Privacy Policy

TRAINR is operated by Streetonaut by Saugy (Einzelunternehmen), based in Stockenweg 35, 8906 Bonstetten, Switzerland. We are the data controller for the personal data described in this policy. Reach us at hello@trainr.ch.

We collect only the data we need to run the platform:

• Account data: email, password (stored hashed), name, role (athlete / coach / admin).
• Coach profile data: bio, tagline, specialties, languages, pricing, training locations, optional avatar photo.
• Booking data: session date, type, price, location, athlete, coach, status. Cancellation reason if provided.
• Payment data: handled by Stripe (we never see your card details). We store: transaction id, amount, currency, status.
• Communications: email content sent throughTRAINR (confirmations, reviews, cancellations).
• Reviews: rating + optional comment you leave about a coach after a session.
• Technical data: IP address, browser type and language preference in server logs of API calls. We do not store IP addresses in our database and we use no device ids. Older waitlist and coach-interest entries may contain a shortened hash of the IP address and the browser type; entries since 14 October 2026 no longer do. No third-party analytics or advertising cookies.
• Search and demand data: what you search for (sport, mode, search area rounded to about 1 km, radius, number of results) and when a coach had no free time for you. If you are signed in, this is linked to your account; otherwise it is anonymous. We use it to understand which training is missing where and to bring coaches to it. No exact locations and no message contents are used for this.
• Availability alerts: if you ask to be told when a coach has time that fits you, we store the coach, the weekdays and times of day you chose, and which free times we already told you about, until you book, end the alert or 60 days pass. The coach sees that someone is looking for these times, never who. If you choose an alert before signing in, a functional cookie (trainr_pending_watch, 1 day) keeps your choice until you have an account.
• How you found TRAINR: the kind of source (for example a coach's link, a search engine or a campaign) and the page you first opened, stored with a booking or a new account.

• Contract performance (Art. 6(1)(b) GDPR / Art. 31 revDSG): to run your account, process bookings, route payments, and let coaches and athletes communicate.
• Legal obligation (Art. 6(1)(c) GDPR): tax, accounting and AML record retention.
• Legitimate interest (Art. 6(1)(f) GDPR): fraud prevention, platform safety, anonymous usage analytics, and product improvement.
• Consent (Art. 6(1)(a) GDPR): optional marketing emails (opt-in only, none today).

We use a small set of trusted processors. They are contractually bound to handle your data only on our instructions, with appropriate safeguards.

• Supabase (database + auth) — EU servers (Ireland).
• Vercel (web hosting) — global edge with EU fallback.
• Stripe (payments) — registered Swiss / EU / US data processor; handles all card data under PCI-DSS.
• Resend (transactional email) — EU region (eu- west-1, Ireland).
• Mapbox (maps + geocoding) — anonymous map tile requests, no personal data shared.
• Hostpoint (DNS + email forwarding) — Swiss servers.

We do not sell your personal data. We do not share it with advertisers. We never share coach profiles or booking history with third parties for marketing.

Some processors (notably Vercel and Stripe) may transfer data outside Switzerland or the EU/EEA. These transfers are protected by EU Standard Contractual Clauses and the Swiss-US Data Privacy Framework where applicable.

• Account data: until you delete your account.
• Booking + payment records: 10 years after the session, as required by Swiss accounting law (OR Art. 958f).
• Communications: 24 months for support continuity.
• Server logs: 30 days.
• Reviews: kept indefinitely (anonymised after account deletion).

You have the right to:

• access the personal data we hold about you,
• rectify inaccurate data,
• request deletion (subject to legal retention obligations),
• restrict or object to processing,
• data portability (export your data in a machine-readable format),
• withdraw consent at any time for consent-based processing.

To exercise any of these rights, email hello@trainr.ch. We respond within 30 days. You also have the right to lodge a complaint with the Swiss FDPIC or an EU supervisory authority.

We use essential cookies for authentication and session continuity, and one first-party cookie, trainr_origin, that remembers for 30 days how you came to TRAINR (the kind of source, such as a coach's link or a search engine, and the first page you opened). It contains no id, is never shared and is read only when you book or create an account. You can block or delete it in your browser at any time; everything keeps working. Website statistics come from Plausible, which is cookie-free and stores no personal data. We do not use third-party analytics, advertising or fingerprinting cookies.

All connections to TRAINR are TLS-encrypted. Passwords are hashed (bcrypt). Database access is restricted by row-level security. Payment processing is delegated to PCI-DSS-compliant Stripe — we never store your card number or CVC. We will notify affected users without undue delay if a breach occurs.

TRAINR is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has registered, contact us and we will delete the account.

We may update this policy as the product or law evolves. Material changes are emailed to registered users at least 30 days before taking effect.

Privacy questions, data requests, complaints — please write to hello@trainr.ch or Stockenweg 35, 8906 Bonstetten, Switzerland.