Privacy Policy

Pinchblock is a two-sided coaching platform connecting fitness and sports coaches with athletes. For the purposes of the EU General Data Protection Regulation (GDPR), Pinchblock is the data controller for personal data processed through the platform. Coaches act as independent controllers for content they publish and any data they collect from athletes outside the platform.

• Account: email address, username, hashed password (or OAuth identifier if you sign in with Google).
• Profile: display name, bio, location, avatar image.
• Training data: plans you author or purchase, workouts, sets, reps, weights, and notes you log.
• Social: posts, likes, follows.
• Payments: Stripe customer and connected account identifiers, purchase amounts, and timestamps. Card and bank details are held by Stripe, never by Pinchblock.
• Technical: minimal server logs (IP address, user agent) for security and abuse prevention.

• Contract performance (Art. 6(1)(b)) — to run your account, deliver plans you enrol in, and process payments.
• Legitimate interest (Art. 6(1)(f)) — to keep the service secure, prevent abuse, and improve core features.
• Consent (Art. 6(1)(a)) — when you choose to use coach-reviewed draft plan generation or coaching suggestions.

Some features are draft and marked with a sparkle icon. When you generate a plan draft or a coach requests a coaching suggestion, we send the relevant plan context and (for suggestions) recent workout logs to our AI provider via the Lovable AI Gateway, which routes requests to Google or Anthropic language models. Outputs are stored on your account and are not used to train third-party models.

• Lovable Cloud — hosting, database, authentication, file storage.
• Stripe — payments, payouts, and Connect onboarding.
• Lovable AI Gateway (Google, Anthropic) — plan drafts and coaching suggestions.

We keep your data while your account is active. When you delete your account, we permanently erase your profile, posts, workout logs, social graph, and purchases within 30 days. Minimal server security logs may be retained for up to 90 days.

Under GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate data (edit in Settings).
• Export your data in a portable format (Settings → Your data → Download my data).
• Erase your account and all associated data (Settings → Danger zone → Delete my account).
• Object to or restrict processing.
• Lodge a complaint with your local supervisory authority.

We use only strictly-necessary cookies required to keep you signed in. We do not use tracking, analytics, or advertising cookies.

For any privacy request, email hello@pinchb.app. We respond within 30 days.