Privacy Policy

1. Data controller and scope

The service provider and data controller for CoachStamp is Orçun Demir, a natural person who operates CoachStamp in his own name.

• Data controller: Orçun Demir
• Address: [ADDRESS — to be completed before publication]
• Email: destek@coachstamp.app
• Website: coachstamp.app

This policy covers the CoachStamp apps for iOS and Android, the coachstamp.app website (including the invitation and link pages) and related support.

This policy provides the information required, where applicable, by the KVKK, the EU General Data Protection Regulation (GDPR) and the UK GDPR. Reading this policy, or confirming in the app that you have read it, does not amount to consent; the processing in CoachStamp relies on the legal bases described below, none of which is consent.

2. KVKK information notice (summary)

This section summarises the information we provide under Article 10 KVKK and the Communiqué on the Procedures and Principles for Fulfilling the Obligation to Inform. The details are in the sections that follow.

• Identity of the data controller: Orçun Demir, [ADDRESS — to be completed before publication], destek@coachstamp.app.
• Categories of personal data: identity (name, display name), contact (email address), customer transactions (lessons, locations, packages, credits, the credit ledger, lesson confirmations, cancel and change requests, disputes and the notes written on them), transaction security (account and session identifiers, security records, IP address, the QR secret), financial (subscription and store transaction details, the price note a trainer adds to a package), device (push token and device information) and legal transactions (records of accepting the legal documents, requests and support correspondence). See section 3.
• Purposes: creating your account and authenticating you; running lesson planning, credit tracking, QR check-in, lesson confirmations, cancel and change requests, disputes, reminders and notifications; providing and verifying the trainer subscription; keeping the service secure and preventing abuse; answering support requests; recording acceptance of the legal documents, meeting legal obligations and protecting legal rights.
• Legal bases (Article 5(2) KVKK): processing directly related to the formation or performance of a contract (c), necessary to comply with a legal obligation (ç), necessary to establish, exercise or protect a right (e), and necessary for our legitimate interests provided that your fundamental rights and freedoms are not harmed (f). Section 4 sets out which basis applies to which purpose. We do not carry out processing based on explicit consent.
• Method of collection: your data is collected electronically and by automated means through the mobile apps and the website, from information you enter or that your trainer or student records, from Apple’s and Google’s sign-in and app store services, from the subscription infrastructure and from technical records created while the service runs; support correspondence is collected by email.
• Recipients and purposes of transfer: Supabase for hosting, the database and authentication; Apple and Google for sign-in, app stores, subscriptions and notification delivery; Adapty for subscription management and subscription and paywall statistics; Cloudflare for hosting the website and forwarding email; Google’s email service for receiving support email; competent public authorities where the law requires it; and legal advisers to protect legal rights. The trainer and the student in the same room see the records described in section 5. Some recipients are located abroad; international transfers are described in section 7.
• Your rights and how to apply: you can exercise your rights under Article 11 KVKK as described in section 10. Your application is concluded within thirty days at the latest.

3. Data we process and where it comes from

We receive data from you, from your trainer or your students through the records you share in CoachStamp, from Apple or Google when you sign in with them, from the App Store or Google Play through Adapty when you subscribe, and from technical records created while the service operates.

