Privacy Policy

This Privacy Policy explains how Lucky Singh, operating as CoreAthlete (“we”, “us”), collects, uses and protects information when you use the CoreAthlete web application (the “Service”).

CoreAthlete is a coaching workspace. It has two kinds of users: Coaches, who create an account and use the Service directly, and Clients (athletes), whose training, nutrition and progress data a Coach enters and manages on their behalf. A Client does not create their own account; they view their plan through a private link a Coach shares with them — see “Client access links” below.

1. Information we collect

1.1 From Coaches, directly

• Name and email address, at signup, and your password (see “How we protect your data”).
• Coaching profile details you choose to add: title, organization name, brand color, and a preferred intensity-display setting.

1.2 About Clients, entered by their Coach

A Coach may enter, for each Client:

• Name, email address, and optionally a phone number.
• Physical profile: age, weight, height, gender, training experience and experience level.
• Training constraints: injuries or physical limitations, movements to avoid, available equipment, and session-length or weekly-availability preferences.
• Body-composition and progress measurements (for example weight, waist/chest/arm/thigh/hip measurements, or body fat percentage), when the Coach or the Client records them.
• Free-text notes the Coach writes about the Client.
• Training programs, nutrition plans, and the Client’s own logged activity — completed sessions, exercises, meals, and optional self-reported energy, sleep and stress check-ins.
• Where a Coach uses the business-tracking features: service names and prices the Coach sets, payment records the Coach manually logs against a Client, and testimonials the Coach records.

This information is entered and controlled by the Coach, not by CoreAthlete. The Coach is responsible for having the right to collect and hold it — see our Terms of Service.

1.3 Collected automatically

• A session cookie that keeps a signed-in Coach logged in — see “Cookies” below.
• Basic request information (such as IP address and browser type), processed transiently by our hosting infrastructure to serve requests and to apply security rate limits. We do not compile this into advertising profiles.
• Internal usage events tied to a Coach’s account (for example, that a program was generated, or a client link was shared), used to understand which parts of the product are used. These do not include the content of a Coach’s or Client’s data.

1.4 What we do not do

• We do not use advertising or analytics trackers on the Service.
• We do not sell personal data.
• We do not send marketing email, and we currently do not send any automated email at all.

2. How AI is used

When a Coach generates or edits a training program or nutrition plan, or asks for a targeted change, the Client information needed to produce it — physical profile, goals, injuries or limitations, restricted movements, available equipment, and the Coach’s own notes or instructions — is sent to OpenAI, our AI provider, to generate that content. OpenAI is a US-based company; this means the specific information sent for a generation may be processed outside India for that purpose. We do not send Client data to OpenAI for any purpose other than producing the program, plan or suggestion the Coach requested.

3. Who processes data on our behalf

• OpenAI — Generates and edits training programs, nutrition plans and coaching suggestions from the athlete information a coach provides.
• Neon — Hosts the PostgreSQL database that stores all account, athlete and program data.
• Vercel — Hosts and serves the CoreAthlete application.
• Razorpay — Processes coach subscription payments. CoreAthlete never receives or stores card, UPI or bank account details directly.

These providers may process data outside India as part of delivering their service to us. We have not published a specific data-hosting region in this policy because that detail depends on our live infrastructure configuration, which we want to state accurately rather than guess at — it will be added here once confirmed.

4. Cookies

We use one cookie, and it is essential to signing in. It is:

• Required for the Service to work while signed in — there is no way to use a Coach account without it.
• Not used for advertising, and not shared with any third party for tracking.
• Set to HttpOnly (not readable by page scripts), SameSite=Lax, and Secure (HTTPS only) in production.
• Valid for 30 days from last use, and deleted immediately when you sign out.

We do not currently use any cookie that requires consent under applicable cookie-consent rules, and we have not added a cookie banner for this reason. If that changes, this policy and the Service will be updated together, not separately.

5. Client access links

A Coach can generate a private link that lets their Client view their own plan and log activity, without creating a password or account. This link:

• Is a long, randomly generated token — only someone with the exact link can use it.
• Grants access only to the one Client it was issued for, never to any other Client’s or Coach’s data.
• Can be revoked by the Coach at any time, which disables it immediately.
• Does not otherwise expire on its own.

A private link is only as private as how it is shared. The Coach is responsible for sharing it only with their intended Client, and should revoke it immediately if they believe it has reached anyone else.

6. Payments

Coach subscriptions are billed through Razorpay. We do not store card, UPI or bank account details — Razorpay collects and processes that information directly. We store only your subscription status, billing interval, the period your current subscription covers, and Razorpay’s own reference IDs for it.

Separately, if a Coach logs a payment they personally collected from a Client (for example, cash or a UPI transfer received outside the app) using our bookkeeping feature, that record is data the Coach entered for their own business records. CoreAthlete is not a party to that payment.

7. How long we keep data

• Account and associated data are retained while the account remains active.
• Program and nutrition plan history is kept as version history — every save creates a new version rather than overwriting the last one, so a Coach can see and restore earlier versions. Deleting a program deletes its entire version history permanently.
• Deleting an athlete permanently deletes that athlete’s programs, nutrition plans, progress records, notes, and any active client access link.
• If you request deletion of your account or data, we will delete what we are not required to keep for legitimate legal, security or accounting purposes. Where specific records must be retained for one of those limited purposes, we will keep only what is necessary, for only as long as that purpose requires.

8. Account deletion

There is currently no self-service “delete my account” option in the product. To request deletion of your Coach account and the data under it, contact us at lsc.aisolutions@gmail.com. We will acknowledge your request and let you know once it has been completed; we are not yet able to commit to a fixed turnaround time for this.

9. How we protect your data

• Passwords are never stored in plain text; they are hashed before storage.
• Session tokens are stored only as a one-way hash — the value that would let someone sign in is never written to our database.
• All traffic to the Service is encrypted (HTTPS).
• A Coach’s data is scoped to that Coach at the database level; one Coach cannot read another Coach’s athletes, programs or data.

No system is perfectly secure, and we cannot guarantee absolute security.

10. Your rights, and your Client’s

Coaches can update most of their own and their Clients’ information directly in the app. For anything else — including an account-deletion request, or a request from a Client regarding information their Coach holds about them — contact lsc.aisolutions@gmail.com. If you are a Client and believe your Coach is holding inaccurate information about you, please contact your Coach directly first, as they control that data.

11. Age

CoreAthlete is intended for use by Coaches who are at least 18 years old. At this stage, the Service is intended to support adult Clients only, and is not designed or intended for the data of minors. If you believe a Client’s information belonging to a minor has been entered into the Service, contact us at lsc.aisolutions@gmail.com.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will update the “Effective” date above.

13. Contact

Questions about this policy, or requests regarding your data, can be sent to lsc.aisolutions@gmail.com. See also our Contact & Grievance page.