Privacy policy

Emmanuel Owolabi is responsible for your personal data (the “controller” under UK data protection law). He runs The Pack as an individual, based in London, UK.

Email: emmanuelowo98@gmail.com

• Account: your name, email address and password, and whether you’re an athlete or the coach. Your password is stored only in scrambled (hashed) form by our sign-in provider, so nobody, including us, can read it.
• Athlete profile: date of birth, gender, training group, events, maximum and resting heart rate, and injury status.
• Training: the plans and sessions assigned to you; session logs (rep times and notes); gym logs (sets, loads and notes); velocity-based training sets (bar-speed traces from a Bluetooth sensor cube); timing-gate runs (sprint times); jump tests (jump height and body mass); personal bests and their history; and the competitions you enter, with your results.
• Wellness: daily check-ins (sleep, energy, mood and notes) and a soreness body map.
• From Apple Health (iOS app, only if you allow it): workouts (type, date and start time, duration), your heart rate during them (a summary and the time spent in each heart-rate zone), and the names of the device and app that recorded them. The app only reads this; it never writes to Apple Health.
• From Polar (website, only if you connect it): exercise sessions (heart rate, calories, training load), daily activity, sleep, Nightly Recharge, ANS charge and Sleep Charge. We also keep the access token Polar gives us and your Polar user ID, so that we can fetch new data and disconnect you later.
• From Garmin Connect (website, only if you connect it): daily heart rate (including resting heart rate), overnight heart rate variability (HRV), sleep (duration, score and Garmin’s sleep details), steps, stress level, Body Battery and blood oxygen (SpO2). To connect, you enter your Garmin email and password on the website. We use them once to sign in to Garmin and don’t store them; we keep the sign-in tokens Garmin returns, so that we can fetch new data.
• Cycle tracking (website, optional): your cycle profile and daily cycle logs.
• Session videos (website Lab): sprint videos your coach records of you, stored privately, and the pose and movement analysis worked out from them (see Modal under Service providers).
• Worked out from the above: your training load, a recovery status that only your coach sees, and a speed curve fitted from your personal bests.
• Technical: your IP address and device or browser details, recorded with your sign-in sessions and in Supabase’s and Vercel’s request logs. We use them only to keep your account secure and to fix problems. Session records last until you sign out on that device or delete your account; request logs are kept for a limited time.

Some of this is health data, which UK law treats as “special category” data: for example heart rate, injury status, wellness check-ins, sleep, body mass, cycle logs, and the data from Apple Health, Polar and Garmin. We only use it with your explicit consent (see Why we use it).

• You: what you enter in the app or on the website.
• Your coach: the plans and sessions they assign you, the times and notes they record at training, and session videos.
• Apple Health: if you allow the app to read it on your device.
• Polar: if you connect your Polar account on the website.
• Garmin Connect: if you connect your Garmin account on the website.
• Bluetooth training devices: the timing gates (sprint times), the sensor cube on the bar (bar speed) and the jump sensor (jump height). They send their readings to the app, which saves them to your account.

We use your data only to run The Pack: to show you your training, and to let your coach plan, monitor and adjust it. We don’t use it for anything else.

• Running the service: we need your account details and training data to provide The Pack to you. Lawful basis: contract.
• Coaching: it’s in our legitimate interests, and yours, for your coach to use your training data to plan sessions, manage your training load and track your progress. Lawful basis: legitimate interests.
• Health data: we use it only with your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)). You give it when you create your account or, if your account is older, the first time you sign in after we started asking. It covers the health data you enter, what’s imported from Apple Health, Polar or Garmin, and what your coach records about you, such as body mass from jump tests, session videos and your recovery status. The iOS app also asks before it first reads Apple Health.

You can withdraw your consent at any time. It won’t affect what we did before. To withdraw it completely, delete your account. To withdraw it for imported data, stop the import: for Apple Health, in the iOS app tap the person icon at the top right of Today → Stop importing, or in the Health app’s sharing settings; for Polar or Garmin, on the website Profile → Connected Devices. You can also ask us to delete particular data. The support page has step-by-step instructions.

• You see your own data.
• Your coach sees your data, including the recovery status, except your cycle logs.
• Your cycle logs are private to you. Your coach can’t see them.
• Athletes can’t see each other’s data, with two exceptions: competitions an athlete adds (name, date, location and any notes) are visible to anyone with an account in The Pack; and if you record a sprint time and your coach then reassigns it to a teammate, you can still see that time.