• Account and profile. Email address, sign-in method and its account identifier, CoachStamp user identifier, display name, language and notification preferences. CoachStamp has no password of its own: on iOS you sign in with Sign in with Apple or Sign in with Google, on Android with Sign in with Google; both are handled through Supabase Auth. With Apple, we receive your Apple account identifier, the email address Apple shares (a private relay address if you choose Hide My Email) and, on first sign-in, the name you let Apple share. With Google, we receive your Google account identifier, your email address and the name on your Google account; if your profile has no name, this name becomes your display name. We do not use your profile photo or save it to your profile; if the sign-in information Google sends contains a link to your profile photo, that link may technically be kept in Supabase Auth’s identity record, but the photo itself is not downloaded or stored. We do not access other data in your Google account, such as contacts, calendar or files.
• Roles and memberships. Whether you use CoachStamp as a trainer, as a student, or both. A trainer’s students form that trainer’s room. For each membership we store its status (waiting for approval, active, on hold or archived), the name shown in the room and the join date. Each trainer has an invite code and link; once a code is used for a join request it is replaced with a new one. A join request reaches the trainer, who approves or declines it.
• Trainer settings. Display name, time zone, working hours, default lesson length, the time of the evening reminder, the low-credit threshold, the late-cancellation window and whether a no-show uses a credit.
• Lessons and locations. Date, start and end time, time zone, status (draft, scheduled, completed, cancelled or no-show), how a completed lesson was confirmed (QR code, by hand, or an unplanned lesson), whether the week has been published, the trainer’s confirmation when lessons deliberately overlap, and changes made to a published lesson that have not been published yet. A trainer can define locations such as studio or gym names (a name of up to 60 characters), assign a location to each lesson and archive locations they no longer use.
• Lesson confirmations and change requests. A student can confirm upcoming lessons the trainer has published, one by one or all at once; we record when each lesson was confirmed. A student can ask for a lesson to be moved by proposing a different day and time, with an optional note of up to 200 characters. We store the proposed time, the note, the status (pending, accepted, declined, withdrawn or no longer valid), when the request was made and decided, and an optional note of up to 200 characters the trainer can add to the decision. If the trainer accepts, the lesson moves to the new time.
• Credits and the credit ledger. Packages (number of lessons, lessons remaining and an optional expiry date) and an optional short price note the trainer can add to a package. The price note is a record for the trainer only; students never see it and CoachStamp does not take payments between trainers and students. The ledger lists every change to a student’s credits (a package loaded, a lesson, a no-show, a late cancellation, an expiry, settling a negative balance or a correction) with its date and time, the lesson or package it belongs to, who made it and the balance afterwards. Ledger entries are never deleted or edited; a correction is added as a new, reverse entry.
• Cancel requests and disputes. A cancel request with an optional reason (a work conflict, travel, wanting another time, a personal matter, or other) and an optional note to the trainer of up to 200 characters, its status and the trainer’s decision with an optional note; and disputes a student raises about a ledger entry within 7 days, with a short note, together with the trainer’s decision.
• The QR secret. When a student joins a trainer, our server creates a secret key for that membership. It is stored on our server and on the student’s device: on iOS in a Keychain item bound to that device, on Android in the app’s private storage, encrypted with a key held in the Android Keystore. Only that student can retrieve it; the trainer cannot. The app uses it to create the QR code for a lesson, even without an internet connection. A code contains the identifiers of the trainer, the membership and the lesson, the time it was created, a random value and a signature; it does not contain your name or email address. When the trainer scans it, our server checks the signature and records the random value so that the code cannot be reused. The secret can be renewed; codes made with the old secret are then rejected.
• Subscription data (trainers). A random billing identifier we create for your account, App Store or Google Play product and transaction details, subscription status (trial, active, renewal, expiry, grace period, plan and its student limit) and subscription events we receive through Adapty. Apple and Google process payment details in their own systems; we do not receive card details. Students do not pay anything in CoachStamp.
• Records of accepting the legal documents. When you accept the Terms of Use and confirm that you have read this Privacy Policy and the KVKK information notice, we record the versions of the documents, the time, the platform (iOS or Android) and the app language.
• Notification data. The device push token (an Apple Push Notification service token on iOS, a Firebase Cloud Messaging token on Android), platform, delivery environment, your notification preferences, and the queue of reminders and notifications with their delivery state.
• Technical data. Sign-in and session events, request keys that make retries safe, limits on repeated attempts (for example entering invite codes), and limited error and security records. Internet services necessarily receive an IP address when a connection is made. If you have chosen on your Apple device to share analytics with app developers, or you use a TestFlight build, Apple gives us crash and performance reports; if you have chosen on your Android device to share usage and diagnostics, Google Play does the same. These reports describe the device model, operating-system and app versions and where the app stopped.
• Support correspondence. When you write to us: your email address, the content of your message and our reply.

