Privacy Policy

1. Introduction

Coachly ("we", "our", "us") operates the website joincoachly.com and associated mobile applications (collectively, the "Platform"). Coachly is a marketplace that connects athletes with sports coaches for booking coaching sessions.

This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our Platform. By creating an account or using Coachly, you agree to the practices described in this policy.

If you do not agree with this policy, please do not use the Platform. For any questions, contact us at help@joincoachly.com.

2. Information We Collect

2.1 Account Information

When you create a Coachly account, we collect:

• Full name
• Email address
• Password (encrypted — we never store plaintext passwords)
• Profile photo (optional)
• Account type (athlete or coach)

You may also sign in using Google. When you do, we receive your name, email address, and profile photo from Google. We do not receive or store your Google password.

2.2 Coach Profile Information

If you register as a coach, we additionally collect:

• Phone number
• Location (city/area where you coach)
• Biography and coaching experience
• Sport(s) and specialisations
• Age groups you coach
• Professional qualifications and certifications (uploaded documents)
• DBS check documentation
• Insurance documentation
• Session types, pricing, and availability
• Stripe account details for receiving payments

2.3 Booking and Transaction Data

When you book or manage coaching sessions, we collect:

• Session details (date, time, type, duration)
• Booking status and history
• Payment amounts and transaction records
• Cancellation and reschedule history
• Reviews and ratings you leave for coaches

2.4 Messages

Coachly provides in-app messaging between athletes and coaches. We store the content of messages you send and receive, including timestamps and read status, to provide the messaging service and for safety and dispute resolution purposes.

2.5 Automatically Collected Information

When you use the Platform, we automatically collect:

• Device type, operating system, and browser type
• IP address and approximate geographic location
• Pages visited, features used, and time spent on the Platform
• Referring URL and how you arrived at the Platform
• Crash reports and performance data

This data is collected via Firebase Analytics and helps us understand how the Platform is used and improve your experience.

2.6 Google Calendar Data (If You Connect Google Calendar)

If you connect Google Calendar, we access and use Google Calendar data to read and write calendar events needed for session scheduling.

We use this data only so your coaching sessions can be synced with your calendar (for example, creating and updating booking events and related reminders).

We do not sell Google Calendar data. We do not share Google Calendar data with third parties except as necessary to provide the calendar sync feature you requested.

2.7 Google User Data (Google Sign-In & Google Calendar)

Coachly uses Google OAuth to allow users to sign in and optionally connect their Google Calendar.

Data Accessed

When you use Google Sign-In or connect Google Calendar, we access:

• Your name
• Your email address
• Your profile photo (if available)
• Google Calendar data, including:
  • Event titles
  • Event dates and times
  • Event metadata necessary for scheduling

Data Usage

We use this data strictly to:

• Authenticate users via Google Sign-In
• Allow users to connect their Google Calendar
• Create, update, and display coaching session events in the user's calendar
• Sync booking data between Coachly and Google Calendar

We do not use Google user data for advertising, profiling, or any secondary purposes beyond providing core application functionality.

Data Sharing

We do not sell or share Google user data with third parties.

Google user data is only shared with:

• Google Calendar API (to perform requested syncing actions)

No Google user data is transferred to external systems except as required to provide core functionality.

Data Storage & Protection

• Google user data is stored securely using Firebase infrastructure
• All data is encrypted in transit (HTTPS/TLS)
• Access is restricted to authorised services only
• We follow industry-standard security practices to prevent unauthorised access

Data Retention

• Google user data is retained only while your account is active
• Google Calendar data is not permanently stored on our servers and is only processed as required to provide real-time syncing functionality

Data Deletion

Users can:

• Disconnect Google Calendar at any time within the app
• Delete their account to permanently remove all associated Google user data from our systems

To request deletion of Google user data, contact: help@joincoachly.com

Limited Use Compliance

Coachly's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.

Coachly does not use Google user data to train, improve, or develop artificial intelligence (AI) or machine learning (ML) models.

3. How We Use Your Information

We use the information we collect for the following purposes:

Providing the Service

• Create and manage your account
• Display coach profiles to athletes searching for coaching
• Facilitate session bookings between athletes and coaches
• Process payments via Stripe
• Enable in-app messaging between athletes and coaches
• Sync bookings with Google Calendar (when you connect it)
• Send booking confirmations, reminders, and updates via email and push notifications

Safety and Trust

• Verify coach qualifications, DBS checks, and insurance
• Moderate reviews and resolve disputes
• Detect and prevent fraud, abuse, or violations of our Terms

Improvement and Communication

• Analyse usage patterns to improve the Platform
• Respond to your enquiries and provide customer support
• Send service-related announcements
• Comply with legal obligations

4. How We Share Your Information

With Other Users

When you book a session, relevant information is shared between athletes and coaches to facilitate the session. Coaches see your name, email, and booking details. Athletes see the coach's profile, location, qualifications, and reviews. Messages you send are visible to the recipient.

