Privacy policy

1. Who we are

bb-system is built and operated by ACF Labs. For anything in this policy, contact [email protected].

2. What this policy covers

It covers the BB Student and BB Coach apps on iOS and Android, the bb-system web console used by coaches and staff, and this website.

This website collects nothing and sets no cookies. The only thing it stores in your browser is the language you picked, so the site opens in that language next time. The fonts are loaded from Google Fonts, so your browser sends Google the usual request details (IP address and browser type) to fetch them.

3. Data we collect

We collect only what the coaching relationship needs. By category:

• Account: your name, e-mail address or username, phone number if you use it to sign in, your password (stored only as a hash), and your role (student, coach or staff).
• Coaching content: the protocols a coach writes for you, covering diet, foods and portions, training plans and supplement instructions.
• What the student records: saved workouts with exercises, sets, loads and duration; exercise ticks; meals; and the adherence numbers derived from them.
• Check-ins: the text and answers you submit and the photos you attach.
• Messages: the chat between a coach and a student.
• Health data, only if you allow it: steps, active calories, exercise minutes, resting heart rate and sleep, read from Apple Health (HealthKit) on iOS or from Health Connect on Android. We use it to show your evolution and to share it with your coach. We only read; we never write to Apple Health or Health Connect. It is never used for advertising, never sold, and never shared beyond the processors listed below, who store it for us. You can revoke access at any time in Apple Health or Health Connect, and the app keeps working without it.
• Technical: crash reports and performance traces (device model, OS version, app version, error details); server logs with IP address and request metadata; and an audit log of who did what in the system, under which role.

4. How we use it

To run the coaching relationship between you and your coach; to show progress over time; to keep the service working and secure; and to send invite codes by e-mail when an account is created.

We do not show advertising, we do not build profiles for third parties, and we do not sell data.

5. Who processes it for us

These companies handle data on our behalf. Each receives only what its job needs.

• Railway: hosts the API, the PostgreSQL database and the Redis session store.
• Cloudinary: stores uploaded photos.
• Resend: sends transactional e-mails such as invite codes.
• Datadog: receives performance traces and server logs.
• Sentry: receives crash and error reports from the apps and the server.

6. Who can see it

A student's data is visible to the coach or coaches assigned to that student, and to ACF Labs staff with operational access. Staff actions are recorded in the audit log.

7. Retention

We keep your data while your account exists. After a deletion request, we delete or anonymise it, except what the law requires us to keep or what is needed to resolve a dispute.

Crash reports, traces and logs expire on the retention schedules of the processors above.

8. Your rights

You can ask to see the data we hold about you, correct it, receive a copy, or have it deleted. Send the request by e-mail to [email protected] from the address on your account, or include your username. We answer within 30 days.

If you are in Brazil, these are your rights under the LGPD. If you are in the European Union, they are your rights under the GDPR. Wherever you are, we honour them the same way.

How to delete your account · How to request your data

9. Children

bb-system is not meant for people under 18 unless a parent or guardian has agreed to it through the coach.

10. Security

All traffic is encrypted in transit. Passwords are stored as hashes. Sessions use short-lived tokens that can be revoked. Staff with global access sign in with a second step from an authenticator app.

11. Changes

When this policy changes we update the date at the top. If a change matters to you, we describe it here and tell testers by e-mail.