Privacy policy

1. Who is responsible for your data?

Masse is coaching software. Your coach is the controller of the data of your coaching: they decide what is asked and why. Masse, published by Kevin Cordeiro, hosts and processes it on the coach’s behalf, as a processor (article 28 of the GDPR). For the coaches’ own accounts, Masse is the controller.

2. Which data?

• Identity and contact: first name, last name, date of birth, e-mail, WhatsApp number, Instagram account if you give it.
• Intake questionnaire: training experience, sessions per week, goal, what has held you back, motivation, time available.
• Video calls: the slot you book with your coach, and its cancellation if any.
• Training: the programme you receive, the sets, reps and loads you log.
• Check-ins: weight, measurements, answers, and three photos per check-in.
• Nutrition: plan, meals logged, supplements.
• Health data, with your explicit consent: injuries and contraindications, pain you report during a session, cycle dates (never symptoms), sleep. Steps are typed by hand.
• Invoicing: amounts, invoices issued by your coach.

Your symptom notes never leave your phone: they are stored on the device only.

3. Why, and on what basis?

• Providing your coaching (programme, check-ins, nutrition): performance of the coaching contract (article 6.1.b).
• Health data: your explicit consent (article 9.2.a), which you can withdraw at any time.
• Invoicing: legal obligation (article 6.1.c).

No advertising, no resale, no trackers, no profiling.

4. Who has access?

Your coach, and no one else. The database itself enforces it: a coach sees only their clients, a client sees only their own data. The technical providers that run Masse:

• Supabase — database, photo storage, sign-in — servers in the European Union (Frankfurt, Germany).
• Vercel — hosting of the application — run in Europe (Frankfurt). Vercel Inc. is a US company: any transfers are covered by the Data Privacy Framework and the European Commission’s standard contractual clauses.
• Brevo — sending of sign-in e-mails and invoices — a French company.

5. For how long?

• For as long as your coaching lasts.
• When your coach archives your file: photos erased after 3 months, everything else after 12 months, automatically.
• If your sign-up is a request your coach has to approve: everything is erased at once if your coach refuses it or if you withdraw it.
• If you delete your account: everything is erased at once.
• Exception: invoices are kept for 10 years by your coach, as French law requires (Commercial Code, article L123-22).

6. Your rights

You can access your data, correct it, erase it, get it back in a file (portability), object to or ask to restrict a processing, and withdraw your consent for your health data. Almost all of it can be done on your own, in the app: Settings → My data (download, withdraw consent, delete the account) and Settings → My details. For anything else, write to your coach or to contact@masseapp.online.

If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with the authority of your own country.

7. Security

Data hosted in Europe, encrypted connections, photos in a private space only you and your coach can reach, access limited by the database itself. Every reading of client data by a platform administrator is logged, with a reason. If you turn on a passkey (Face ID, fingerprint), Masse keeps only its public key: your face or fingerprint never leaves your device.

8. Cookies and local storage

Masse uses only what it needs to work: the sign-in cookie and the language cookie. Your phone also keeps locally your theme, the sets you log offline and your symptom notes. No advertising cookie, no audience measurement: so no banner is needed.

9. Age

Masse is reserved for people aged 18 and over.