Privacy Policy

Version 2026-10-13

COACTA PRIVACY POLICY

Effective Date: 2026-10-13
Entity: Coacta Corp ("Coacta," "we," "us," or "our")

This Policy explains what we collect, how we use and share it, and choices you have. It applies to the Coacta mobile apps, website, and related services (the "Services"). Our Terms of Service govern use of the Services. The Services are for users who are at least 18 years old.


1. Information we collect

Information you provide

- Account / auth: name, email, password (handled by our auth provider)
- Private account settings: gender, date of birth (used to confirm you are 18+), phone (optional), marketing opt-in, unit preferences
- Public profile: username, display name, city, bio, sports interests, profile photo, and related profile fields
- Activities and clubs: activity details (title, description, sport, planned time, start location name/coordinates, optional route notes as text, planned distance/duration/pace or similar fields, photos where allowed, visibility, RSVPs, comments, reminders), club details, membership and roles, join requests, club chat messages, polls, and announcements
- Messages, chat photos, and chat videos: direct messages you send, photos you send in club chat or in a direct message, and videos you send in club chat. Before a video is uploaded, the app removes the location and device details stored in the file, and our server refuses a video that still contains them
- Friends and social: friend requests/relationships, favorites, blocks, notification preferences
- Nudge messages: if you have Premium, the short message (up to 140 characters) you choose to add when you nudge a friend about an activity
- Availability: availability windows you choose to share (where the feature is offered)
- Event saves: races or catalog events you save to your profile
- Reports and feedback: reports about other users or content; product feedback you send us
- Support and requests: messages you send to our support, privacy, or safety contacts, including requests to remove content and the contact details and signature such a request contains
- Health and fitness information: training values you enter or import, such as maximum heart rate, functional threshold power (FTP), golf handicap, and the heart rate or power targets attached to a workout step. See "Health and fitness information" below
- Routes and workouts: routes you build or import (including the full path, elevation, distance, waypoints, and any timestamps present in a file you import) and structured workouts you build or import (steps, durations, intensity, and targets)
- Group waivers: if a group you join requires its own waiver, we record which version you accepted and when, along with the details listed under "Consent and security records"
- Contacts matching: if you choose to check your contacts, your device computes a one-way cryptographic hash of each phone number and email address in your address book and sends only those hashes. We compare them against hashes of our own users' phone numbers and emails to tell you which of your contacts already use Coacta. We do not receive or store your contacts, their names, or the numbers and addresses themselves, and we do not keep the hashes you send after answering the request. We record only how many hashes were checked and when, to limit abuse.

Information collected automatically

- Device / usage: app interactions, approximate diagnostics/crash data as provided by the platform or our analytics tools. This includes a record of the events you open and a running count of the activities you have RSVPed to in each sport. The count outlives the activities themselves, which are deleted shortly after they take place, and both are used to infer your sport interests as described under Advertising
- Push tokens: device push notification tokens when you enable notifications
- Consent and security records: when you accept our policies, accept a group waiver, or change a privacy preference, we record the time, which document version you accepted and its content hash, your platform and app version, your IP address, and, on the web, your browser user agent. We keep these to show what was agreed and to detect abuse. They are not used to build a profile of you and are never an input to advertising
- Location: when you choose an activity start point, set a club location or establishment address, save a discovery location preference, or view map-based event listings. We also use saved discovery locations for People nearby, which suggests people to add as friends. Suggestions can be based on the start points of public activities, the locations of clubs that are already visible to you, and the saved discovery locations of other members who appear in People nearby; in the same way, we use your saved discovery location to suggest you to signed-in members near you. Before a saved discovery location is compared, it is rounded to a wider area, and other members see only an approximate distance (for example, within 5 miles), never the location itself. You can stop appearing to others under Settings > Privacy and data > Show me in People nearby. We do not continuously track your location in the background for workout recording, and we do not offer live movement sharing. Separately, a route you build or import is stored in full, as described under "Routes and workouts" above; a route imported from a file may contain the exact path and times of an activity you actually completed
- Website: if you use Coacta.com, standard web logs and any cookies or similar technologies described on the site

From other sources

- Event catalog data may include publicly available race/event information and links to third-party registration pages
- Reports submitted by other users about your conduct
- Service providers that help us operate auth, hosting, maps/geocoding, or push delivery

Health and fitness information

A few fields are about your body rather than your schedule: maximum heart rate, FTP, golf handicap, and the heart rate or power targets on a workout step. Some U.S. state laws treat information like this as health data, so we handle it narrowly:

