This Privacy Policy describes how Coach Claw ("we," "us," "our") collects, uses, stores, and shares information when you use our service at app.coachclaw.fitness and the Coach Claw MCP server (collectively, the "Service").
By using the Service, you agree to this Policy.
Coach Claw is operated by [YOUR BUSINESS ENTITY]. Contact us at [CONTACT EMAIL].
When you connect a data provider like Garmin, we receive:
Garmin Connect does not offer public OAuth access to small developers. To sync your data, we authenticate to your Garmin account on your behalf using your Garmin email and password.
We store your Garmin password. It is encrypted at rest using industry-standard symmetric encryption (Fernet / AES-128 in CBC with HMAC). The encryption key is a server-side secret never exposed to client code. We use these credentials solely to authenticate to Garmin Connect on your behalf. They are stored only as long as the integration is active; when you disconnect Garmin or delete your account, the encrypted credentials are removed.
You should treat your Garmin password as compromised in the unlikely event of a security breach affecting us. We strongly recommend you use a unique password for Garmin Connect (i.e. not the same password as any other service) so that a breach here does not expose other accounts.
We deliberately do not solicit, and ask you not to submit:
If you submit prohibited information through the chat interface or coaching memory, we may delete it without notice.
We do not sell your personal information. We do not use your data to train third-party AI models.
Coach Claw's coaching analysis is powered by Claude, an AI assistant operated by Anthropic. To generate analysis, we send relevant portions of your training and health data to Anthropic's API.
You should understand:
We share information with the third-party providers we rely on to run the Service. Each is bound by its own privacy practices:
| Provider | What they receive | Why |
|---|---|---|
| Clerk | Email, password (they store; we never see), session data | Authentication |
| Stripe | Payment card data (collected by Stripe directly), customer ID, subscription status | Billing |
| Anthropic | Training data summaries, coaching prompts, MCP tool inputs | AI inference |
| Garmin Connect | Your Garmin credentials (used to authenticate to your existing Garmin account) | Activity / health data sync |
| Railway | All Service data (Railway hosts our infrastructure) | Hosting |
| Tigris | GPX files, chart images, serialized blobs | Object storage |
We do not share your personal information with advertisers or marketers. We do not sell your data. We may disclose information when required by law (subpoena, court order, government investigation) or to protect rights, property, or safety.
We retain your data while your account is active and for a reasonable period after deletion to comply with legal obligations and resolve disputes.
Depending on where you live, you may have the following rights:
To exercise any of these rights, email us at [CONTACT EMAIL]. We will respond within 30 days.
If you are a California resident, you have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect, the right to delete it, and the right not to be discriminated against for exercising your rights. We do not sell personal information.
If you are in the EU or UK, you have rights under the GDPR including access, rectification, erasure, restriction, portability, and objection. Our lawful bases for processing are: contract (to provide the Service you've signed up for), legitimate interests (to improve and secure the Service), and consent (for any optional processing).
Coach Claw is operated from the United States. Data you submit will be transferred to and stored in the United States. We rely on standard safeguards for international data transfers.
No system is perfectly secure. If we become aware of a breach affecting your data, we will notify you and the relevant authorities as required by law.
The Service is not intended for and may not be used by anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us with personal information, contact us and we will delete it.
We use a minimal set of cookies necessary to operate the Service:
We do not use third-party advertising cookies or behavioral tracking.
We may update this Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice in the Service at least 30 days before the changes take effect. The "Last updated" date at the top of this policy will always reflect the most recent revision.
For questions or to exercise your privacy rights, email us at [CONTACT EMAIL].