Privacy
CoachBlocks holds two different kinds of information, and they are not treated the same way. There is what we know about you, the coach, because you have an account with us. And there is what you record about your clients, which is yours, not ours. This page covers both.
CoachBlocks is run as a registered business in Kosovo. For questions or to have anything deleted, email hello@coachblocks.com.
What we hold about you
- Your name and email address
- Your password, stored scrambled so that nobody here can read it
- Whether you work in kilos or pounds
- Which plan you are on, and the reference numbers our payment provider gives us
- The date you signed up
We never see your card. That goes straight to Paddle, who take the payment. We only learn that a payment happened.
What you record about your clients
When you add a client, you can store:
- Their name, and an email or phone number if you enter one
- How often they train, their goal and their experience
- Where they train, and any injury or limitation you note down
- Any notes you write about them
- The training you have written for them, and every set they log
- Their bodyweight, if they choose to record it on their own link
Bodyweight is the client's to enter and the client's to skip. Nothing in CoachBlocks asks them for it twice, nothing scores it, and their training is exactly the same whether they record it or never do. It is a more personal number than a squat is, so treat it like one: have a reason to be looking at it, and tell them you are.
This information is yours and your client's, not ours. You decide what to record and why. We hold it, show it back to you, and show each client their own training. We do not sell it, we do not use it to train any model, and we do not look at it except when you ask us for help or when we have no choice in order to keep the service working.
In data protection terms, you are the controller of your clients' information and we are your processor. Practically, that means it is your job to have a proper reason for recording it and to be straight with your clients about it. Please do not put medical records into CoachBlocks.
Your clients never make an account
A client sees their training through a private link you send them. There is no password, no signup, and no cookie. The link contains a long random code that cannot be guessed, and those pages are kept out of search engines. If a link ever gets into the wrong hands, you can replace it from the client's page and the old one stops working immediately.
Cookies and tracking
One cookie, and only if you have an account. When you log in we set cb_session so the site knows it is still you on the next page. It holds a random token, nothing about you, and logging out deletes it. Your clients never get one, because they never sign in.
There are no advertising trackers, and nothing follows you around the internet after you leave.
We do count page views, using Vercel Web Analytics. It sets no cookie. Visitors are counted as a hash of the request rather than as a person, that hash is thrown away after 24 hours, and your IP address is not stored. What it records is the page, the site you came from, your country and city, and your browser and device.
Two pages are left out of it completely: your client's link and a password reset link. Both have a secret in the address, so we do not report those addresses anywhere. Client and block addresses have the identifier stripped out before they are counted, so we can see that a page was used without saying which client it was about.
Where it is stored
In a database hosted by Neon in Frankfurt, Germany, on servers run by Vercel in the same region. Everything travels over an encrypted connection.
Who else touches it
These are the only companies involved, and each does one job:
- Neon: stores the database
- Vercel: runs the website, and counts page views
- Resend: sends the few emails we send, such as a password reset. They see the address and the message
- Paddle: takes payments and handles the sales tax. They see your billing details; we do not
Nobody else. We do not sell data and we do not share it with advertisers.
How long we keep it
While your account is open, and for 30 days after you ask us to close it, so that a mistake can be undone. After that it is deleted. Cancelling a paid plan does not delete anything. You drop to the free plan and your work stays put.
Records of payments are kept longer where tax law requires it. That is dates and amounts, not anything about your clients.
Your rights
You can ask for a copy of what we hold, ask us to correct it, or ask us to delete all of it. Email hello@coachblocks.com and we will do it within 30 days. You do not need to give a reason.
If one of your clients asks you for their information, you can give it to them straight from their page. If they contact us directly we will point them back to you, because it is your record, and we will help you answer.
If something goes wrong
If data is ever exposed, we will tell the coaches affected within 72 hours of finding out, explain what happened in plain words, and say what we are doing about it. We would rather tell you about a small problem than have you find out about a big one.