- You provide it. Coacta does not measure it. We do not read Apple Health, Google Fit, or any other health app, and we do not pair with a heart rate monitor, watch, or other wearable. It reaches us only when you type it in or import a workout file yourself
- We use it only to calculate and display your own workout targets and training zones
- We do not analyze photos or videos you send, for example to assess your form, gait, or an injury
- It is never an input to advertising, and we do not use it to infer health conditions, injuries, or fitness level for any other purpose
- It is visible to you. It reaches other users only through a workout or route you choose to share
- You can clear these fields at any time in the app, and deleting your account deletes them
- We do not sell it, and we do not share it for cross-context behavioral advertising

Payments

We may offer paid features. Card and store payment details are processed by Apple, Google, or other payment processors—not stored as full card numbers on Coacta servers. We may receive limited purchase metadata (for example product, status, entitlement). We will update this Policy if our payment practices change materially.


2. How we use information

- Provide and improve the Services (profiles, planned activities, clubs, chat, friends, calendars, availability, event browsing and saves)
- Apply visibility settings and show Content to the right audience
- Enforce the 18+ age requirement
- Enforce Terms and Community Guidelines, investigate reports, and protect safety
- Send product notifications you enable (activity, club, chat, group posts, friend activity, and similar)
- Send service announcements about the app itself, such as outages, safety notices, and changes to these policies. These are not marketing, and because they are part of operating the Services they go to every account rather than only to people who opted in. We keep them infrequent
- Send marketing only if you opt in; you can turn this off in Account information
- Analytics, troubleshooting, and product improvement
- Legal compliance, fraud prevention, and protection of Coacta and our users


3. How information is visible to others

Coacta is built around coordinating upcoming activities with chosen audiences. Visibility depends on settings you choose:

- Profiles and activity posts may be visible to friends, club members, selected friends, or a wider audience when you choose public (or similar) visibility
- Club members may see club activities, chat, polls, and member lists according to club settings and your role
- Your friends can see the groups you belong to, including private groups, and, unless you turn it off in Settings, a notice in their feed for 48 hours when you join one
- Some activities are marked female only by the person posting them. If your gender is set to female you can see and RSVP to those activities; if it is set to anything else, or left unset, they are hidden from you. Coacta does not verify gender, and your gender is not shown on your public profile
- If a group requires a waiver, its activities and chat stay hidden from you until you accept that group's waiver
- Direct messages and certain club chat content are visible to participants in that conversation; we may also access them when investigating reports or safety issues as described below
- Photos and videos sent in a club chat can be seen by the members of that chat, and photos sent in a direct message by both people in it. Anyone who can see a photo or video can keep a copy, for example by saving it, taking a screenshot, or recording the screen, and we cannot prevent that
- Unless you turn it off, signed-in members near your saved discovery location may see you suggested in People nearby, with an approximate distance and never your location
- A message you add to a nudge is shown to the friend you nudge, in the app and in the push notification on their device

You are responsible for the audience you choose. Content you share with others may be copied or reshared by them outside Coacta. Search engines may index publicly available profile pages if we make them publicly reachable.


4. Sharing

We do not sell personal information.

- Other users: see profile and activity/club information according to visibility settings
- Service providers: hosting, authentication, database, storage, maps/geocoding, analytics, email/push delivery, and (when used) payment/entitlement processors. They may process data only to provide services to us and must protect it appropriately. The main ones today are Supabase (hosting, database, authentication, file storage), Expo (app delivery and push notification delivery), Sentry (crash and error diagnostics), RevenueCat (subscription and entitlement management), and Google Cloud (drawing the map images shown for routes and activities). Email privacy@coacta.com for the current list
- Legal / safety: when required by law, valid legal process, or to protect users, the public, or Coacta—see also our Law Enforcement Guidelines when published
- Business transfers: merger, acquisition, financing, or sale of assets
- With consent: other cases you approve
- Aggregated or de-identified information that does not reasonably identify you may be used or shared for analytics or research

Advertising

We may show ads in the Services. We select which ads to show using information you give us, information that is part of your account, and what you do in the app. That includes the sports on your profile and the sports we infer you care about from the activities you post and RSVP to, the groups you join, the events you save or open, and the suggestions you tap, together with general profile details such as age range and gender, and your general location. This selection happens on our own systems.

Some things are deliberately kept out of ad selection and will not be added without an update to this Policy: your health and fitness information, including heart rate, FTP, and anything from the workout builder; the contents of chat and direct messages, including photos and videos sent in them, and any message you add to a nudge; reports and blocks you submit; the hashes used for contact matching; and whether you can see female-only activities.

We do not sell your personal information. We do not share your personal information with third parties for cross-context behavioral advertising, and we do not allow advertisers to track you across other apps or websites. Advertisers receive aggregate reporting about how their ads performed—for example how many times an ad was shown—not personal information about you or lists of the people who saw it.

