Privacy Policy

We collect the following categories of data when you use BarMetrics:

Account Information

When you register, we collect your name, email address, and password (stored in hashed form). Coaches may also provide a timezone preference. Athletes may be invited via email by their coach. Athletes may also provide profile details used for coaching and competition planning: date of birth, gender, height, body weight, phone number, and location (country, state, city, ZIP code).

Training Data

This includes training blocks, session structures, exercise prescriptions, set logs (prescribed and actual weights, reps, RPE), movement records, and personal records (PRs). Coaches create programming data; athletes generate performance and logging data. If nutrition logging is enabled, athletes may log daily macronutrients (protein, carbohydrates, fat) and body weight entries, which are visible to their coach. For athletes competing in meets, we store meet registrations (federation, division, weight class, weigh-in weight), attempt plans, and meet-day details such as venue, flight, and schedule.

Readiness and Feedback Data

Athletes may submit pre-session check-ins that include self-reported scores for sleep quality, soreness, hydration, nutrition, and stress levels. Post-session feedback, including difficulty, soreness, and energy ratings, may also be collected.

Forms, Check-Ins, and Comments

Coaches may send athletes questionnaires (intake forms and recurring check-in forms) whose questions are written by the coach; athlete answers are free text and may include whatever information the athlete chooses to share, including health-related information. Responses may be automatically evaluated against coach-configured rules to flag answers for the coach's attention. Coaches and athletes can also exchange per-session comments, which are stored so both parties can view the discussion history.

Payment Information

Subscription payments are processed through Stripe. BarMetrics does not store your full credit card number, CVV, or other sensitive payment details. Stripe handles payment data in accordance with PCI-DSS standards. We store Stripe identifiers (customer, subscription, and payment references), subscription status, and billing period information. We also receive event notifications from Stripe (such as invoice and payment events) and retain their contents for up to 90 days for reconciliation and support, after which the detailed contents are deleted. For coaches who accept payments from athletes through BarMetrics (see Coach Payments below), we store the coach's Stripe Connect account identifiers and payout-readiness status.

Device and Usage Data

We collect basic technical information necessary to operate the Service, including browser type, device type, and session timestamps. If you enable push notifications, we store a push subscription endpoint for your device.

The BarMetrics mobile app stores your training data locally on your device (in an on-device SQLite database) so it works offline, and synchronizes that data with our servers when connectivity is available.

We use the data we collect for the following purposes:

• Service delivery: To provide, maintain, and operate the BarMetrics platform, including displaying training programs, tracking performance, calculating analytics, and enabling coach-athlete communication.
• Notifications: To send in-app notifications (such as new PR alerts, variance alerts, and coach notes) and push notifications (such as session reminders) when you have opted in.
• Billing: To process subscription payments, manage plan changes, and communicate about billing-related matters.
• Service improvement: To understand usage patterns through anonymized, aggregated data, identify issues, and develop new features.
• Account security: To authenticate your identity, protect against unauthorized access, and detect fraudulent activity.
• Communication: To send transactional emails related to your account, such as password resets, email confirmations, and athlete invitation links.
• Analytics: To understand how the web platform is used via Google Analytics, only when you consent through the cookie banner.

BarMetrics does not sell your personal data. We share data only in the following limited circumstances:

• Coach-athlete relationship: Coaches can view their athletes' training data, session logs, readiness scores, and performance records. Athletes can view training programs assigned to them by their coach.
• Stripe: Payment information is shared with Stripe to process subscriptions and manage billing. Stripe's privacy policy governs their handling of your payment data. Stripe also powers payments from athletes to their coaches (Stripe Connect): when an athlete pays a coach through BarMetrics, payment is processed on the coach's connected Stripe account, and coaches complete Stripe's onboarding (including identity verification) directly with Stripe.
• Discord: If a coach connects a Discord server and an athlete links their Discord account, we store the athlete's Discord user ID and username and post training updates — such as the athlete's name and new personal records — to the configured Discord channels. Discord's privacy policy governs data on their platform. Athletes choose whether to link Discord and can unlink at any time.
• Google: Push notifications to the mobile app are delivered through Google Firebase Cloud Messaging, and notification content (such as titles that may include names or training details) passes through that service. The mobile app also uses Google Firebase Analytics as described below. Web pages load fonts from Google Fonts, which means your IP address and browser information are sent to Google when a page loads.
• Mailgun: Transactional email (confirmations, password resets, invitations) is delivered through Mailgun, which processes recipient email addresses for that purpose.
• Push notification services: If you enable push notifications, your device's push subscription endpoint is used to deliver notifications through standard web push protocols (VAPID-authenticated).
• Legal requirements: We may disclose data if required by law, subpoena, or court order, or to protect the rights, safety, or property of BarMetrics, our users, or the public.

