Privacy Policy

EVAD ("the app", "we") is a personalized athlete training app. This policy explains what data the app collects, how it is used, and your choices. We keep this short and accurate to what the app actually does.

Information you provide

• Account: your email address and password, used to create and secure your account. Authentication is handled by Supabase (our backend provider); we never store your password ourselves. You may instead sign in with Apple (Sign in with Apple), in which case Apple provides your name and an email address (or a private relay address) to create your account.
• Athlete profile: information you enter to personalize your training — name, sport, event/specialty, primary goal, target timeline, training days, equipment access, body weight, height, years training, personal records (PRs), and any injury notes.
• Training activity: workouts you log (exercises, sets, reps, loads), completed sessions, daily goals, supplements you track (name, dosage, timing, and notes), and journal entries (including mood and notes).

How your information is used

• To generate and display your personalized training program and daily focus goals.
• To track your progress, calendar, and history across the app.
• To keep you signed in and sync your data across your devices.

We do not sell your data, show third-party advertising, or use third-party analytics/tracking SDKs.

Product analytics

To understand how the app is used and improve it, we record first-party product-usage events — for example, which screen you're on and which features you interact with — in our own app_events table. These events are linked to your account (user ID) but never leave our own backend. We do not use a third-party analytics SDK, and we do not track you across other apps or websites. Athlete-entered values (profile fields, workout numbers, journal text) are not included in these events.

Crash and diagnostics

If the app crashes or hits an error, we collect a diagnostic report to help us fix it: the error message and stack trace, the screen you were on, the app version and build, and basic device information (platform, OS version, device model). These reports are linked to your account so we can reproduce the issue, and are stored in our own crash_reports table. We do not use a third-party crash-reporting SDK.

CREW — social features

CREW is EVAD's optional social layer, and it stays off until you claim a handle and accept the CREW community terms. Doing so creates a CREW profile — your handle, display name, bio, sport, and your Coach EVAD mascot loadout — which other athletes can find by searching your handle. Your athlete profile (PRs, body weight, age, injury notes) is stored separately and is never shown on CREW.

CREW is friends-only. Your account is private from the moment you claim a handle: a follow arrives as a request, and nothing you post is visible to anyone until you approve them. There is no public feed, no way to post to everyone, and no direct messages. Every post is either My Crew (the athletes you have approved) or Only me — those are the only two options, and our servers refuse a post published any wider. If you are under 16 you cannot turn the approval step off at all.

What you publish to CREW — posts and the workout/PR/streak card they render, captions, comments, likes, and your follower and following lists — is visible to the approved followers the post is addressed to. CREW carries no photos or other uploaded images: a post is a card generated from your own training data plus the text you write, and there is no way to attach a file to one. In Profile → CREW & Privacy you can change which of the two visibilities new posts default to, and turn off discoverability so your handle stops appearing in athlete search. Saves are private to you.

Safety signals. You can block another athlete, and you can report a post, comment, or profile. A report records who reported what, the reason you selected, and any note you add. Reporting a post or comment hides it from you straight away, and it stays hidden from you. It is hidden from everyone automatically once three different athletes whose accounts are at least a week old have reported it — a threshold that stops a couple of brand-new throwaway accounts from taking down someone else's post. Reports from newer accounts still reach us. We review reports ourselves so we can hide or remove content and act on accounts, and reporting a profile is always a manual call rather than an automatic one. Blocks and reports are not disclosed to the person you blocked or reported.

You can delete any post or comment you posted at any time. Deleting your account removes your CREW profile, posts, comments, likes, saves, and follows along with the rest of your data.

Website link analytics

Our website uses short attribution links of the form evadtraining.com/go/<channel>/<campaign> in social posts and ads. When you tap one, we redirect you to the site's home page and record one first-party click event: the channel and campaign tag from the link itself, the referring page address truncated to 200 characters, the two-letter country code Cloudflare's edge derives from the connection, and the browser user-agent string truncated to 128 characters (so we can filter out link-preview bots).

That event is written to Cloudflare Analytics Engine — the same infrastructure that already serves the site. It sets no cookie, stores no IP address, and is not linked to your EVAD account or to any other event. We use it only to count taps per channel. The website uses no third-party analytics or advertising trackers.

Data retention and deletion

We keep your data for as long as your account exists, so your program, history, and progress stay intact across your devices.

