Privacy policy

1. What this is about

This privacy policy describes which personal data we process in the A² app (app.a-squared.ch) and on the website a-squared.ch, for what purpose, on what basis, to whom it is disclosed and how long we keep it. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable (e.g. for clients in the EU), the General Data Protection Regulation (GDPR).

2. Controller

A-Squared (A² Coaching), sole proprietorship, owner Alexander Hafner, Alte Landstrasse 2, 8302 Kloten, Switzerland. Email: team@a-squared.ch. You can contact us at this address with any questions or requests about data protection.

3. Which data we process

• Account: name, email address, phone number (optional), profile picture (optional), app language, time of logins and of your consents.
• Questionnaire: goal, training experience, equipment, training frequency, eating habits, daily routine and working hours, information about injuries, complaints or limitations.
• Coaching data: weight, body measurements, calories, macronutrients, steps, sleep, workouts with exercises, weights, reps and perceived effort, training locations (gyms), your own exercise notes, training calendar, sick days, check-in answers (e.g. energy, stress, hunger), progress photos.
• Meals: photos and descriptions of meals and the nutrition values estimated from them.
• Roster (optional): duties per day (e.g. early, late, night, location of a nightstop) and the screenshots or PDFs you upload for this.
• Roster subscription (optional): if you connect a calendar link (e.g. from your crew portal), we store this link and fetch the calendar regularly. Only duty type, times, route and place per day are imported; sick days and other entries are not stored. You can disconnect the link at any time. For the workout subscription we create a personal secret link; anyone who has it can see your planned workouts.
• Chat: messages, photos and voice messages between you and your coach.
• Subscription and payment: subscription status, price, term, cancellations and cancellation reason, Stripe customer and subscription ID. You enter your card or TWINT details directly at Stripe; we do not receive or store them.
• Notifications: a technical address of your device for push notifications (only if you turn them on).
• Technical data: IP address, device, browser, time and requested address in server logs of our hosting providers; error logs.
• Application via the website: name, email, phone (optional), work, goal, training experience and your message. We only use it to review your application and contact you, and delete it at the latest 6 months after it is closed if no coaching results from it.
• Email contact: content and sender of your emails to us.

4. Health data

Weight, body measurements, photos, information about injuries, complaints, limitations and sick days, sleep and in part nutrition information are health data and therefore particularly sensitive personal data (FADP) or special categories of personal data (Art. 9 GDPR). We only process them with your explicit consent, which you give at your first login. You can withdraw it at any time; without this data, however, the coaching is not possible, and withdrawal only applies to the future.

5. What we process the data for

• Providing the coaching: training and nutrition planning, evaluating your progress, feedback, communication in the chat.
• Running the app: login, storage, notifications, reminders (e.g. for check-ins), security and troubleshooting.
• Handling the subscription: payment, invoices, email confirmations, collecting outstanding amounts.
• Improving the offer: evaluating cancellation reasons and feedback.
• References (only with your separate consent, which you can revoke at any time): publication of your testimonial with your first name and, if you expressly agree, selected before/after photos on a-squared.ch and Instagram. We only show photos after checking with you. If you revoke consent, we remove published posts within 30 days.
• Complying with legal obligations, e.g. retaining accounting records.

We do not use your data for advertising, do not sell it and do not share it with third parties for their own purposes. We only show progress photos or results publicly (e.g. on Instagram or the website) if you have separately agreed in writing beforehand.

6. Legal bases (where the GDPR applies)

• Performance of contract (Art. 6(1)(b) GDPR): account, coaching, subscription and payment.
• Explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): health data, push notifications, roster, AI features with photos, transfers to the USA where no other safeguard exists.
• Legal obligation (Art. 6(1)(c) GDPR): retention of accounting records.
• Legitimate interest (Art. 6(1)(f) GDPR): security, preventing misuse, troubleshooting, server logs.

7. Who sees the data

Within A², only the coaches (Alex and Amelia) have access to your data, and only as far as needed for your coaching. Other clients never see your data. We also use the following service providers, who process data on our behalf and are contractually bound to confidentiality and data protection.

