Your privacy.

Your privacy contact

For questions about how HybridHQ handles direct athlete account information, contact support@hybridhq.fit for privacy questions and requests. This notice covers the direct athlete app and its signup journey; separately contracted coaching-business services have their own contractual scope.

Your account and personalised information

We use your email, authentication information, preferences and support correspondence to provide and secure your account. The service is for adults aged 18 or over. Your optional records can include body measurements, goals, training availability, planned and completed workouts, food plans and portions, health-related logs, race results and reflections, messages and progress photos. We use the records you provide to save and display your plans and calculate the training, nutrition and progress summaries you request.

Why we use information

Providing your account and paid membership is necessary to perform our contract with you. We use billing records to fulfil accounting and legal obligations. We rely on legitimate interests in securing the service, preventing abuse, resolving support issues and understanding aggregate service usage; you can object to processing based on legitimate interests. Where body or training records reveal health information, we ask for your separate explicit consent to personalised processing. This consent is separate from contractual acceptance and marketing choices. You can explore the public demo without giving health information, and photographs are optional.

Consent and withdrawal

We record the consent statement version, your account, your choice and the server time. In Account → Privacy choices you can withdraw consent. The control explains that withdrawal permanently erases personal plans, meal plans, logs, health records, race journals and live photos and revokes coaching/partner access. Export anything you wish to keep first. Account sign-in, billing and a minimal consent audit remain. Withdrawal does not cancel a subscription; use Membership → Manage billing & cancellation or contact support. Withdrawal does not affect processing lawfully carried out before withdrawal. If photo cleanup fails, we tell you and provide a retry/support path.

Sharing you control

Coaches and partners use separate accounts. My team lets you grant and revoke access. Partners can see your name, training dates, blocks and workouts and edit your training plan. Coaches can additionally see profile settings, meals, logs, session summaries and race events, and edit nutrition targets and plans. Revocation stops subsequent shared-workspace access; it cannot remove copies another person has already saved outside the service. Independently engaged coaches may be responsible for their own use of information outside HybridHQ.

Food lookup and optional AI

Food search terms and packaged-food barcodes are sent to Open Food Facts. Barcode scanning decodes on your device; the lookup sends the barcode, not camera frames. When available and you explicitly select AI meal interpretation, your entered meal description is sent to OpenAI to identify meals and foods. The non-AI interpretation option remains available. Do not include unnecessary personal details. Check food matches, portions and calculations before saving. We do not promise that an AI provider retains no data.

Providers and international processing

We use Supabase for authentication, database and live photo storage; Vercel for hosting; Stripe for checkout, subscription and payment records; Resend for transactional email; Google Workspace for support correspondence; and Cloudflare R2 for encrypted photo backups in the EU. Payment card details are handled by Stripe. These providers may process information outside the UK, including in the EU and United States. Their applicable processing terms describe transfer mechanisms and subprocessors. Contact support for information about the safeguards relevant to your data.

Provider information: Supabase, Vercel, Stripe, Resend, Google Workspace, Cloudflare and OpenAI.

Retention, export and deletion

We keep your account records while needed to provide your account and the history you choose to retain. Subscription cancellation alone does not delete training history. Account controls provide export and deletion; photo metadata is in the export, while image files are downloaded separately. Deletion requires account verification and may require you to resolve an active subscription first. Health-consent withdrawal is separate and does not require ending billing first. Support records are retained as needed to resolve the request and associated disputes; billing and minimal audit records are retained where needed for legal obligations or establishing and defending claims.

Photo backups are encrypted and expire after 30 days. Deleted information can remain in protected historical backups until expiration and must not be reintroduced into active use during recovery. Database backups are managed separately. Exports, device-only copies and information someone else has independently saved are not erased by cloud deletion.

Your rights

You can request access, correction, erasure, restriction and portability where applicable, withdraw consent, and object to processing based on legitimate interests. We may need to verify your identity. We respond within the applicable legal time limit, normally one month, and will explain any lawful extension. Contact support@hybridhq.fit if an in-app control does not meet your needs. You can complain to the UK Information Commissioner’s Office.

Cookies, local storage and marketing

The athlete app uses authentication cookies and a currency-preference cookie lasting up to one year. A rest timer saves its deadline in the browser session. The offline cache holds a generic connection-help page, not your saved workouts or meals. Legacy device-only records remain in that browser until its site data is cleared; cloud deletion does not remove those copies. The workout editor keeps a recovery copy of your session edits and selected exercise on your device, scoped to your account, workout and date. It also attempts background saving to your account. Recovery copies are eligible for restoration for up to seven days; newer cloud changes take priority. Successful completion, signing out, account deletion or consent withdrawal clears workout recovery copies on the device where you take that action. Clear site data on other devices to remove their local copies. Storage restrictions or clearing browser data can make device recovery unavailable. Public demo changes reset on reload. Optional signup-source information helps us understand how people found HybridHQ and does not subscribe anyone to marketing email. Promotional email choices are separate from account and support messages.

Updates

This notice was updated on 10 September 2026. Material changes will be explained through the service or an appropriate account notice. If we need consent for a new purpose, we will ask before that use begins.