These limits are enforced by the database itself, not just by the screens in the app. Apart from the service providers below, we don’t share your data with anyone, unless the law requires us to.

These companies handle data for us, only to provide their service and under terms that require them to protect it. Each gives your data the same or equal protection as this policy describes.

• Supabase: our database, sign-in, file storage and server functions. Your data is stored in Supabase’s EU region in Ireland, which UK law recognises as protecting personal data adequately. Supabase also sends the account confirmation and password-reset emails.
• Vercel: hosts the website. Vercel is a US company, so data you send or view through the website can pass through its servers outside the UK. Vercel is certified under the EU–US Data Privacy Framework and its UK Extension (the “UK–US data bridge”), which UK law recognises as a safeguard for personal data sent to certified US companies.
• Modal: runs the video analysis for the Lab. When your coach analyses a session, Modal receives the storage locations of that session’s videos, downloads the videos from our storage, works out the pose and movement analysis, and writes it back to our database. It holds the videos only in temporary storage for the length of the job, which is cleared when the job finishes. Modal is a US company, so this happens outside the UK. Its data processing terms include the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, which UK law recognises as safeguards for personal data sent abroad.
• Polar (only if you connect it): Polar Electro, in Finland, runs your Polar account. We fetch your data from it with the access you give us. What Polar does with the data in your Polar account is covered by Polar’s own privacy policy.
• Garmin (only if you connect it): Garmin runs your Garmin Connect account. We fetch your data from it using the sign-in you give us. What Garmin does with the data in your Garmin account is covered by Garmin’s own privacy policy.

Apple Health runs on your device, and Apple isn’t one of our service providers. Workouts you allow the app to read are copied to your training log (stored with Supabase, in Ireland) and shown to you and your coach.

• The app only reads from Apple Health. It never writes to it.
• It reads only the workout data listed above, and only after you allow it.
• We use it only to show your training and training load to you and your coach.
• We never use it for advertising, marketing or data mining, and we never sell it.
• We don’t share it with anyone beyond your coach and the service providers above.
• We don’t store it in iCloud.
• You can stop imports at any time: in the iOS app, tap the person icon at the top right of Today → Stop importing, or in the Health app’s sharing settings.

The Pack has no adverts, no analytics and no tracking. We don’t track you across other companies’ apps or websites, we never sell your data, and we never pass it to data brokers. The website uses only the cookies it needs to keep you signed in.

We keep your data for as long as you have an account. You can delete it at any time:

• In the iOS app: tap the person icon at the top right of Today → Delete account
• On the website: Profile → Delete account (athletes) or Account → Delete account (coach)

Deletion happens straight away and can’t be undone. It removes your account and everything in it: your profile, logs, sprint times, jump tests, personal bests, wellness and cycle logs, imported Apple Health, Polar and Garmin data, your session videos and their analysis, and your Polar and Garmin connections. We also ask Polar to disconnect you, where we can.

If your coach removes you from the squad, your account is deleted in exactly the same way.

Some things aren’t ours to delete: workouts in Apple Health stay on your device, and data in your Polar or Garmin account stays with Polar or Garmin.

Our database provider, Supabase, may keep copies of the database in its own short-term backups, which it uses to recover from failures. Those copies expire on Supabase’s schedule, and we never use them to bring back a deleted account.

The programmes, plans, calendar sessions and training phases the coach wrote are deleted. Competitions they added, and group sessions from the app’s older session list, stay but no longer show who created them.

You keep everything you logged: your gym sets, session logs, times and so on. Only the link between your logs and a deleted programme or plan is removed.

Under UK data protection law you have the right to:

• get a copy of your data;
• have it corrected if it’s wrong (you can fix most of it yourself in Profile);
• have it deleted;
• restrict or object to how we use it;
• receive it in a format you can take elsewhere;
• withdraw your consent at any time (see Why we use it).

To use any of these rights, email emmanuelowo98@gmail.com. We’ll reply within one month.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.

The Pack is for adults. You must be 18 or over to create an account, and we don’t knowingly collect data from anyone younger. If we find that someone under 18 has an account, we’ll delete it.

If we change this policy, we’ll update this page and the date at the top. If a change affects how your data is used, we’ll tell you in the app or by email before it takes effect.

Questions about this policy or your data: emmanuelowo98@gmail.com.

Emmanuel Owolabi, London, UK.