GoatGauge
Privacy policy
GoatGauge (“GoatGauge”, “we”, “us”) runs the GoatGauge apps for iPhone, iPad and Android and the website at goatgauge.com. This policy explains what personal data we collect when you use GoatGauge, why we use it, who we share it with and the choices you have. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR), the EU GDPR where it applies, and the Data Protection Act 2018.
Questions or requests: support@goatgauge.com.
The short version
- Your data is stored in the European Union (Ireland).
- Coaches only see your training and health data while you’re on their coached program, and only if you give them permission. You can withdraw it at any time.
- If you set a home town to find coaches near you, coaches never see it. Requests you post reach matching coaches without your name, and a coach only learns who you are if you reply to them.
- We don’t sell your data, show you adverts or use advertising trackers.
- You can download your data or delete your account at any time from More → Privacy & data.
What we collect
Your account
- Your email address and password (stored as a secure hash we can’t read), or the account details shared by Google, Apple or Microsoft if you sign in with them: your name, email address and an account identifier.
- Your display name, profile picture (if you add one), date of birth, time zone, language and unit preferences (for example kilograms or pounds).
- Two-step verification settings, if you turn it on.
- Records of which terms and policy versions you agreed to, and when, and your marketing email choice.
Your training
- Programs you build, join, buy or try, and the workouts, sets, weights, repetitions, times, distances and notes you log.
- Personal exercises you create, including any photos or videos you add to them.
Health and body data (only with your consent)
- Check-ins you choose to record, such as body weight, measurements, sleep, energy, mood, nutrition and recovery, answers to questionnaires, and progress photos.
- This is health data, a special category of personal data. We only collect it after you give explicit consent in the app, and you can withdraw that consent in More → Privacy & data.
Coaching, messages and community
- Messages you send and receive with your coaches, including text, voice notes, photos and videos.
- Events you’re invited to and whether you said you’re going.
- Reviews you write for programs you bought.
- Reports you make about content or people, and reports others make about you, together with a copy of what was reported.
- If you coach or run an organisation: your organisation’s details, team members and roles, the programs you sell, events you publish and comments you leave for clients.
Finding a coach
- Your home town, if you choose to set one. We store the town only, never an address. We use it on our servers to show coaches near you first and to decide which coaches your requests reach. Coaches never see it.
- “What I’m looking for” requests you post: your goals, sports, specialities, whether you want to train in person or online, and any budget, schedule and notes you add. We also store the town you’d set when you posted, the introductions coaches send you and whether you replied.
- If you coach or run an organisation: the public profile you choose to publish, such as your bio, sports, specialities, qualifications, languages, coaching style, your town and the area you cover. Town data comes from GeoNames (geonames.org, CC BY 4.0).
Purchases and payouts
- What you bought, when, the price and its status (for example active, cancelled or refunded). Payments in the apps are handled by Apple or Google, and on the web by Stripe. We never see or store your full card details.
- If you sell programs: your sales, fees, payouts and billing. Stripe collects the identity and bank details needed to pay you; we only store a reference to your Stripe account.
Your devices and use of the service
- A push notification token for each device where you allow notifications, and your notification settings.
- Technical information our providers record when you connect, such as IP address, device and browser type and error logs, used to run and protect the service.
- Records of important account and admin actions (for example role changes, suspensions and deletions), kept for security.
Why we use it, and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, logging training, programs you join or buy, messaging your coaches, events and notifications you asked for | Contract: we need it to provide GoatGauge to you |
| Showing coaches near you, publishing coach profiles, and sending your requests to matching coaches | Contract: you asked us to do this. Setting a home town and posting requests are optional |
| Recording and showing your check-ins, measurements and progress photos | Your explicit consent (health data) |
| Sharing your training and check-in data with an organisation’s coaches | Your consent, given separately for each organisation |
| Taking payments, paying sellers and billing organisations | Contract, and our legal obligations to keep financial records |
| Keeping GoatGauge secure, preventing fraud and abuse, enforcing our terms and dealing with reports | Our legitimate interest in a safe, working service |
| Product tips and news by email | Your consent (optional, and you can turn it off at any time) |
| Responding to legal requests and meeting tax and accounting rules | Legal obligation |
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who can see your data
Coaches and organisations
When you join a coached program, the organisation’s owner and admins and the coaches assigned to you can see your workouts, check-ins, questionnaire answers and progress photos, but only after you give that organisation permission. Access stops straight away if you withdraw permission or the program ends. Coaches never see your date of birth. Organisations that sell a self-guided program see that you bought it, not your training.
