Security
Last updated: 3 September 2026
Coaching means holding things about you that are nobody else's business: your weight, your injuries, your
photos, what you said to your coach on a bad week. This page says what we do to protect that, in the same
plain words we would use out loud. Anything on this page written in the present tense is running now.
Anything marked planned is decided and not switched on yet, and it stays marked that way
until it is.
The privacy policy covers what we collect and why. This page is about how it is
kept.
In transit
- Every page on this site and every request the training app makes is served over HTTPS. Plain HTTP is
redirected, never answered.
- Both send a strict transport header with a one-year life, covering subdomains, so a browser that has
visited once will refuse to talk to us over plain HTTP again even if a link tries.
- Card details go straight from your browser to Stripe. They never pass through our servers, so there is
nothing here for anyone to take.
At rest
- Your password is stored as an argon2id hash, never as text and never in anything readable. Nobody at
Train With Moe can look up what your password is, including Moe.
- Sign-in tokens, reset codes and confirmation links are stored hashed too, so a copy of the database
does not let anyone sign in as you.
- Backups are taken nightly and encrypted on the server before they leave it, using a key that is not
held on the server. They go to two separate providers. Daily copies are kept for 30 days off-site,
and one copy per calendar month is kept as a longer-term archive.
- Planned: point-in-time restore, so we can rewind the database to a specific minute
rather than to last night. The settings are in place and a restore has been rehearsed end to end.
Nothing is being recorded yet: that starts once the installer has been run and the database has had
its scheduled restart.
- Planned: written confirmation from the host that the disk under the training app
server is encrypted. We have not been able to prove that from our side, so we do not claim it.
Who can reach your data
- Every request to the training app proves who you are and what you own before it answers. A client can
only ever read their own rows, and a coach only their own clients. That rule is checked per request,
not once at sign-in, and it is covered by an automated test suite that has to pass before anything
ships.
- From this release, every time your coach opens your health data, that access is written to a log with
who looked, at whose record, and when. Those records survive even if the account is later deleted, so
the history of who looked cannot be erased by deleting the person.
- Session cookies are http-only and same-site, so a script on another site cannot read or send them.
- The coach's admin is behind a password plus an authenticator-app second factor, and with that second
factor on, a sign-in from a device we have not seen before has to be approved from a link emailed to
the account.
- Moe is the only person with access. There is no support team, no offshore contractor and no shared
login.
How long each kind of thing is kept
| What | How long |
|---|
| Anonymous browsing analytics, including IP and browser details | 13 months, then deleted automatically |
| Applications and lead details | While we are in contact, and deleted on request at any time |
| Unsuccessful applications | Deleted 12 months after they are declined |
| Client training records, check-ins, photos and messages | For the duration of coaching plus a reasonable period after |
| Purchase records | 6 years, because tax law requires it |
| WHOOP data | A rolling 90 days, and all of it the moment you disconnect WHOOP |
| Backups | 30 days of daily copies, plus one keeper per calendar month |
Who else touches it
The same list as the privacy policy, kept in one place there so the two can never disagree: Hostinger,
the training app host, Stripe, FITR, Zapier, Plausible, jsDelivr, Anthropic, Google Meet or Zoom, and (only
if you accept advertising cookies) Meta and Google. What each one sees is described under
who we share data with.
Deleting your data
- If you train on our app, you can delete your whole account from inside it. That removes your profile,
your training history, your check-ins, your photos and videos and your messages, and it cancels any
subscription still running.
- If you are on our email list, every email has a one-click unsubscribe, and you can ask us to erase
your record entirely.
- Either way, email hello@trainwithmoe.com and we will
confirm what has gone. We will also send you a copy of what we hold if you ask for one.
If something goes wrong
We have a written plan for a breach rather than an intention to write one. If personal data of ours is
exposed, we contain it first, work out exactly whose data and how much, and report it to the Information
Commissioner's Office within 72 hours of becoming aware, which is what the law requires. If
the breach is likely to put you at risk, we tell you directly and in plain words: what happened, what of
yours was involved, and what to do about it. We do not sit on that.
ICO registration: [number pending]
Found a problem?
If you have found a security problem on this site or in the app, email
hello@trainwithmoe.com with enough detail to reproduce it. You
will get a reply from a person, not a form. Please do not test against other people's accounts or data.
Changes
If something on this page changes in a way that matters, we update the page and the date at the top.