Privacy Policy

This Privacy Policy explains how Composite Athlete, a brand owned and operated by Harvey Brands LLC(“we,” “us,” or “our”) collects, uses, shares, and protects information when you use our website, applications, and services (the “Platform”). By using the Platform you agree to this Policy. It should be read alongside our Terms & Conditions.

1. Information we collect

• Account information - your name, email address, and a securely hashed password.
• Health & fitness information you provide - onboarding and check-in responses (goals, training history, a pre-participation health screen, injury/pain reports), body measurements, heart-rate zones, and your logged training and nutrition. This is sensitive information (see Section 3).
• Media you upload - progress photos, form-check videos, and any medical-clearance documents you choose to share.
• Messages - communications you send to a coach or to us through the Platform.
• Payment information - subscriptions are processed by Stripe. We do not collect or store your full card number; Stripe handles card data and shares only limited billing status with us.
• Usage & technical data - information such as IP address, device/browser, and activity on the Platform, used to operate and secure the service.
• Our iPhone and Android apps - when you sign in to the app we keep a sign-in record for that device (the platform, the app version and the device’s name). If you turn on notifications we keep the device’s push token, which Apple or Google issues so we can send notifications to that device. Signing out of the app deletes that device’s push token from our records.
• Apple Health and Health Connect - only if you allow it in the app. The app writes the sessions you complete to Apple Health (iPhone) or Health Connect (Android) as workouts, and, where you allow it, reads data such as your resting heart rate and workouts recorded by other apps to show alongside your training (see Section 3).
• Website analytics - we measure site traffic with a self-hosted, privacy-focused analytics tool (Umami) running on our own servers. It sets no cookies, collects aggregated and anonymized page/interaction data only, does not identify individual visitors, and shares nothing with third parties.
• Cookies - we use cookies that the Platform needs to work (for example, to keep you signed in), the referral cookies described below, and, on the workbook store and book pages only, the Meta Pixel cookies described in the next item. We do not use cookies for anonymous analytics.
• Waitlists - if you join the waitlist for a book that is not out yet, we keep your email address, your first name if you give it, which page you signed up on, the campaign details of the link you arrived from (such as utm codes or an ad click ID), the site that referred you, your browser details and when you signed up. We use them to email you when the book is available and to measure which pages and ads lead to sign-ups. We do not send other marketing to that address. To be removed from a waitlist, contact us (Section 12).
• Advertising measurement - our workbook store pages (/programs) and book pages (/books) use the Meta Pixel, and when you buy a workbook or join a book waitlist we send Meta a purchase or sign-up event from our server (the Meta Conversions API). This tells us which Facebook and Instagram ads lead to sales and sign-ups. Meta may set cookies on those pages and receive your IP address, browser details, the products you view or buy and their price, and a one-way hashed copy of your checkout or waitlist email. It is not used on the training app, coaching or health pages, and we never send Meta any health or fitness information. You can limit ad tracking in your Facebook and Instagram ad settings or by blocking third-party cookies in your browser.

Campaign codes. Campaign codes in a link may be kept in session storage for the current browser tab and attached to an account created in that tab. We use these codes to evaluate acquisition channels.

Referral cookies. When you arrive through a link from one of our partners (a link with ?ref= or ?via=, or a partner page at /with/) or from an affiliate network we work with (Awin), we set first-party cookies that record which partner or network link referred you and when you clicked it: ca_aff for our own partner program (kept for 60 days), ca_awc for Awin and ca_imreffor impact (each kept for that network’s referral window, 60 days unless we state otherwise). These cookies cannot be read by scripts on the page, and we use them only to credit the right partner when you buy. If you create an account while one is set, the referring partner is saved on your account, so a purchase within 60 days of the click, on any device, is still credited to them. You can delete these cookies in your browser at any time; doing so does not change your price.

We do not give referral partners access to your account, training, nutrition or health data. A partner sees that a sale they referred happened, its amount and its status, so they can be paid. These records are separate from anonymous website analytics.

2. How we use your information

• To provide the Platform - generate and adapt your training and nutrition programs, deliver sessions, and enable coach–athlete coaching.
• To connect athletes and coaches you have chosen to work with, subject to your consent (see Section 4).
• To operate safety features - for example, surfacing a pain or health flag to your coach and prompting you to seek professional care.
• To process payments and manage subscriptions (via Stripe).
• To communicate with you - account, session, and support emails.
• To secure, maintain, and improve the Platform and to comply with legal obligations.

3. Health & fitness data

The health and fitness information you provide is used to personalize your programming and to power conservative safety responses. It is not medical advice, diagnosis, or treatment (see our Terms). We restrict access to this data (Section 6), and coaches can see it only within the scope you consent to.

