Version 2026-10-05 · in force 2026-10-05
Privacy Policy
Last updated 5 October 2026.
Corner is run by Roni Ricardo Rizk, an individual doing business as Corner in College Station, Texas. Write to support@cornercoachfit.com about anything on this page.
This policy says what Corner holds about you, why, who else sees it, how long it stays and how to get it back or have it erased. There is a separate page for health data specifically, because Washington law requires one: the Consumer Health Data Privacy Policy.
Who is responsible for your data
If you are a coach: we hold your account and your business's data, and we are responsible for it.
If you are somebody's client: your coach decides what to collect from you and what to do with it — they are the one running the coaching. We hold it and process it on their behalf, under the terms in When a coached client's data is processed for their coach, below. Your account itself, your login and your billing, are ours.
If you are training on your own: it is all ours to be responsible for.
What we collect
| What | Why we have it |
|---|---|
| Your name, email address, and a password we only ever store scrambled | so you can sign in and we can reach you |
| For a coach, the business name you choose | it is what your clients see |
| Training: your programs, sessions, sets, reps, loads, notes | it is the product |
| Nutrition: what you logged, the foods, the amounts, your targets | it is the product |
| Your body: weight, measurements, photos you upload, injuries and limitations you tell us about, sleep and steps if you enter them | it is the product, and it is health data — see the health-data page |
| Check-ins and messages between you and your coach | it is the product |
| Forms your coach asks you to fill in — screening questionnaires, agreements | so a coach can screen a client before training them |
| Billing details: what plan you are on, when it renews, your invoices | so you can pay. We never see or store your card. Stripe does |
| If you turn notifications on: the delivery address your browser gives us for your device | so the reminders and alerts you asked for can reach you |
| Technical: your IP address, browser, the pages you opened, error reports | to keep it running and to find faults |
We do not buy data about you from anybody, and we do not collect anything from you that Corner does not use.
Corner keeps you signed in, and remembers settings like the theme, in your browser's own storage. None of it tracks you across other sites, and none of it is for advertising.
Why we are allowed to hold it
- Because you asked for the service. Running your coaching or your training is what you signed up for.
- Because you consented, for health data specifically. That consent is a tick box on the sign-up form that is never pre-ticked, and you can withdraw it — see below.
- Because we have to. Invoices and tax records.
- Because we have a legitimate interest in keeping the service secure and working, and in not letting it be abused.
If you are in the EU or the UK: your health data is Article 9 data, and the condition we rely on is your explicit consent under Article 9(2)(a). Withdrawing it means we can no longer run your program, so withdrawing it and deleting your account amount to the same thing, and we will say so before you do it.
Who else sees it
Your coach, if you have one, sees your diary, your program, your check-ins, your messages and any photos you send them. That is the point of having a coach, and it is what you agreed to when you accepted their invitation. You can end it from your own account. When you send a check-in, your coach is also told by email, and that email carries your answers.
Nobody else's coach ever sees anything of yours. That is enforced in the database itself, not just in the app.
The companies that run pieces of Corner for us. They are bound by contract, they process only what they need to, and they do not get your data for their own purposes:
| Who | What they do | What they touch |
|---|---|---|
| Supabase | the database, the sign-in and the file storage | everything you put into Corner |
| Netlify | hosting and the code that answers your app | requests as they pass through |
| Stripe | payments | your name, email and card — the card never reaches us |
| Resend | sending our emails | your email address and what the email says — for a check-in, the answers your coach is sent |
Notifications, if you turn them on, are delivered by your browser's own push service — Apple's, Google's or Mozilla's, depending on your device. What a notification says is encrypted on the way, so the push service cannot read it.
Open Food Facts and the USDA provide the food database Corner searches. When you look up a food or scan a barcode, the search goes to them from our server, not from your device. Nothing about you goes with it — not your name, not your account, not what you ate.
When AI features arrive, Anthropic will process the text a coach asks a draft for, and this page will be updated and dated before that happens rather than after.
We may also disclose what the law actually requires us to, and we will tell you unless we are forbidden to.
What we never do
- We never sell your data. Not to advertisers, not to data brokers, not to anybody. Texas law forbids selling sensitive personal data without prior consent even for a business our size, and Washington's forbids selling health data without a signed authorization — but the plain fact is simpler: there is nobody in Corner who is a buyer, and nothing in it that sells.
