Privacy Policy

This policy says what data Project 7 keeps about you, why, where, and who can see it. In short:

• We keep only the data needed for coaching and for running the service.
• We do not sell your data, show ads or use advertising trackers or analytics.
• A coach sees only their own athletes. Progress photos are private.
• Our servers are outside Iran, in Germany and Ireland.
• You can download your data or delete your account whenever you want.

1. Who we are

Project 7 is run by its founder, Mohammad Amid Mokhtari, who is responsible for the data entered in it. The contact address is in section 12.

2. What we keep and why

2.1 Everyone

• Account: email, password (only as a hash; we never have the password itself), role (coach or athlete), language and sign-up time. To sign you in, recover your password and send the emails that are needed.
• Mobile number (optional): private and never shown to anyone. We send no text messages yet. If we ever turn on sign-in or recovery by SMS, the number will be passed to an Iranian SMS provider to send the messages, and we will update this policy first.
• Acceptance of these documents: the version of the Terms of Use and of this policy you accepted, and when.
• Notifications: the in-app notifications created for you.
• Technical data: your IP address is kept as a one-way hash for at most an hour to limit repeated attempts (such as password guessing). Our hosting provider also keeps short-lived technical logs (such as the IP address and the page requested) for security and troubleshooting.

2.2 Coaches

• Public profile: display name, profile photo, city, bio, years of experience and sports. These are visible to everyone so athletes can find you.
• Verification documents: the files (PDF or images) you send to get the "Verified" badge. Only you and Project 7's admin see them; they are never shown on a public page. Each file is stored under a random, unguessable address.
• Programs and custom exercises: the programs you write and the copy made for each client, your custom exercises and notes.
• Clients and invites: invite links, your private note on each client and your comments on sessions.
• Subscription payments: the plan, the amount you say you transferred, the bank tracking number, your optional note, the review result and the subscription period. You send the receipt to support on Telegram; Telegram is a separate service with its own policy and we do not store the receipt in Project 7. We never collect your bank card details.

2.3 Athletes

• Profile: display name, profile photo, city, bio, sports and fitness level.
• Intake form: training goal, training experience, injuries, training days, equipment, height, weight and body measurements. Injuries and body measurements are health-related data; we keep them only so your coach can write a program that suits you.
• Training logs: every session and set (load, reps, time), session RPE and your notes.
• Body weight and measurements: what you log on the progress page.
• Progress photos: kept in private storage. They have no public address and each time open only through a link valid for five minutes.

3. Who sees what

• Your coach: when you join through an invite link, your coach sees your intake form, program and logged sessions, body weight and measurements, and progress photos. Photos are shown only to coaches you are currently a client of.
• Other coaches: see none of your training data. Each coach sees only their own athletes.
• Every visitor: coach profiles and the plans a coach made "public". Athletes' data is never public.
• People you connect with: in coach discovery, the other side sees your display name, photo, city and sports; your email and mobile are never shown.
• Project 7's admin: sees users' emails and names, coach documents and payments to review them. The admin panel does not show athletes' training data or photos. Direct database access is for maintenance and security only and is held by the founder alone.
• We do not sell or give your data to anyone else, except where the law requires it.

4. Where the data is kept

Project 7 runs on the services below. All of them are outside Iran, so your data is transferred to, processed and stored outside Iran:

• Vercel (a US company): runs the website, the app and the API; the API servers are in Frankfurt, Germany.
• Supabase (a US company): the database and file storage (profile photos, coach documents, progress photos); in Frankfurt, Germany.
• Resend (a US company): sends the email confirmation and password recovery emails; in Ireland. Your email address and the email's text pass through it.

The domain project-7.ir was bought from an Iranian registrar; no user data is kept there. If we move hosting (for example to an Iranian provider), we will update this policy first.

5. Security

• All connections are encrypted with HTTPS.
• Passwords are stored only as hashes (bcrypt).
• Your session is kept in cookies that the page's JavaScript cannot read.
• Repeated attempts to sign in, sign up or recover a password are limited.
• No system is perfectly safe. If we learn of a data breach, we will tell the people affected.

6. How long we keep data

• We keep your data for as long as your account exists.
• When you delete your account, your data is removed from the database at once and your files (profile photo, documents, progress photos) are removed from storage.
• Database backups are kept for at most 30 days and then overwritten; a deleted account's data stays in backups until then and is used only to restore the service after a failure.
• Approved payments are kept for accounting, without a name: when a coach deletes their account, the payment loses its link to them and the free-text notes, and only the plan, amount, tracking number and dates remain. Pending and rejected payments are deleted.
• Rate-limit counters last at most an hour.

7. Deleting your account

You can delete your account from Account settings. To be sure, we ask for your password and your email. Deletion cannot be undone.

• If you are an athlete: your account, profile, intake form, every session and set, body weight and measurements and progress photos are deleted. Your coach no longer sees you among their clients.
• If you are a coach: your account, public profile, documents, programs, custom exercises, invite links, notes and session comments are deleted. Your athletes keep their own accounts and training history, lose the link to you and are told about it in the app. A custom exercise an athlete logged sets with stays, with its name only, for that athlete's history.
• Notifications that showed your name to other people are deleted too.
• An admin account cannot be deleted this way. An admin can delete a coach or athlete account from the admin panel under the same rules.

8. Your rights

• Access and a copy: you see all your data in the app. Account settings → Download my data gives you a JSON file with your own data. It contains no other user's personal data; the progress photo links in it are valid for five minutes.
• Correction: you edit your profile, mobile number, intake form and logs yourself.
• Deletion: from Account settings (section 7).
• Withdrawing consent: by deleting your account. The app cannot be used without accepting these documents.
• For any other request, write to the address in section 12. We answer within 30 days.

9. Cookies and browser storage

We use only the cookies and data that are needed, and no advertising or analytics cookies:

• Session cookies: keep you signed in. Signing out removes them.
• Language cookie: remembers the language you chose.
• Browser storage: display settings (such as the dark or light theme) and sessions you logged offline until they reach the server. This data stays on your device.

10. Age

Project 7 is for users aged 18 and over. A user under 18 may create an account only with the permission of a parent or legal guardian. If we learn an account was created without it, we delete it.

11. Changes to this policy

Each version of this text has a number and a date. If we change it, the version number goes up and the next time you open the app we ask you to read and accept the new version.

12. Contact

Send questions or requests about your data to privacy@project-7.ir. The Terms of Use explain the general rules for using Project 7.