Data Protection Notice

1. Who we are

For data protection purposes, the controller of your personal data is 2 To 1 Powerlifting Ltd (company number 17483976, registered office 81A Adelaide Grove, London W12 0JX), trading as Auriga. Contact us at will@auriga.2to1.co.uk with any question about your data or this notice.

This notice applies to everyone whose personal data we process through Auriga: coaches, athletes coached by someone else, and self-coached users, regardless of who has a contract with us. Our data protection obligations to you do not depend on whether you have a contract with Auriga.

2. What we collect

Account information: your name, nickname, email address, role (coach and/or athlete), and, if you choose to give it, your gender (used only for GL Points/DOTS scoring on competition results).

Training data: the programs assigned to you, the sets/reps/weight/RPE you log, session ratings and notes, and any sleep/life-event influences you choose to record.

Competition data: competitions you or your athletes enter, results, and bodyweight at weigh-in.

Externals data: bodyweight, daily steps, sleep, calories eaten and exercise calories that you choose to log from your Dashboard. In the Android app you can also turn on syncing from Health Connect: we then read your daily steps, sleep and calories eaten from it, from the day you turn it on, only to fill in these numbers. We never use Health Connect data for advertising and never sell it, and you can turn the sync off in the app or remove access in Health Connect at any time. If you log enough of it, we calculate a personalised calorie/TDEE estimate from your own data for you to see; this is an estimate only, not medical or dietary advice.

Technical data: standard server logs (IP address, timestamps, error reports) generated by normal use of the app, kept for security and troubleshooting.

Notification data: if you turn on push notifications, we store a notification address for your browser or device (issued by your browser's push service, or by Google's Firebase Cloud Messaging if you use the Auriga Android app), the encryption keys needed to send to it where they apply, your time zone, and your browser's name and version, so we can send you the notifications you choose.

3. What we do not collect

We do not collect payment card details directly: if a coach's account is on a paid plan, payment is handled by our payment provider, not stored by Auriga itself.

We do not use advertising trackers, ad cookies, or sell any personal data to third parties.

4. How we use it

To provide the service: showing coaches their roster and programs, showing athletes their training, and keeping the two in sync.

To communicate with you: invite/account emails, and (only if you opt in) a weekly digest email, push notifications on your device (such as a reminder that you have a session today), and updates in our WhatsApp community.

To keep the service secure and working: detecting abuse, debugging errors, and improving performance.

To develop and improve Auriga: understanding how coaches and athletes actually use the app so we can decide what to build next, and testing new features. Where we look at real training data for this, we use it in an aggregated or anonymised form wherever practical; we do not review a specific person's identifiable data for product-development purposes beyond what is needed to build or debug a specific feature (for example, investigating a bug report you have sent us).

5. Our legal basis

Processing a coach's core account and training data is necessary to perform our contract with them (providing the Auriga service).

For an athlete who does not have a contract with us (see the Terms), processing their core account and training data instead relies on our legitimate interest in providing the service their coach has contracted for, balanced against their privacy.

Sending the optional weekly digest email, push notifications, and anything you opt into (like the WhatsApp community), relies on your consent, and you can withdraw it at any time from Account Management (or, for push notifications, in your browser's settings).

Keeping basic security/error logs, and using data in aggregated or anonymised form to develop and improve Auriga, relies on our legitimate interest in running and improving a reliable service, balanced against your privacy, which is why we minimise use of identifiable data for that purpose.

6. Who we share it with

We use a small number of service providers ("processors") to run Auriga, who only process your data on our instructions:

• Cloudflare: hosts our application (API and frontend) and runs our scheduled jobs.
• Render: hosts our Postgres database.
• Resend: sends transactional and digest emails on our behalf.
• Stripe: takes payment for paid coach plans. Card details go to Stripe and are never held by Auriga; we keep only who is subscribed and the status of the subscription.

If you turn on push notifications, each notification is delivered through your browser's own push service (for example Google, Apple, Mozilla or Microsoft, depending on your browser), or through Google's Firebase Cloud Messaging if you use the Auriga Android app. Web push notifications are encrypted so that only your device can read them; either way, that service can see that a notification was sent to your device, and when.

Your coach can see the training data of athletes assigned to them, and an athlete can see data their coach shares back; that is the core function of the app, not third-party sharing.

Your coach can also make a link, protected by a short code, to share your training plan, and with your agreement your logged training, with another coach to get advice or to coach you together. Your coach is responsible for checking you are happy with this first. The link does not show your name, stops working after a set time, and your coach can switch it off at any time. Your session notes are shown as you wrote them.

We do not sell personal data, and we do not share it with anyone else except as described above or where required by law.

7. International transfers

Our hosting, email and payment providers, and your browser's or device's push service (Google, in the Android app) if you use push notifications, may process data outside the UK/EEA. Where that happens, we rely on the safeguards those providers offer (such as the EU-US Data Privacy Framework or standard contractual clauses) to keep your data protected to UK standards.

8. How long we keep it

We keep your account and training data for as long as your account is active, plus a reasonable period afterwards in case you or your coach wants to reactivate it or export historical data.

You can delete your account yourself from Account Management, or, if you can't sign in, by following the steps at auriga.2to1.co.uk/delete-account. We then hold the account for 30 days in case you change your mind: nobody can use it in that time, your notifications and digests stop, and signing in again cancels the deletion. After 30 days we permanently delete the account and the training, competition, bodyweight and other data tied to it, including the copy your coach could see, except where we need to keep something for a legitimate reason (for example, financial records we are legally required to retain).

A coach must say goodbye to their athletes before deleting their account. Training a coach wrote for an athlete is that athlete's, so it stays with the athlete when the coach's account is deleted.

Your notification address is deleted when you turn notifications off on that device, sign out, or delete your account.

9. Keeping you signed in

Auriga does not use tracking cookies. Signing in stores an access token in your browser's local storage (not a cookie) purely to keep you signed in. This is strictly necessary for the app to work and is not used for tracking.

We use Cloudflare Web Analytics to see how many people visit our public pages. It does not use cookies or local storage and does not identify individuals.

Some Learn articles can embed videos or posts from YouTube or Instagram. Nothing loads from them until you choose to play, after which that provider (Google or Meta) may set cookies and collect data under its own privacy policy (Google's, Instagram's).

If you use Auriga's offline mode, some of your recent training data is cached on your device so you can keep logging without a connection. Signing out clears this cache.

10. Security

Passwords are hashed, not stored in plain text. Data is encrypted in transit (HTTPS). Access to production data is limited to people who need it to run the service.

11. Athletes under 18

If a coach adds an athlete under 18, the coach is responsible for having the parent or guardian's consent before the account is created. Parents/guardians can contact us to ask about, access, or delete a minor's data.

12. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you, and take a copy in a portable format: use Download my data in Account Management, or email us.
• Ask us to correct inaccurate data.
• Ask us to delete your data, or delete your account yourself in Account Management (subject to the retention reasons above).
• Ask us to restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent for anything based on consent, at any time.

To exercise any of these, email will@auriga.2to1.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) if you think we have mishandled your data.

13. Changes to this notice

We may update this notice as Auriga changes. If we make a material change, we will let you know before it takes effect.