Privacy Policy
Version 2026.10.24 · Effective October 25, 2026
TRAIN HARD STAY HUMBLE GmbH ("we", "us" or "our") operates the STRENUO website, the web app and the mobile application (the "Platform"). This Privacy Policy explains how personal data is processed, stored and protected in connection with your use of the Platform.
1. Controller and contact
TRAIN HARD STAY HUMBLE GmbH, Tangentenweg 11, 4058 Basel, Switzerland, e-mail: aroldo@thsh.fit. Send privacy requests to this address. We are not required to appoint a data protection officer and have not appointed one.
2. Roles and responsibilities
STRENUO is a coaching platform. There are two roles:
- For coaching data (training, nutrition, health and progress data, messages and calls with your coach) and for data a coach processes about other people through the Platform (e.g. through forms, e-mail or their website) the respective coach is the controller and decides the purposes and means of processing. TRAIN HARD STAY HUMBLE GmbH acts as processor on the coach's documented instructions; a data processing agreement (DPA) is in place with every coach.
- For operating the Platform itself (account, login, security, support, billing of coaches, referral programme, domain registration, product analytics, marketing towards coaches) TRAIN HARD STAY HUMBLE GmbH is the controller.
If your coach works in a team, other coaches of that team can access your data within their permissions.
Important: TRAIN HARD STAY HUMBLE GmbH does not provide coaching, medical or nutritional services. All coaching services are delivered directly by the respective coach. TRAIN HARD STAY HUMBLE GmbH is not a party to the relationship between coach and client.
3. Data we collect
3.1 Data you provide
Account information
- E-mail address (required to create an account)
- Name, phone number (optional), gender, date of birth
- Password (stored securely as a hash)
- Profile picture
- For coaches in addition: company details, VAT number and the bank details for their invoices
Health and fitness data
- Body weight, body measurements and target values
- Wellbeing data (e.g. sleep, mood, muscle soreness) as well as injuries and limitations
- Training data, check-ins, performance tests, habits and progress notes
- Nutrition data, food logs and meal photos
- If you grant it on your device: data from Apple Health or Health Connect (e.g. steps, activity, heart rate, sleep). This data is sent directly from your device to us; Apple and Google do not process it on our behalf. You can revoke the device permission at any time in your device settings.
- If you connect your Oura or Polar account: values such as heart rate variability, resting heart rate and sleep. You can disconnect at any time in the app.
Health-related data (including data you share from Apple Health, Health Connect, Oura or Polar) is provided voluntarily by you and processed on the basis of your separate, explicit consent (Consent to the Processing of Health Data, withdrawable at any time in the settings) and at the direction of your coach for the purpose of delivering personalized coaching services. TRAIN HARD STAY HUMBLE GmbH does not independently determine how this data is used.
Media and communication
- Progress photos and videos
- Messages and voice messages between you and your coach
- Calls with your coach (section 3.5)
Scheduling
- Appointments with your coach (title, time, description). If your coach has connected an external calendar (Google Calendar, Microsoft Outlook/365, iCloud or CalDAV), the appointment title, times and your name are transferred to that calendar; the privacy terms of your coach's calendar provider apply in addition.
Challenges
- If you take part in a challenge of your coach, the other participants see your first name, the initial of your last name and your points, unless you take part anonymously.
Payments to your coach
- If you pay your coach through the Platform, the payment runs through Stripe. We store invoices, amounts and payment status as well as the card type and the last four digits of your card, never full card or account numbers.
3.2 Data collected automatically
- Technical access logs (IP address, timestamp, device type, app version) to run the Platform securely
- On a coach's public forms: a bot check processes your IP address and browser signals to prevent abuse
- Product usage events in the coach dashboard (only if the coach has enabled this; see section 7). No product analytics runs for clients in the app.
- On our website and in the coach sign-up flow: usage data from our own web analytics (e.g. pages viewed, where the visit came from). If you take out a subscription, we link the visit to your subscription. We set cookies for this only as described in section 7.
3.3 Data we do not collect
- Precise location data
- Advertising tracking (no advertising cookies, no advertising pixels)
- No session recordings, no automatic capture of screen content
3.4 Public forms, offers and enquiries to a coach
Coaches can offer public forms (e.g. enquiry or questionnaire links) and bookable offers through the Platform. If you fill in such a form or book an offer without already being that coach's client, the coach is the controller for the information you provide (typically name, e-mail, phone number and your answers). The data is stored in that coach's account and may also be processed with AI for the coach; TRAIN HARD STAY HUMBLE GmbH processes it only as a processor. If the coach has added their own consent or information texts to the form and they were shown to you when filling it in, those apply in addition; the exact wording you accepted is stored with your submission. Direct access or erasure requests to the coach; we support them in fulfilling such requests. If no coaching relationship follows, the coach decides on deletion; the technical deletion periods in section 8 apply here as well.
