Privacy Policy
TopShape is a platform for personal trainers and their clients: the coach manages clients, workouts, and check-ins through the web portal, and the client trains with the mobile app. This policy explains, in plain language, what data we collect, why we collect it, who we share it with, and what your rights are. It applies to the TopShape app (iOS and Android), the web portal, and the topshapeapp.com website.
1. Data we collect
Account data
- Name and email — to create and identify your account.
- Phone number (optional) — to make it easier for coach and client to get in touch.
- Date of birth — used, among other things, to calculate heart rate zones.
- Profile photo (optional) — if you choose to upload one.
Training and progress data
- Workouts and sessions — exercises performed, sets, reps, weights, and cardio sessions.
- Check-ins — periodic client check-ins, including body measurements (such as weight and circumferences) and progress photos the client chooses to upload. Photos are stored in a private area and are visible only to the client and their coach.
Heart rate (Apple Watch / HealthKit)
On iPhone, if you grant permission, the app reads heart rate data from Apple Health (HealthKit) recorded by your Apple Watch during cardio sessions. We calculate your average and maximum heart rate and time in effort zones, and those results are sent to our servers along with the cardio log so you and your coach can track progress.
The app only reads from HealthKit — it never writes to it. HealthKit data is never used for advertising or marketing, is never sold, and is never shared with third parties for those purposes. You can revoke access at any time in Settings > Privacy > Health.
Chat messages
- Conversations between coach and client within the platform — stored so the conversation works and stays available to both participants.
Usage data (analytics)
- We use Mixpanel to understand how the product is used (for example, which screens are viewed and which features are triggered). These are usage events tied to your account, used only to improve the product. We do not sell your data.
Push notifications
- Device tokens — technical identifiers required to deliver notifications (workout reminders, chat messages). You control notifications in the app preferences and in your system settings.
Payments
- The coach's subscription is processed by Stripe. Card details are handled directly by Stripe — we never store card numbers.
- The client app does not process payments. The coach may record on the platform the status of fees arranged directly with the client, but no charge goes through the app.
2. How we use your data
- To provide the service: building workouts, logging sessions, tracking progress, check-ins, and chat.
- To let the responsible coach follow the training data of their own clients.
- To send notifications you have set up.
- To improve the product based on usage data.
- To support you when you reach out.
We do not sell personal data, and we do not use your health or training data for advertising.
3. Where your data lives and who we share it with
- Supabase — our backend and database infrastructure, hosted in the us-east-2 region (United States). Progress and profile photos live in private buckets, accessible only through short-lived signed URLs.
- Stripe — coach subscription processing.
- Mixpanel — product usage analytics.
- Apple and Google — push notification delivery (APNs and FCM).
We share with these providers only what each service needs to work. Beyond that, we only share data if required by law or to protect rights, safety, and prevent fraud.
Within the platform, your training data, check-ins, photos, and messages are visible to your coach (if you are a client) or to your clients (if you are a coach), according to the link between the accounts.
4. Security and retention
We use encryption in transit (HTTPS), per-account access control, and private storage for photos. We keep your data for as long as your account exists. When you delete your account, your personal data is removed from our active systems within a reasonable period, except for what we must keep to meet legal obligations.
5. Your rights (GDPR, LGPD, and similar laws)
At any time, you can:
- Access the data we hold about you;
- Correct incomplete or outdated data;
- Delete your account and your data;
- Withdraw consent (for example, HealthKit access or notifications).
To exercise any of these rights, write to topshape.fitnessapp@gmail.com. We respond in line with the GDPR, Brazil's LGPD, and similar applicable laws.
6. Children
TopShape is not directed at children. The app is intended for users aged 13 and over, and we do not knowingly collect data from anyone under that age. If you believe a child has provided us personal data, contact us so we can remove it.
7. Changes to this policy
We may update this policy from time to time. Meaningful changes will be announced on the website or in the app, and the effective date at the top will be updated.
8. Contact
Questions about privacy? Reach out: topshape.fitnessapp@gmail.com.