Yellow Rock PT

Privacy policy

Yellow Rock PT does not sell your personal information. Ever.

This policy explains how Yellow Rock PT, based in Yellow Rock, NSW, Australia, handles information when you enquire about training, train with us or use our training app.

Information we collect

We collect information directly from you, from your trainer as part of providing services, and from the services you choose to use with your account. If you choose not to provide information needed for a service, we may be unable to provide that service.

How we use it

We use information to manage your account, plan and deliver training, track progress, organise appointments, communicate with you, administer billing and maintain the security and reliability of the app. Your trainer can access your training records and messages to support you.

Apple Health sharing

If your trainer enables the optional iPhone companion feature and you choose to connect Apple Health, the companion app can read and share up to 30 days of workout records and daily step totals. Shared workout details may include workout type, date and time, duration, distance, active energy and available heart-rate summaries. Yellow Rock PT does not write to or alter Apple Health.

This information is visible only to you and your linked trainer. It is used to give your trainer context about your activity and, where timing supports it, to suggest a possible match with a Yellow Rock PT appointment. Uncertain matches require trainer confirmation. You can review the imported information in ClientUX and hide individual workouts from your trainer. You can also stop future sharing; information already retained remains subject to the access, correction and deletion rights below.

Google sign-in: access, use, storage and sharing

This policy applies specifically to the Yellow Rock PT training app at app.yellowrockpt.com, operated by Yellow Rock PT. Google sign-in is an optional way to access an invited training account.

What we access

When you choose Continue with Google, our authentication service requests basic identity access (openid, email and profile). Google may supply your Google account identifier, email address and verification status, name, profile-picture URL and other basic profile details available through those permissions. We do not request access to Gmail messages, Google Drive files, Google Calendar events, contacts or Google Photos. We never receive your Google password.

How we use Google user data

We use the identifier and verified email to authenticate you, associate the sign-in with your Yellow Rock PT account and maintain secure account access. Basic profile details may be retained with your authentication record. Google sign-in does not give an uninvited person access to client records. We do not use Google user data for advertising, sell it, or use it to train general-purpose AI or machine-learning models.

Where it is stored and how it is protected

Google identity and profile information is processed and stored by Supabase, our authentication provider, as part of your account and linked identity records. The app stores session information in your browser to keep you signed in. Production sign-in uses HTTPS to protect information in transit, and authenticated access controls restrict access to account and training records. Service providers may process information overseas as described below. No online service can guarantee absolute security.

Who receives it

Google and Supabase process the sign-in exchange. Yellow Rock PT uses the resulting account identity to provide your training service. Your account name and email may also be used by your trainer and our email-delivery providers to communicate with you about that service. We do not share Google user data with advertisers or data brokers. Any other disclosure is limited to providing and protecting the service, complying with law, or the circumstances described in this policy.

Retention, deletion and your choices

We retain linked Google identity information while it is needed to operate and secure your account, subject to applicable legal retention requirements. You may remove Yellow Rock PT access in your Google Account connections settings. That stops the Google connection but does not itself delete existing Yellow Rock PT records or necessarily end an already active app session. To request deletion of your account or Google-derived information, email richard@yellowrockpt.com and follow our data-deletion instructions. We will explain any records that must be retained and confirm the outcome.

Facebook sign-in

If you choose Facebook sign-in, we receive the account identifier, email and basic profile information supplied for authentication. Supabase processes this information to sign you in and associate your identity with your training account. We do not receive your Facebook password. The retention and deletion process above also applies to Facebook-derived account information. Google and Facebook handle information under their own privacy policies.

Service providers and sharing

We use Supabase for app data, authentication and storage, and Resend for email delivery. Hosting, email and payment services also process information needed to provide their services. Where Stripe is used for payments, payment information is handled through Stripe; the app keeps relevant billing records and references.

Trainer email alerts may include your message content or workout-completion details. Appointment emails may include appointment details and calendar attachments. Email and calendar providers process those messages when they are delivered or added to a calendar.

We may disclose information where required or authorised by law, or where necessary to address a serious safety or security issue. We do not sell your information to advertisers or anyone else.

Storage, security and overseas processing

We use account authentication and access controls to protect records. No online service can guarantee absolute security. Keep your login details secure and tell us if you suspect unauthorised access.

Our technology providers may store or process information outside Australia, including in the United States and other countries in which they or their service providers operate. Locations depend on the service and its configuration. Contact us for information about the providers relevant to your records.

Browser storage

The app uses browser storage to keep you signed in, remember preferences and support workout progress and recovery. Clearing browser data may sign you out or remove locally stored preferences and unsynchronised progress.

Retention and deletion

We keep information for as long as it is needed to deliver services and meet applicable record-keeping, accounting, dispute-resolution and legal obligations. When information is no longer needed, we will delete it or de-identify it. Some retained records and backup copies may remain for a limited period rather than disappearing immediately.

You can request account and data deletion using our data-deletion instructions. Removing Google or Facebook access alone does not delete your Yellow Rock PT records.

Access, correction and privacy concerns

Email richard@yellowrockpt.com to request access to or correction of your information, request deletion, or raise a privacy concern. Tell us which account and issue your request relates to. We may ask for reasonable identity verification before providing or changing personal information.

We will review your request, contact you if clarification is needed and explain the outcome, including any limits on what we can provide or delete. If you are dissatisfied with our response, you can contact the Office of the Australian Information Commissioner about privacy complaint options.

Changes to this policy

We may update this policy as the service changes. The date below identifies the latest revision; If we change how we access, use, store or share Google user data, we will notify affected users through the app or email before applying the change, and obtain consent where required.

Last updated: 30 September 2026