Recordings only upload when the “Upload Recordings to Server” toggle is on. If it is off, recordings remain on your device.
Privacy by control, not opacity
How Coach Yu handles your training data.
Coach Yu is an Olympic weightlifting trainer app. This policy explains what we collect, what stays on your device, when video leaves your device, and how to exercise your UK GDPR rights.
Heart rate, Apple Watch sensor data, Apple Health data, and app preference toggles are processed locally and are not sent to our servers.
Firebase Analytics is not initialised until you consent. It excludes personal identifiers, workout content, video, health, and credential data.
Section 01
Who we are
Coach Yu is an Olympic weightlifting trainer app developed and operated by Lewis Mills and Pui Kwan Yu.
Lewis Mills and Pui Kwan Yu are joint data controllers for personal data collected through Coach Yu. If you have any questions about how we handle your data, contact privacy@coach-yu.com.
ICO Registration: Registration pending — to be completed prior to public launch.
Section 02
What data we collect and why
Account data
When you create a Coach Yu account, we collect your display name and email address.
Your email address is used solely to create and identify your passkey credential in iCloud Keychain. It is not used for marketing, newsletters, or outbound communications, and is not visible to you within the app. Your account is anchored to an anonymous UUID generated by Coach Yu. This identifier is meaningless outside our systems and cannot be used to identify you elsewhere.
Physical profile data
During sign up and ongoing use, we collect height, weight, gender, date of birth, one-rep maximums for key lifts, and baseline assessment results.
This data is stored on our servers to provide coaching, programming, and progress tracking features. It is linked to your anonymous UUID, not to your name or email address.
Training data
When you log training sessions, we collect session logs including sets, reps, weights, RPE, and training programme data. This data is stored on our servers and forms the core of your coaching history.
Video and AI analysis data
Video recording and upload is entirely under your control. It is governed by the “Upload Recordings to Server” toggle in your settings.
- When the toggle is on: training footage is uploaded to our servers for AI technique analysis. Both the raw footage and processed outputs are stored.
- When the toggle is off: video recordings remain on your device only and are never transmitted to our servers.
Video files are stored in Google Cloud Storage. Metadata associated with your videos, such as upload timestamps and session associations, is stored in our database.
Data that never leaves your device
Heart rate and heart rate recovery data
All Apple Watch sensor data
Apple Health data
App preference settings and toggles
The Early HR Recovery feature uses your heart rate to start a timer locally. No heart rate values are stored or transmitted.
Analytics data
We use Firebase Analytics to understand how users interact with the app and to diagnose issues. Analytics data is collected only with your consent.
Firebase Analytics may collect app opens, session starts, screen engagement time, app version, device model, OS version, country or region, language, onboarding progression, authentication events, profile settings interactions, and toggle state changes.
Analytics data does not include your name, email address, account identifier, date of birth, height, weight, gender, workout content, sets, reps, weights, video data, sensor data, Apple Health data, passkey credentials, or authentication tokens.
Section 03
Where your data is stored
All personal data processed by Coach Yu is stored within the European Economic Area.
| Data type | Storage system | Location |
|---|---|---|
| Account and profile data | Google Cloud Storage | Belgium, europe-west1 |
| Training and session data | Google Cloud Storage | Belgium, europe-west1 |
| Video recordings | Google Cloud Storage | Belgium, europe-west1 |
| Account metadata | MongoDB Atlas on GCP | Belgium, europe-west1 |
| Analytics data | Firebase / Google Analytics | Google infrastructure, EEA |
The United Kingdom has granted adequacy status to the European Union, meaning data stored in Belgium is treated equivalently to data stored in the United Kingdom for UK GDPR purposes. No additional transfer mechanisms are required.
Section 04
Our legal basis for processing
| Data or processing activity | Legal basis | Details |
|---|---|---|
| Account creation and management | Contract | Necessary to create and maintain your Coach Yu account. |
| Physical profile | Contract | Necessary to provide personalised coaching and programming. |
| Training and session data | Contract | Core service delivery: your training history and progress. |
| Video upload and AI analysis | Contract + consent | Contract for feature delivery; consent governs your upload toggle choice. |
| Firebase Analytics | Consent | Only collected after you opt in at first launch. |
| Anonymised retained data after account deletion | Legitimate interests | Improving coaching models; data is non-identifiable at this point. |
Section 05
Analytics and your consent
Firebase Analytics is not initialised until you actively opt in. When you first launch Coach Yu, you will be asked whether you agree to analytics being collected. You can change this preference at any time in your device settings or by contacting us.
If you decline analytics, no Firebase data is collected at any point during your use of the app. Declining analytics does not affect any coaching or training features.
Firebase Analytics is operated by Google LLC. Google acts as a data processor on our behalf. For more information on how Google handles analytics data, see Google’s Privacy Policy at policies.google.com/privacy.
