Privacy notice
Version 2026-11-01 · last updated 1 November 2026
Draft for review: to be checked by a solicitor before launch. Bracketed details are still to be completed.
Who we are
Abode Fitness is run by [legal business name], [company number], [registered address]. Contact: hello@abodefitness.co.uk. ICO registration number: [number].
The short version
- We keep the workouts, check-ins and health information you choose to log, including any progress photos you upload, so the app can track your training and progress.
- We only do that with your explicit consent, which you can withdraw at any time in Settings › Your data.
- Your health information and progress photos are not shown in Abode HQ (the screens our team uses to run the service), and HQ logins can't open them.
- If you're coached by a trainer on Abode, they can see and update your coaching records, and they decide how those are used.
- We don't sell your data, show adverts or use it to train AI.
Who is responsible for your information
- Training on your own (Personal accounts), and trainers' own training: Abode Fitness is the controller of your records.
- Coached by a trainer: your trainer (the person or business named when you joined them) is the controller of your coaching records: your plans, workouts, check-ins, body measurements, progress photos and their notes about you. Abode Fitness runs the app for them and processes those records on their behalf. Your trainer's own privacy notice explains how they use them; where they've added a link, you'll see it when you give consent.
- Your account, membership, payments, security and support: Abode Fitness is the controller, whoever you train with.
Who can use Abode Fitness
Adults aged 18 and over. We ask you to confirm this when you create an account. If we find an account belongs to someone younger, we'll close it and delete its information.
What we collect
- Your account: name, email, the type of account (Personal, Trainer or Client), your sign-in password, your profile photo if you add one, your app settings and units. Your password is never stored in readable form: we keep only a scrypt hash made with a unique random salt, which can't be turned back into the password.
- Your training and health information (special category data): the workouts and activities you plan and log (sets, reps, weights, times, distances, heart rate, effort, calories), daily and weekly check-ins (for example weight, sleep, energy, mood and anything your trainer asks), body measurements, targets (calories, protein, carbs, fats, steps, goal weight), illness, injury or holiday notes, your date of birth, height, and any injuries you tell us to work around.
- Progress photos you choose to upload. We only receive the photos you pick; the app can't see the rest of your photo library.
- If you're a trainer: your business name, logo, colours, title, bio, welcome message and video, first-week checklist, check-in questions, join code, and your clients' names and emails that you add.
- Membership and payments: your plan, its price, discounts, payment history and receipts, and references to your customer and subscription records at Stripe, our payment provider. Your card details go straight to Stripe and are never stored by us. [Live card payments aren't switched on yet.]
- If you cancel: the optional reason and comment you give us, and whether you took a one-off offer to stay.
- How you use the app: when you last signed in, and counts such as how many sessions a trainer's clients logged this week.
- If you contact us: what you send (help requests, the Talk to us form) and our replies.
- Security: your IP address is used briefly in memory to limit repeated sign-in attempts; we don't store it.
Your name, email and password are needed to have an account. Health information is optional, but the app's tracking can't work without it: if you don't give consent you can still manage your account, membership and data, but nothing new can be logged.
Why we use it, and our legal basis
| What for | Information | Legal basis |
|---|---|---|
| Running your account and the app you signed up for | Account details, settings | Contract (UK GDPR Article 6(1)(b)) |
| Storing your training and health records, showing them back to you, working out progress, trends, next-session suggestions and nutrition targets | Training and health information, progress photos | Contract (Article 6(1)(b)) and your explicit consent (Article 9(2)(a)) |
| Letting your trainer coach you (coached clients) | Your coaching records | Your trainer's basis, and your explicit consent naming them (Article 9(2)(a)); we process on their behalf |
| Membership and payments, including making sure nobody is charged for a plan they no longer have | Plan, payments, Stripe references | Contract; keeping payment records for tax and accounting law (legal obligation, Article 6(1)(c)) |
| Understanding why people cancel, to improve the service | Your optional cancellation reason and comment | Legitimate interests (Article 6(1)(f)); it's optional and you can ask us to delete it |
| Emails the service needs: confirming your email, password resets, trainer invitations | Name, email | Contract, or our and the trainer's legitimate interests in inviting you (Article 6(1)(f)) |
| Keeping the service secure, preventing misuse, backups so information isn't lost | Account details, sign-in records, backup copies | Legitimate interests (Article 6(1)(f)) |
| Helping trainers and running the business (HQ): account lists, plans, usage counts | Account details and counts only, never the content of health records | Legitimate interests (Article 6(1)(f)) |
| Answering help requests and enquiries | What you send us | Legitimate interests (Article 6(1)(f)) |
| Records of your consent and its withdrawal | Consent record | Legal obligation to be able to show consent (Article 6(1)(c)) |
| Marketing emails | Name, email | Only if you tick the optional box to receive them (PECR consent). We don't currently send marketing to customers on any other basis. |
Your consent for health information
- You give it by ticking a separate, unticked statement when you create your account, or on the screen the app shows you. It names who it's for: Abode Fitness, and your trainer if you're coached.
