Privacy policy
Last updated: 30 July 2026
This English version is provided for convenience. The Service is operated from France and governed by French law; in case of any discrepancy, the French version prevails.
This policy explains what personal data Koach collects, why, how long it is kept, who it is shared with and what rights you can exercise. It is drawn up in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act.
It covers the Koach mobile application and the koachapp.fr website.
1. Data controller
Alexandre D'Agate, sole trader (entrepreneur individuel), registered with the Angers trade register under number 919 899 179, 15 rue Joubert, 49100 Angers, France.
Contact for any question about your data: alexandre@koachapp.fr.
Data protection officer: Mr D'Agate Alexandre.
2. Data collected
2.1 Account and profile
Email address, password (stored as a non-reversible hash), first name, last name or username, date of birth, gender, profile picture, declared level, goals and training preferences.
If you sign in with Google or Apple, the account identifier and email address passed on by the provider.
2.2 Training activity
Sessions created and completed, exercises, sets, reps, loads, rest times, duration, distance, estimated calories, how it felt, personal records and the related history.
This is self-declared activity data: it is neither a medical record nor a diagnosis.
2.3 Body data
Weight, height, body fat and measurements (waist, hips, chest, arm, thigh), along with their history.
Tracked over time, this data says something about your physical condition and is treated as data concerning health within the meaning of article 9 of the GDPR. It is only collected if you enter it yourself, on the basis of your explicit consent (article 9.2.a). You can withdraw that consent at any time by deleting this data from the application.
2.4 Published content
Posts, photos, comments, reactions, follows, reports and social interactions.
2.5 Technical data
Session identifier, device type, operating system, application version, language, IP address, technical logs, performance data and crash reports.
2.6 Advertising identifiers
Your device's advertising identifier (IDFA on iOS, GAID on Android) and the related browsing data.
These identifiers are only read once your consent has been collected through the consent dialog shown on first launch. Until you consent, they are neither read nor transmitted.
2.7 Notifications
The push notification token tied to your device, if you agreed to receive notifications.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and managing your account | Performance of the contract |
| Providing the training and tracking features | Performance of the contract |
| Recording weight and measurements | Explicit consent |
| Displaying the social feed and handling interactions | Performance of the contract |
| Sending push notifications | Consent |
| Sending service emails (verification, reset) | Performance of the contract |
| Displaying personalised advertising | Consent |
| Measuring audience and improving the product | Consent |
| Moderating reported content | Legal obligation and legitimate interest |
| Ensuring security and preventing abuse | Legitimate interest |
| Responding to a legal obligation or a formal request | Legal obligation |
4. Advertising
The application serves advertising through third-party networks, in particular Google (AdMob / Ad Manager). These partners may process your advertising identifier, browsing data and an approximate location.
Your consent is collected through a GDPR-compliant consent management platform (CMP) before any identifier is read. You can change or withdraw it at any time from the application settings; withdrawing it does not remove advertising, it makes it non-personalised.
The koachapp.fr website itself serves no advertising.
5. Recipients and processors
Your data is never sold or rented. It is accessible to authorised staff of the publisher and to the following providers, acting as processors:
| Provider | Role | Location |
|---|---|---|
| Render Services, Inc. | Hosting the application and the database | Frankfurt (EU) |
| Amazon Web Services | Storing photos and media | Paris |
| Resend | Sending transactional emails | Ireland |
| Expo | Delivering push notifications | United States |
| PostHog | Audience measurement and crash reports | European Union |
| Google AdMob / Ad Manager | Serving advertising | United States |
It may also be disclosed where required by a legal obligation or a formal request from a competent authority.
6. Transfers outside the European Union
Some providers, in particular Google and Expo, process data in the United States. These transfers are covered by appropriate safeguards within the meaning of chapter V of the GDPR — the European Commission's standard contractual clauses and, where applicable, certification under the Data Privacy Framework.
7. Retention periods
- Account and related data: for the lifetime of the account, then deleted or anonymised within 30 days of its deletion.
- Inactive accounts: 3 years after the last sign-in.
- Technical logs and crash reports: 12 months.
- Advertising consent records: 6 months.
- Data kept under a legal obligation: for the applicable statutory period.
8. Your rights
Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability, as well as the right to withdraw your consent at any time and to set instructions about what happens to your data after your death.
To exercise them, write to alexandre@koachapp.fr. You will receive an answer within one month, extendable by two months for complex requests.
If you believe your rights are not being respected, you can lodge a complaint with the CNIL, the French data protection authority (3 place de Fontenoy, 75007 Paris, cnil.fr).
9. Deleting your account
Deleting your account from the application erases your training and body data, as well as your published content, except for data that has to be kept for a legal reason.
10. Cookies and trackers
The koachapp.fr website sets no advertising cookie and no audience measurement tracker. Fonts are loaded from Fontshare, which involves a connection to that service.
The application uses technical trackers needed to run, as well as advertising and audience measurement trackers subject to your consent. You can change your preferences at any time from the settings.
11. Security
Passwords are stored as non-reversible hashes, traffic is encrypted in transit, access to production data is restricted to authorised people and access is logged. As no system is infallible, these measures constitute an obligation of means.
12. Minors
The Service is not intended for people under 15, the age of digital consent in France. Between 15 and 18, use requires the agreement of legal representatives, as set out in the terms of use.
No data concerning a child under 15 is intentionally collected. Such data will be deleted upon a simple report to alexandre@koachapp.fr.
13. Changes
This policy may change. Any substantial change will be flagged in the application before it takes effect.