Privacy Policy

The controller of your personal data is Stevan Osecanski, a private individual based in Belgrade, Serbia.

For any question about how data is processed, and to exercise the rights in this policy, write to [email protected].

We collect only what the service needs to work. That is the data you enter yourself and the data your use of the app produces:

• Account data — name, email address, chosen language and role (coach or client).
• The coach–client link — which coach or client you are linked to, and since when.
• Body metrics — the weights and measurements you enter, with their dates.
• Progress photos — photographs you upload yourself.
• Workouts — plans, exercises, sets, reps, weights and notes on completed sessions.
• Messages — the content of conversations between a coach and a client.
• Technical data — a device identifier used to deliver notifications, and technical records of how the app and our server are running.
• Sign-in with Google or Apple — this option is not yet active in any released build; we describe it in advance and will update this policy before it goes live. Once it is on and you choose it, the provider gives us your name, email address and an account identifier; we keep the identifier, and the email address as it was when you linked the account, so we can recognise you next time.

A coach can keep private notes about a client. Those notes are deliberately invisible to the client they are about: they appear on no screen the client sees and in no response the client's device receives.

The notes belong to the coach, not to the client. When a client links to a new coach, the previous coach's notes are cleared and do not follow the client onward. Data the client entered themselves — workouts, measurements and photos — stays with the client.

We state this explicitly because it is the only part of a client's record that the client cannot see in the app. If you want to know what notes concern you, ask at [email protected].

Account data, workouts, schedules and messages are processed to perform our contract with you — without them the service simply does not exist.

Body metrics and progress photos may count as health data and are processed only on your explicit consent, which you give by entering them and can withdraw at any time by deleting the data or your account.

Technical records of crashes and errors are processed on our legitimate interest in keeping the app correct and secure, to the extent described below.

Progress photos and exercise images are held in private storage that is not publicly accessible. There is no public address through which they can be reached.

When the app needs to display a photo, it receives a temporary signed address valid for a few minutes, after which it stops working. Sharing such an address with someone else has no lasting effect.

We do not sell your data and we do not use it for advertising. We use a small number of processors, each for one specific purpose:

• Sentry — crash and error reports, both from the app and from our server. What those reports do and do not contain is described in the next two sections.
• Have I Been Pwned — checking whether a password you choose has already appeared in a public data breach. We send only the first five characters of a one-way fingerprint of the password, a fragment that a great many different passwords share, and make the comparison ourselves; the password itself never leaves our server, and neither does the rest of its fingerprint.
• Firebase Cloud Messaging (Google) — delivering push notifications to your device.
• An object storage provider — holding photos and other media in private storage.
• RevenueCat — subscription handling. This integration is not yet active in any released build; we name it in advance and will update this policy before it goes live.
• Google and Apple — sign-in, which is not yet active in any released build; we name it in advance and will update this policy before it goes live. Once it is on, the coach console's sign-in and sign-up pages load Google's and Apple's sign-in scripts, so those providers receive the usual browser request data, such as your IP address and browser, from anyone who opens those pages. If you sign in with them, we check the sign-in token against their published keys.

Crash reports are where data leaks by accident most easily, so this section is written as a list of what is switched off rather than what is switched on. A list of refusals is the only shape that fails safe.

A crash report from the app does not carry any of the following:

• Default personal data is off — no IP address, no user agent, no request headers.
• The user is never attached to a report — no identifier, no email, no username.
• No screenshot is attached. A screenshot of a message thread is the message content.
• No view hierarchy is attached, because it carries the text that is on screen.
• Network requests never become a breadcrumb — no URL, no body, no headers.
• Errors the app receives from the server — a failed login, a rejected password, a limit reached — never enter reports at all.

The app is one source of reports; our server is the other. A server report is written by the software rather than by you. Expected outcomes — a failed login, a rejected password, a limit reached — are not faults and produce no error report. Separately from faults, we record how long requests take so we can find the slow and broken parts of the service, and those timing records are made for requests that succeeded as well as for ones that failed.

