Your privacy.
Direct athlete accounts · Updated 9 September 2026
HybridHQ Studio waitlist
When you join the Studio waitlist, we store your name, email, optional phone number, gym or studio details, role, location/member ranges, current display method and any comments you choose to provide. With your consent, we use these details to send Studio updates and discuss early-access testing. If you supply a phone number, you are asking us to call about your Studio enquiry; we do not use it for SMS marketing. Joining does not create an athlete account or subscription.
Interest records are stored privately using Supabase and processed through Vercel. Only authorised HybridHQ operators can access them. We retain interest records for up to 12 months unless you join a programme or agree to continued contact. Email support@hybridhq.fit to withdraw consent, correct or delete your details. A short-lived, pseudonymous network identifier helps limit repeated submissions and expires within 48 hours; raw IP addresses are not stored in the waitlist.
Campaign links
Some outreach links record anonymous visit totals and first and last visit times within each hour to help us understand interest in a proposal. These counts are stored privately using Supabase. The campaign counter does not store your email address, IP address or browser details, set tracking cookies, or link visits to an athlete account. Repeat visits and automated email checks may affect the totals.
Your privacy contact
For questions about how HybridHQ handles direct athlete account information, contact support@hybridhq.fit for privacy questions and requests. This notice covers the direct athlete app and its signup journey; separately contracted coaching-business services have their own contractual scope.
Your account and personalised information
We use your email, authentication information, preferences and support correspondence to provide and secure your account. The service is for adults aged 18 or over. Your optional records can include body measurements, goals, training availability, planned and completed workouts, food plans and portions, health-related logs, race results and reflections, messages and progress photos. We use the records you provide to save and display your plans and calculate the training, nutrition and progress summaries you request.
Why we use information
Providing your account and paid membership is necessary to perform our contract with you. We use billing records to fulfil accounting and legal obligations. We rely on legitimate interests in securing the service, preventing abuse, resolving support issues and understanding aggregate service usage; you can object to processing based on legitimate interests. Where body or training records reveal health information, we ask for your separate explicit consent to personalised processing. This consent is separate from contractual acceptance and marketing choices. You can explore the public demo without giving health information, and photographs are optional.
Consent and withdrawal
We record the consent statement version, your account, your choice and the server time. In Account → Privacy choices you can withdraw consent. The control explains that withdrawal permanently erases personal plans, meal plans, logs, health records, race journals and live photos and revokes coaching/partner access. Export anything you wish to keep first. Account sign-in, billing and a minimal consent audit remain. Withdrawal does not cancel a subscription; use Membership → Manage billing & cancellation or contact support. Withdrawal does not affect processing lawfully carried out before withdrawal. If photo cleanup fails, we tell you and provide a retry/support path.
Sharing you control
Coaches and partners use separate accounts. My team lets you grant and revoke access. Partners can see your name, training dates, blocks and workouts and edit your training plan. Coaches can additionally see profile settings, meals, logs, session summaries and race events, and edit nutrition targets and plans. Revocation stops subsequent shared-workspace access; it cannot remove copies another person has already saved outside the service. Independently engaged coaches may be responsible for their own use of information outside HybridHQ.
Food lookup and optional AI
Food search terms and packaged-food barcodes are sent to Open Food Facts. Barcode scanning decodes on your device; the lookup sends the barcode, not camera frames. When available and you explicitly select AI meal interpretation, your entered meal description is sent to OpenAI to identify meals and foods. The non-AI interpretation option remains available. Do not include unnecessary personal details. Check food matches, portions and calculations before saving. We do not promise that an AI provider retains no data.
Providers and international processing
We use Supabase for authentication, database and live photo storage; Vercel for hosting; Stripe for checkout, subscription and payment records; Resend for transactional email; Google Workspace for support correspondence; and Cloudflare R2 for encrypted photo backups in the EU. Payment card details are handled by Stripe. These providers may process information outside the UK, including in the EU and United States. Their applicable processing terms describe transfer mechanisms and subprocessors. Contact support for information about the safeguards relevant to your data.
Provider information: Supabase, Vercel, Stripe, Resend, Google Workspace, Cloudflare and OpenAI.
Retention, export and deletion
We keep your account records while needed to provide your account and the history you choose to retain. Subscription cancellation alone does not delete training history. Account controls provide export and deletion; photo metadata is in the export, while image files are downloaded separately. Deletion requires account verification and may require you to resolve an active subscription first. Health-consent withdrawal is separate and does not require ending billing first. Support records are retained as needed to resolve the request and associated disputes; billing and minimal audit records are retained where needed for legal obligations or establishing and defending claims.
Photo backups are encrypted and expire after 30 days. Deleted information can remain in protected historical backups until expiration and must not be reintroduced into active use during recovery. Database backups are managed separately. Exports, device-only copies and information someone else has independently saved are not erased by cloud deletion.
Your rights
You can request access, correction, erasure, restriction and portability where applicable, withdraw consent, and object to processing based on legitimate interests. We may need to verify your identity. We respond within the applicable legal time limit, normally one month, and will explain any lawful extension. Contact support@hybridhq.fit if an in-app control does not meet your needs. You can complain to the UK Information Commissioner’s Office.
Cookies, local storage and marketing
The athlete app uses authentication cookies and a currency-preference cookie lasting up to one year. A rest timer saves its deadline in the browser session. The offline cache holds a generic connection-help page, not your saved workouts or meals. Legacy device-only records remain in that browser until its site data is cleared; cloud deletion does not remove those copies. The workout editor keeps a recovery copy of your session edits and selected exercise on your device, scoped to your account, workout and date. It also attempts background saving to your account. Recovery copies are eligible for restoration for up to seven days; newer cloud changes take priority. Successful completion, signing out, account deletion or consent withdrawal clears workout recovery copies on the device where you take that action. Clear site data on other devices to remove their local copies. Storage restrictions or clearing browser data can make device recovery unavailable. Public demo changes reset on reload. Optional signup-source information helps us understand how people found HybridHQ and does not subscribe anyone to marketing email. Promotional email choices are separate from account and support messages.
Updates
This notice was updated on 10 September 2026. Material changes will be explained through the service or an appropriate account notice. If we need consent for a new purpose, we will ask before that use begins.