Section 06
AI model training
Coach Yu’s coaching features are powered by AI models. To improve these models over time, we intend to use anonymised, non-identifiable training footage and session data.
- Not yet active. This feature is not currently active. We will update this policy before it becomes active.
- Anonymised only. Before any data is used for training, it is stripped of all identifiers and cannot be linked back to any individual user.
- No identifiable data. We will never use identifiable personal data to train AI models without your explicit consent.
- Two-year limit. Anonymised data retained for this purpose is held for a maximum of two years following account deletion, after which it is permanently deleted.
Section 07
Third-party data processors
We use the following third-party services to operate Coach Yu. Each acts as a data processor under UK GDPR, processing data only on our instructions.
| Processor | Purpose | Location |
|---|---|---|
| Google Cloud Storage | File and media storage | Belgium, EEA |
| MongoDB Atlas on GCP | Database storage | Belgium, EEA |
| Google Firebase Analytics | Consent-gated app analytics | EEA |
| Apple iCloud Keychain | Passkey credential storage | Apple infrastructure |
We do not sell your data to any third party. We do not share your data with advertisers. No advertising network has access to your Coach Yu data.
Section 08
Coach access
If you are enrolled with a Coach Yu coach, your coach has limited access to support your account. A coach may look up your account by display name or username to assist with account recovery and may trigger a passkey reset link if you have lost access to your device.
Your coach does not have access to your email address, training footage, session data, physical profile, or any other personal data beyond your display name and username.
Coaches who have access to any user data are bound by a Data Processing Agreement and are required to handle that data in accordance with UK GDPR.
Section 09
Passkey and account recovery
Coach Yu uses passkeys for authentication. Your passkey is stored in Apple iCloud Keychain on your device and is never transmitted to our servers.
If you lose access to your device and cannot sign in, your coach can trigger a recovery flow. This generates a secure link that allows you to register a new passkey, which is then associated with your existing account and data. No personal data is exposed during this process.
Section 10
How long we keep your data
| Data type | Retention period |
|---|---|
| Account and profile data | Held for the duration of your account. Deleted immediately on account deletion. |
| Training and session data | Held for the duration of your account. Deleted immediately on account deletion. |
| Video recordings and AI outputs | Held for the duration of your account. Deleted immediately on account deletion. |
| Email address | Deleted immediately on account deletion. |
| Analytics data | Governed by Google Firebase retention settings, with a maximum of 14 months. |
| Anonymised usage data after deletion | Retained for up to two years following account deletion, then permanently deleted. |
When you delete your account, all personally identifiable data is deleted immediately and irreversibly. There is no grace period or recovery window.
Section 11
Your rights under UK GDPR
As a UK resident, you have the following rights regarding your personal data:
- Right of access. You can request a copy of all personal data we hold about you.
- Right to rectification. You can request that we correct inaccurate or incomplete data. To update your email address, contact us directly.
- Right to erasure. You can delete your account at any time from within the app by going to Profile Settings, then Delete Account.
- Right to data portability. You can request an export of your personal data in a machine-readable format.
- Right to object. You can object to processing based on legitimate interests.
- Right to withdraw consent. Where processing is based on consent, including analytics and video upload, you can withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact privacy@coach-yu.com. We will respond within one calendar month.
Section 12
Deleting your account
You can delete your account at any time by navigating to Profile Settings, then Delete Account within the app. Account deletion:
- Permanently deletes all personally identifiable data immediately.
- Removes all training data, session logs, and profile information.
- Purges all video recordings and AI analysis outputs from our servers.
- Cannot be reversed. There is no recovery window.
Anonymised, non-identifiable data derived from your usage may be retained for up to two years following deletion for the purpose of improving coaching models, as described in Section 6.
Section 13
Children and age restrictions
Coach Yu is not intended for use by anyone under the age of 16. We enforce a minimum age of 16 during the sign-up process. If you believe a person under 16 has created an account, contact us and we will delete the account and associated data promptly.
Section 14
Security
We take the security of your data seriously. Our technical measures include:
- Passkey authentication: no passwords are stored anywhere.
- HTTPS/TLS: all data is transmitted over encrypted connections.
- Encryption at rest: data is protected via Google Cloud Storage server-side encryption.
- JWT revocation: account sessions use signed JWTs with versioned revocation, allowing us to invalidate all sessions instantly if required.
- No third-party identity data sharing: advertising networks and external identity providers do not receive Coach Yu account, training, video, or health data.
Section 15
Questions and complaints
If you have questions about this policy or want to exercise your rights, contact privacy@coach-yu.com.
If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Section 16
Changes to this policy
We may update this policy as Coach Yu changes. If we make material changes, especially around AI model training, analytics, video upload, or data retention, we will update this page before those changes become active.