4. Purposes and legal bases

We rely on the following legal bases. The KVKK provisions apply to processing in Türkiye; the GDPR provisions apply where the GDPR or UK GDPR applies.

• Providing the service. Creating an account and authenticating you; running rooms, lesson plans and locations, lesson confirmations, change and cancel requests, packages, the credit ledger, QR check-ins, disputes, reminders and notifications; providing the trainer subscription: formation and performance of the contract, Article 5(2)(c) KVKK and Article 6(1)(b) GDPR. These features cannot be provided without the necessary account and room data.
• Security and proper operation. Preventing unauthorized access and abuse (for example guessing invite codes or reusing QR codes), keeping the ledger consistent, making retries safe, verifying subscriptions, measuring how subscriptions and the trainer paywall perform (statistics from Adapty), keeping limited diagnostic records and providing support: our legitimate interest in operating the service securely, Article 5(2)(f) KVKK and Article 6(1)(f) GDPR, and performance of the contract where applicable. We take your interests and fundamental rights into account, and you may object to this processing.
• Records of accepting the legal documents. Being able to show which version you accepted and when, and meeting our accountability obligations: legal obligation and legitimate interests, Article 5(2)(ç) and (f) KVKK, Article 6(1)(c) and (f) GDPR.
• Legal obligations and legal claims. Records required by law, lawful requests from public authorities and answering your requests: Article 5(2)(ç) KVKK and Article 6(1)(c) GDPR. Limited records needed to establish, exercise or defend legal claims: Article 5(2)(e) KVKK and Article 6(1)(f) GDPR.
• Notifications. Notifications are sent when your device’s notification permission is on. Processing your push token and the notification content to send them is part of providing the reminder and notice features you use: Article 5(2)(c) KVKK and Article 6(1)(b) GDPR. You can turn the permission off in your device settings, and students can turn individual notification types off in the app, at any time; this does not delete lessons, credits or other records.

CoachStamp does not carry out any processing based on consent; we do not send marketing messages and we show no ads. If we ever add processing that requires consent, we will ask for it separately and it will be optional.

5. What your trainer and your students can see

A trainer sees everything in their own room: each student’s name and membership status, all lessons and their locations, including draft weeks and unpublished changes, students’ lesson confirmations, packages and price notes, the full credit ledger, cancel and change requests with their reasons and notes, and disputes.

A student sees the trainer’s name, their own membership, their own lessons in weeks the trainer has published and the location of those lessons, the location names the trainer has defined, their own packages and ledger entries in the same detail as the trainer (except the price note), and their own confirmations, cancel and change requests and disputes together with the trainer’s decision notes. Students cannot see other students or their data. If you have more than one trainer, each trainer sees only their own room.

Share your invite code and link only with people you want to teach; every join request needs your approval. Your trainer also uses the records in their room for their own work with you, such as their bookkeeping, and is responsible for having a lawful basis for the information they enter in their room; you can raise questions about that with your trainer as well as with us.

6. Service providers and other recipients

We do not sell personal data or share it for advertising. CoachStamp shows no ads and contains no third-party tracking SDKs or general-purpose analytics SDKs; the only statistics come from Adapty and are limited to subscriptions and the trainer paywall, as described below. The following recipients receive and process data only as needed to provide the service or meet legal obligations.

