Stem App Privacy Policy

1. Who uses Stem, and who sees what

Stem is a platform two kinds of people use:

• Coaches run their coaching business on Stem.
• Clients are invited by a coach to be coached. Client accounts are invite-only. There is no public sign-up.

If you are a client, your coach can see the data you record in Stem: your workouts, nutrition logs, body measurements, progress photos, messages and check-ins. That sharing is the entire point of the product. You are choosing to share this information with your coach so they can coach you. Your coach cannot see clients belonging to other coaches, and other coaches cannot see you. Each coach's data is isolated from every other coach's.

2. What we collect

Account and identity

• Your name and email address.
• A password, stored only as a secure one-way hash, so we never see or store the plain text.
• For coaches: your business name and optional profile photo.

Health and fitness data (sensitive, see Section 8)

• Workout logs: exercises, sets, reps, weights, and effort ratings (RIR or RPE).
• Nutrition logs: foods, quantities and calorie or macronutrient values you record, including entries added by scanning a barcode.
• Body measurements and bodyweight over time.
• Intake-form answers and periodic check-in responses.

Progress photos (sensitive, see Section 8)

• Photos you upload to track physical progress. Clients own their photos: you can delete any of them yourself at any time, and your coach can view but cannot upload or delete them.

Messages and voice notes

• The content of messages and voice notes you exchange with your coach (or, for coaches, your clients), including any images or files attached.

Payment information

• Coaches pay for Stem, and clients pay their coach, through Stripe. Card and bank details are entered directly with Stripe and never touch Stem's servers. We store only what we need to run billing, for example your subscription status and a record that a payment occurred.

Device and technical data

• A device token if you enable push notifications, so we can deliver them.
• Standard technical data needed to operate and secure the service, for example authentication tokens, and server logs containing IP address and request metadata.

We do not use advertising trackers, and we do not build an advertising profile of you.

3. How we use your information

We use your information only to run the coaching service:

• To provide the app's features: recording and displaying your training, nutrition, measurements, photos and messages, and sharing them with your coach as described above.
• To send transactional email you need, such as invites, password resets, and important account or billing notices, via our email provider.
• To send push notifications you have enabled, for example a new message from your coach.
• To process payments and manage subscriptions.
• To secure the service, prevent abuse, debug problems, and keep it running.
• To look at aggregate, non-identifying usage patterns so we can improve the product, for example how many coaches are active. This never involves selling your data or profiling you for advertising.

We never sell your personal information.

4. Nutrition lookups

When you search for a food by name or scan a barcode, the search term or barcode is sent to Open Food Facts, an open non-profit food database, to look up nutrition information. Only the search term or barcode is sent. We never send your name, account, or any health data.

5. Who we share it with

We share data only with the service providers we need to operate Stem, and only for that purpose. None of them are permitted to use your data for their own purposes.

Some of these providers are located overseas, so some of your data may be processed outside your country. We choose providers that offer appropriate protections, and our primary database, API and web servers are located in Australia.

We may also disclose information if required by law, or to protect the rights, safety or property of our users or Stem.

6. Where your data is stored

Your core data, meaning everything in the database, the API, and the web app, is stored and processed in Australia (Sydney). Uploaded media is stored in Cloudflare R2 with an Oceania location. Some service providers listed in Section 5 process limited data overseas.

7. How long we keep it, and deleting your account

• We keep your data for as long as your account is active.
• Clients can delete their account from within the app (Profile, then Delete account). This permanently deletes your personal data: your workouts, nutrition, measurements, progress photos, messages, check-ins, intake answers and device tokens are erased and cannot be recovered. Where a financial record must be retained for accounting or tax obligations, it is kept with your identity removed, meaning your personal link to it is deleted.
• Clients can delete individual progress photos at any time from the Progress screen.
• If a coach ends a coaching relationship, they may archive a client, which removes the client from their active roster while retaining the record. This is separate from account deletion above.
• Coaches wishing to close their account and delete their data can contact us at support@stem.fit.

8. Sensitive data

Health and fitness information and progress photos are sensitive personal information. We collect them only because they are the core of a coaching service, we use them only to provide that service, and we share them only with your own coach. We never sell this data, use it for advertising, or share it for any purpose other than delivering your coaching.

9. How we protect your information

• All connections to Stem are encrypted with HTTPS.
• Passwords are stored only as secure one-way hashes.
• Uploaded photos and voice notes live in a private store with no public access. They are reachable only through short-lived signed links generated for you or your coach.
• Each coach's data is strictly isolated from every other coach's at the database-query level.
• Payment card details are handled entirely by Stripe and never stored on our servers.

No system is perfectly secure, but we work to protect your information using measures appropriate to its sensitivity.

10. Your rights

Depending on where you live, you have rights over your personal information, which may include:

• Access: ask for a copy of the data we hold about you.
• Correction: most of your data is editable directly in the app, and you can also ask us to fix it.
• Deletion: clients can delete their account in-app (Section 7), and anyone can ask us to delete their data.
• Portability, objection or restriction, where applicable law provides these rights.

To exercise any of these, email support@stem.fit. If you are in Australia and are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). If you are in the EU or UK, you may lodge a complaint with your local data protection authority.

11. Children

Stem is not intended for children under 16. Client accounts are invite-only and created through a coach, and we do not knowingly collect data from anyone under 16. If you believe a child has an account, contact support@stem.fit and we will remove it.

12. Changes to this policy

If we make material changes to this policy we will update the "Last updated" date and, where appropriate, notify you in the app or by email. Continued use of Stem after a change means you accept the updated policy.

13. Contact

Questions about your privacy, or want to exercise a right above? Email support@stem.fit.