- We never use your data to advertise to you.
- We never train an AI model on your data.
How long we keep it
| What | How long |
|---|---|
| Your account and its contents | while your account exists |
| After you delete your account | removed from the live service at once; purged within 30 days |
| Encrypted backups | deleted data ages out of them within 7 days of the purge |
| Technical logs | 30 days |
| Invoices and tax records | as long as tax law requires |
When you delete your account, each company that runs a piece of Corner lets go of its copy in its own way, and none of them keeps it for a purpose of its own:
- Supabase holds the database, the sign-in and the files. Our purge removes your rows, your files and your sign-in within 30 days. Its daily backups keep a deleted row for at most 7 days after that; files are not in those backups at all.
- Resend keeps each email it sent for us — the address, what it said, whether it arrived — for 30 days after sending, and its own backups for 7 days after that. To have a particular email removed sooner, ask us and we will ask Resend.
- Netlify keeps its own logs of the requests our code answered — which never carry what you logged — for the short period its plan sets (its documentation names 24 hours, or 7 days on some plans).
- Push services: from the moment you delete your account nothing more is sent to your devices, and a notification still waiting to be delivered is dropped within 24 hours. It was encrypted, so the push service could never read it.
- Stripe: deleting your account cancels your subscription and deletes your customer record at Stripe, which removes your card. Stripe keeps the record of past payments under its own privacy policy.
Your rights, and how to use them
Wherever you live, you can:
- See what we hold — it is in the app, and you can download all of it.
- Export it, in one click, as a file you can read.
- Correct it, in the app.
- Delete it, from your settings. We offer the export first.
- Withdraw consent for health data. That ends the service, because there is no Corner without it.
- Object or ask us to restrict what we do — write to us.
- Complain to your data protection authority if you are in the EU or the UK, or to the Attorney General of your state.
We answer within 30 days. We do not charge, and we do not treat you differently for asking.
Where an EU or UK representative is required under Article 27, we have not appointed one yet. We will appoint one when our first paying customer in the EU or the UK signs up. Saying so here rather than staying quiet is the honest version.
How we protect it
The wall is in the database: every row belongs to somebody, and the database refuses a request for somebody else's row even if the application asks for it. On top of that: HTTPS everywhere; passwords checked against known-breached lists and stored only scrambled; the one key that could bypass the wall lives only on our servers, is used only by the few jobs that need it, and never reaches a browser; uploaded files are private and reachable only through links that expire in minutes; logs that never carry the contents of a diary.
No system is perfectly secure, and anyone who tells you otherwise is selling something.
If there is ever a breach
We will tell the people affected without unreasonable delay and within 60 calendar days of discovering it, by email and by a notice inside the app — the Federal Trade Commission's rule requires both, not one. We will tell you what happened, when, what we did about it and what you can do. Where the numbers require it we will also notify the FTC, the Texas Attorney General and the media, on their own deadlines.
You can ask for that notice on paper instead of by email. Write to support@cornercoachfit.com.
Children
Corner is for people 18 and over. We do not knowingly collect anything from anyone under 18, and if we learn we have, we delete it and close the account.
Where your data lives
Corner's servers are in the United States. If you use Corner from outside the United States, your data is transferred there. For the EU and the UK, our processors' own data-processing terms carry the standard contractual clauses that make that transfer lawful.
When a coached client's data is processed for their coach
For a client who has a coach, the coach decides what is collected and why; we process it for them. Those data-processing terms are part of the coach's agreement with us and they say: we act only on the coach's instructions and the law; the people who touch it are bound to confidentiality; we keep it secure the way this page describes; we do not bring in another processor without saying so on this page; we help the coach answer their client's requests and handle a breach; and when the coach leaves we delete or return what is theirs. Whether Texas and Washington read that split the same way the GDPR does is not settled, and it decides who has to send a breach notice to a coached client. We have named it rather than assumed it, and we will send the notice ourselves either way.
Changes to this policy
If a change matters, we will tell you by email or in the app at least 14 days before it takes effect, and the date at the top will change.
Questions, requests, or anything that looks wrong: support@cornercoachfit.com.