• Supabase. Authentication (Sign in with Apple and Sign in with Google), database hosting, server functions, realtime updates on trainers’ screens and the scheduled jobs that send reminders. CoachStamp’s project is hosted in the eu-central-1 region (Frankfurt, Germany). This does not mean that every support operation, log, backup or subprocessor activity remains in the same country.
• Adapty (trainer subscriptions). The Adapty SDK in the app sends Adapty the data needed to show the trainer paywall, to verify and keep track of a subscription, and to give us statistics about subscriptions and paywall views: the random billing identifier we create for your account (it is not your email address or your name; on Android it is also passed to Google Play as the obfuscated account identifier), your App Store or Google Play purchase and subscription details, your device’s developer-specific identifier (IDFV on iOS; Android ID and, where available, App Set ID on Android), device information (such as device model, operating-system version, app version, language, time zone and store country) and an event when the paywall is shown. We keep IP address collection and advertising identifier collection (IDFA or Android advertising ID) turned off in the SDK; your IP address still technically reaches Adapty when a connection is made. Our server receives subscription notifications from Adapty and asks Adapty for the current status of a billing identifier. Lessons, credits and other room data are not sent to Adapty. Adapty acts as our processor; see adapty.io/end-users-privacy.
• Apple. Sign in with Apple, App Store purchases and subscriptions, TestFlight and crash reports as described in section 3, and delivery of iOS notifications through the Apple Push Notification service (APNs), through which the notification text passes. Apple applies its own privacy terms to its services.
• Google. Sign in with Google, Google Play purchases and subscriptions, Google Play crash reports, and delivery of Android notifications through Firebase Cloud Messaging (FCM), through which the notification text passes; FCM uses a registration token and a Firebase installation identifier for the device. The app does not include Firebase Analytics or Crashlytics. Google applies its own privacy terms to its services.
• Cloudflare. Hosts coachstamp.app: the website, the invitation link pages (coachstamp.app/j/ followed by an invite code), the files that let those links open the app, and a small configuration file the app reads (for example the minimum supported version). Cloudflare receives your IP address and standard request information when you or the app load these pages. Email sent to destek@coachstamp.app also passes through Cloudflare’s email forwarding service.
• Support email. Email you send to destek@coachstamp.app is forwarded to and stored in our inbox on Google’s email service (Gmail). Send only information needed for support; do not send passwords, card details or identity documents.
• Public authorities and legal advisers. Only where necessary to comply with an applicable obligation or a lawful request, or to protect legal rights.

7. International transfers

Our database is hosted in the European Union (Frankfurt, Germany), but Apple, Google, Adapty and Cloudflare may process data outside the country where you live, including outside the European Economic Area and in the United States. For users in Türkiye, using CoachStamp means that personal data is transferred abroad and processed there. We do not promise that all data remains within the European Union.

The purpose of these transfers is to provide the services described in section 6. Transfers are made under one of the appropriate safeguards provided for in Article 9 KVKK and Chapter V GDPR (for example standard contractual clauses or an adequacy decision). You can ask us at destek@coachstamp.app for information about the relevant providers, processing locations and safeguards.

Confirming in the app that you have read this policy is not explicit consent to international transfers; the transfers do not rely on consent.

8. Device permissions, notifications and data on your device

The camera is used to scan QR codes: a trainer scans a student’s lesson code, and a student can scan a trainer’s invite code. The app reads the code from the camera image and sends only the code’s content to our server; camera images are not stored or uploaded. The app does not request access to your location, contacts, photos or microphone.

Notifications are optional. After you sign in, the app asks once for notification permission (on Android 13 and later as a system permission); if you decline, the app keeps working without notifications.

• Students can receive a reminder the evening before a lesson (in the trainer’s time zone, at 20:00 by default) and three hours before it (not sent if that falls within quiet hours, 23:00–07:00 by default), and notices when a week is published, a lesson is added, moved, cancelled, has its location changed or is completed by the trainer, a no-show or late cancellation is recorded, a package is loaded, a credit is returned, a cancel or change request is decided, a dispute is declined, a join request is approved, or the trainer deletes their account.
• Trainers can receive notices about join requests, cancel requests, change requests and disputes.

Our server writes these notifications and sends them through APNs on iOS and FCM on Android. Their text can include names, lesson times and locations, and details of a request (for example the reason for a cancellation, a proposed new time, or the note on a cancel or change request or on the trainer’s decision), and may appear on your lock screen. Students can turn each reminder type and plan-change notices off separately in Profile; anyone can turn notifications off in device settings. Everything a notification tells you is also shown in the app.