When you delete your account from Settings → Delete Account, the account itself is removed immediately: your login is destroyed, your records cascade out of our database, and the account cannot be signed in to or recovered. If you signed in with Apple, we also ask Apple to revoke the app's sign-in link — that step needs a quick Apple confirmation at delete time, and if you skip that prompt the link simply remains on Apple's side (you can remove it yourself in Settings → [your name] → Sign in with Apple).

Some of that work happens outside the database — sweeping any residual stored files, clearing rate-limit counters, and completing the Apple revocation — and any one of those steps can fail for reasons on a provider's side. Rather than report a partly finished deletion as done, we record the deletion as a durable job and retry the remaining steps automatically: the first retry is about 15 minutes later, and repeated failures back off to at most 8 hours between attempts. Most residual cleanup finishes within hours. If a step is still failing after 30 attempts we stop retrying and keep the record so a person can finish it by hand, rather than claim a cleanup that never happened. The Apple revocation is the one exception: its credential is single-use and short-lived, so we retry it only a handful of times, and if it still fails we record that outcome permanently instead of holding the credential — the sign-in link then stays removable on Apple's side as described above. Deletion is irreversible — we cannot restore an account or its data afterwards.

One kind of record can outlive your account. When our automatic content filter flags text you entered on your CREW profile — your handle, display name, bio, or sport — it stores a moderation record holding your account identifier and a short excerpt (up to 300 characters) of the flagged text. That record is not attached to a post, so the deletion cascade does not remove it; we keep it to act on repeat abuse and to meet our legal obligations, and it is never shown to other athletes. Flags on posts and comments are deleted along with the post or comment itself.

AI program generation

When you generate a training program or daily goals, the relevant parts of your athlete profile and recent training context are sent to Anthropic's Claude API to produce the program text. This request is routed through our own secure server (a Cloudflare Worker) and is gated by your signed-in session. We do not send your email, password, or journal entries for this purpose beyond the training context needed to build the program. Anthropic processes this data under its own terms and, for API usage, does not use it to train its models by default.

To stop one person from running up the cost of that service, our proxy admits each request against short-lived abuse counters. Those counters are keyed by a salted, truncated hash of the network address the request arrives from — we do not store the address itself — and they expire on their own after 2 hours and 48 hours. They are used for rate limiting only, never to profile or track you.

Where your data is stored

Your data is stored in a Supabase (PostgreSQL) database with row-level security, so your records are only accessible to your authenticated account. Data is transmitted over encrypted connections (HTTPS/TLS).

Data sharing

We share data only with the service providers that operate the app and site on our behalf:

• Supabase — authentication and database storage.
• Anthropic — AI generation of program/goal text, as described above.
• Cloudflare — the secure proxy that routes AI requests, the hosting and content delivery for our website, and the first-party click counts described under "Website link analytics".
• Apple — Sign in with Apple (if you use it), App Store purchases if we ever offer paid features, and revoking the Apple sign-in link when you delete your account.

Other than the providers named above, we do not share your data with any third parties — no advertisers, no data brokers, and no third-party analytics or tracking services. We do not sell your data.

Your choices and rights

• Access/update: you can view and edit your profile, goals, and metrics in the app's Settings.
• Export your data: you can download a copy of your account data as a .json file from Settings → Export My Data — your profile and training history, your CREW profile and content, your consent records, and the product-analytics events recorded about your use of the app. The file itself names what it deliberately leaves out.
• Control what CREW shows: your account is private by default and follow requests need your approval — athletes 16 and over can turn that approval step off, and under 16 it always stays on. You can also set each post's visibility (My Crew or Only me), change your default, approve or remove followers, turn off discoverability, block athletes, and delete any post or comment you posted — see "CREW — social features" above.
• Delete your account: you can permanently delete your account and all associated data — including your CREW content, your product-analytics events, and your crash/diagnostic reports — from Settings → Delete Account. The account is removed immediately and irreversibly; the residual cleanup described under "Data retention and deletion" continues automatically afterwards, and the one moderation-record exception is described there too.
• Questions or requests: contact us at the email below.

Children's privacy

EVAD is not directed to children under 13, and we do not knowingly collect personal information from them.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

Contact

For privacy questions or data requests, contact: evad.training.support@gmail.com