Apple Health and Health Connect data.Data the app reads from or writes to Apple Health or Health Connect is used only to provide the training features you turned on. We never use it for advertising or marketing, we never sell it, and we never send it to an AI provider (Section 5). You can change or withdraw the app’s access at any time in the Health app (iPhone) or in Health Connect settings (Android). Workouts the app has written stay in Apple Health or Health Connect until you remove them there, including after you delete your account.

4. How we share information

• With coaches - only after you request and consent to a coaching connection, and only within the sharing scope you set. You can revoke access, which ends the coach’s ability to see your data going forward.
• With service providers that operate the Platform on our behalf: Stripe (payments), Mailgun (transactional email), Meta (advertising measurement on the store and book pages - see Section 1), our AI providers, Anthropic and Moonshot AI (to generate and adapt programming and meal plans and to draft coach feedback, unless you choose not to allow it or turn it off on your Profile page - see Section 5), Apple and Google (to deliver app notifications to your device, and Apple for purchases made in the iPhone app), Tolt (our partner program platform: when a purchase is credited to a partner, we send Tolt the buyer’s email address, an account reference, the amount and product, and which partner is credited, so the partner can be paid; partners’ own details are covered in Section 10), Awin (an affiliate network: for one-time purchases we send Awin the order reference, amount, currency, any discount code and Awin’s own click reference, never your name or email address), and our hosting provider (Hetzner). These providers process data only to provide their service to us.
• For legal reasons - to comply with law, enforce our Terms, or protect the rights, safety, and property of our users or the Company.
• We do not sell your personal information.

5. AI processing

We use two AI providers to build and adapt personal training programs and meal plans, to update your PRs from the sessions you log, and to draft coach feedback. Unless you have turned this off, each receives the following:

• Moonshot AI (Kimi models) receives your training inputs (goals, sports, race date, training days, equipment, limits you tell us about, maxes and race times) and the sessions you log, to build your program and adjust it.
• Anthropic (Claude models) receives the sessions you log and your notes, to update your PRs and adapt upcoming sessions; your meal-plan inputs (body measurements, age, sex, goals, diet and allergies) for meal plans; and, if you work with a coach, your recent training for the coach's feedback drafts.

We ask for your permission in the app before your first use and on the website during onboarding. If you created your account before we added this question, we ask you once, the next time you sign in or visit while signed in; until you answer, AI processing stays on for your account as it was when you signed up. You can turn it off at any time on your Profile page (or in the app’s account settings). If you don’t allow it, or turn it off later, nothing of yours is sent to an AI provider: personal AI plans, adaptation, automatic PR updates and AI meal plans are off, and store programs, general programs and plans you already have keep working. Data from Apple Health or Health Connect is never sent to an AI provider. We do not use your data to train our own models, and we do not authorize either provider to train on it. AI-generated programming is educational and is not a substitute for professional medical or nutritional advice.

6. Data security

We host on a dedicated, firewalled server with a self-hosted database that enforces row-level securityand least-privilege access, so each account’s data is isolated at the database layer. Traffic is served over TLS/HTTPS, and backups are encrypted and stored off-site. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your information.

7. Data retention

We retain your information for as long as your account is active and as needed to provide the Platform, comply with our legal obligations, resolve disputes, and enforce our agreements. You can delete your account and associated personal data yourself at any time (see Section 8); some records may be retained where the law requires.

8. Your rights and choices

• Access, correct, or update much of your information from your account.
• Revoke a coaching connection to stop future sharing of your data with that coach.
• Withdraw your permission for AI processing at any time on your Profile page or in the app’s account settings (see Section 5).
• Request a copy of your personal data by contacting us (Section 12). Depending on where you live, you may have additional rights under applicable privacy laws.

Deleting your account. You can delete your account yourself: in the app under Account, Delete account, or on the website on your Profile page. You can also ask us to do it (Section 12). Deletion is permanent and removes your profile, programs, logged sessions, PRs, meal plans, photos and videos, messages, device sign-ins and push tokens. A Stripe subscription is canceled when you delete your account (payments already made are not refunded). We keep only what we need for accounting and to prevent abuse: order and payment records, a one-way hash of your email address (so a free trial is offered once per person), and records of any App Store purchases, which hold Apple’s purchase identifiers but not your name, email address or training data. We cannot cancel a subscription you pay for through Apple; cancel it in your Apple subscription settings.

9. Children’s privacy

The Platform is intended for adults. You must be 18 or older to create an account or use the Platform, on the web or in our mobile apps. We do not knowingly collect personal information from children under 13.

11. Changes to this Policy

We may update this Policy from time to time. We will post the updated version here and revise the “Effective Date” above. Your continued use of the Platform after changes take effect constitutes acceptance of the updated Policy.

12. Contact us

Questions about this Policy or your data? Email support@compositeathlete.com or write to us at 2425 Grand Pine Ln, Clemmons, NC 27012.