California Privacy Notice

We updated this notice on 17 August 2026 so that its lists of categories, sources, and disclosures match what we actually collect.

• Corrected — how wearable data reaches us, and that we store daily summaries of it on our servers.
• Added — ledger, fee, and retail records; referral attribution; survey responses.
• Added — employment records we hold about gym staff, including pay rate and geofenced clock-in location.
• Added — QuickBooks, where a gym has connected its own account. Financial records only; no health data.

This California Privacy Notice supplements our Privacy Policy and provides additional information for California residents under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

If you are a California resident, you have specific rights regarding your personal information described below.

In the past 12 months, we have collected the following categories of personal information:

• Identifiers: name, email address, account ID, IP address, device identifiers
• Customer records (Civ. Code §1798.80): billing information, payment method (handled by Stripe)
• Protected classifications: age, gender (only as voluntarily provided in your profile)
• Commercial information: subscription history, products and services viewed, session balances and member ledger entries, cancellation and no-show fees where a gym charges them and fees a gym waives, in-person retail purchases and returns, referral link attribution (views, clicks, sign-ups), satisfaction survey responses
• Internet/electronic activity: usage data, app interactions, feature engagement
• Geolocation data: approximate location from IP. Precise location is collected in two limited cases and only with the relevant permission: optional gym check-in, and — for gym staff whose employer has enabled a geofenced facility — the location captured at clock-in to verify attendance. We do not track location continuously in either case.
• Audio/electronic information: voice recordings (processed in real-time, not retained)
• Professional and employment information: trainer and staff credentials and certifications; for gym staff, the role, permissions, employment classification and pay rate entered by their employing gym, and time-clock entries including who recorded each entry
• Sensitive personal information: health and fitness data (including wearable daily summaries stored on our servers), biometric data, precise geolocation in the two cases described above, account credentials
• Inferences: AI-generated insights about your fitness preferences and progress, readiness and recovery scores, adaptive TDEE estimates

We collect personal information from the following sources:

• Directly from you: when you create an account, complete your profile, log workouts/nutrition, message your trainer
• Automatically: when you use our app (device info, usage patterns, IP address)
• From your devices: wearable data read on your own device from Apple HealthKit or Google Health Connect by the MyTrainerOS app, and — if you connect them directly with your authorization — from WHOOP or Oura. In each case the app then sends daily summary metrics to our servers, where they are stored. See our Health Data Privacy Policy for exactly what is and is not stored.
• From your trainer or gym: if you signed up via an invite, your gym may share your name and goals to set up your account. If you are a member of staff, your employing gym enters your role, permissions, classification, and pay rate.
• From service providers: Stripe (payment confirmations), Anthropic (AI processing logs), Deepgram (voice transcription)

We use personal information for the following business purposes:

• Providing fitness coaching services and AI-powered features
• Processing payments and managing subscriptions
• Detecting security incidents and protecting against fraud
• Debugging and repairing platform errors
• Internal research for technological development and improvement
• Quality control of our services
• Complying with legal obligations

We do not use personal information for cross-context behavioral advertising or sell personal information.

In the past 12 months, we have disclosed the following categories of personal information for business purposes:

• Identifiers and contact information → Stripe, Inc. (payment processing), Resend (transactional email), Firebase (hosting/analytics)
• Commercial information → Stripe, Inc. (subscription management)
• Internet/electronic activity → Firebase Analytics (with your consent), Sentry (error monitoring)
• Audio information → Deepgram, Inc. (real-time speech-to-text, not retained)
• Sensitive personal information (health data) → Anthropic, Inc. (AI coaching only with your explicit consent; not retained for training)

All third-party recipients are bound by data processing agreements limiting use to the specific service requested.

Disclosure Your Gym Initiates

Separately from the above, a gym may connect its own Intuit QuickBooks account. When it does, commercial information — that gym's sales, payments, fees, and refunds — is sent to that gym's QuickBooks account as accounting entries. No health or fitness data, and no sensitive personal information, is included. This sharing is initiated and controlled by the gym, not by us, and once the data reaches QuickBooks it is governed by the gym's own agreement with Intuit.

MyTrainerOS does not sell personal information.

MyTrainerOS does not share personal information for cross-context behavioral advertising.

We honor the Global Privacy Control (GPC) signal automatically. When detected, we treat it as a verifiable opt-out request from sale or sharing for all browsers, devices, and accounts associated with the GPC signal.

You may also submit an opt-out request manually via our Do Not Sell or Share My Personal Information page.

As a California resident, you have the following rights:

Right to Know

You can request that we disclose: the categories of personal information collected; specific pieces of personal information; sources from which it was collected; business purposes; and categories of third parties with whom it was shared.

Right to Delete

You can request that we delete personal information we have collected from you, subject to legal exemptions (e.g., financial records retained for tax compliance). Submit deletion requests via Settings > Privacy & Consent > Delete Account.

Right to Correct

You can request that we correct inaccurate personal information. Most profile fields are directly editable in Settings; for other fields, contact privacy@mytraineros.com.

Right to Opt Out of Sale/Sharing

You can opt out at any time via the Do Not Sell or Share page or by enabling Global Privacy Control in your browser. We honor GPC automatically.

Right to Limit Use of Sensitive Personal Information

You can direct us to use sensitive personal information (including health data) only for specified, limited purposes. Enable this restriction in Settings > Privacy & Consent > Limit Sensitive Personal Information.

Right to Data Portability

You can request a copy of your personal information in a machine-readable format. Submit export requests via Settings > Privacy & Consent > Export My Data.

Right to Non-Discrimination

We will not discriminate against you for exercising any of these rights. We will not deny goods or services, charge different prices, or provide a different level of service for users who exercise their privacy rights.

To submit a verifiable consumer request, you can:

• In the app: Navigate to Settings > Privacy & Consent
• By email: Send a request to privacy@mytraineros.com with the subject line "California Privacy Rights Request"
• Authorized agents: You may designate an authorized agent to make a request on your behalf. We will require written authorization signed by you and may verify the agent's authority.

We will respond to verifiable consumer requests within 45 days. If we need additional time (up to an additional 45 days), we will inform you of the reason and extension period.

We retain personal information only as long as necessary to provide our services and comply with legal obligations:

• Active accounts: retained while your account is active
• Health data: deleted within 30 days of account deletion or consent withdrawal
• Financial records: retained 7 years per IRS requirements (anonymized after account deletion)
• Consent records: retained 6 years per Washington MHMDA
• Audit logs: retained 3 years for compliance and security

The categories of personal information described in this notice are collected for the business purposes listed above. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not knowingly collect personal information from minors under 18.

For complete details, please review our Privacy Policy and Health Data Privacy Policy.

For California privacy inquiries:

• Email: privacy@mytraineros.com
• Subject line: "California Privacy Inquiry"
• Mail: MyTrainerOS Privacy Team, [Mailing Address Pending]

We will respond within 45 days.