Privacy policy.

We collect only what we need to coach you well, run our business, and stay safe and legal.

Account information

• Your name and email address.
• A password hash. We never store your password in readable form.
• Your time zone and preferred session times.

Training profile

• Your height, weight, and age.
• Your training history, fitness goals, and self-disclosed health information you choose to share with your coach.
• Notes your coach writes after each session, plus the program they build for you.

Billing

• Your subscription tier, billing cycle, and payment status.
• Stripe handles your card details on our behalf. We never see your full card number.

Session recordings

• We record video and audio of every coaching session. Recording is on by default, with your written consent at signup and a verbal confirmation at the start of each session.
• Recordings include only what is in frame and on mic during your scheduled session window. We do not record outside that window.

Behavioral and device data

• Pages you visit, buttons you click, and features you use, captured by PostHog for product analytics.
• Your IP address, browser, operating system, and device type, used for security and fraud prevention.

When you contact us

• Emails you send to any of our addresses, kept as support history.
• If you choose to message us on WhatsApp, that conversation happens on WhatsApp's platform under WhatsApp's own terms and privacy policy. Nothing is shared with WhatsApp unless you start the chat yourself.

Each kind of data has a specific purpose. We do not collect data for vague "future use".

• To deliver coaching: pairing you with a coach, running live sessions, programming for next week, and reviewing your form between sessions.
• To run the business: billing, fraud prevention, customer support, and complying with tax and accounting law.
• To keep you and our coaches safe: reviewing recordings if a safeguarding concern is raised, by you or by us.
• To improve the product: aggregated analytics on which features get used. We do not target ads. We do not sell or share your data with advertisers.

What we will not do

• We do not train AI models on your sessions, your coach notes, or your training profile.
• We do not use your health or fitness data for marketing.
• We do not sell your data to anyone.
• We do not share your sessions, profile, or recordings with social platforms.

Recording every session is the part of our service that touches your privacy most directly. We are deliberately specific about how it works.

Why we record

• Your coach reviews recordings between sessions to refine your program and catch form issues you both moved past in real time.
• If a safeguarding concern is raised, by you or by Bespoke Fit, our safety team can review the relevant recording.

Who can see your recordings

• Your coach can view recordings of sessions they coached. Coaches cannot view other members' recordings.
• Recordings are for internal coaching and safety use only and are not made available to members for playback.
• Our safety team can view a recording only when a documented safeguarding review is open. Every such access is logged.
• No one else inside Bespoke Fit accesses recordings, and no third party receives them.

How long we keep recordings

• Raw recordings are deleted automatically 90 days after the session.
• Coach notes (text, not video) are kept for the life of your subscription plus 12 months.
• If a safeguarding incident is documented, the relevant recording is preserved for the period required by the legal-claims window in your jurisdiction, then deleted.

Withdrawing consent

You can withdraw consent to recording at any time. Because live coaching depends on recording for safety review and program iteration, withdrawing consent ends your active subscription. You can request that all of your recordings be deleted on your way out.

Your coach is most likely based in the Philippines. To coach you, they view your live session and may temporarily store your recording on their work device. The Philippines does not have an EU adequacy decision, so we use the EU Standard Contractual Clauses and the UK International Data Transfer Addendum with each coach's contracting entity, plus a transfer impact assessment.

You can request a copy of the SCCs and IDTA we use by writing to privacy@bespoke.fit.

We delete data when its purpose ends. The table below summarizes the retention period for each category.

Depending on where you live, you have the rights below. We honor every request, regardless of where you live.

If you are in the EU, UK, or EEA

• Access: ask for a copy of the data we hold about you.
• Rectification: ask us to correct anything wrong.
• Erasure: ask us to delete your data, subject to legal retention duties.
• Portability: get your data in a machine-readable format.
• Restriction and objection: ask us to pause or stop a specific use.
• Withdraw consent: at any time, with no effect on processing that happened before.
• Lodge a complaint with your local data protection authority. Norway's authority is Datatilsynet.

If you are in California

• Right to know: what we collect, why, and who we share it with.
• Right to delete: with limited legal retention exceptions.
• Right to correct: anything inaccurate.
• Right to opt out of sale or sharing: we do not sell or share your data, so there is nothing to opt out of, but you have the right to be told that.
• Right to non-discrimination: exercising any of these rights does not change your service, your price, or your coach.

To exercise any of these rights, write to privacy@bespoke.fit. We respond within 30 days.

• Data in transit is encrypted with TLS 1.2 or newer.
• Data at rest is encrypted with AES-256.
• Access to recordings and notes is role-based: coaches only see their own sessions, the safety team only on documented review, no one else.
• Every safety-team access is logged and audited monthly.
• If you find a security issue, write to security@bespoke.fit. We thank every responsible disclosure.

• We set first-party cookies for login, session, and basic preferences.
• We use PostHog for product analytics. PostHog is configured to mask any input fields and to keep events on our own subdomain.
• We do not use advertising cookies and do not share data with ad networks.

Bespoke Fit is for adults aged 18 or older. We do not knowingly collect data on anyone under 18. If you believe a minor has signed up, write to privacy@bespoke.fit and we will delete the account.

If we change this policy in a way that meaningfully affects your rights or how we use your data, we will email you at least 30 days before the change takes effect. The current version is always at bespoke.fit/privacy with the last-updated date at the top.