Privacy Policy
Information We Collect
We collect the following categories of information.
Account and profile information. Your email address, your display name, and optionally your first and last name. Your date of birth, which you provide at signup. We use it for two purposes: to verify that you meet the minimum age requirement, and — like your other profile and body data — as an input that helps personalize your training plans and coaching content (for example, calibrating exercise intensity to your age). Your gender. Your language and week-start preferences. If you sign up with email and password, your password is held by our authentication provider (Supabase) in hashed form — CoreSteps never sees or stores your password in plain text. If you sign in with Google, we receive your email address and basic profile information from Google, but never your Google password.
Health and fitness information. This is the most sensitive category we hold, and we want to be precise about it. It includes: injuries you report (such as knee, back, shoulder, wrist, neck, shin, or hip problems); medical conditions you report (such as heart conditions, high blood pressure, pregnancy, recent surgery, or diabetes); whether you are under professional care; your activity level and training history; your answers to the fitness self-test; your training goals; the equipment and space available to you; and your body weight and body measurements recorded over time, together with metrics derived from them.
Activity information. Your workout logs, including exercises performed, sets, reps, durations, and any free-text notes you write; your training plan history, including archived plans; and your message history with the AI coach.
AI coaching personalization data. Drawn only from your own chat messages: a small set of running signals about how you seem to prefer being coached (for example, whether you respond better to concrete numbers or to encouragement), and a short log of notable things you've told the coach — a stated feeling, a win, or a struggle. Both exist only to make the coach's tone and content more relevant to you over time, and are never shared or used for anything beyond personalizing your own coaching.
Usage and analytics information. The sign-in method you used and when you signed in; a daily aggregate of how much active time you spend using the Service (tracked only while the app tab is visible in your browser); and, per AI feature you use, how much usage that request took to generate. This information is used only to monitor cost and system health, not to build any profile of you beyond your own account.
Billing information. Your subscription tier and status, and the customer and subscription identifiers provided by Paddle, our payment provider and merchant of record. This also includes your country/location, which Paddle uses to calculate applicable sales tax or VAT. We never receive or store your card number, expiry date, or security code — payment details are entered directly with Paddle and never pass through CoreSteps' systems.
Support and promotional information. If you contact us, we receive your name, email address, your message, and your subscription tier at the time of writing. If you request a discount code, we receive your email address.
How We Use Information
We use your information to:
• create and maintain your account, authenticate you when you sign in, and verify that you meet the minimum age requirement
• generate and adapt your training plans and coaching content, using your profile data — including your age and gender — to calibrate difficulty and tailor guidance to your state, and filtering exercises against the injuries, medical conditions, equipment, space, and time you have told us about
• produce your AI coaching content — weekly insights, daily check-ins, chat replies, and suggested exercise substitutions
• carry out, only after your explicit confirmation in chat, actions the coach has proposed — such as logging a workout, updating your saved preferences and goals, or creating and activating a temporary plan
• display your progress, workout history, and body metric trends back to you
• let you generate a shareable "recap" summary if you choose to — this creates a public link containing a snapshot of your workout stats and trends (never your name or email address); anyone with the link can view it without signing in, and it expires automatically after 90 days
• operate your subscription, process payments through Paddle (our payment provider and merchant of record), and enforce tier limits, free-trial eligibility, and refund eligibility
• respond to your support enquiries and send you a discount code if you request one
• monitor for abuse and enforce our Terms, including the AI chat safeguards
• keep the Service secure, diagnose faults, and improve how it works
We do not sell your personal information. We do not use it for advertising, and we do not provide it to advertisers.
Data Sharing & Sub-Processors
We do not sell your data. We share it only with the service providers we need in order to operate CoreSteps, and only to the extent required for them to perform their function:
• Supabase — hosting, database, authentication. Receives: all account, profile, health, activity, and billing-status data stored by the Service.
• Anthropic — AI-generated plans, insights, and chat. Receives: profile details, intake information (including injuries and medical conditions you reported and your training preferences), workout log, and body metrics.
• Paddle — payment processing and merchant of record for paid subscriptions. Receives: your email address, country/location (for tax calculation), and payment details you enter directly with them. As merchant of record, Paddle is the seller for billing purposes and calculates, collects, and remits applicable sales tax or VAT on the transaction.
• Resend — delivery of discount-code emails. Receives: your email address and the message content.
• Email/SMTP provider — internal notifications to our support inbox. Receives: the contents of support enquiries you send us.
On AI processing specifically. To provide our AI-powered features (weekly insights, daily check-ins, coach chat, and the plan generator), we send some of your data to our AI provider (Anthropic) — including your profile details (e.g. age, gender, goals, equipment), intake information (injuries and medical conditions you reported, training preferences), your workout log, and your body metrics — solely to generate that personalized content. This information is not sold or shared with the AI provider for advertising purposes, and is not used to train third-party AI models. When this content includes a proposed action (such as logging a workout or updating a preference), the AI only drafts the proposal — the actual write to your data is performed by our own systems, and only after you have approved the proposal yourself.