Both kinds are a snapshot of a request in flight, so this section is written as a list of what they may include rather than as a list of refusals. For this half, what is sent is the honest shape. A report may carry the following:

• The address of the request and its method, together with the request headers — but never the authorisation header, never cookies, and never your IP address.
• The content of the request, up to roughly ten kilobytes — whatever you had just typed or sent. Where the request was sending a message, that includes the text of the message.
• The internal account number of whoever was signed in — but not your name and not your email address.
• The database statements that ran, without the values placed into them.
• The addresses of the services we called while handling the request, such as the push notification service.
• A short trail of what happened just before — the log lines the request wrote and the names of the cache entries it touched. These reports are kept for less time than your content and are used for nothing but fixing faults.

Account data and the content you entered are kept while your account exists. When you ask us at [email protected] to delete your account, we delete them within a reasonable period, except anything we are legally required to keep.

When you delete your account in the app or the coach console, it is deleted immediately, together with your training history, measurements, progress photos and messages. Copies in our backups disappear as the backups are overwritten on their regular cycle. If your coach deletes their account, your conversation with them is deleted, and your own training history, measurements and photos stay with your account.

If you signed in with Apple, deleting your account also revokes our access with Apple.

Backups are short-lived and are overwritten on a cycle, so deleted data may persist briefly in a backup before it disappears from there too.

Technical records and error reports are kept for less time than content and are used for nothing but fixing faults.

Under the Serbian Personal Data Protection Act, and where it applies under the General Data Protection Regulation (GDPR), you have the right to:

• request access to the data we process about you;
• request correction of inaccurate data, or completion of incomplete data;
• request deletion of your data and your account;
• request restriction of processing, or object to processing;
• request your data in a common, machine-readable format;
• withdraw consent, without affecting the lawfulness of processing before withdrawal.

You can send a request to [email protected] and we will answer within the period the law allows.

If you believe your rights have not been respected, you may complain to the Serbian Commissioner for Information of Public Importance and Personal Data Protection, or to the supervisory authority in your country of residence.

Traffic between the app and the server runs over an encrypted connection. Passwords are stored only as a cryptographic hash and cannot be read back.

One coach's data, and their clients', is separated from every other coach's at the level of the database query itself rather than by a check on an individual screen — a request with no established user returns nothing at all, it is refused.

No measure is absolute. If a breach occurs that may put your rights at risk, we will notify you and the supervisory authority within the periods the law sets.

The site and the coach console use only the cookies they need to work. There is no analytics, no tracking and no third-party cookie. The mobile app uses no cookies.

When you open the coach console, it sets two more cookies: a session cookie, which keeps you signed in, and a security cookie that stops anyone else from sending a request in your name. Both expire after 120 minutes without activity. Signing out ends the session at once, so the cookie left behind no longer signs anyone in.

You can delete these cookies in your browser settings at any time. The site then follows your device's settings again, and the console asks you to sign in again.

The site's pages set no cookie until you choose a language or a theme yourself. Your choice is then kept in a cookie on your device, so it is still there on your next visit:

• Language (cobalt_locale): Serbian or English. Kept for five years.
• Theme (cobalt_theme): light, dark or following your device. Kept for five years.

The service is not intended for anyone under 16. We do not knowingly collect data from them.

If we learn that we have collected a child's data without appropriate consent, we will delete it. If you believe this has happened, tell us at [email protected].

Some of the processors we use handle data outside the Republic of Serbia and the European Economic Area.

We make such transfers only with the safeguards the law requires — as a rule under standard contractual clauses or an adequacy decision.

We may change this policy. The updated version is published at https://cobaltcoaching.app/privacy with a new date.

We will tell you about material changes — a new processor or a new purpose in particular — in the app or by email before they take effect.

For privacy questions and to exercise your rights: [email protected].

For anything else: [email protected].