Privacy Policy

1. Who we are

Train with Mills (“we”, “us”, “our”) provides online fitness coaching and nutrition guidance. We are the data controller for the personal data described in this policy. For any privacy question or request, contact us at millie@trainwithmills.co.uk.

2. The information we collect

• Account details - your name, email address, and either a password (stored only as a secure hash) or your Google sign-in.
• Coaching data - the training, check-in, nutrition and habit information you log, messages you send us, and any form-check videos you upload.
• Health information - see section 3.
• Usage data - basic, anonymous analytics about how the site is used (see section 6).

3. Health and sensitive data

Some of what you share (for example energy levels, menstrual-cycle phase, injuries or training readiness) is “special category” health data under UK data protection law. We only collect it to coach you safely and effectively, and we process it on the basis of your explicit consent, which you can withdraw at any time by contacting us.

4. How and why we use your data

We use your data to deliver and personalise your coaching, communicate with you, and improve our service. Our lawful bases are:

• Contract - to provide the coaching you've signed up for.
• Consent - for health data and for any marketing emails you opt into.
• Legitimate interests - to keep the service secure and working well.

5. Who we share it with

We never sell your data. We share it only with the trusted providers that help us run the service, who process it on our instructions:

• Stripe - subscription payments. Your card details go directly to Stripe and are never seen or stored by us.
• Vercel - website hosting and anonymous analytics.
• Cloudflare R2 - secure, private storage for uploaded videos.
• Resend - sending transactional emails (e.g. sign-up and reset links).
• Google - if you choose “Sign in with Google”.

6. Cookies and analytics

We keep cookies to the minimum needed to run the service:

• Sign-in cookie - a single essential cookie that keeps you logged in to your portal.
• Payment cookies - when you pay, Stripe sets essential cookies on the checkout to prevent fraud and keep your payment secure.
• On-device storage - your browser stores small bits of app data locally (for example an unsent message draft or app preferences). This stays on your device and is never used to track you.

Our analytics (Vercel Web Analytics) is privacy-first: it uses no cookies, doesn't identify you and builds no advertising profiles.

7. How long we keep it

We keep your data for as long as you have an account with us, and for a reasonable period afterwards to meet legal and administrative obligations. We delete your data 12 months after your coaching ends. You can ask us to delete your account and data at any time.

8. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or receive a portable copy of your data, and to withdraw consent. To exercise any of these, email us at millie@trainwithmills.co.uk.

9. Security

Passwords are hashed, uploaded videos are stored privately and served only via short-lived signed links, and access to your data is limited to your coach. No system is perfectly secure, but we take reasonable steps to protect your information.

10. Under-18s

The service is intended for adults (18+). We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time; the “last updated” date above shows the latest version.

12. Contact and complaints

Questions? Email millie@trainwithmills.co.uk. If you're in the UK and unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk.