Privacy Policy

Last updated: 30 October 2026

This policy explains how Train With Moe ("we", "us") collects, uses and protects your personal data when you use trainwithmoe.com, apply for coaching, buy a training programme, or train with us. We are the data controller for the information described here. Contact: hello@trainwithmoe.com.

What we collect, and why

When	What	Why (lawful basis)
You browse the site	First-party analytics: pages viewed, time on page, how you arrived (e.g. from Instagram), a random visitor identifier, approximate device type, your IP address and browser type. With analytics accepted, we also count how many seconds each part of a page was on screen, with no record of what you typed or pressed. Advertising trackers only run if you accept them in the cookie banner; see the cookies section below.	Understanding what works on the site (consent, which you give or refuse in the cookie banner), and keeping the site secure (legitimate interests).
You arrive from one of our ads	The click identifier that Google or Meta adds to the ad link, stored with your visit so we can tell which ad brought you here.	Measuring which ads work (consent, given via the cookie banner). If you later buy a programme, we confirm the purchase to the ad platform as described in the cookies section.
You apply for coaching	Name, email, phone number, Instagram handle (optional), training goal, and what's holding you back.	Handling your application and replying to you (steps prior to a contract).
You tell us about injuries or health conditions	Any injury or health information you choose to share in the application or during coaching.	This is special category (health) data. We process it only with your explicit consent, given by ticking the consent box on the application form, and we use it solely to coach you safely. You can withdraw consent at any time by emailing us. Movement screens, the scores and notes your coach records when assessing how you move, are kept only with the explicit consent you give in our iPhone app. Withdrawing it there deletes them.
You book a call	Name, email, phone, chosen time, timezone, and where you want the call (Google Meet, Zoom or phone).	Running the call you asked for (contract), and sending confirmations and reminders.
You buy a programme or coaching	What you bought, when, and the amount. We never see or store your card details; payment is handled by Stripe or FITR, our payment and training-delivery providers, or by Apple when you subscribe in our iPhone app.	Fulfilling your purchase (contract) and accounting duties (legal obligation).
You're a client	Weekly check-ins, for 1:1 clients: weight (if you share it), sessions completed, and your notes.	Delivering the coaching you're paying for (contract). Health-related details are covered by the same explicit consent as above.
You train on our app	Account details, your programme, the sessions and sets you log, check-ins, progress photos and videos you upload, messages with your coach, nutrition entries, and any wearable or training data you choose to connect (see wearables and connected apps).	Delivering the coaching you're paying for (contract). Health-related information, including wearable data, is processed only with your explicit consent, which you can withdraw at any time by disconnecting the service or emailing us.
You sign up for free training or emails	Email address and name.	Sending what you signed up for (consent). Every email includes a one-click unsubscribe.

Our training app has its own privacy policy, at app.trainwithmoe.com/privacy, which covers the app in full, including subscriptions bought through the App Store.

Wearables and connected apps

Clients on our training app (app.trainwithmoe.com) can connect wearables and training services to feed their coaching. Every connection is optional, started by you from inside the app, and you can disconnect it yourself at any time. Most of these connections only read data into Train With Moe. Two also receive something: on an iPhone, if you allow it, the app saves each session you finish to Apple Health as a workout, and if you connect Garmin, we put the sessions your coach planned on your Garmin Connect calendar, as set out below. We never sell what these services send us. Only your coach sees it, with one exception: if you turn on the coach assistant, a readiness band worked out from your WHOOP recovery and sleep goes to Anthropic, as our app's privacy policy explains.

• WHOOP: if you connect your WHOOP, we read your daily recovery score, heart rate variability, resting heart rate and sleep performance, so you and your coach can see how recovered you are and shape training around it. With your approval on WHOOP's own screen, we also read the workouts you record on WHOOP (sport, date, duration, heart rate, WHOOP's strain measure, and distance and elevation where WHOOP recorded them) so a workout you did can be matched to a session your coach prescribed and marked complete, and to decide whether your coach's note for that session arrives. Where the same session is also on Strava, Strava's record is the one we use, and your coach's note is never decided from Strava. This is health data, and we process it only with the explicit consent you give on WHOOP's own connect screen; if you connected WHOOP before workout reading existed, nothing changes until you reconnect and approve it. We keep a rolling 90 days of WHOOP data; older days are deleted automatically, and the record that you completed a prescribed session stays part of your training history like any other logged session. Disconnecting deletes everything we hold from WHOOP immediately and revokes our access with WHOOP. How WHOOP itself handles your data is described in WHOOP's privacy policy.
• Strava: if you connect Strava, we read your cardio activities (name, sport, start time, duration, distance, elevation, average and maximum heart rate, and the device that recorded it, never routes or location) so the training you did shows against the plan your coach set. We keep your activities while you stay connected; the record that you completed a prescribed session stays part of your training history like any other logged session. Disconnecting stops the syncing, removes our access straight away and deletes everything we hold from Strava. Strava may monitor and collect data about how our app uses its service, and use it for its own business purposes.
• Garmin: if you connect Garmin Connect, you sign in on Garmin's own page, so we never see your Garmin password. Before that, our app shows you what we will read and what we will send, and asks you to agree. We send the sessions your coach planned to your Garmin Connect calendar, so you can follow them on your watch. Each one carries its name, sport and date, and its steps: the exercise or interval, the reps, time or distance, and any target, such as a pace, power or heart rate, which can be worked out from your own benchmarks, such as your FTP. Nothing else of yours goes with them. Once a session is in Garmin Connect, it is Garmin's own copy. Garmin may keep it and use it for its own purposes under the Garmin Connect privacy notice, and we cannot delete it for you. You can remove it from your Garmin Connect calendar yourself. Garmin also sends us a summary of each activity you record. We keep only the sport, start time, duration, distance, elevation, average and maximum heart rate, and the Garmin device that recorded it, never routes or location, so a session you did can be matched to one your coach prescribed and marked complete, to show how each went against the plan and show any note your coach left for it, and to show your coach a prompt, for example a run that was not on your plan. If the same session also reaches us from Strava or WHOOP, Garmin's record is the one we use. Garmin also sends us a daily summary of your health data. We keep only your sleep, resting heart rate, stress level and Body Battery, and drop the rest, such as steps and calories, the moment it arrives, so you and your coach can see how recovered you are and shape training around it. This is health data, and we process it only with the explicit consent you give in our app when you connect Garmin. Nothing from Garmin, and nothing worked out from it, is ever sent to an AI service or used to train one, including the coach assistant in our app. We keep your Garmin activities while you stay connected and a rolling 90 days of sleep and recovery data; older days are deleted automatically, and the record that you completed a prescribed session stays part of your training history like any other logged session. Disconnecting in our app, or in Garmin Connect once Garmin tells us, stops the sending and the syncing, ends our access with Garmin and deletes everything we hold from Garmin.
• Apple Health: if you enable it on your iPhone, the app sends us daily readings only: weight, steps, sleep, exercise minutes, resting heart rate and heart rate variability. You control exactly what is shared in your phone's Health settings, and you can turn it off there at any time.

Wearable data follows the same rights as everything else in this policy: you can ask for a copy of what we hold or have it deleted at any time, and deleting your account removes all of it.

A note your coach writes for a session can reach you the evening before it, or once it is marked Complete.

Cookies and analytics

We use a small number of cookies and similar storage, and nothing non-essential loads unless you accept the cookie banner:

• Analytics identifier (first-party): a random ID that lets us see how visits flow through the site. It is not linked to your name unless you later apply or sign up.
• Plausible (page-view counting): loads on every page, before and regardless of the cookie banner. It sets no cookies, stores nothing on your device and builds no profile of you, which is why it is outside the banner's scope. It counts the page, where the visit came from and a rough device type, and nothing that identifies you. We rely on legitimate interests for it, and you can object by emailing us.
• Advertising measurement (Meta Pixel): if we are running ads and you accept the banner, Meta's pixel loads and tells Meta which of our pages you visited and whether you signed up or applied, so our ads can be measured and shown to people they're relevant to. Meta acts on this data as described in Meta's privacy policy. Choosing "Essential only" means the pixel never loads and nothing is shared with Meta.
• Advertising measurement (Google): if we are running Google ads and you accept the banner, Google's tag loads so Google can measure which searches and ads lead to applications. Google acts on this data as described in Google's privacy policy. Choosing "Essential only" means the tag never loads.
• Consent choice: remembers your cookie banner decision.

If you accepted advertising cookies, we also confirm a sign-up or a purchase on this website to the ad platform directly from our server, so it can match it to the ad you clicked. We go by the choice your browser had made the last time you gave us your email address or started a checkout, so if you later choose "Essential only" and sign up again, nothing more is confirmed. That confirmation can include your email address (in scrambled, unreadable form), the ad click identifier, and the IP address and browser type recorded on your visit. It never includes your card details. A subscription bought in our iPhone app is never reported to an ad platform.

We never sell your data, and nothing beyond the advertising measurement described above is shared with advertisers. Anonymous browsing data, including IP addresses and browser details, is deleted automatically after 13 months.

Who we share data with

Only the services needed to run the business, under their own data protection commitments:

• Hostinger: hosts the website and database.
• The training app host (a virtual private server rented from Hostinger): runs app.trainwithmoe.com and holds your training and health data, including check-ins, progress photos and videos, messages with your coach, and any wearable data you connect.
• Backup storage: our nightly backups, encrypted before they leave the app host, are copied to a second server rented from Hostinger in the UK and to Backblaze's storage in the Netherlands. Neither can read them.
• Stripe: processes card payments. Stripe is in the United States: see transfers outside the UK.
• Apple: takes the payment when you subscribe to a programme in our iPhone app. We never see your card details. Apple sends us signed notices of each renewal, failed payment, refund and cancellation so your plan stays in step, and refunds are asked for from Apple.
• Garmin: only if you connect Garmin Connect in our training app. Garmin sends us the activities and recovery data described under wearables and connected apps, and we send Garmin the sessions your coach planned, so they appear on your Garmin Connect calendar and your watch. Garmin is a separate company and holds what we send under its own privacy notice, and may use it for its own purposes. Garmin's service for apps like ours is run from the United States: see transfers outside the UK.
• FITR: delivers your training programme and app access after purchase.
• Zapier: carries the notice that a FITR sale happened from FITR to us, so your purchase reaches your record. It sees your name, email and what you bought, never card details.
• Plausible: counts page views on every page of this site. Cookieless, and it receives no name, email or identifier of yours.
• jsDelivr: serves the international phone-number field on the application form. Your browser fetches that file directly, so the request carries your IP address and browser type to jsDelivr. Nothing you type in the form is sent there.
• Anthropic: an AI company in the United States. It powers AI drafting and summaries inside the coach's own admin, for example drafting a reply for Moe to edit. When Moe asks for a draft reply to you, Anthropic receives what the draft is written from, which can include your name and email address, the email conversation with you (up to its last 8,000 characters), what you have bought, calls you have booked, the subjects of emails we have sent you, and Moe's own notes about you. Your application answers about injuries, and about what is holding you back, are left out by default. This goes to the United States under Anthropic's data processing terms: see transfers outside the UK.
• Google Meet / Zoom: hosts your intro call if you choose a video call.
• Meta: only if you accept advertising cookies in the banner, and only the ad-measurement signals described in the cookies section above.
• Google: only if you accept advertising cookies in the banner, and only the ad-measurement signals described in the cookies section above.

We never sell your data. We disclose it beyond the above only if the law requires it.

Transfers outside the UK

Our own servers are in the UK. These services are in the United States, so using them sends some of your data there:

• Anthropic: AI drafting in the coach's admin, as described above, and the coach assistant in our training app if you turn it on.
• Apple: payment for a subscription bought in our iPhone app, and notifications to an iPhone.
• Garmin: the sessions we send to your Garmin Connect calendar, if you connect Garmin in our training app.
• Google: Google Meet calls, and Google's advertising tag if you accept it.
• Zoom: video calls, if you choose Zoom.
• Stripe: card payments.
• Zapier: the notice that a FITR sale happened.

Each one is made under that company's data processing terms, relying on the UK-US data bridge where the company is certified under it, and otherwise on the standard contractual clauses with the UK's addendum. Email hello@trainwithmoe.com for a copy of the safeguard for any of them.

How long we keep it

• Anonymous browsing analytics: deleted after 13 months. IP addresses and browser details are removed after 13 months for everyone, including clients.
• Applications and lead details: kept while we're in contact; deleted on request at any time.
• Unsuccessful applications: deleted 12 months after they are declined, and the lead record is anonymised at the same time unless you are also a client.
• Client records: for the duration of coaching plus a reasonable period afterwards, and as long as tax law requires for purchase records (6 years).
• WHOOP data: a rolling 90 days, with older days deleted automatically, and all of it deleted the moment you disconnect WHOOP. Copies inside our encrypted backups are cleared within 30 days, and WHOOP data is never kept in the monthly archive.
• Strava activities: kept while you stay connected, and all of them deleted the moment you disconnect Strava. The record that you completed a prescribed session stays part of your training history. Copies inside our encrypted backups are cleared within 30 days, and Strava data is never kept in the monthly archive.
• Garmin data: activities kept while you stay connected, sleep and recovery data for a rolling 90 days with older days deleted automatically, and all of it deleted the moment you disconnect Garmin in our app, or as soon as Garmin tells us you disconnected in Garmin Connect. The record that you completed a prescribed session stays part of your training history. Copies inside our encrypted backups are cleared within 30 days, and Garmin data is never kept in the monthly archive. Sessions we sent to Garmin are Garmin's own copy, held under Garmin's privacy notice, and we cannot delete them for you.
• Backups: taken nightly, encrypted on the server before they leave it with a key that is not kept on the server, and copied to the two places named under who we share data with. Daily copies are kept for 30 days, and one copy per calendar month is kept as a longer-term archive that holds nothing from WHOOP, Strava or Garmin.

Your rights

Under UK data protection law you can ask us at any time to:

• Access the personal data we hold about you;
• Correct anything inaccurate;
• Delete your data ("right to be forgotten");
• Receive a copy of your data in a portable format;
• Object to or restrict how we use it;
• Withdraw consent, including for health information and marketing emails, at any time, without affecting anything done before you withdrew it.

Email hello@trainwithmoe.com and we'll respond within one month. If you train on our app you can also delete your whole account from inside it, which removes your training history, photos, videos and messages.

Complaints

If something we have done with your data is wrong, tell us first: email hello@trainwithmoe.com with what happened and we will look into it and reply within one month. Putting it right ourselves is faster for everybody.

If you are not happy with our answer, or you would rather not come to us at all, you have the right to complain to the Information Commissioner's Office. They take complaints at ico.org.uk/make-a-complaint or on 0303 123 1113. Going to them costs you nothing and does not stop you also raising it with us.

ICO registration: [number pending]

Security

The site runs over HTTPS everywhere. Access to your data is protected by two-factor authentication, and role-based permissions limit what any team member can see. Card details never touch our servers. Every time your coach opens your health data, that access is recorded.

The full detail, in plain words, is on our security page: how data is protected in transit and at rest, who can reach it, how long each kind is kept, and what we do if something goes wrong.

Changes

If this policy changes in a way that matters, we'll update this page and the date at the top.