Version 1.1 · Effective 20 October 2026

Privacy policy

This policy explains what personal data Coquet collects, why, who receives it, how long we keep it and what rights you have. It covers the Coquet app for iPhone, the Coquet Studio web app and the coquet.app website.

The short version

• Your training videos never leave your phone. The app analyses them on the device. What we store in the cloud is the result: when each attempt starts and ends, the move you tagged and a sequence of body-position points calculated from the video.
• Your account, profile and training log are stored in our cloud database in the EU, so you can restore them on a new phone.
• If you join a class in Coquet Studio, your instructor sees your name, your attendance, the progress they record for you and any late or absence note you send. They don't see your own training log or videos.
• We use Amplitude to understand how the app is used and Sentry to find and fix crashes.
• We don't sell your data, show ads or track you across other companies' apps and websites.

1. Who is responsible for your data

The controller of your personal data is Patrycja Rychlik-Widera, running a sole proprietorship (jednoosobowa działalność gospodarcza) registered in the Polish Central Register and Information on Business (CEIDG), NIP 6263025822, business address ul. Sokolska 30a, 40-086 Katowice, Poland (“Coquet”, “we”, “us”).

• Privacy requests: [email protected]
• Everything else: [email protected]
• We have not appointed a Data Protection Officer, because the law doesn't require one for a business of our size and activity. Write to the address above with any question about your data.

2. What we collect, why, and on what legal basis

Legal bases refer to Article 6(1) of the EU General Data Protection Regulation (GDPR): (a) consent, (b) performance of a contract with you (our Terms of Service), (c) legal obligation, (f) our legitimate interests.

2.1 Your account

• If you sign up with email: your email address and password. The password is held only in hashed form by our sign-in provider, Google Firebase Authentication. We never see it.
• If you use Sign in with Apple: an Apple user identifier, and the name and email address Apple shares with us. You can choose Apple's “Hide My Email”, in which case we only get a relay address.
• Your user ID, your display name and when the account was created.

Why: to create and secure your account, sign you in and reset your password. Basis: contract (b).

2.2 Profile and onboarding answers

Your experience level, training goals, how long you have trained, the styles you are interested in, what equipment you have (home pole, studio only, no pole yet), when you finished onboarding and the app version you started on. We also keep your favourite moves, the programs you are enrolled in, your badges and your weekly-goal history, and whether you have an active Coquet Pro subscription.

Why: to tailor programs and suggestions and to show your progress. Basis: contract (b).

2.3 Training log, goals and collections

The practice sessions you log (date, type, duration, place, the class and instructor name if you add them, moves, combos and exercises, how confident you felt, and your notes, wins, challenges and cues), your goals, combos, collections, move status and move notes, and your program progress.

This data is kept on your phone and, while you are signed in, copied to your account in our cloud database, so it is backed up and can be restored when you sign in on another device.

Why: to show your progress, streaks, recaps and suggestions, and to keep your data safe if you change phones. Basis: contract (b).

2.4 Pain or injury flag (health data)

When you log a session you can choose to mark “pain or injury”. This is information about your health, a special category of data under Article 9 GDPR. It is optional: we only record it when you switch it on, and we treat switching it on as your explicit consent (Article 9(2)(a) GDPR) to store it with that session in your account. We use it only to show you injury and recovery guidance and to adapt suggestions. Nobody else sees it, including your instructor.

You can withdraw your consent at any time by switching the flag off or deleting the session, or by asking us to delete all flags at [email protected]. Withdrawal doesn't affect what happened before it. Please don't write health details in free-text notes; if you do, they are stored like the rest of your log.

2.5 Training videos and video analysis

• On your phone only: when you import a training video, the app copies it into its own storage on your phone, finds your body position in each frame and splits the video into one clip per attempt. Videos, clips and frames are never uploaded to us. They stay in the app's storage on your phone, which is included in your device or iCloud backups according to your Apple settings. The original in your Photos library is never changed.
• What we store in the cloud for each analysed video, linked to your account: its length and frame rate; the start, end and hold count of each attempt; the move you tagged; a pose sequence (up to 240 frames per attempt of body-joint coordinates, a set of numbers, not images) and a short summary of it; and the file names the app uses for the video on your phone.
• Why: to keep your tagged attempts across devices and to suggest which move an attempt shows by comparing your pose with reference examples. Basis: contract (b).
• We don't use pose sequences to identify you, we don't share them with anyone, and we don't use them to train machine-learning models. If we ever want to, we will ask for your separate opt-in consent first and update this policy.
• Proposed move names: if you propose a new move name while tagging, we store the name and your user ID so we can review it for the shared move list. Basis: legitimate interests (f) in maintaining an accurate move catalogue. If approved, the name is added to the move list without your user ID.
• Pose model download: the first time you analyse a video, the app downloads the pose-detection model from Google's servers. This reveals your IP address to Google; nothing else is sent.

