan, that payment is handled by Stripe. We never see your card details.

Age

Train Smart is for people aged 14 and over. You must be at least 14 to create an account, and we do not knowingly collect personal information from anyone younger. If you are under 18, use Train Smart with the knowledge and agreement of a parent or guardian — in particular before you connect health data, pay a coach, or message or call one.

If you believe someone under 14 has created an account, email jack@trainsmartt.com and we will delete it.

Health data

With your permission, Train Smart reads these from Apple Health on iPhone or Health Connect on Android: sleep, heart rate variability, resting heart rate, workouts, heart rate, cardio fitness (VO₂ max), active and resting energy, distance, steps and exercise minutes, and body mass. You choose which to allow, and can change that at any time in Apple Health or Health Connect, or switch individual types off inside the app.

Read-only. Train Smart never writes anything to Apple Health or Health Connect.
Used only for features you see: filling in your daily check-in, your readiness score, recovery and training load, the injury-risk alert on your home screen, your daily step target, the Progress screen, and adjusting your sessions to how you have slept and recovered.
Kept on your phone unless you turn on “Save to my account”, which stores it with our backend provider so it reaches your other devices. Turning that switch off deletes what was saved.
Shared only if you switch it on: with your coach, with your team boards, or with the AI coach — each is a separate switch in the app, and all are off until you turn them on. The AI coach is powered by Anthropic, which processes what is sent only to produce the coach’s reply.
Never sold, never used for advertising, and never used to decide credit, lending or insurance.
Not read by people at Train Smart, except when you ask us to help with a problem, where needed for security, or where the law requires it.

AI processing

The AI coach, the injury analysis and the tools that read a photo of a program, a physio’s exercise sheet or a scan report are powered by Anthropic. When you use one of them, we send only what that request needs: a summary of your current program, what you typed, and any photos you chose to attach. Readings from your watch are included only if you have separately switched on sharing with the AI coach.

Photos you attach are sent to be read and are not stored on our servers. What is read out of them — the list of rehab exercises, or the injury named in a report — is saved with your training data so the app can use it.
AI output is training guidance, not medical advice. Return-to-play timeframes shown in the app are general estimates from published ranges, not a prognosis for your injury.

How we use it

To run your account, generate and adapt your training program, and power the optional social feed. We do not sell your personal data or use it for advertising. Health data is used only to produce your readiness score and training-load signals, and is sent to the AI coach only if you have separately consented to that specific purpose.

Where it is stored

Most of your training data is kept on your device. With an account it also syncs to our backend provider, Supabase, protected by row-level security so that only you — and anyone you have chosen to share with — can read it. Messages, and the photos, videos and voice messages sent in them, are stored there too, in private storage that only the people in that conversation can open — the two of you, or the members of a group.

Where that is. Our Supabase database and file storage are hosted on Amazon Web Services in Tokyo, Japan. The other providers listed under Sharing process data in the United States and other countries where they operate. That means your information is stored and handled outside Australia. Each provider is sent only what its job needs.

How long. We keep your data for as long as your account exists. Deleting your account removes it — see Your choices and deletion.

We share data only with service providers needed to operate the app, and where required by law:

Supabase — our database, sign-in, and storage for photos and for what is sent in messages.
Apple or Google — if you choose to sign in with them.
Apple’s push notification service — if you turn on notifications, each notification is delivered to your iPhone through Apple. It carries the sender’s name and a short preview of the message, or says that a call is coming in.
Call connection services — a voice or video call connects your device directly to the other person’s wherever the two networks allow it. To set that up, your device’s network address is shared with the other person’s device and with public connection (STUN) servers run by Google and Cloudflare, which tell a device what its own public address is. Where a direct connection is not possible the call, still encrypted, may be passed through a relay server. No provider can hear or see a call.
Netlify — hosts this website and the web version of the app, and fetches a recipe page when you paste its link.
RevenueCat, with the App Store or Google Play — membership purchases and renewals.
OpenStreetMap (its Nominatim and Overpass services) — when you check in or pick a town board, your location is sent to find nearby gyms and to name your suburb. Nothing else about you is sent.
Stripe — payments to coaches, club seat billing and affiliate payouts.
Anthropic — the AI features, only for what you choose to send.
Open Food Facts — barcode and food-name lookups.

Social posts you choose to publish are visible to other users of that feature. If you are a member of a club squad, the categories you have consented to share are visible to that club’s staff — and no others. If you accept a personal coach, they can see your training, write your week, and message and call you; ending the pairing ends their access. If your coach adds you to a group, the other members can see what you post there and that you are in it; you can leave a group at any time.

Security

Data is encrypted in transit and protected by row-level security, so one account cannot read another’s. Photos, videos and voice messages sent in coach messaging are kept in private storage that only the people in that conversation can open. Voice and video calls are encrypted between the two devices and are not recorded. Every post, comment and message can be reported, and any user can be blocked.

This website

This website (not the app) uses Google Analytics to understand how visitors find and use it — which pages are viewed, how people arrive, and which links to the App Store or Google Play are clicked. Google Analytics sets cookies and receives your IP address and device and browser information; it does not receive anything you enter in the app. We use these reports only in aggregate to improve the site. You can opt out with Google’s opt-out browser add-on or by blocking cookies in your browser. See how Google uses information from sites that use its services.

Your choices and deletion

You can edit or remove your training data in the app at any time, and revoke any health permission in Apple Health, Health Connect or your device settings. You can ask us for a copy of your data, or to correct it. To delete your account and all associated data — including your photos and messages — use Profile → Account & legal → Delete my account in the app, or email jack@trainsmartt.com. How account deletion works, and what is kept.

Contact

Questions, requests or a complaint about how we have handled your information: jack@trainsmartt.com. If you are not satisfied with our response, you can contact the Office of the Australian Information Commissioner at oaic.gov.au.