Privacy Policy

1. Who is responsible for your data#

Treinamos is operated by Pedro, a sole proprietorship based in Portugal, trading as Treinamos (Leiria). Throughout this policy, “Treinamos”, “we”, and “us” refer to that business. You can reach us at support@treinamos.com.

2. What data we collect#

We only collect data you provide by creating an account and using the service:

• Account data — your name, email address, and authentication credentials (passwords are hashed; sign-in sessions use rotating secure cookies or app tokens). If you are a professional, the professional types you activate (coach, nutritionist, physiotherapist, massagist).
• Training and workout data — training plans, training sessions, exercise and interval logs, personal records, and the notes professionals write for their clients.
• Health-adjacent data you choose to log — body metrics (for example weight or body-fat readings), daily metrics (for example resting heart rate or HRV), and form-check videos you upload for review. You decide what to record; nothing here is required to use the platform.
• Organization data — if you belong to an organization: its name and settings, your role and staff modules, class and booking records, and service catalogs.
• Technical data — server logs (including IP address) used for security, rate limiting, and diagnosing errors, error reports from the apps, and, if you enable push notifications, the push token of your device.
• Communications — messages you send to our support address.

We do not run advertising, we do not sell personal data, and we do not build profiles about you for third parties.

3. Why we process it (legal bases)#

• To provide the service (performance of a contract) — running your account, syncing your training data across web and mobile, showing plans and sessions to you and, where you connect with a coach or organization, to the people you train with.
• To keep Treinamos secure (legitimate interest) — rate limiting, fraud and abuse prevention, audit logs for administrator actions, and error monitoring.
• To answer you (legitimate interest / contract) — replying to support and account questions.
• To meet legal obligations (legal obligation) — accounting and tax records for paid subscriptions.
• Consent — only for optional processing we ask you about explicitly. There is none today: Treinamos sets no analytics or tracking cookies (see section 5).

4. Payments#

Paid subscriptions are sold by Paddle, which acts as the merchant of record for sales of Treinamos subscriptions — Paddle is the legal seller and handles payment, invoicing, and tax. When billing is active, your payment relationship is with Paddle: they process your card and billing details, and we never see or store your card number. We only receive the minimum needed to run your account — for example which tier you subscribed to and whether the subscription is active. Paddle is bound by its own privacy terms, which apply to the payment data it processes.

5. Cookies and site statistics#

Treinamos uses only essential cookies — the sign-in session cookies that keep you logged in. We set no analytics, advertising, or cross-site tracking cookies, on the website or in the apps.

We do use Vercel Web Analytics and Vercel Speed Insights for this website: cookieless, aggregated usage statistics (page views and performance timings). They place no cookies, do not follow you across sites, and do not identify you. If we ever want measurement that stores anything on your device, it will be gated behind an explicit consent prompt that is denied by default.

6. Where your data lives and who processes it#

The Treinamos service itself — the application backend, the database, authentication, and file storage (including form-check videos) — runs on server infrastructure we operate ourselves, located in Portugal. The database, authentication, and file-storage software is the open-source Supabase stack, self-hosted by us: the Supabase cloud company never holds or processes your data.

A short list of third-party providers helps us run the service, each under its own data-protection terms:

• Vercel — hosts this website and serves the cookieless statistics described above.
• Brevo (Brevo SAS, France) — delivers our transactional email (password resets and account emails), sent from a sender domain we have authenticated with them.
• Google (Firebase Cloud Messaging) — delivers push notifications to the mobile apps. We send it the device push token needed to reach your device.
• OpenRouter — powers administrator-run AI quality checks on exercise-library content. Requests sent to it contain exercise content (names, categories, descriptions), not your personal data.
• Sentry — error monitoring (crash reports with request context).
• Cloudflare — DNS and the encrypted network path that carries traffic to our servers, plus encrypted off-site storage for our backups. Backup data is encrypted before it leaves our servers, so Cloudflare stores only ciphertext. Cloudflare Email Routing also forwards messages sent to our support address to the mailbox described next.
• Proton (Proton AG, Switzerland) — hosts the mailbox where messages to our support address arrive.
• Paddle — the subscription merchant of record described in section 4, once billing is live.

Inside Treinamos, access to your data is limited by role and workspace, and is enforced in the application’s authorization layer — every request is checked before any database query runs. See our Security page for detail.

7. How long we keep data#

• Account and training data — for as long as your account exists. When you delete your account, your data is removed from the service and the files you uploaded (such as form-check videos) are deleted from storage. Encrypted backup copies roll off automatically on their normal schedule — at most about twelve months later.
• Security and audit logs — up to 12 months. An automated job deletes anything older, every day.
• Billing records — for the period required by Portuguese tax and accounting law.
• Support messages — for as long as needed to resolve your request, plus a short follow-up window.

8. Your rights#

Under the GDPR you can ask us to access, correct, delete, restrict, or export your personal data, and you can object to processing based on legitimate interest. Most of this is self-service, directly in the app:

• Export — download a complete, machine-readable copy of the personal data we hold about you (profile, preferences, training history, health metrics, bookings, billing, and references to your files) as a JSON file, from Account settings.
• Deletion — delete your account from Account settings. This removes your data from the service, including the files you uploaded.
• Access and correction — your profile, settings, and training data can be viewed and edited in the app at any time.

For anything else, write to support@treinamos.com from the email address on your account. We answer within one month.

If you are in the EU/EEA and believe we mishandled your data, you can complain to your national data protection authority — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados).

9. Children#

Treinamos is intended for adults. We do not knowingly collect personal data from children; if you believe a child gave us data, contact us and we will delete it.

10. International transfers#

Your account, training, and health-adjacent data is stored on our own servers in Portugal, inside the European Economic Area. A few of the providers listed in section 6 — for example website hosting, push delivery, and error monitoring — operate from or use data centers outside the EEA. Where that happens, transfers rely on the safeguards the GDPR provides — for example the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses — and we choose regions closest to our users where the service allows it.

11. Changes to this policy#

If we change this policy materially, we will announce it in the app and update the date at the top of this page. The version online is always the one that applies.

12. Contact#

Questions about privacy: support@treinamos.com (Pedro, Leiria, Portugal).