For use without a connection, the app keeps a copy of the data you need on your device (for trainers: recent weeks of lessons, students and balances; for students: their published lessons and balance). Calendar changes waiting to be sent, your appearance setting (light or dark) and other preferences are also kept on the device; the QR secret is stored as described in section 3. The Android app excludes its data from device backups. Signing out deletes the local copy and the waiting changes. Uninstalling the app does not delete your account or cancel a subscription.

9. Retention and deletion

We keep account and room data (including lessons, locations, lesson confirmations, cancel requests, packages, the credit ledger and disputes) for as long as your account and the room exist. Change requests that have been resolved (accepted, declined, withdrawn or no longer valid) are deleted 90 days after they were resolved. The credit ledger is append-only: its entries are not deleted or edited while the room exists, and mistakes are corrected with reverse entries, so that the trainer and the student always see the same history. Archiving a student frees a place within the trainer’s student limit and keeps that student’s history and balance.

Deleting a student account

In the app go to Profile → Delete account. The deletion takes effect immediately: your login account, email address, profile and push tokens are deleted; in each trainer’s room your name is replaced with “Deleted student”; the notes you wrote on cancel requests, change requests and disputes are deleted; and your upcoming scheduled lessons are cancelled. Your lesson and credit history stays in the trainer’s records without your identity, because it is the trainer’s business record, and your place within the trainer’s student limit is freed. Because the trainer may still recognise those entries, they are not always fully anonymous. Talk to your trainer about any remaining credits before you delete your account.

Deleting a trainer account

In the app go to Settings → Delete account. Your upcoming lessons are cancelled, your students are notified, and your room stays read-only for 30 days so that they can still see their remaining credits and history. After 30 days, all data of the room is deleted: memberships, lessons, locations, lesson confirmations, change and cancel requests, packages and price notes, the credit ledger and disputes. Deleting your account does not cancel an App Store or Google Play subscription; cancel it first in your Apple account or in Google Play.

Other records

• When any account is deleted, we ask Adapty at the same time to delete the subscription profile linked to the account’s random billing identifier. If that request fails, it is retried automatically every day until Adapty confirms the deletion; we cannot promise a fixed completion time on Adapty’s side.
• We keep records of accepting the legal documents while your account exists; after the account is deleted, we keep them at most for as long as needed for possible legal claims and only for that purpose.
• Technical records are kept only as long as their purpose requires: used QR values and rate-limit records for a few days, retry keys until they expire (normally 7 days), records of sent or undeliverable notifications for 14 days, and reminder records for 30 days after the lesson time.
• We delete or de-identify support correspondence and limited diagnostic records once your request has been resolved and the period needed for possible disputes has passed.
• Deleted data can remain in backups until those backups are overwritten on their regular cycle.

You can also ask us to delete your account without the app; see Delete your account and data.

10. Your rights and how to make a request

Under the GDPR and UK GDPR you have the right to access your data and receive a copy, to have inaccurate data corrected, to have data deleted, to restrict processing, to object to processing based on legitimate interests, and to receive the data you provided in a structured, commonly used and machine-readable format or have it transmitted to another controller.

Under Article 11 KVKK you have the right to learn whether your personal data is processed and to request information about it, to learn the purpose of the processing and whether the data is used in line with that purpose, to know the third parties in Türkiye or abroad to whom it is transferred, to have incomplete or inaccurate data corrected, to have data deleted or destroyed under the conditions in Article 7 KVKK, to have corrections and deletions notified to the third parties to whom the data was transferred, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing.

How to make a request

Send your request to destek@coachstamp.app from the email address registered in your CoachStamp account, and describe what you are asking for. Applications under the KVKK can also be made, in Turkish, in the ways set out in the Communiqué on the Procedures and Principles of Applications to the Data Controller:

• in writing with a wet-ink signature, delivered by hand to the address in section 1, by registered post or through a notary;
• to destek@coachstamp.app from your registered electronic mail (KEP) address, or signed with a secure electronic signature or mobile signature;
• to destek@coachstamp.app from the email address registered in your CoachStamp account.

