F4F Privacy notice
Controller: Luke Thomas, Flexibility for Fighters — contact: luke@luke-thomas.co.uk. Last updated 4 September 2026.
What we hold about you, and for how long
| Data | Why | Kept |
|---|---|---|
| Your account: email address, the products you bought, access expiry, sign-in timestamps | To run your access (performance of contract, Art. 6(1)(b) UK GDPR). Sign-in is by one-time email link — no passwords. | Until 90 days after your access expires, then deleted automatically together with everything below. |
| Range audit results: the angles measured for your splits, leg lifts and kicks, the 12-week plan built from them, and the sessions you tick off | To show your progress and let the coach hold you to your plan (performance of contract). These are measurements of your flexibility — you choose whether to run an audit at all. | Your last 100 audits and 10 plans, deleted with your account. |
| Audit video clips — only if you tick “share my capture clips” | To improve the tracker. Clips are short, filmed by you, stored only on our server, and seen only by Luke. This is optional consent (Art. 6(1)(a)) and you can withdraw it by unticking the box or emailing us. | 180 days, then deleted automatically; deleted immediately on request. |
| Coach conversations: what you write to the AI coach, its replies, and a short running summary it keeps of your goals, training history and any pain or injury you mention | To coach you consistently across sessions (performance of contract; where you tell it about pain or injury, your explicit consent by doing so, Art. 9(2)(a)). Do not share more than you want coached. | 180 days after your last conversation, then deleted automatically; deleted with your account. |
| Usage counts: messages per day and token counts | To enforce the fair-use limits. | With the conversations. |
| Server access logs: requested pages, timestamps, browser type, and your IP address truncated to the network (last octet removed) | Security and reliability (legitimate interest, Art. 6(1)(f)). | 14 days. |
There is no advertising, no analytics service, no tracking pixels. The single cookie we set is your sign-in session — strictly necessary, which is why there is no cookie banner. Sharing a clip also records the type of browser you used, so we can reproduce tracking problems.
Who processes it for us
- Hetzner Online GmbH (Germany) — hosts the server that holds everything above, under a data processing agreement.
- Anthropic, PBC (United States) — provides the AI model behind the coach. What you type to the coach, its running summary of you, and your plan and audit numbers are sent to Anthropic to generate each reply. Anthropic does not use this data to train its models. Transfer is under the UK International Data Transfer Addendum to Anthropic's standard terms.
- Google (Google Workspace, United States) — relays the sign-in emails we send you.
- Google Fonts — pages load typefaces from Google's font servers, which see your IP address when a page loads. We are moving these to our own server.
What stays on your device
The live camera tracking during a range audit runs in your browser. Video is never uploaded unless you tick the sharing box. With the box unticked, only the measured angles, your plan and your tick-offs are sent to your account.
Your rights
Access, correction, deletion, portability, restriction and objection — email the controller and it will be done without undue delay. Deletion removes your account, audits, plan, shared clips and coach conversations across all of our systems, and ends your access. You may also complain to the Information Commissioner's Office (ico.org.uk).