Internal access. A limited number of authorised CoreSteps personnel, restricted by an explicit allowlist, can access an administrative dashboard showing user subscription tiers, subscription status, submitted support messages, aggregate sign-in and usage activity, and AI usage cost per feature. This access exists to operate and support the Service.
We may also disclose information where required by law, to enforce our Terms, or to protect the rights, safety, or property of CoreSteps or others.
Data Retention & Deletion
We keep your information for as long as your account is active, so that your training history and progress remain available to you. You have two self-serve controls in your account settings:
Note: on the Free plan, the app's Progress and Body pages display only your most recent 30 days of workout and measurement history — this is a display limit only, not deletion. Your full data is always kept in full on our servers, and if you upgrade to the Pro plan, your complete history becomes visible again immediately; if you return to the Free plan, the display reverts to the last 30 days while your older data continues to be retained.
Reset my data. This clears your training data — workout logs, plan history, and body metrics — while keeping your account open. This action cannot be undone.
Delete my account. This removes your personal and training data from the Service. For security and fairness reasons, we retain a minimal record of your authentication identity in a disabled state rather than erasing it entirely; this prevents the same email address from being used to obtain repeated free trials or refunds. That retained record is not used for any other purpose.
We may retain limited information for longer where we are legally required to — for example, billing and transaction records that tax law requires us to keep. Where data has already been transmitted to a sub-processor, its own retention and deletion policies also apply.
If you would like your data removed beyond what the self-serve controls do, contact us via our Contact page.
Your Rights
You have the right to:
• access the personal information we hold about you
• correct inaccurate information — most of it is directly editable in your profile and body-metrics screens. Your date of birth is an exception: it cannot be self-edited, and can be corrected only as described in our Terms (once per account, never to a minor's date)
• delete your data, using the controls described above or by contacting us
• export a copy of your data in a portable format, on request
• object to or restrict certain processing
• withdraw consent where our processing relies on your consent — including by removing health information you previously entered, or by stopping use of the AI features
• complain to your local data protection authority
To exercise any of these rights, use the controls in your account settings or contact us via our Contact page. We will respond within the time required by applicable law.
Cookies
CoreSteps uses only two cookies, both strictly necessary for the Service to work:
• a language preference cookie (corestep-lang), which remembers whether you are using Hebrew or English
• an authentication session cookie, set by our authentication provider (Supabase), which keeps you signed in
We do not use analytics cookies, advertising cookies, or third-party tracking of any kind. There are no ad networks, no tracking pixels, and no cross-site profiling in CoreSteps.
Because both cookies are strictly necessary, they cannot be disabled without breaking core functionality; you can clear them at any time through your browser settings, which will sign you out.
Children's Privacy
The Service is not intended for anyone under 18, and we don't knowingly collect information from anyone under that age. At signup we collect a date of birth to verify the minimum-age requirement; this is stored on your account and can't be self-edited. If we learn we've collected information from a user under 18, we'll take steps to delete it.
If you believe a person under 18 has provided us with personal information, contact us via our Contact page.
International Transfers & Security
CoreSteps is operated from Israel. Our service providers — including Supabase, Anthropic, Paddle, and our email providers — may store or process data in other countries, including in the United States and the European Union. Where data is transferred internationally, we rely on the safeguards those providers put in place for such transfers.
We take reasonable technical and organisational measures to protect your information, including encrypted connections, hashed passwords, database-level access rules that isolate each user's data, and restricted internal administrative access. No system is perfectly secure, and we cannot guarantee absolute security.
Marketing Communications
We do not send marketing or promotional email unless you have given us separate, explicit consent to do so — for example, by ticking an opt-in box in your account settings. This is entirely optional and is never required to use the Service.
If you opt in, we may occasionally email you about benefits and offers we think you'll value — such as discounts, a birthday treat, new features, or seasonal perks. We keep this kind of email infrequent and benefit-focused; we do not sell or rent your email address to anyone, and we do not send third-party advertising.
Where we send you a benefit tied to a specific piece of your data — for example, a birthday offer based on your date of birth — we only do so if you have opted in to marketing, and using your data in this way is part of what that opt-in covers.
You can withdraw your marketing consent at any time, through your account settings or the unsubscribe link in any such email. Withdrawing it stops the promotional email but does not affect the service-related messages described in our Terms, which are necessary to operate your account.
Changes to This Policy
We may update this Privacy Policy. If we make a material change — particularly to what we collect or who we share it with — we will notify you through the Service or by email before it takes effect.