Stem App Privacy Policy

1. Who uses Stem, and who sees what

Stem is a platform two kinds of people use:

• Coaches run their coaching business on Stem.
• Clients are invited by a coach to be coached. Client accounts are invite-only. There is no public sign-up.

If you are a client, your coach can see the data you record in Stem: your workouts, nutrition logs, body measurements, progress photos, form-check videos, messages and check-ins. That sharing is the entire point of the product. You are choosing to share this information with your coach so they can coach you. Your coach cannot see clients belonging to other coaches, and other coaches cannot see you. Each coach's data is isolated from every other coach's.

Your coach can also export your data from Stem, for example to keep a copy, or to paste it into an analysis or AI tool that helps them plan your coaching. Stem leaves your name out of an export unless your coach chooses to include it. Once your coach has exported your data, that copy is in your coach's hands: their own privacy practices apply to it, not this policy, and Stem cannot see or control it. If you want to know how your coach handles your data, ask them.

2. What we collect

Account and identity

• Your name and email address.
• For clients: your phone number, if your coach adds it (optional).
• For clients: your date of birth, if you or your coach add it (optional).
• A password, stored only as a secure one-way hash, so we never see or store the plain text.
• For coaches: your business name and optional profile photo.

Health and fitness data (sensitive, see Section 8)

• Workout logs: exercises, sets, reps, weights, and effort ratings (RIR or RPE).
• Nutrition logs: foods, quantities and calorie or macronutrient values you record, including entries added by scanning a barcode.
• Body measurements and bodyweight over time.
• Intake-form answers and periodic check-in responses.

Progress photos (sensitive, see Section 8)

• Photos you upload to track physical progress. Clients own their photos: you can delete any of them yourself at any time, and your coach can view but cannot upload or delete them.

Form-check videos (sensitive, see Section 8)

• Short videos of yourself performing an exercise, with their sound, that you choose to send to your coach. They are recorded or picked by you, converted on your phone, and then uploaded.

Messages and voice notes

• The content of messages and voice notes you exchange with your coach (or, for coaches, your clients), including any images, video clips or files attached.

Payment information

• Coaches pay for Stem, and clients pay their coach, through Stripe. Card and bank details are entered directly with Stripe and never touch Stem's servers. We store only what we need to run billing, for example your subscription status and a record that a payment occurred.

Device and technical data

• A device token for push notifications, registered when you sign in on a device, so we can deliver the notifications you allow.
• Your device's time zone, sent when you sign in, so days and dates in the app follow your local time and so we can see which regions our users are in.
• Standard technical data needed to operate and secure the service, for example authentication tokens and request logs (the time, the address requested and whether it succeeded). Our logs record only the network a request came from (the first part of its IP address, enough to tell an internet provider or country apart), never your full IP address. Our hosting providers see it when your device connects, as with any internet service.
• Crash reports from the iOS and Android apps: when the app hits an error, it sends the error, where in the app it happened, and your device model, operating system and app version. A crash report carries no name, email, account or IP address, and is not linked to you.
• Product usage events: a record that you used a feature (for example, that you signed in or shared a workout image), stored against your account in our own database. They carry only identifiers, categories and numbers, never free text, and are not sent to any analytics company.

Home and lock screen widgets (iPhone)

• If you add a Stem widget to your iPhone's home screen or lock screen, it shows information from your account there, such as your next session and the newest message from your coach (for coaches, the clients who need you today). That information is kept on your phone so the widget can show it. While the phone is locked, the widget hides names and other personal details.

We do not use advertising trackers, and we do not build an advertising profile of you.

3. How we use your information

We use your information only to run the coaching service:

• To provide the app's features: recording and displaying your training, nutrition, measurements, photos and messages, and sharing them with your coach as described above.
• To send transactional email you need, such as invites, password resets, and important account or billing notices, via our email provider.
• To send push notifications you have enabled, for example a new message from your coach.
• To process payments and manage subscriptions.
• To secure the service, prevent abuse, debug problems, and keep it running.
• To understand how the product is used so we can improve it, for example how many coaches are active. We analyse usage events in aggregate. This never involves selling your data or profiling you for advertising.