The BarMetrics mobile app uses Google Firebase Analytics to collect usage data — screens viewed and app events, including details of completed sessions and logged personal records (movement, weight, and reps) — and a device-scoped app-instance identifier. This data helps us understand how the app is used and improve it. It is not used for advertising, and we do not sell it. Firebase's handling of this data is described in Google's privacy documentation. You can disable analytics in the app under Profile → Settings. The web platform uses Google Analytics 4 to understand usage of the app. Analytics runs only if you accept the cookie banner; declining (or ignoring) it keeps analytics storage disabled. We do not use advertising trackers, and we do not sell your data.

We retain your data for as long as your account is active and as needed to provide the Service. Specifically:

• Active accounts: All data is retained while your account remains active.
• Deleted accounts: When you delete your account, personal data is permanently removed within 30 days. Billing records may be retained for up to 7 years as required for tax and legal compliance. You can initiate account deletion directly in the BarMetrics mobile app (Profile → Delete Account), which follows the same 30-day completion window.
• Deactivated athletes: When a coach deactivates an athlete or an athlete leaves a coach, the athlete retains access to their own training logs and performance data. The coaching relationship data is archived but not deleted.
• Anonymized data: Aggregated, anonymized data from which individuals cannot be identified may be retained indefinitely for service improvement.

You can request account deletion, including without the app, on our Delete Your Account page.

BarMetrics uses cookies and local storage for the following purposes:

• Session cookies: We use essential session cookies to authenticate your identity and maintain your login state. These cookies are required for the Service to function and cannot be disabled.
• CSRF tokens: We use tokens to protect against cross-site request forgery attacks.
• Analytics cookies (optional): With your consent via the cookie banner, Google Analytics sets cookies to help us understand usage. Your choice is stored in your browser's local storage and can be changed by clearing site data.
• IndexedDB (offline storage): If you use BarMetrics as a progressive web app (PWA), session data may be cached locally in IndexedDB to enable offline training functionality. This data is stored only on your device and is synchronized with our servers when connectivity is restored.

We do not use advertising cookies. Analytics cookies are set only with your consent.

You have the following rights regarding your data:

• Access: You can view all data associated with your account through the BarMetrics dashboard at any time.
• Export: You may request a copy of your data in a portable format by contacting us.
• Correction: You can update your account information at any time through your profile settings.
• Deletion: You can request deletion of your account and associated data by contacting us. Deletion will be completed within 30 days, subject to legal retention requirements.
• Opt out of notifications: You can disable push notifications at any time through your browser or device settings. In the mobile app you can also turn off usage analytics in Profile → Settings.

To exercise any of these rights, contact us at support@barmetrics.app.

If you are located in the European Economic Area (EEA), the United Kingdom, or another jurisdiction with data protection laws, you may have additional rights under the General Data Protection Regulation (GDPR) or similar legislation. These include:

• Legal basis for processing: We process your data based on contractual necessity (to provide the Service), legitimate interests (to improve and secure the Service), and your consent (for optional features like push notifications).
• Right to restriction: You may request that we restrict the processing of your data under certain circumstances.
• Right to object: You may object to certain types of data processing based on legitimate interests.
• Data portability: You may request your data in a structured, commonly used, machine-readable format.
• Supervisory authority: You have the right to lodge a complaint with your local data protection authority.

BarMetrics's servers are located in the United States. If you use the Service from outside the US, your data will be transferred to and processed in the US. By using the Service, you consent to this transfer.

We take the security of your data seriously. Measures we employ include:

• Passwords are hashed using bcrypt before storage
• All data in transit is encrypted via HTTPS/TLS
• Authentication tokens (JWT) are used for session management
• Payment data is handled by Stripe in PCI-DSS compliant infrastructure
• Push notifications use VAPID authentication for secure delivery

While we implement reasonable security measures, no method of transmission or storage is 100% secure. We cannot guarantee absolute security but will promptly notify affected users in the event of a data breach.

BarMetrics is not intended for children under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected data from a child under 16 without parental consent, we will take steps to delete that data promptly. If you believe a child under 16 has provided us with personal data, please contact us at support@barmetrics.app.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you via email or through an in-app notification at least 14 days before the changes take effect. We encourage you to review this policy periodically. Your continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

If you have questions or concerns about this Privacy Policy or how we handle your data, please contact EARS, LLC at support@barmetrics.app.