1. Who we are
highlinesx (the "Service", "we", "us") is a coaching platform that connects independent coaches with their clients. This policy explains what personal data we collect when you use the web app or the highlinesx mobile apps, and what we do with it.
2. What we collect
Account information
- Name, email address and (where applicable) phone number
- A password (stored only as a salted hash — we never see your plaintext password)
- Account role — coach, client or admin
Profile content
- Coach profiles: bio, expertise, rates, profile photo, cover image
- Client profiles: optional goals, preferences and check-in data
Messages and uploads
- Chat messages exchanged between coaches and their clients
- Voice notes, video messages and any other files you upload via the chat or check-in flows
- Session-related metadata: join timestamps, session status
Device and usage data
- Mobile push notification device tokens (Apple APNs / Google FCM)
- Basic request logs (IP address, user-agent, route, timestamp) used for abuse-prevention and debugging
Payment data
- We use a third-party payment processor to handle transactions. We receive metadata (amount, status, last four digits of the card if available) but we do not store full card numbers or banking credentials on our servers.
Zoom account connection (coaches only)
- A coach may choose to connect their own Zoom account so they can host live coaching sessions from within highlinesx. Doing this is optional — coaches who don't connect Zoom can still schedule sessions and share a meeting link manually.
- If a coach connects Zoom, we receive an OAuth access/refresh token pair and basic Zoom identity info (Zoom user ID, account email) via Zoom's standard OAuth flow. We never see or store the coach's Zoom password.
- We do not receive Zoom meeting recordings, chat transcripts from other Zoom meetings, or any data from Zoom meetings unrelated to highlinesx coaching sessions.
3. How we use it
- Operate the service. Authenticate you, deliver chat and live sessions, settle payments to coaches, and surface notifications.
- Improve the product. Aggregate, anonymized signals about feature usage and error rates.
- Optional AI assistance. When AI features are enabled, certain content (e.g. a meal log, a weekly recap draft) is sent to our AI provider (currently Google Gemini) to generate a response. AI providers process content under their own contractual terms; we do not use your chat content to train models.
- Zoom-hosted live sessions. For a coach who connects Zoom, we use their OAuth grant to create an instant meeting in that coach's own Zoom account when they start ("Go Live") a session, and to obtain a short-lived host start credential so their own app can launch that meeting as host. This connection is used only to act on the connecting coach's own Zoom account — never any other Zoom account.
- Safety and disputes. Review reported messages, session join timestamps, and uploaded evidence when a dispute is opened, so an admin can settle it fairly.
- Legal. Comply with applicable laws and lawful requests.
4. When we share data
We do not sell your personal data. We share it only with:
- Your coach or your clients — chat content, profile info and session activity are shared with the people you are coaching or being coached by, by design.
- Service providers we rely on to run the product: our cloud storage provider (DigitalOcean Spaces / Cloudflare R2), push notification providers (Apple, Google Firebase), and our payment processor.
- Zoom — for coaches who connect their Zoom account, we call Zoom's API, under that coach's own OAuth authorization, to create and start meetings on their behalf. We only send what's needed to open the meeting (e.g. a session topic); we do not send client health, payment, or chat data to Zoom.
- Administrators of the platform, when reviewing a dispute or a safety report.
- Law enforcement, only when compelled by a valid legal request.
5. Where data is stored
Application data is stored in a PostgreSQL database hosted by our cloud infrastructure provider. Uploaded media (photos, voice notes, videos) is stored on S3-compatible object storage. Zoom OAuth tokens are encrypted at rest before storage. Some providers operate from regions outside your country; using the Service means you accept this cross-border processing.
6. How long we keep it
- Account data: for as long as your account is active.
- Chat history and session records: retained while the relevant subscription is active and for a reasonable archival period afterwards to support disputes and accounting obligations.
- Zoom OAuth tokens: kept only while a coach's Zoom connection is active, and deleted immediately when the coach disconnects Zoom from their profile settings.
- Backups: routine backups may persist data beyond deletion, but they cycle out within a bounded retention window.
- Request logs: short retention, used for operational debugging.
7. Your rights
Depending on where you live (e.g. EU/UK GDPR, California CCPA), you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and associated personal data
- Export a copy of your data
- Object to or restrict certain processing
To exercise any of these, email [email protected]. We will respond within the timeframes required by applicable law.
8. Children
highlinesx is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a minor has provided us data, contact us and we will delete it.
9. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top of this page reflects the current version. Material changes will be announced inside the app.
10. Contact
Questions or requests?
- Privacy inquiries: [email protected]
- General support: [email protected]