Privacy Policy

Effective date: 14 August 2026. This version updates the controller's details following incorporation.

CuttingCoach is a tracking companion for people using GLP-1, GIP or glucagon receptor agonist medications. It is for adults aged 18 or over.

The short version

Your health data lives on your phone. If you never create an account, nothing you record ever reaches us and most of this policy simply does not apply to you. If you choose to create an account, an encrypted copy of your tracking data is stored on servers in the European Union so you can back up and sync between devices, and you can delete all of it, permanently, from inside the app at any time. We show no ads, we use no analytics trackers and we never sell or share your data.

What the app records

Whatever you choose to log: injection doses, dates and sites, weight, daily water, daily macros, side effects and, with premium, body composition, lifts and session ratings, plus your settings (medication name, dose, goal weight, targets, units, reminder day and time, and, if you use the targets wizard, sex, date of birth, height, activity level and chosen deficit, used only to calculate suggested targets on your device). Some of this is health data, which UK law treats as special category data deserving extra protection. We agree with that framing, which is why the app is local-first.

If you do not create an account

Everything above is stored only in the app's storage on your device. It is not transmitted to us or anyone else. There are no analytics, no advertising identifiers and no tracking of any kind in the app. Jab reminders are scheduled on the device itself. If you uninstall the app or clear its data, the data is gone; the in-app export exists so you can make your own backups.

If you create an account

Creating an account is optional and adds backup and cross-device sync. When signed in we process:

• Account data: your email address and sign-in credentials (or your Google identity if you choose Google sign-in), used to operate your account. Lawful basis: performance of a contract (Article 6(1)(b) UK GDPR).
• Your tracking data (the health data listed above), synced to our database so we can store your backup and deliver it to your other devices. We process this data, which includes health data, because you give us your explicit consent (Article 6(1)(a) and Article 9(2)(a) UK GDPR) when you choose to create a sync account, through a separate, specific, unticked consent control at account creation, not bundled into acceptance of the Terms. You may withdraw that consent at any time by deleting your account in the app; this permanently deletes the synced data, subject only to any clearly stated, limited technical retention.

Your synced data is stored with Supabase in Frankfurt, Germany, in the European Union, encrypted in transit and at rest, and is protected by row level security, so each account can only ever read or write its own rows. We do not use your data for anything except operating your account and sync. No advertising, no profiling, no selling, no use for training AI models.

Our processors

We use a small number of service providers acting on our instructions: Supabase (database and authentication, primarily processed in Frankfurt, EU), Netlify (website hosting and, later, the small server functions that verify subscription purchases) and, only if you choose them, Google (Google sign-in; and Google Play processes subscription payments entirely on its own terms, we never see your payment details). Each processor is bound by a data processing agreement.

Choosing Frankfurt as our database region means your data is primarily stored and processed there, but it does not mean every part of the service is. Our processors, in turn, rely on their own sub-processors for things like infrastructure and customer support tooling, and some of those are located outside the UK and EU. Where that happens, the transfer is protected by Standard Contractual Clauses and the UK's international data transfer addendum, put in place through our agreement with each processor. We will keep this section current and will name any processor whose sub-processors materially change how your data is handled.

Premium subscriptions

If you subscribe, Google Play handles the payment. We store only your subscription status (active or not, plan and expiry) against your account so premium features unlock on your devices. Cancelling or managing the subscription happens in Google Play. Note that deleting your CuttingCoach account does not cancel a Play subscription; the app reminds you of this and links to Play's subscription screen.

How long we keep data

Synced data: for as long as your account exists. Delete your account in the app (Settings, Account, Delete account) and every row of your data is deleted immediately from our live database; this is automatic, with no support ticket required. Our database provider also keeps routine backup copies for resilience (currently up to seven days), so a very recent deletion may still exist in a backup until that backup is itself automatically overwritten on its normal schedule; backups are not otherwise accessed and are not used to restore individually deleted data. Local data on your phone always remains yours to keep or wipe. We keep no server logs that identify you beyond short-lived operational logs held by our processors.

Your rights

Under UK GDPR you can ask us for access, rectification, erasure, restriction, portability or to object, and you can withdraw consent at any time. The app is built so the two big ones need no request at all: portability is the in-app export (a complete copy of your data in a documented JSON format) and erasure is in-app account deletion. For anything else email cuttingcoach@gmail.com and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Children

CuttingCoach is for adults prescribed these medications and is not intended for anyone under 18. We do not knowingly hold data on under-18s; if you believe we do, contact us and we will delete it.

The website

cuttingcoach.co.uk is a static informational site. It sets no cookies and runs no analytics, so it needs no cookie banner. If that ever changes this policy will change first.

Changes to this policy

We will post any changes here with a new effective date, and for meaningful changes we will tell you in the app before they take effect. We will never quietly downgrade your protections; anything that expands how your data is used would require your fresh consent.