With Service Providers

We share information with trusted third-party services that help us operate the Platform:

• Google Firebase — Authentication, database (Cloud Firestore), file storage, analytics, and hosting
• Stripe — Payment processing. We do not store your full card details; Stripe handles this securely
• Resend — Transactional email delivery (booking confirmations, reminders, account notifications)
• OneSignal — Push notification delivery
• Google Calendar API — Calendar synchronisation (only when you choose to connect your calendar)
• Google Maps / Places API — Location search and display

Each provider processes data in accordance with their own privacy policies. We only share the minimum information necessary for each service to function.

For Legal Reasons

We may disclose your information if required by law, court order, or government request, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

Business Transfers

If Coachly is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

We do not sell your personal information to third parties for advertising or marketing purposes.

We also do not sell or broadly share your Google Calendar data. Google Calendar data is only used for session syncing functionality and is not used for advertising.

5. Payment Processing

Payments on Coachly are processed by Stripe. When you make a payment, your card details are sent directly to Stripe and are never stored on our servers. We receive only a transaction confirmation, the last four digits of your card, and the payment amount. Stripe may collect additional information as described in their privacy policy.

Coaches who receive payments connect their Stripe account during onboarding. Stripe handles identity verification and bank account details for payouts.

6. Cookies and Tracking Technologies

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Required to keep you signed in and maintain your session (Firebase Authentication)
• Analytics Cookies: Help us understand how you use the Platform, which pages are popular, and where users encounter issues (Firebase Analytics)
• Preference Cookies: Remember your settings and preferences

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent you from signing in or using core features of the Platform.

We do not use third-party advertising cookies or tracking pixels for targeted advertising.

7. Push Notifications

With your permission, we send push notifications for booking confirmations, reminders, new messages, and other important updates. Push notifications are delivered via OneSignal. You can disable push notifications at any time through your browser or device settings.

8. Data Security

We take the security of your information seriously and implement appropriate measures, including:

• All data is transmitted over HTTPS (TLS encryption)
• Passwords are hashed and never stored in plaintext (managed by Firebase Authentication)
• Database access is controlled by Firebase Security Rules
• Payment data is handled by PCI-DSS compliant Stripe
• Coach verification documents are stored securely in Firebase Storage with restricted access

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but will notify you promptly if a data breach affects your information.

9. Data Retention

We retain your personal information for as long as your account is active. When you delete your account, we delete your profile data, preferences, and messages. We may retain certain information after account deletion where required:

• Transaction records: Retained for up to 7 years for tax and accounting purposes
• Reviews: May be anonymised and retained to maintain platform integrity
• Legal holds: Data subject to legal proceedings is retained until the matter is resolved

10. Your Rights

Under UK GDPR and applicable data protection laws, you have the following rights:

• Access: Request a copy of the personal information we hold about you
• Rectification: Request correction of inaccurate or incomplete information
• Erasure: Request deletion of your personal information ("right to be forgotten")
• Restriction: Request that we limit how we process your information
• Data Portability: Request your information in a structured, machine-readable format
• Objection: Object to processing of your information for certain purposes
• Withdraw Consent: Withdraw consent at any time where processing is based on consent

How to Exercise Your Rights

• Delete your account: Go to Settings in your Coachly account and select "Delete Account"
• Other requests: Email us at help@joincoachly.com

We will respond to all data rights requests within 30 days. We may ask you to verify your identity before processing your request.

11. Children's Privacy

Coachly accounts are intended for users aged 18 and over. We do not knowingly collect personal information from anyone under 18.

Parents and guardians may book coaching sessions on behalf of their children. In these cases, the parent or guardian's account and information is used — we do not create accounts for or collect personal data from the child being coached.

If you believe a child under 18 has created an account, please contact us immediately at help@joincoachly.com and we will delete the account.

12. International Data Transfers

Coachly uses cloud services (Firebase, Stripe, Resend, OneSignal) that may process and store data in the United States and other countries. Where data is transferred outside the UK or EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, in accordance with UK GDPR requirements.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will notify you by email or through a notice on the Platform. The "Last updated" date at the top of this page will always reflect the most recent version.

We encourage you to review this policy periodically. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

14. Contact Us

If you have any questions about this Privacy Policy, your personal data, or wish to exercise your data rights, please contact us:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your personal information has not been handled appropriately.