8. Service providers

• Supabase (database, login, storage of photos and files): Supabase Pte. Ltd., Singapore (group headquartered in the USA); data is stored on servers in Ireland (EU).
• Vercel (hosting of app and website, server logs): Vercel Inc., USA; delivery via a global network, including servers in the USA.
• Anthropic (AI features, see section 9): Anthropic PBC, USA.
• Resend (sending emails: login codes, subscription confirmations): Plus Five Five, Inc. (Resend), USA. Your email address and the content of the email are transmitted.
• ImprovMX (forwarding of emails sent to team@a-squared.ch): Reflectiv SAS, France; servers may also be located outside the EU. And Google (Gmail, our inbox for these emails): Google LLC, USA. The sender and content of your emails to us are processed. Please send sensitive health information via the in-app chat rather than by email.
• Stripe (payments and subscription): Stripe Payments Europe Ltd., Ireland, and Stripe Inc., USA. Stripe processes your payment data partly as an independent controller (e.g. for fraud prevention and legal obligations); Stripe’s privacy policy applies to that.
• Push services from Apple, Google or Mozilla (depending on your device, USA): delivery of notifications including their content, e.g. “New message from your coach”.

9. Artificial intelligence (Anthropic)

For some features we send data to Anthropic’s AI model Claude. Your name, email address, progress photos and chat content are never transmitted. In detail:

• Training plan draft: information from the questionnaire (goal, experience, frequency, equipment, routine, limitations) and, if entered, your roster.
• Check-in feedback draft and coach analysis: your check-in answers and your history (daily values for weight, nutrition, steps, workouts, sick days), without your name.
• Nutrition estimate: the photos (max. 2) and description of the meal. For branded products the AI may search the web for the official nutrition values; only a search term (e.g. product name) is used.
• Meal ideas: your nutrition targets and preferences.
• Reading your roster: the uploaded screenshot or PDF. A roster may contain names, staff numbers or flight details; crop such details before uploading if you do not want to transmit them.

According to Anthropic, this data is not used to train its models and is only stored for a limited time (e.g. for abuse detection). Your coach reviews drafts of plans and feedback before you see them. Nutrition estimates are shown to you directly, are estimates and can be edited by you. There are no automated individual decisions with legal effect for you.

10. Transfers abroad

Some service providers are based in the USA or may process data there. In the view of Switzerland and the EU, the USA only offers an adequate level of data protection for companies certified under the Data Privacy Framework. Where a provider is certified we rely on that, otherwise on the EU Commission’s standard contractual clauses (with the adjustments required for Switzerland). In addition we ask for your explicit consent to these transfers. Despite these measures, US authorities may under certain circumstances access data.

11. Cookies, local storage, tracking

The app only uses technically necessary cookies or local storage: for your login, your settings (e.g. language, expanded and collapsed sections) and to cache a workout in progress, drafts and data for offline use on your device. We do not use analytics, tracking or advertising tools. Fonts are self-hosted; no connection to Google Fonts is made.

The website a-squared.ch does not use cookies or tracking. The application form transmits your details to us encrypted; you receive a confirmation by email (via Resend). When you visit it, our hosting provider Vercel records technical data (including IP address) in server logs to deliver and secure the website.

12. How long we keep data

• Coaching and account data: as long as your account exists and at most 12 months after the end of your last subscription or coaching, so you can continue if you come back. We delete it afterwards.
• With “Delete my data” in the app you can delete your account and all coaching data yourself at any time, immediately.
• Payment and accounting records (invoices, payments, subscription history): 10 years, as required by law (Art. 958f Swiss Code of Obligations). Stripe additionally retains payment data under its own legal obligations.
• Server and error logs: usually a few days up to 30 days.
• Technical backups of our service providers: deleted data may remain in them for up to 30 days until it is automatically overwritten. We only use them to restore data after a technical failure.
• Emails to us: as long as needed to handle them, at most 2 years, unless they form part of accounting records.

13. Security

Data is transmitted encrypted (HTTPS). Access is restricted by login and database access rules so that each client only sees their own data. Absolute security on the internet is, however, not possible.

Only Alex and Amelia have coach access to client data. If a data security breach is likely to result in a high risk to you, we will notify the Swiss FDPIC and, where required, you, as provided by law.

14. Your rights

You have the right to access your data, to rectification, erasure, restriction of processing, to receive or transfer your data in a common format, to object to processing based on legitimate interests and to withdraw your consents with effect for the future. Write to team@a-squared.ch. We may ask for proof of identity and usually respond within 30 days.

You can lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). If you live in the EU, also with the data protection authority of your country.

15. Age

The app and the coaching are intended exclusively for persons aged 18 and over.

16. Changes

We update this privacy policy when our processing changes. For material changes we ask for your consent again in the app. The current version on this page applies.