Privacy policy
Last updated
Who is responsible
kico.coach is operated by the coach named on the about page, acting as the data controller for everything described here. Questions and requests go to the contact address listed there.
What we collect
Your account. Email address, name, and a hashed password. Never the password itself.
Your profile. Time zone, preferred language, date of birth and sex. The last two are used to calculate calorie and macronutrient targets and for nothing else.
Your training and nutrition records. Logged sets, weights, repetitions, session notes, meals, water intake, body weight and body measurements.
That third category is health data. Under Article 9 of the GDPR it gets special protection, and we treat it accordingly: it is stored separately, every read of it by your coach is recorded, and it is never shown in list views — seeing a value requires opening your record, which is itself a logged event.
Why we are allowed to hold it
- Your account and licence — because we cannot provide coaching you have paid for without them (contract, Art. 6(1)(b)).
- Your health data — because you explicitly consented (Art. 9(2)(a)).
Consent is asked per purpose and never bundled. Agreeing to have your weight tracked is not agreement to have your photograph published. You may withdraw any consent at any time, including the one that makes the app usable; withdrawing it removes that surface rather than being refused.
Who can see it
Your coach, and no one else. There is no advertising network, no analytics vendor and no third-party tracker on the authenticated part of this site.
We use two processors: a mail provider to send transactional email such as password resets and licence reminders, and our hosting provider. Both are contracted under Art. 28 and both store data inside the EU.
How long we keep it
Health data is erased after a period of account inactivity. You get a warning email 30 days before anything is deleted, and the deletion covers only health records — your login, licence history and consent record survive, so the account still works if you come back.
Your rights
You can request a copy of your data, correct it, or have it erased, from your account page.
Erasure is queued for confirmation rather than applied instantly. Article 12(3) allows up to a month, and a single irreversible tap that destroys a paying client's training history is a button that gets pressed by accident. Nothing is deleted without a second confirmation.
Changes
The revision date at the top of this page is the authoritative one. Your recorded consent stores the version of the document you agreed to, so an edit here never silently changes what you signed up for.