Privacy Policy

1. Data We Collect

1.1 Account Data

When you create an account, we collect:

• Email address (used for authentication)
• Display name, username, first name, last name, and ring name
• Avatar photo (uploaded by you, compressed to 400px wide, and stored on our servers)
• Role selection: boxer, coach, or both
• An age band (13–15, 16–17 or 18+). At sign-up you enter your date of birth; it is checked on your device and immediately discarded. We store only the band, never the date.
• If you sign in with Apple or Google, the name and email address that provider shares with us
• The date and time you accepted our Terms of Service and this Privacy Policy

You may optionally provide: bio, city, gender, fighting stance, years of experience, and fight record (wins, losses, draws). Fight records are self-reported and not verified by Clinchr.

1.2 Fitness & Workout Data

We collect data about your workouts, including: workout type (bag work, sparring, pad work, shadow boxing, roadwork, weight training, jump rope, and others), duration per type, total duration, rounds, strength sets (exercise, reps and weight), your own intensity and sharpness ratings, session focus, distance (for roadwork), for "Other" activities a name you choose, a distance and a match result (win, loss or draw), date and time, the gym or location label you train at, notes, title, and visibility preference (public, friends-only, or private).

Some features store data that is visible only to you: private workout notes, your gear locker, and personal goals.

You may also upload workout photos (compressed to 1200px wide before storage) and videos (up to 50MB). We track your current and longest workout streaks. If you log them, we also store body-weight entries (weigh-ins) so you can track your weight over time.

When logging a coached workout, we collect session type, focus areas, and skill level.

Tagged friends and copies. If you tag friends in a workout, they can add a copy of it to their own log. The copy includes your workout photos and videos unless you switch that off for the workout.

Importing past sessions. If you import training sessions from your notes app, the text you paste is read on your device. Only the workouts you confirm are saved to your account; the pasted text itself is not uploaded.

1.2a Heart Rate & Health Data (optional)

You can add heart rate to one of your own saved workouts, either by typing it in or by importing it from Apple Health (iPhone) or Health Connect (Android). Both are optional and off until you use them.

What the App reads. Only after you tap "Import from Apple Health" or "Import from Health Connect", read an explanation, and grant permission, the App reads two kinds of data from your phone: your workouts (exercise sessions) for the day you pick, and the heart-rate readings during the one workout you choose. The App never writes anything to Apple Health or Health Connect and never reads in the background.

What we store. The heart-rate readings are turned into a summary on your device. Only that summary is saved to your account: average and peak heart rate, time spent in each heart-rate zone, how many minutes had readings, the start and end time of the watch workout, its identifier and the name of the app that recorded it (for example "Garmin Connect"), and the max heart rate used to calculate the zones. The individual readings never leave your phone. If you set a max heart rate in the App, we store that number too.

Who can see it. Only you. Heart rate and max heart rate are never shown to friends, gyms, coaches, other users or on the clinchr.app website, even on public workouts.

What we never do with it. We do not use health data for advertising or marketing, do not sell it, do not use it to decide credit, insurance or employment, and do not share it with third parties, except our database host Supabase, which stores it for us (see section 4). Heart-rate zones are for training only and are not medical advice.

Stopping and deleting. You can remove the heart rate from any workout in the App, and you can withdraw the App's access at any time in the Health app on iPhone (tap your profile picture → Apps → Clinchr) or in Health Connect on Android (App permissions → Clinchr). Withdrawing access stops new imports; heart rate you already saved stays until you remove it or delete your account.

1.3 Location Data

Your profile may include a city name, latitude, and longitude, selected through a city picker — not through continuous GPS tracking. This data is used to sort gyms and coaches by proximity using the Haversine formula. Raw coordinates are never displayed to other users; only your city name is shown.

The App may request coarse device location to power the "nearby gyms" search feature. This is optional and you can deny the permission at the device level.

1.3a Contacts (optional)

If you choose to find friends from your contacts, and only after you agree on a consent screen in the App, the App reads the email addresses in your address book and turns each one into a one-way SHA-256 code on your device. Only those codes are sent to our server, where they are compared against the codes of existing Clinchr accounts to show you matches. Your contacts' names, phone numbers and email addresses are never uploaded, and the codes are not stored after the comparison.