2.6 Coquet Studio (class groups)

If you are an instructor, we store your instructor profile (display name, studio name, city, short bio and Instagram handle, as you choose to fill them in), your groups (name, level, description, location, schedule, join code), lesson plans and lessons (moves, combos, notes, links, post-class review notes), and the attendance and progress marks you record for each student. Your students see your display name, studio name, the group details and the lessons you share with them.

If you are a student and join a group with a code, QR code or invite link:

• the instructor sees your display name, when you joined, your attendance, the progress marks they record for you and any late or absence note you send them;
• we keep the list of groups you belong to in your profile;
• your own training log, videos, pose data and pain or injury flags are not shared with the instructor.

Instructors can turn grading off for a group and each student can opt out of grading. You can leave a group at any time. Please don't put health details in late or absence notes: your instructor will see them.

Why: to run the class-group feature you chose to use. Basis: contract (b). Coquet provides the tools; how an instructor uses what they see about their students for their own classes is their own responsibility as an independent controller (see our Terms).

Coquet Studio on the web (coquet-studio.pages.dev) uses Google reCAPTCHA Enterprise through Firebase App Check to check that requests come from our genuine app and not from bots. reCAPTCHA collects device and browser information under Google's terms. Basis: legitimate interests (f) in protecting the service from abuse.

2.7 Subscriptions

Coquet Pro is sold by Apple through the App Store. Apple handles the payment; we never see your card details or billing address. We use RevenueCat to check whether your subscription is active: RevenueCat receives your Coquet user ID and the purchase information Apple provides (product, purchase and expiry dates, country and price tier). Our servers ask RevenueCat about your user ID before giving access to premium demo videos. Basis: contract (b).

2.8 App analytics and crash reports

• Product analytics (Amplitude): the app sends events about how it is used, for example which screens and features you open, that you logged a session, started a program or joined a group. Events are linked to your user ID, and your email address and display name are stored as properties of your analytics profile. Some events contain names you typed yourself, such as the title of a goal, the name of a collection or of a move you propose, and your onboarding answers. Amplitude also receives device model, operating system, app version, language and session times. The app is configured not to send your IP address or advertising identifier. Why: to understand which features work and to improve the app. Basis: legitimate interests (f). You can object at any time by writing to [email protected] and we will stop analytics for your account.
• Crash and error reports (Sentry): when the app crashes or hits an error, it sends a report with the error details, device model, operating system and app version, the screens you went through before the error, and performance timings. Reports are linked to your user ID, email address and display name, so we can help you if you contact us about a problem. Why: to keep the app stable and secure. Basis: legitimate interests (f).

2.9 Demo videos and TikTok clips

• Our demo videos are streamed from Cloudflare through short-lived links our servers create after checking your access. Cloudflare receives your IP address and the request.
• TikTok clips: some move pages show example clips from TikTok in TikTok's own player. When one loads, TikTok receives your IP address and device information and may use its own cookies or identifiers, under TikTok's own privacy policy. We receive nothing back. You can switch TikTok videos off in your Profile settings.

2.10 Reminders

Training reminders and recaps are scheduled on your phone as local notifications. We don't collect a push token and don't send notifications from our servers.

2.11 Contacting us

If you write to us, we use your email address and what you write to answer you and keep a record of the conversation. Basis: contract (b) where it concerns your use of Coquet, otherwise legitimate interests (f) in answering you; legal obligation (c) for complaints we must handle under consumer law.

