Privacy Policy

1. Who we are

A90 ("we", "us") provides a personalised training and nutrition app, available through our website at www.a90trainingclub.com. This policy explains what data we collect, how we use it, and your rights.

2. Data we collect

• Account: email, display name, sign-in identifier (Apple/Google ID).
• Profile & onboarding: goals, training level, height, weight, gender, dietary preferences, allergies.
• Activity: workouts logged, sets, reps, weights, meals logged, plan progress.
• Photos (optional): progression photos you choose to capture or upload. Stored in a private, encrypted cloud bucket scoped to your account (only you can access them). Deleted immediately when you delete your account or remove a photo in-app.
• Camera & Photo Library (optional, on-device permission): we request camera and/or photo library access only when you tap to add a progression photo. We never access your camera or photo library in the background.
• Device: device id (for onboarding session linking), app version, OS, crash logs.
• Subscription & purchase: Apple/Google purchase tokens and entitlement status (active, trialing, expired). We do not see or store your payment card details - billing is handled entirely by Apple/Google.

3. How we use your data

To create and adapt your personalised plan, track progress, send service emails (account verification, plan updates), prevent fraud, and improve the App. We do not sell your data.

4. Third-party services

• Apple App Store / Google Play: billing & subscription management.
• Backend hosting: encrypted cloud database for your account and plans.
• Sign in with Apple / Google: federated authentication only. We receive your email and name.
• RevenueCat: validates your Apple/Google purchase receipts and keeps your subscription status in sync. Receives an anonymous user identifier and purchase token only - no profile, health, or activity data.

5. Data retention

Account data is retained while your account exists. When you delete your account, we delete your account, profile, onboarding answers, training plans and progress data. We may retain a minimal deletion audit record (a hashed identifier and the request and completion timestamps only, with no plain email, name, onboarding answers, plan data or device id) where required for security, fraud prevention, legal compliance, or to evidence completion of your request. Subscription receipts are held by Apple/Google under their own retention rules.

6. Your rights

You can: access your data (Settings → Account), correct it (Settings), export it on request, or delete your account (Settings → Delete Account). EU/UK residents have additional rights under GDPR including the right to lodge a complaint with a supervisory authority.

7. Children

A90 is not intended for children under 16. We do not knowingly collect data from children.

8. Security

Data is encrypted in transit (TLS) and at rest. Access is restricted by row-level security policies so only you can see your account. Progression photos are stored in a private bucket and served via short-lived signed URLs that only your authenticated session can generate. Passwords are checked against known data-breach databases (HaveIBeenPwned) on signup and change to block compromised credentials. Onboarding requests are rate-limited per device to prevent automated abuse.

9. Account deletion

You can permanently delete your account and personal data at any time:

• In the app: Profile → Settings → Delete Account. Your identity, profile, photos, badges, and plans are wiped immediately. Anonymised aggregate workout/meal records may be retained for analytics.
• From the web: Visit www.achieve90.com/support or email support@achieve90.com from your account email. We will action requests within 30 days.

10. Changes

We may update this policy. We'll notify you in-app of material changes.

11. Contact

Privacy questions or requests: support@achieve90.com. Website: www.a90trainingclub.com.

Achieve90 Ltd (Company No. 17200043), 4th Floor, Silverstream House, 45 Fitzroy Street, London, W1T 6EE.