We do not use information about your health, injuries, or medical conditions to select ads.

If we change these practices—for example by working with a third-party advertising network—we will update this Policy, give notice before the change takes effect, and provide the choices required by applicable law, including an opt-out of sharing for targeted advertising and honoring browser or device opt-out signals where required.


5. Retention and deletion

We retain information as needed to operate the Services, enforce our rules, and meet legal obligations. In general, account-associated information is kept until you delete the account or the information is no longer needed for those purposes. Notices in your friends' feeds that you joined a group are deleted after 48 hours. A message you add to a nudge is stored with the recipient's notifications: it is not deleted when the activity it was about is deleted, and it is removed when the recipient deletes their account.

Photos sent in chat are deleted 24 months after they are sent; the message stays, without the photo. Videos sent in club chat are deleted 90 days after they are sent, and the message then shows that the video has expired.

A photo is also deleted, usually within a day, when its message is unsent or removed by a group admin, or when the account that sent it is deleted. A video that is removed before its 90 days are up disappears from the chat for everyone at once, and within about a minute it can no longer be played anywhere. That includes a video its sender unsends, one a group admin or Coacta removes, and one in a group that is deleted. For 7 days after the removal we keep a copy of the video and its preview image, with a record of the message and of who removed it, where only Coacta can reach them, in case the video is reported to us or we receive a legal request to preserve it. After the 7 days we delete them, unless one of those has happened. If we cannot make the copy, the video is deleted without one. When the account that sent a video is deleted, its videos and any of these copies are deleted at once, unless they have been reported or are under a legal request to preserve them.

If a message, photo, or video is reported, we keep a copy of what was reported, where only Coacta can reach it, until the report is resolved and for one year after that. We keep it longer where the law requires, for example for at least one year after a report to the National Center for Missing & Exploited Children, or while a legal request to preserve it is in effect.

You can delete your account in the app (Account information > Delete account). After deletion, we aim to remove or de-identify personal information from active systems within a reasonable period (target: within 45 days), except where we must retain data for legal, security, dispute, or backup purposes, or where copies remain with other users (for example messages they received).

Consent and security records—which policy or group waiver version you accepted, when, and the details listed under "Consent and security records" above—are kept while your account exists, and may be kept for a limited period after deletion where we need them to show what was agreed or to establish or defend a legal claim.

We do not control content you posted to third-party sites or that others copied outside Coacta.


6. Your choices and privacy rights

Choices in the product

- Update account and profile fields
- Control activity and content visibility where the product allows
- Control push notification preferences
- Turn off the notice your friends see when you join a group
- Turn off whether you appear in People nearby
- Control marketing opt-in
- Control device location permissions
- Control contacts permission, and turn off whether people who already have your phone number or email can find your profile
- Clear your health and fitness fields (maximum heart rate, FTP, golf handicap) at any time
- Delete Content you control or delete your account

Rights that may apply where you live

Depending on your location, you may have rights to access, correct, delete, or obtain a copy of personal information; to appeal a denied request; and to authorize an agent to act for you. Email privacy@coacta.com to make a request. We may need to verify your identity (and your agent's authority) before fulfilling a request. We will not discriminate against you for exercising privacy rights.

California and other US state residents may have additional rights under CCPA/CPRA and similar laws, including rights related to sensitive personal information and opting out of sale/share for targeted advertising.

Washington and Nevada residents have specific rights concerning consumer health data, which under those laws can include the fitness information described under "Health and fitness information." You may confirm whether we collect it, ask which third parties we shared it with, and ask us to delete it. Email privacy@coacta.com and we will respond as those laws require. As stated above, we do not sell that information and do not share it for advertising.

We do not use automated decision-making that produces legal or similarly significant effects about you without human involvement.


7. Security

We use administrative, technical, and organizational safeguards appropriate to the nature of the data we handle. No method of transmission or storage is fully secure.


8. Children's privacy

The Services are for adults only. You must be at least 18 years old to create an account or use the Services. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete the account and related personal data. Contact privacy@coacta.com if you believe someone under 18 has provided information.


9. International transfers

The Services are offered only in the United States and are not directed to users in other countries. Information is processed in the United States and in other countries where our service providers operate. If we later offer the Services in regions that require additional safeguards for cross-border transfers, we will update this Policy before doing so.


10. Changes

We may update this Policy. We will post the updated Policy with a new effective date and, for material changes, provide prominent notice that is reasonable under the circumstances. If you object to changes, stop using the Services and delete your account.


11. Contact

- privacy@coacta.com
- Support: support@coacta.com
- Postal: Coacta Corp, 16192 Coastal Hwy, Lewes, DE 19958