2.12 The coquet.app website and waitlist

• Waitlist and survey: when you join the waitlist or fill in the survey we store your email address, your survey answers and note, whether you would like a call, the language of the page, which form and page you used and the page that referred you, and your approximate city and country, which our host Cloudflare derives from your IP address at that moment. We don't store your IP address: to stop spam we keep a one-way hash of it for 60 seconds. Why: to invite you to Coquet, send you the survey results and decide what to build. We show the total number of signups and a recent-signup line with a city only, never names or emails. Basis: consent (a), which you can withdraw at any time by writing to us or using the unsubscribe link in our emails.
• Invite links (coquet.app/join/…) open the website when the app isn't installed. The group code is part of the address, so Cloudflare receives it with the page request; we don't store it.
• Website analytics and browser storage: if you accept analytics cookies, Google Analytics (Google Ireland Limited / Google LLC) measures page visits and interactions using cookies and device/browser information. Google receives your IP address to process requests. We send page addresses without query strings or fragments and do not load Analytics on invitation or error pages. Advertising storage and advertising personalisation are disabled. Basis: consent (a). You can decline or withdraw consent at any time using “Analytics cookies” at the bottom of each page. Withdrawal stops future analytics and removes this site’s Google Analytics cookies. Your choice is remembered for six months. Your browser also stores your colour theme, language and signup status. Cloudflare processes your IP address and request details to deliver and protect the site. See Google’s privacy policy for its processing, including international transfers.

2.13 Data on your device

The app keeps your settings, training data, video analysis results, studio data and streaks in its private storage on your phone, alongside your videos and clips. This storage is included in your device or iCloud backups according to your Apple settings. Deleting the app removes it from the phone, but not from existing backups.

3. What we don't do

• We don't sell or rent your personal data, and we don't show ads.
• We don't track you across other companies' apps or websites and don't use your advertising identifier.
• We don't collect your location, contacts, photos you haven't picked, or Apple Health data.
• We don't send your data to AI services.
• We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Move suggestions and “ready to try” labels are suggestions you can accept or change.

4. Who receives your data

We use the service providers below. They process data on our behalf, only on our instructions, under data processing agreements (Article 28 GDPR).

Independent recipients act under their own privacy policies: Apple (Sign in with Apple and App Store purchases), TikTok (only when a TikTok clip loads, section 2.9) and Google (the pose-model download, section 2.5).

Other users: in Coquet Studio, as described in section 2.6.

We may also disclose data when the law requires it (for example to a court or authority), to protect the rights and safety of our users or ours, or to a buyer if the business is transferred. In that case this policy continues to apply to your data.

5. Transfers outside the EEA

Our main database and server functions are in the EU. Some providers (Google for sign-in and App Check, Cloudflare, RevenueCat, Amplitude, Sentry as a US company, Apple) may process data in the United States or other countries outside the European Economic Area. For those transfers we rely on the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (Article 46 GDPR). You can ask us for a copy of the safeguards at [email protected].

6. How long we keep data

7. Your rights and how to use them

Under the GDPR you have the right to:

• access your data and receive a copy;
• rectify inaccurate data;
• erase your data;
• restrict processing;
• data portability: receive the data you gave us in a machine-readable format;
• object to processing based on our legitimate interests, including analytics;
• withdraw consent at any time, without affecting processing before the withdrawal.

In the app: you can correct your profile; export your training log, combos, goals, collections, move notes and program progress (Profile → Export my data); delete individual sessions and videos; leave a class group; and delete your account (see section 6).

By email: for anything else, including a full copy of your data or erasure of your cloud data, write to [email protected]. We may ask you to confirm the request from your account email. We reply within one month; for complex requests we may extend this by two more months and will tell you why.

Complaints: you can lodge a complaint with a data protection authority, in Poland the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in the EU country where you live or work. We'd be grateful for the chance to sort it out first.

8. Age limit

Coquet is for people aged 16 and over. We don't knowingly collect data from anyone younger. If you believe someone under 16 has given us data, write to us and we will delete it.

9. Security

Data travels encrypted (HTTPS/TLS) and is encrypted at rest by our providers. Database rules let each person read and write only their own data, except for the class-group data shared as described in section 2.6. Demo videos are only available through short-lived links issued after an access check. No system is perfectly secure; if a breach puts your rights at risk, we will notify you and the supervisory authority as the law requires.

10. Notice for residents of the United States

We don't sell or share personal information for cross-context behavioural advertising, as those terms are defined in US state privacy laws, and haven't done so in the past 12 months. We collect identifiers (email, user ID), account and profile information, commercial information (subscription status), internet activity within the app (analytics and crash data), inferences (move suggestions) and, if you use the flag described in section 2.4, health information, for the purposes described in section 2. We use health information only to provide the feature you asked for, never share it beyond our processors, and never sell it. Depending on your state, you can ask to know, access, correct or delete your data and appeal our decision by writing to [email protected]. We won't treat you differently for using these rights.

11. Changes to this policy

When we change this policy we update the version and effective date at the top. We'll tell you in the app or by email before material changes take effect, and we'll ask for your consent where the law requires it.

Questions? [email protected]. See also our Terms of Service and Safety policy.