BoxCoach Privacy Policy

Updated 29 September 2026.

BoxCoach is operated by Safi Shaaban (סאפי שעבאן). For privacy questions or requests to access, correct, export or delete data, contact business.shabaan@gmail.com.

BoxCoach processes account and contact details, club and coach links, user-selected photos, training schedules, attendance, programs, messages, packages and payment records. Athletes or coaches may provide stance, experience, goals or weight. Do not put card details, passwords or medical documents in messages.

The public community may show a club name, city, address, coordinates, logo, cover image, description, opening hours, public coach names, posts and events. Following a club and requesting to join remain private to the relevant user and club. Reports include the reported item and reason so the platform operator can review them. A minor may appear in community content only when the publishing club confirms guardian authorization.

For Push delivery, BoxCoach processes an installation identifier, Expo Push token, platform, app version, language, time zone, preferences, delivery tickets and receipts. Notification content is kept limited and preferences can be changed in the app or device settings.

For the club-owner subscription, BoxCoach processes the store and product identifier, a provider transaction or purchase reference, signed server-notification status, expiry and offer status. Apple or Google handles the store payment and card data; BoxCoach does not receive or store the full card number.

Data is used to provide accounts and club operations, public discovery and community features, deliver requested notifications, verify subscription access, support users, prevent abuse and secure the service. BoxCoach does not sell personal data, use a targeted-advertising SDK or track users across other companies’ apps and websites.

Access depends on role. Coaches see assigned athletes; financial access needs permission; guardians see linked children. The platform operator manages accounts, clubs, reports and moderation. Private-content support access requires time-limited club approval, except the specific content included in a user report.

Supabase provides authentication, database, Edge Functions and file storage; the project database is in Paris. Expo provides builds, web hosting and Push delivery. Brevo sends account email through SMTP. Apple and Google Play process subscription transactions in their respective stores. These providers may process technical data in other countries under their own safeguards.

Data is retained while needed to operate the account, club, community and subscription. Request deletion in Settings with explicit confirmation or contact support after identity verification. Deletion disables access and removes the login account, profile details, personal files and linked training content. Other people’s accounts are not deleted. Content made for another athlete or public club content may remain without a link to the deleted account when another lawful controller still needs it.

Limited financial amounts, transaction references, moderation records, security logs and audit links may remain for disputes, fraud prevention and legal recordkeeping. Backups are not used for routine service; deletion requests must be reapplied after restoration. A failed deletion step is not reported as completed.

Independent accounts are for adults aged 18 or over. Clubs handling a minor’s data must link a guardian and obtain required authorization. Access controls, club isolation, encrypted transport and expiring private-file links reduce risk but cannot guarantee absolute security. Material policy changes will be published here and communicated where required.