3.5 Calls with your coach
Calls are transmitted encrypted in real time; participants, start time and duration are stored. Your coach can have a conversation recorded to create notes from it. A recording is only made if all participants have agreed.
3.6 Further features of your coach
Coaches can send and receive e-mail through the Platform, run their own website, connect their social media accounts and their ad account, and create success stories from their clients' results. The coach is the controller for the data processed in doing so; we process it on the coach's behalf. If a coach turns on sharing with an advertising network, contact details are only transmitted as a hash; you can object at any time towards the coach.
3.7 Data of coaches and prospective coaches
As controller, we additionally process information you give us in the sign-up flow, in the onboarding assistant, when booking a call with us or in support requests, information on the referral programme and, when you register a domain, the registrant data. We pass the registrant data to the registrar and the responsible registry, which may publish part of it in the public domain directory.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Providing the Platform, account, login, messages, appointments | Performance of a contract (Art. 6(1)(b) GDPR; Art. 31(2)(a) Swiss FADP) |
| Coaching data and other data on behalf of a coach (sections 3.4 to 3.6) | Processing on the coach's instructions; health data on the basis of your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7) FADP); call recordings only with the agreement of all participants |
| Apple Health, Health Connect, Oura, Polar | Your explicit consent (permission or connection, and health data consent) |
| Security, abuse prevention, bot protection | Legitimate interest (Art. 6(1)(f) GDPR) |
| Product analytics (coach dashboard) | The coach's consent (Art. 6(1)(a) GDPR) |
| Web analytics on the website and sign-up flow | Legitimate interest (Art. 6(1)(f) GDPR); cookies only with your consent (Art. 6(1)(a) GDPR; § 25(1) German TDDDG), for visits from Switzerland with the option to refuse (Art. 45c Swiss Telecommunications Act) |
| Data of coaches and prospective coaches (section 3.7) | Performance of a contract and pre-contractual steps (Art. 6(1)(b) GDPR) |
| Billing of coaches, invoice archive | Performance of a contract and statutory retention (Art. 6(1)(c) GDPR; Art. 958f Swiss Code of Obligations) |
| Notifications (e-mail, push) | Performance of a contract; can be switched off in the settings |
| Anonymising the AI memory on deletion and using the anonymised data to improve the Platform | The coach's instructions; legitimate interest (Art. 6(1)(f) GDPR) |
Payments may be processed through external payment providers or directly by the coach. Full card and account numbers are never stored on our systems.
5. Recipients and processors
We do not sell personal data. To operate the Platform we use carefully selected service providers that process data solely on our behalf under data processing agreements:
| Category | Processing location | Purpose |
|---|---|---|
| Hosting infrastructure | Zurich, Switzerland | Database, login, server logic |
| File storage and delivery | EU | Images, files, voice messages, e-mails; coach websites; abuse protection |
| Video storage and playback | EU / USA | Videos |
| Video-call transmission | EU | Real-time transmission; recording only with the agreement of all participants |
| E-mail and push delivery | EU / USA | Invitations, reminders, notifications, coaches' e-mails |
| Payment processing | EU | Processing of payments (independent controller under its own privacy policy) |
| Usage analytics | EU | Pseudonymised analysis of the coach account, only with the coach's opt-in |
| Web analytics and cookie banner | EU | Our own web analytics on the website and sign-up flow |
| AI processing | EU; individual features USA | AI features (section 6) |
| Social media and advertising | EU | Only if a coach connects their accounts (section 3.6) |
| Domain registration | EU | Only when a domain is registered (section 3.7) |
| Call booking, help videos, onboarding assistant | EU / USA | Only for coaches and prospective coaches (section 3.7) |
| The coach's calendar provider | provider-dependent | Calendar synchronisation, only if your coach connects a calendar (your coach is the controller for this) |
The complete, continuously updated list of sub-processors with company names and locations is Annex B of the data processing agreement (DPA) with your coach; you can request it through your coach or by e-mail to aroldo@thsh.fit.
Other recipients: your coach and, where applicable, their team (to deliver the coaching), other participants of a challenge (section 3.1), authorities where legally required, and a successor in the course of a business transfer.
6. AI-assisted processing
The Platform contains AI features that support your coach in their work and can take on tasks for them.
What is processed: Only the data required for the specific task is sent to the AI providers. Contact details from your profile are not sent; your coach can individually exclude first names, free-text notes, health metrics and financial data. If your coach asks the AI about you directly, it uses your name.
Providers used: AI requests are processed predominantly in the EU; technical logging takes place in the EU with automatic deletion after 30 days. Company names and locations are listed in Annex B of the DPA.
Stored AI insights (memory): Insights derived from your data (e.g. trends, preferences, summaries) are stored together with a technical representation (embedding) in our database in Switzerland and used in later requests so that responses and suggestions for you and your coach are personalised. They are not shared with third parties and are visible to your coach. When your data is deleted, these insights are anonymised: everything that could identify you is removed and the link to you and your coach is cut. In this form we use them to improve the Platform.