A KVKK application should state your name and surname, your signature for written applications, your Turkish identity number if you are a citizen of Türkiye or otherwise your nationality and passport or identity number, your address for notifications, your email address and telephone number if any, and the subject of your request. You do not need to send a copy of an identity document; where necessary we verify your identity using proportionate methods.

If you used Apple’s Hide My Email, say so and include Apple’s relay address, so that we can match the request to your account.

Response times and complaints

GDPR requests are answered without undue delay and generally within one month; if the law permits an extension, we will explain it within the first month. KVKK applications are concluded free of charge as soon as possible and within thirty days at the latest; if the request involves an additional cost, a fee set by the Turkish Personal Data Protection Board may be charged.

Because the ledger is shared, a request to correct or delete a ledger entry is assessed together with the other person’s rights; a wrong entry is normally corrected with a reverse entry rather than removed.

You may complain to the data protection supervisory authority where you live or work or where an alleged infringement occurred, and in the United Kingdom to the Information Commissioner’s Office (ICO). Under the KVKK, if your application is rejected, you find our answer insufficient or we do not answer in time, you may complain to the Personal Data Protection Board within thirty days of learning our answer and in any case within sixty days of your application.

11. Suggestions, credit rules and automated checks

When a trainer plans a new week, the app suggests lessons on the trainer’s device from the past four weeks: a student who came at the same day and time in at least two of those weeks is suggested at that time, and suggestions are marked when they overlap another lesson or the student’s credits would not cover them. The trainer decides which suggestions to add. When a lesson uses a credit, it is taken from the student’s package that expires first.

Our server checks QR codes, credit changes, subscription status and the trainer’s student limit before it records anything. These rules organise lessons and credits; we do not use them to build advertising profiles, and the service is not designed to make solely automated decisions that produce legal or similarly significant effects. Cancel requests, change requests and disputes are decided by the trainer, not by CoachStamp. Contact support if a result appears incorrect.

12. Minimum age and health information

CoachStamp is for users aged 16 or older and is not directed to children. Users aged 16 or 17 may use CoachStamp with the approval of a parent or legal guardian. You must be 18 or older to buy a subscription as a trainer. When you accept the Terms in the app, you also confirm that you are 16 or older.

The age-16 threshold in Article 8 GDPR concerns consent-based processing for services offered directly to children. The core processing in CoachStamp relies on performance of a contract, not on consent; the age-16 limit is our rule about who the service is for. Tell us if you believe the data of someone under 16 has been processed; we will take the necessary steps, including closing the account and deleting the data.

CoachStamp does not ask for health information and has no health-related option, including among the cancel reasons. You never have to give a reason. Notes you write on cancel requests, change requests or disputes go only to your trainer; do not write health information or other sensitive information, such as identity documents or card numbers, in them. Trainers should likewise not write sensitive information about students in price notes, decision notes or location names.

13. Security

CoachStamp uses HTTPS in transit, signed-in sessions, and access rules on our database that let a trainer read only their own room and a student only their own records. Credits, the ledger, lessons, requests and subscriptions can only be changed through checks on our server, not directly from the app. QR codes are signed with a secret that the trainer cannot read and that is kept on the student’s device in the iOS Keychain or in encrypted storage protected by the Android Keystore. Protection of local data also depends on your device-security settings. Authorized systems used to operate the service can process the data; CoachStamp does not promise end-to-end encryption.

14. Changes and contact

The version and the date of the last update are shown at the top of this page. We will update this policy before we add a new sign-in method, service provider or purpose. For material changes, the app may ask you to read the current version and accept the Terms of Use again; if a new purpose requires consent, we will ask for it separately and it will be optional.

Send questions and requests to destek@coachstamp.app. Related pages: Terms of Use, Delete your account and data, Support.