In short
SBR is a coaching platform connecting trainers and athletes. We collect the account,
coaching, and — where you choose to connect a device — fitness/health data needed to run that
coaching relationship. We do not sell your personal data, and we do not use your health data
for advertising.
This Privacy Policy explains how SBR ("SBR," "we," "us") collects, uses,
shares, and protects information across our website (shapedbyreps.com and admin.shapedbyreps.com),
our SBR Coach mobile app, and our SBR Athlete mobile app (together, the
"Services"). By using the Services, you agree to the practices described here.
1. Who this applies to
SBR has three kinds of accounts:
Athletes, who use the SBR Athlete mobile app to follow programs, log workouts, and optionally connect a health/fitness data source.
Trainers/coaches, who use shapedbyreps.com and the SBR Coach mobile app to build programs and manage the athletes who have accepted them.
Administrators, who manage the platform's master content library at admin.shapedbyreps.com.
An athlete–trainer relationship on SBR is opt-in on both sides: an athlete must accept a trainer's coaching (or request one) before that trainer can see any of the athlete's data.
2. Information we collect
Account information
Name, email address, phone number, date of birth, gender, and (for trainers) profile photo, bio, and location/specialties.
Login credentials — passwords are stored as salted, one-way hashes; we never store your password in plain text.
Coaching and training content
Workout programs, assigned exercises, logged sets/reps/weights, results, and progress photos you choose to upload.
Messages, voice notes, and check-in forms exchanged between an athlete and their trainer(s).
Feedback you submit to us through the in-app Feedback feature.
Health and fitness data (only if you connect a device)
In the SBR Athlete app, you may optionally connect one or more health/fitness sources.
We only receive data from a source after you explicitly grant permission, and you can
disconnect any source at any time from Settings → App integrations.
Source
Data types
Apple Health (HealthKit)
Steps, distance, heart rate, HRV, sleep, workouts — read on-device with your explicit HealthKit permission.
Android Health Connect
Steps, heart rate, sleep — read on-device with your permission.
Google Health, WHOOP
Heart rate, HRV, sleep stages, recovery/readiness scores, and related metrics — retrieved via each provider's own OAuth authorization, only after you sign in to that provider and approve access.
We use this data solely to show your training and recovery trends to you and to the trainer(s)
you are actively working with. We do not sell, rent, or use this health data for advertising.
Usage and device information
App version, device type/OS, and general usage events (e.g., which screens are opened) collected via Google Analytics for Firebase, used to understand feature usage and fix problems — not to build an advertising profile.
Standard technical logs (IP address, timestamps) generated by our cloud infrastructure for security and reliability.
3. How we use your information
To operate the coaching relationship: showing athlete progress to their accepted trainer(s), and enabling programs, messaging, and check-ins.
To maintain your account, authenticate you, and provide customer support.
To improve the Services — fixing bugs, understanding which features are used, and building new ones.
To communicate with you about your account, service changes, or (if you've opted in) product updates.
To detect, prevent, and address fraud, abuse, or security issues.
4. Who can see your information
SBR's access model is built around one rule: a relationship is private to its two parties.
An athlete's data is visible to that athlete and to the trainer(s) they have actively accepted — up to three at a time. A trainer cannot see which other trainers an athlete works with.
A pending coaching request does not grant any data access — a trainer only sees an athlete's data after the athlete accepts.
SBR administrators can access account and platform data as needed to operate, secure, and support the Services, and to review the shared exercise/program library.
We do not sell your personal information to third parties, and we do not share it with advertisers.
5. Service providers we use
We use the following categories of service providers to operate SBR. Each only receives the data needed to perform its function, under contractual confidentiality and security obligations:
Google Cloud / Firebase — hosting, authentication, database (Firestore), file storage, and backend functions.
Google Analytics for Firebase — aggregated, privacy-respecting product usage analytics.
Wearable/health platforms you connect (Apple Health, Google Health, WHOOP) — only the specific provider(s) you choose to authorize, and only for the data types you approve.
6. Payments
SBR does not process in-app purchases. Any future billing will be handled through
a web-based checkout outside the mobile apps, consistent with Apple's and Google's guidelines.
At this time, no payment information is collected by SBR.
7. Data retention
We retain account and coaching data for as long as your account is active, so that your
training history remains available to you and to trainers you're working with. If you close
your account, we retain the minimum data needed for legal, security, or dispute-resolution
purposes, and delete or anonymize the rest within a reasonable period.
8. Your choices and rights
Access & correction — you can review and edit most of your profile information directly in the app under Settings.
Disconnecting a health source — turn off any connected device at any time from Settings → App integrations; this stops future data collection from that source.
Deleting your account — contact us at the email below to request deletion of your account and associated personal data, subject to the retention exceptions in Section 7.
Coaches — you may end a coaching relationship with an athlete (or an athlete with you) at any time from the app, which stops further data sharing between you.
Depending on where you live, you may have additional rights under laws such as the CCPA/CPRA (California) or GDPR (EEA/UK) — including the right to request a copy of your data or object to certain processing. Contact us to exercise these rights.
9. Children's privacy
SBR is not directed to children under 13, and we do not knowingly collect personal
information from children under 13. If you believe a child has provided us with personal
information, please contact us and we will delete it.
10. Security
We use industry-standard safeguards — encrypted connections, hashed passwords, and access
controls enforced both in our backend logic and in our database security rules — to protect
your information. No method of transmission or storage is 100% secure, and we cannot guarantee
absolute security.
11. International users
SBR's infrastructure is hosted in the United States. If you use the Services from
outside the United States, your information will be transferred to and processed in the
United States.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we'll
update the effective date above and, where appropriate, notify you in the app.
