Privacy Policy

Trenamo is the coaching workspace at https://trenamo.com.

The operator, and the controller of your account and of the subscription you buy, is Raz Fridman, trading as Trenamo.

Write to support@trenamo.com.

They are not the same job.

For your account, your subscription, the security of the service and the records that keep it running, Raz Fridman, trading as Trenamo, is the controller.

For the coaching records in a workspace, you are the controller. That means clients, groups, sessions, attendance, packages and the payments you track. You decide why they are kept. Trenamo only processes them to provide the workspace you asked for: to store them, to show them to you and to let you export them. Trenamo does not write to your clients, and a client does not get an account.

Lemon Squeezy takes the subscription payment as merchant of record. The card payment is its responsibility, under its own terms.

Trenamo controls the following, because it is needed to run the account:

• Your email address, and a password stored by the sign-in service as a hash. If you use Google, the email Google confirms and the link to that Google account.
• Your display name, your language and whether the clock is 12-hour or 24-hour.
• The workspace name, its IANA time zone, its default currency, its default session length, the first day of its week and whether it is active.
• That you are the owner. There is no way to invite a second person.
• Subscription facts: the state, whether the trial is a founding trial or the ordinary one, the founding number when there is one, when the trial started and when it ends, paid-through, the end of any grace and whether it will stop at the end of the paid period. Identifiers that match a Lemon Squeezy subscription are stored for billing and are left out of your download.
• A cookie that keeps you signed in, and a language cookie that holds only a language code.
• A line recording that a download happened: the date and how many records, never the records themselves.

You type this. You are the controller. Trenamo processes it for you:

• Clients: a name, an optional phone number in international form, an optional email, optional notes and whether the client is active. Notes are plain text of at most 2000 characters.
• Groups: a name, whether the group is active, a default length and an optional WhatsApp invite link. The link is stored. It is not opened, and the chat is not read.
• Which clients are in a group, and when they joined or left.
• Package defaults, and the packages you give a client: a name, a number of sessions, an optional price in whole minor units with its currency, a start date, an optional end date, whether it covers private sessions, group sessions or both, and whether completing a session uses a credit.
• Repeating series and single sessions: private or group, the local date and time, the time zone, the length, the status and optional notes.
• Attendance of each client at a session, and which package credit moved.
• A ledger of those credits: a credit used, a credit given back and a correction.
• Amounts you record as owed, and the payments you record against them: the amount, the currency, an optional due date, the date paid and an optional note. This is your note. The client does not pay Trenamo, and a client's card is never stored.

There is no field for a date of birth, an age, a medical record, a photograph, a home address or an official identity number.

There is no account for a child. A client you add may still be a minor. You are the controller of that record and you need a lawful reason to keep it.

Notes are free text. The product cannot tell that a note holds health information or anything else sensitive. Do not put that in a note unless you have a reason that the law accepts.

For the data Trenamo controls:

• To open the account, to run the workspace and to provide the subscription you choose. That is the contract.
• To keep the service secure, to limit abuse and to record that a download happened without keeping the file. That is a legitimate interest. You can object. See Your rights.
• To keep the billing record the law requires.

For coaching data, you choose the reason: a contract with the client, a legitimate interest, or consent, including a parent's where the client is a child. Trenamo does not choose it.

These are the services that handle personal data for Trenamo. Hosting inside the EU is not, on its own, a statement that the law is met.

• Supabase, with this project's database in the EU, in Frankfurt (eu-central-1): the database and sign-in, including the message that confirms an email address and the message that resets a password.
• Vercel: hosts the application. A request can be handled on its network, which is not limited to one country.
• Lemon Squeezy, as merchant of record: the subscription charge. The card is typed on Lemon Squeezy's page. Trenamo does not store the card number. Lemon Squeezy has its own privacy notice.
• Resend: the service chosen for product email, such as a trial ending, a failed payment or a subscription ending. The application is not connected to it, so those messages are not sent.

• Meta: the Meta pixel measures ads. It loads only after marketing cookies are allowed, and only when a pixel id is configured. No event is sent before that choice. An early-access signup and an account signup store the campaign fields and any Meta click id from the first link opened in that browser session.