1.4 Social Data

We collect data arising from your social interactions in the App: friend connections (requests, acceptances, blocks), kudos (likes) on workouts, comments on workouts (up to 500 characters), referral codes and referral tracking, QR codes for friend adding (containing your user ID only), and your blocked user list.

Gym chat. Each gym has a group chat for its members. We store the messages you send there (up to 1,000 characters each), with the time sent. They are visible to the gym's current members and its owner, and our moderators can read a chat to handle reports. Your messages stay until you delete them, the gym owner or a moderator removes them, or you delete your account. If you get chat notifications, we also store whether you muted that chat and when you last opened it, so we don't notify you about messages you are already reading.

Friend suggestions. Your profile may be suggested to other users, for example people who share a gym or friends with you. To keep suggestions useful we mainly suggest people who trained in the last 30 days, and a suggestion can show that reason (for example "Trained in the last 30 days"). New users may also be shown the most active accounts.

Private profiles. If you make your profile private, people who are not your friends see only your profile header (photo, display name, username, gyms and badges) and can send you a friend request; your workouts and stats stay hidden from them.

1.5 Gym Data

We store your gym memberships (up to 3 gyms as a boxer, 5 as a coach) and your workout history at each gym. Gym page view analytics — including total views, viewer gender breakdown, top viewer cities, and daily view counts — are collected and visible only to the gym owner.

Some gyms ask the owner to approve new members. If you request to join such a gym, the gym owner sees your request together with your display name, username and profile photo, and can accept or decline it. Gym owners can also set training challenges for their gym; your public workouts at that gym count toward them as described in section 1.6a.

1.6 Coach Data

If you use the App as a coach, we collect your coach profile information: specialties, certifications, hourly rate, bio, phone number, website, and Instagram handle. We also track coach-student relationships and coached session logs. In a coaching relationship, the coach can view their student's training data — including workout history (even workouts marked private), profile details, and body-weight (weigh-in) trends — through the coach dashboard, a free web app at coach.clinchr.app. This sharing begins only when the student accepts the coaching relationship and stops when either party ends it. Coach page view analytics are visible only to the coach themselves.

1.6a Gym Challenges & Check-ins

If you take part in a gym challenge, we record your check-ins at that gym (by scanning the gym's QR code or NFC tag, or by uploading a photo or video as proof) and link them to the workouts you log. Your challenge ranking, display name, profile photo and hours trained are shown on that challenge's public page (see section 4a). Only public workouts count toward a challenge, and you can leave public rankings at any time with the leaderboard opt-out in Settings.

1.7 Device & Technical Data

We collect your Expo push notification token and device type to deliver push notifications. If crash reporting is active, Sentry may collect crash reports including stack traces, device information, and app version for debugging purposes.

In-app usage analytics. We record which features are used (for example "workout logged" or "friend request sent"), linked to your account, in our own database so we can see what works and what does not. These events contain no device identifiers, no advertising IDs and no content you wrote, and they are never shared with advertisers or analytics companies.

Feedback. If you send feedback from the App, we store your message with your account, app version and platform, and email it to our team together with your username (or your email address if you have no username) so we can follow up.

1.7a Emails

We send emails needed to run your account (for example to confirm your email address or reset your password).

Training reminder emails. We may send you an occasional reminder email about your own training, for example a few days after you joined a gym without logging a session, or when you have not logged anything for two weeks. These emails are on by default for users aged 18 or older (and for accounts without a known age) and are never sent to users we know to be under 18. You can turn them off at any time in Settings → Notification settings → Email, or with the unsubscribe link at the bottom of every reminder; one click is enough. We send at most one reminder per day.

To decide whether a reminder is due, we use your email address, language, account creation date, gym memberships and pending gym join requests, and the date of your latest logged workout. A reminder may greet you by your first name and, in the gym reminder, mention the name of your gym. We keep a record of each reminder (which email, when it was sent and whether it was delivered, bounced or marked as spam) and of your email choice. We do not track whether you open the email or click its links. If an address bounces or reports a reminder as spam, we stop sending reminders to it.