Requests and introductions
A request you post is shown only to coaches whose sports, way of working and area match it. They see what you wrote, without your name, contact details or town; coaches who work near you see “in your area”, and those who cover a whole country or work worldwide see your country. Each organisation can introduce itself once. If you reply, a conversation opens and that organisation’s coach, owner and admins see your display name. Organisations you don’t reply to never learn who you are. Write your request without your name or contact details.
Other people
Reviews show your display name. People in a conversation see the messages in it. Coach and gym profiles you publish, including your town, are visible to anyone signed in to GoatGauge.
Service providers who process data for us
- Supabase: database, sign-in, file storage and server functions, hosted in the EU (Ireland).
- Stripe: card payments on the web, seller payouts (Stripe Connect) and organisation billing.
- RevenueCat: records of App Store and Google Play purchases, so access matches what you bought.
- Apple and Google: in-app payments through the App Store and Google Play, and sign-in if you choose it.
- Microsoft: sign-in, if you choose it.
- Google Firebase Cloud Messaging: delivering push notifications.
These providers only use your data to provide their service to us, under contracts that require them to protect it. Apple, Google and Stripe also act as independent controllers for the payments they process, under their own privacy policies.
Others
We may disclose data if the law requires it, to protect people from harm, or as part of a sale or reorganisation of our business (you’d be told). We never sell your personal data.
International transfers
Your account and training data are stored in the EU. Some providers above (for example Stripe, RevenueCat and Google) may process data in the United States or elsewhere. Where they do, the transfer is protected by an adequacy decision (such as the UK–US data bridge), or by standard contractual clauses or the UK International Data Transfer Agreement.
How long we keep it
- We keep your data while you have an account.
- When you delete your account, your profile, training data, check-ins, progress photos, messages and files are deleted straight away. Copies in our providers’ backups are removed as those backups expire, within 30 days.
- Records we must keep by law, such as sales, refunds and payouts for tax and accounting, are kept for as long as the law requires (usually six years), without your training or health data.
- When a coaching relationship ends, the coach’s access to your data ends immediately.
- Requests close after 30 days, or sooner if you close them. Closed requests and the introductions you received stay in your account so you can look back at them, and are deleted with your account. You can remove your home town at any time.
- Records of security and admin actions are kept for as long as needed to protect the service and resolve disputes.
Your rights
You have the right to:
- access your data: download a copy from More → Privacy & data, or ask us;
- correct it: most of it you can edit in the app;
- delete it: delete your account from More → Privacy & data (how to delete your account);
- take it with you (portability): the download is in a common, machine-readable format;
- object to or ask us to restrict some uses;
- withdraw consent at any time, for health data, sharing with an organisation or marketing emails, without affecting anything done before.
To use a right we can’t handle in the app, email support@goatgauge.com. We’ll reply within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk) or, in the EU, your local data protection authority. We’d appreciate the chance to help first.
Security
Data is encrypted in transit and at rest. Access inside our database is restricted row by row, so people can only reach data they’re allowed to see. You can protect your account with two-step verification, and GoatGauge staff must use it. No system is perfectly secure; if a breach affects you, we’ll tell you and the regulator as the law requires.
Age
GoatGauge is for people aged 16 and over. We don’t knowingly collect data from younger people, and we delete accounts that we find belong to someone under 16.
Cookies and similar technology
GoatGauge uses only what’s strictly necessary to work: on the web, your browser’s local storage keeps you signed in and remembers your settings. We don’t use advertising or analytics cookies, so there’s nothing to accept.
Changes to this policy
If we change this policy in a way that matters, we’ll tell you in the app and ask you to agree again before you carry on. The date at the top shows when it last changed.