No training: The AI providers do not use your data to train their models and either do not store it or keep it for at most 30 days for abuse detection.
Degree of automation: Your coach decides which tasks the AI carries out on its own and remains responsible for them.
No automated decision-making with legal effect on you takes place.
Legal basis: Performance of a contract (Art. 6(1)(b) GDPR) on the instructions of the coach as controller and, for special categories of personal data, your explicit consent (Art. 9(2)(a) GDPR).
Objection: You can object to AI processing of your data at any time towards your coach. Your coach then excludes you in the AI settings; from then on no data about you is sent to AI providers. The only exception is what your coach writes or says about you in the AI chat themselves.
7. Cookies and local storage
The Platform uses no advertising cookies. Technically necessary data is stored on your device and, only with your consent, statistics cookies:
- Login session (access token) so you stay signed in
- Preferences such as language and appearance
- In the coach dashboard, only after the coach's opt-in: a pseudonymous identifier for product analytics (local storage, no cookie)
- On public forms: a cookie set by the bot check for the duration of the check, and a random identifier in local storage for the form's statistics
- In the web app: Stripe's fraud-prevention cookies under Stripe's privacy policy
- On our website and in the sign-up flow: your choice in the cookie banner (12 months) and, with your consent, statistics cookies of our own web analytics (at most 12 months)
The technically necessary storage is required to operate the Platform (Art. 6(1)(b) and (f) GDPR; § 25(2) German TDDDG) and requires no consent; product analytics requires the coach's consent, the statistics cookies your consent (§ 25(1) TDDDG). For visits from Switzerland we set the statistics cookies from the first page view and point this out in the cookie banner; you can refuse them at any time (Art. 45c Swiss Telecommunications Act). You can change your choice via "Cookie settings" in the footer.
8. Retention
| Data category | Retention |
|---|---|
| Account and profile data | Until the account is deleted; client accounts are deleted immediately, coach accounts 30 days after the deletion request |
| Coaching data (training, nutrition, health, check-ins, photos, messages) | For as long as you are coached; afterwards your coach decides on deletion. Deleting your account removes it |
| Apple Health, Health Connect, Oura, Polar | As coaching data; once the permission is revoked or the connection removed, no new data is imported |
| Calls | Call metadata and notes as coaching data; recordings at most 1 day |
| E-mails, form submissions and booking requests | Until the coach deletes them |
| AI memory and other AI data | As coaching data; the AI memory is anonymised on deletion (section 6) |
| Data exports | Download link 72 hours, file at most 4 days |
| AI logs | 30 days |
| Product analytics (coach dashboard) | Until the coach withdraws the opt-in, at most 12 months |
| Web analytics | At most 2 years |
| Technical access logs | At most 90 days |
| Invoices and billing data (coaches) | 10 years from the invoice date (Art. 958f Swiss Code of Obligations) |
| Domain registrant data | As long as the domain is registered through STRENUO |
After the retention period, data is erased or anonymised unless a statutory retention obligation applies.
9. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. You can withdraw any consent you have given (in particular to the processing of health data) at any time with effect for the future, in the app settings or by e-mail.
Rights concerning coaching data are exercised towards your coach as controller; we forward requests sent to us and support their fulfilment. For data we control ourselves, contact aroldo@thsh.fit directly.
Right to lodge a complaint: You may complain to a supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern. In the EU/EEA you may contact the supervisory authority of your place of residence; in Germany the data protection authority of your federal state, in Austria the Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna.
10. Data security
We apply technical and organisational measures to protect personal data, in particular:
- Encryption in transit and at rest in line with the state of the art
- Secure password storage (hashing; a starting password set by the coach stays readable until the first sign-in), optional two-factor authentication for all accounts
- Role-based access control and tenant isolation at the database level
- Signed, time-limited links for photos, videos and files
- Database and login hosted in Zurich, Switzerland
As with any digital system, complete security cannot be guaranteed.
11. International data transfers
The database and login are operated in Switzerland, files are stored in the EU. Some providers (section 5) process data in the USA. Switzerland and the EU/EEA mutually recognise an adequate level of data protection. Transfers to the USA rely on the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) as recognised by the FDPIC and, where the provider is certified, on the EU-U.S. or Swiss-U.S. Data Privacy Framework. A copy of the relevant safeguards is available on request.
12. Children's privacy
Coaches must be adults. Clients under 16 may only use STRENUO if a parent or legal guardian has agreed; the coach obtains this agreement. Without such agreement we do not knowingly collect personal data from anyone under 16.
13. Changes to this Privacy Policy
This Privacy Policy may be updated. Material changes are shown within the Platform and must be accepted again; the current version and its date are visible in the app.
14. Language
The German version of this Privacy Policy is authoritative; translations are provided for convenience.
15. Contact
TRAIN HARD STAY HUMBLE GmbH E-mail: aroldo@thsh.fit Address: Tangentenweg 11, 4058 Basel, Switzerland