1.8 Payment Data

Clinchr does not collect or store credit card numbers, bank details, or payment credentials. All payments are processed through Apple App Store or Google Play Store native in-app purchase systems. We store your subscription status (free or premium), the gyms you have upgraded, and the transaction identifiers and receipts Apple or Google return, which we check with Apple or Google to confirm a purchase is genuine.

2. How We Use Your Data

We use your data to:

• Provide and operate the App, including workout logging, social features, leaderboards, and achievements
• Authenticate your account and deliver push notifications
• Send account emails and, unless you switch them off, training reminder emails
• Display gym and coach search results sorted by proximity
• Enable social interactions: friend connections, kudos, comments, gym chat, and referrals
• Show you the heart rate of your own workouts, if you choose to add it
• Provide gym owners with page analytics and management tools
• Enable coach-student relationships and coached session tracking
• Track and display streaks, leaderboards, and achievements
• Diagnose crashes and improve app stability (via Sentry)
• Process subscription status for premium features
• Enforce rate limits and safety measures

We do not use your data for advertising or sell it to third parties.

3. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): Processing necessary to provide the App's services as described in our Terms of Service — including account management, workout logging, social features, and subscription management.
• Legitimate interest (Art. 6(1)(f) GDPR): Crash reporting and app stability monitoring, in-app usage analytics to improve the App, fraud prevention, purchase verification, backups, enforcing rate limits, and training reminder emails about your own use of the App. Reminder emails are sent to existing users under the existing-customer rule for email (Article 11.7(3) of the Dutch Telecommunications Act), and you can object at any time, free of charge, by switching them off in Settings or using the unsubscribe link in each email.
• Explicit consent for health data (Art. 9(2)(a) GDPR): Heart rate is health data. We only process it after you choose to add it to a workout and, for imports, grant access in Apple Health or Health Connect. You can withdraw consent at any time as described in section 1.2a.
• Consent (Art. 6(1)(a) GDPR): Optional data such as location access for nearby gym search, contact matching, push notifications and optional profile fields. You may withdraw consent at any time through your device settings or within the App.

4. Data Sharing & Third-Party Services

We share data with the following third-party services as necessary to operate the App:

• Supabase (EU-hosted) — backend, database, authentication, and file storage. Stores all user data, workout data, and uploaded media.
• Google Places API — used for gym search, city autocomplete, and gym photos. Gym photos retrieved from Google are downloaded once and re-hosted on our own servers; Google is not contacted on subsequent views.
• Apple / Google — in-app purchase processing for premium subscriptions. All payment processing is handled by their systems; we receive only purchase confirmation.
• Sentry (optional) — crash reporting. Collects crash data, stack traces, and device information for debugging.
• Expo Push Notification Service — delivers push notifications using tokens stored in our database.
• Cloudflare — hosts the clinchr.app website and the coach and gym dashboards, and stores encrypted nightly backups of our database.
• Resend — sends our emails: training reminder emails to you, and the feedback messages you send from the App to our team's inbox. For reminders, Resend receives your email address and the content of the email, and tells us whether it was delivered, bounced or marked as spam. Open and click tracking are switched off.

We do not sell your data. We do not use advertising trackers.

4a. Public Visibility on the clinchr.app Website

When you mark a workout as "Public" in the App, the workout is published to the public live activity feed at clinchr.app, viewable by anyone on the open internet without an account.

The following information is shown on the public website for public workouts:

• Your display name and profile photo
• Workout type, duration, and timestamp
• Your gym name (if you logged the workout at a gym)
• The count of kudos and comments on the workout

The following information is never shown on the public website: your email address, phone number, exact location, friend list, private workouts, or workouts you marked as "Friends-only".

Gym leaderboards on the website show gym names and aggregated training hours. Individual user data shown in leaderboards is limited to display name and total workout time.

Gym challenge pages (for example clinchr.app/vanthof) show the fighters taking part: display name, profile photo, rank, hours trained and recent qualifying public sessions. Private and friends-only workouts appear only as anonymous totals. Users who opted out of leaderboards are not shown.