Left off this list on purpose:

• Google, and only if you choose Google sign-in. The button appears only when that option is on. Google then handles the sign-in under its own terms.
• WhatsApp, and the phone and email apps on your device. Opening them is your action. Trenamo does not message your clients and does not read those chats.
• GitHub holds the source code and synthetic test data, not a coach's workspace.
• Error monitoring is planned and is switched off. It is not a current subprocessor.

The database is in the European Union, in Frankfurt. That does not cover every provider.

Vercel, Lemon Squeezy and Resend can process outside the EU and the EEA, including in the United States. Supabase keeps this database in Frankfurt. The company, and the services it uses, may still access it under its contract.

Where a transfer needs a safeguard, the tool intended is the European Commission's standard contractual clauses, plus the region the provider really uses. This policy does not say those clauses are already signed for every provider.

Coaching records stay while the workspace is in use. Nothing expires on a timer during that use.

A download is built while you save it. No file is written on a server, nothing expires and there is no link another person could open. Trenamo keeps only the fact of the download, with the date and the number of records.

After the trial and the 7 days of full access that follow it, or after a paid period ends, the intention is that the workspace becomes read-only, that download stays available, and that unpaid data is kept for 90 days and then removed, with a notice 30 days before and another 7 days before. The removal job does not exist.

There is no button to delete one client, and no button to delete the workspace or the account.

Other periods, as designed, with no job deleting them yet:

• Receipts of a saved change (a hash and identifiers, no names) are meant to expire after 7 days.
• The download record is meant to be kept for 90 days.
• A billing event is stored as a fingerprint and a short list of identifiers and amounts, never the raw message. The plan is 30 days after it is handled, and up to 400 days for the fingerprint.
• A short billing history of identifiers and codes, with no names, is kept if a workspace is removed, as the minimum billing record.
• Server logs are meant to avoid personal data and to be kept for about 14 days. The host's real setting has to be confirmed.

The owner can download a ZIP from the privacy screen in settings. If the last sign-in was more than 15 minutes ago, the screen asks for a fresh sign-in first. Only that owner can do it.

The file holds the workspace, the membership, your profile preferences, the subscription state without payment-provider identifiers, clients, groups and memberships, package defaults, client packages, repeating series, sessions, attendance, package credits, tracked amounts, receipts and changes to those amounts.

It leaves out every other workspace, passwords, sign-in tokens, card numbers, payment-provider references and the internal records Trenamo keeps to run the service.

Inside the ZIP are one JSON document and one CSV for each kind of record, in UTF-8, plus a README that explains the columns. Signed-in pages, including this download, are sent with a cache header of private, no-store.

If you are in the EEA or the United Kingdom and Trenamo is the controller, you can ask to see the account data, to correct it, to erase it, to restrict it, to receive a copy you can move, and to object where the reason is a legitimate interest. You can also complain to a supervisory authority. That is usually the authority in the country where you live or work. Saying so is not a claim that every duty has already been assessed.

You can already download the workspace, as described above, and you can correct the workspace name, the time zone, the currency and your language in settings. Erasing the account is by email to the address under Contact, until a deletion screen exists.

A client, or a parent, who wants access or deletion of coaching records should ask the coach, who is the controller of that data. If a request reaches the address under Contact, Trenamo will pass it to the coach and will not keep a coaching copy the coach has asked to remove, apart from a billing record the law requires. There is no form in the product for a client's request. Even after deletion exists, a name typed into another person's note cannot be found reliably, so a promise to scrub every free-text mention would be false.

The account is for a coach. The product does not offer an account to a child and it does not ask for anyone's date of birth.

If you record a minor as a client, you are the controller. You need a lawful reason, which may have to come from a parent. Trenamo does not contact that minor.

Each workspace is kept apart from the others. Changes go through checked commands on the server. The browser does not write the tables directly. Passwords stay with the sign-in service. Card numbers stay with Lemon Squeezy. Signed-in responses are not put in a shared cache.

A material change will be posted on this page with a new date.

Email: support@trenamo.com

Website: https://trenamo.com