- We record when you gave it, how, the exact words you saw, and which version of this notice applied.
- We ask again if the purposes change, or if you join a different trainer.
- Withdrawing: Settings › Your data › Withdraw consent. Logging stops straight away and your training and health records (logged workouts, calendar, check-ins, measurements, targets and progress photos) are deleted. You can download a copy first. Your account, settings, templates and membership stay, so you can give consent again later and start afresh. Withdrawing doesn't affect what was done before.
Who can see your information
- You.
- Your trainer, if you're coached: your plans, logged workouts, check-ins, body measurements, targets, progress photos and progress, and the profile details you add (date of birth, height, goal, injuries and preferences). They can add and change entries. They can't see your password, your payments or your help requests.
- Abode HQ: the screens our team uses to run the service show account details (name, email, account type, plan, payments, when you last signed in, help requests) and counts. They don't show health records or progress photos, and HQ logins are blocked from opening them through the app or its web addresses. HQ can suspend or delete accounts, or delete training data, without seeing it.
- People who run the infrastructure: the data is stored on servers we control. A small number of authorised people at Abode Fitness with access to the hosting account can technically access the stored files and backups for maintenance, security and recovery. We keep that access to [named role(s)], use it only when needed, and don't look at health information or photos otherwise.
- Our service providers, only to provide their service: Railway (servers and storage for the app, photos and backups; location: [region]); Resend (sending account emails; location: [country]); Stripe (taking card payments, managing subscriptions, and emailing you about a failed payment or an expiring card; Stripe receives your name, email and an account reference, never your health information or progress photos). Stripe also keeps payment records as a controller in its own right, for fraud prevention and its legal duties, under Stripe's privacy policy.
- Nothing else is loaded from other companies while you use the app: fonts and icons are served by us, and there are no analytics, advertising or social media scripts.
- We don't sell your information or share it for advertising. We'd disclose it if the law requires it.
International transfers
[To complete once confirmed: where the hosting region and the email provider process data, and the safeguard used for any transfer outside the UK, for example the UK Extension to the EU–US Data Privacy Framework or the UK International Data Transfer Addendum.]
Joining, leaving or changing trainer
- When you join a trainer, we ask for your consent naming them before anything new is added to your records.
- When you leave (or switch), your old trainer loses access straight away. Your records stay in your account and become yours to manage; their private notes about you are removed from your account. Anything your old trainer already downloaded is their responsibility under their own privacy notice.
- If your trainer deletes you as a client, your client account and its records are deleted (a safety copy is kept for up to 30 days). [Decision pending: whether clients should keep their records as a Personal account instead.]
How long we keep it
- Account and records: while you have an account. Delete it (Settings › Login & security) and they're removed straight away, together with your help requests, cancellation answers, and our notes and tasks about your account; entries in our activity log no longer name you.
- Backups and safety copies: daily backups are kept 14 days and recent copies a few hours; a safety copy made before a deletion is kept 30 days. So deleted information is fully gone within 30 days.
- Unconfirmed sign-ups: removed when the confirmation link expires (24 hours). Invitations never accepted: removed 90 days after they expire.
- Payment records: kept for 7 years, as tax and accounting law requires, then deleted; when an account is deleted they no longer say who paid. When you delete your account we also delete your customer record at Stripe (Stripe keeps the payment records the law requires it to).
- Cancellation reasons and comments: 24 months, or until you delete your account.
- Records of what we sent to Stripe (for example, a cancelled subscription): 24 months, without your name.
- Help requests and enquiries: up to 24 months after they're closed. Our activity log: 24 months.
- Consent records: while you have an account.
Cookies and your device
- One essential cookie keeps you signed in (30 days). Abode HQ staff have a second, used only to return from a test account. No advertising or analytics cookies, so there's no cookie banner.
- The app saves your display choices and any half-typed drafts on your device. Drafts are cleared when you sign out or delete your account.
- When you pay or update your card you're on Stripe's own page, which uses its own essential cookies under Stripe's cookie policy.
Your rights
- See a copy of your information: Settings › Your data lets you download it (JSON or CSV), including your account, membership and payments, Stripe references, consent history, help requests and any cancellation answers. It also includes any notes our team keeps about your account. Progress photo files aren't in the download yet: ask us and we'll send them.
- Correct it, delete it (Settings › Login & security › Delete account), restrict or object to how it's used, or take it elsewhere (portability).
- Withdraw consent at any time (Settings › Your data).
- If you're coached, you can also ask your trainer, who is responsible for your coaching records.
- Email hello@abodefitness.co.uk. We'll reply within one month. If you're unhappy, tell us first and we'll acknowledge your complaint within 30 days; you can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Changes to this notice
We'll show the date and version at the top. If we make a material change, we'll tell you in the app before it applies, and ask for your consent again where it's needed.