Search engines may index the public feed. Pages on the clinchr.app website are crawlable by Google and other search engines, and individual entries may appear in search results. Third-party services may also cache or archive the content (for example, the Internet Archive's Wayback Machine).

To stop a workout from appearing on the public website, change its visibility to "Friends" or "Private" in the App, or delete the workout. Deleted workouts are removed from the public feed within the next refresh cycle. Deleting your account removes all your workouts and profile information from both the App and the public website.

5. Data Storage & Security

All user data is stored on Supabase servers located in the European Union. Uploaded photos and media are stored in Supabase Storage (EU region).

We apply the following measures to protect your data: encrypted connections (HTTPS/TLS), compressed image uploads to reduce exposure surface, server-side token handling for third-party integrations, and rate limits on user actions to prevent abuse.

6. Data Retention

Your data is retained for as long as your account is active. When you delete your account, all data is permanently and irreversibly removed, including: your profile, workouts, heart-rate data, kudos, comments, gym chat messages, notifications, friendships, achievements, avatar files, workout media files, and coach or gym ownership records. There is no soft-delete or recovery period in the App.

Encrypted database backups are kept for up to 30 days for disaster recovery and are then deleted automatically, so deleted data can remain in a backup for up to 30 days. We do not restore backups to bring deleted accounts back.

The details of a sent training reminder email (address, name and content) are removed after 30 days; we keep only a minimal record that a reminder was sent, so you do not get the same reminder twice. Your email choice (on, off or unsubscribed) is kept while your account exists. All of it is deleted with your account.

If you held gym ownership, the gym becomes claimable by others upon your account deletion.

7. Your Rights Under GDPR

As a user, you have the following rights:

• Right to access: You can export all your data (profile, workouts, heart-rate data, achievements, friendships, kudos, comments, gym chat messages, and your training reminder email choice and history) as a JSON file via "Export My Data" in Settings.
• Right to deletion: You can delete your account from Settings at any time. This permanently removes all your data using cascading deletes. This action is irreversible.
• Right to rectification: You can edit your profile information and workout data at any time within the App.
• Right to data portability: Covered by the JSON data export feature.
• Right to restrict processing: You may contact us at support@clinchr.app to request restriction of processing.
• Right to object: You may object to processing based on legitimate interest by contacting support@clinchr.app. To stop training reminder emails, switch them off in Settings or use the unsubscribe link in any reminder.
• Right to lodge a complaint: You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or another relevant supervisory authority.

To exercise any of these rights, contact us at support@clinchr.app.

8. Cookies & Tracking

The Clinchr mobile app does not use cookies. We do not use advertising trackers. Sentry is used for crash reporting only and does not track user behavior.

The clinchr.app website does not use cookies and does not contain analytics, advertising, or behavioral tracking scripts. Fonts are self-hosted on our own servers (no third-party CDN). The only persistent client-side storage used is the browser's localStorage, which holds two small values: a flag set when you dismiss the one-time privacy notice, and your light/dark theme choice if you change it. Neither contains personal data. You can clear it at any time via your browser settings.

9. Children's Privacy

Clinchr is available to users aged 13 and older. Sign-up asks for a date of birth and does not let anyone under 13 create an account; the date itself is never stored (see section 1.1). We do not knowingly collect personal data from children under 13. If you believe a child under 13 has created an account, please contact us at support@clinchr.app and we will promptly delete the account and associated data.

For users between 13 and 16 years of age in the EU, parental or guardian consent may be required under applicable law. By allowing a minor to use the App, the parent or guardian agrees to this Privacy Policy on the minor's behalf.

10. International Data Transfers

All primary data storage is within the European Union (Supabase, EU region). Where third-party services process data outside the EU (such as Sentry, Google, Expo, Resend or Cloudflare), they do so under appropriate safeguards including Standard Contractual Clauses (SCCs) or equivalent mechanisms as required by GDPR.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the App or by other appropriate means. Your continued use of the App after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or your personal data, contact us at:

Email: support@clinchr.app
Website: clinchr.app