We never sell your personal information.

4. Nutrition lookups

Food search runs against Stem's own food database. When you scan a barcode we do not already hold, that barcode is sent to Open Food Facts, an open non-profit food database, to look up the product. Only the barcode is sent. We never send your name, account, or any health data.

5. Who we share it with

We share data only with the service providers we need to operate Stem, and only for that purpose. None of them are permitted to use your data for their own purposes.

Some of these providers are located overseas, so some of your data may be processed outside your country. We choose providers that offer appropriate protections, and our primary database, API and web servers are located in Australia.

We may also disclose information if required by law, or to protect the rights, safety or property of our users or Stem.

6. Where your data is stored

Your core data, meaning everything in the database, the API, and the web app, is stored and processed in Australia (Sydney). Uploaded media is stored in Cloudflare R2 with an Oceania location. Technical logs from our API are stored in the European Union and kept for up to 13 months in Cloudflare R2 with an Oceania location, and crash reports from the mobile apps are stored in the USA. Some service providers listed in Section 5 process limited data overseas.

7. How long we keep it, and deleting your account

• We keep your data for as long as your account is active.
• Clients can delete their account from within the app (Profile, then Delete account). This permanently deletes your personal data: your workouts, nutrition, measurements, progress photos, form-check videos, voice notes, messages, check-ins, intake answers and device tokens are erased and cannot be recovered. Your photos, videos and voice notes are deleted from storage at the same time, and a daily cleanup removes anything that deletion misses within 7 days. Where a financial record must be retained for accounting or tax obligations, it is kept with your identity removed, meaning your personal link to it is deleted.
• Clients can delete individual progress photos at any time from the Progress screen.
• If a coach ends a coaching relationship, they may archive a client, which removes the client from their active roster while retaining the record. This is separate from account deletion above.
• Coaches wishing to close their account and delete their data can contact us at support@stem.fit.
• Step-by-step instructions for both apps are at stem.fit/delete-account.

8. Sensitive data

Health and fitness information, progress photos and form-check videos are sensitive personal information. We collect them only because they are the core of a coaching service, we use them only to provide that service, and we share them only with your own coach, who can export them as Section 1 explains. We never sell this data, use it for advertising, or share it for any purpose other than delivering your coaching.

9. How we protect your information

• All connections to Stem are encrypted with HTTPS.
• Passwords are stored only as secure one-way hashes.
• Uploaded photos, videos and voice notes live in a private store with no public access. They are reachable only through short-lived signed links generated for you or your coach.
• Each coach's data is strictly isolated from every other coach's at the database-query level.
• Payment card details are handled entirely by Stripe and never stored on our servers.

No system is perfectly secure, but we work to protect your information using measures appropriate to its sensitivity.

10. Your rights

Depending on where you live, you have rights over your personal information, which may include:

• Access: ask for a copy of the data we hold about you.
• Correction: most of your data is editable directly in the app, and you can also ask us to fix it.
• Deletion: clients can delete their account in-app (Section 7), and anyone can ask us to delete their data.
• Portability, objection or restriction, where applicable law provides these rights.

To exercise any of these, email support@stem.fit. If you are in Australia and are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). If you are in the EU or UK, you may lodge a complaint with your local data protection authority.

11. Children

Stem is not intended for children under 16. Client accounts are invite-only and created through a coach, and we do not knowingly collect data from anyone under 16. If you believe a child has an account, contact support@stem.fit and we will remove it.

12. Changes to this policy

If we make material changes to this policy we will update the "Last updated" date and, where appropriate, notify you in the app or by email. Continued use of Stem after a change means you accept the updated policy.

13. Contact

Questions about your privacy, or want to exercise a right above? Email support@stem.fit.