Privacy Policy

Information we collect

We receive information you provide directly and information created while delivering our services. This can include:

• Contact and account information: your name, email address, phone number, address, profile photo, sign-in information, account preferences, and communications with us. Our authentication service processes passwords and sign-in credentials.
• Forms and applications: answers, supporting files, photographs, signatures, consent acknowledgments, and the version of the form you submitted. Depending on the program, requested information may include school, eligibility, emergency-contact, or training-related details.
• Bookings and events: selected services, appointments, attendee and family information, registration references, attendance and check-in records, prices, payment status, and staff notes. Website booking and event payments are currently recorded by staff; these forms do not collect credit-card numbers.
• Connected fitness features: goals, experience, equipment, readiness responses, workout and running records, body measurements or weight, nutrition entries, appointments, trainer relationships, assignments, feedback, and messages when you provide or use them in COGI Athletic. Some of this information may reveal health or fitness details.
• AI interactions: questions, prompts, conversation history, transcribed speech, relevant service or fitness context, generated replies, and actions you choose to confirm. The AI section below explains the differences between assistants.

How we use information

We use information to operate accounts, respond to inquiries, review applications, arrange training and events, manage registrations and attendance, support trainer-client services, provide requested AI assistance, and maintain accurate records. We also use it to deliver service messages, manage newsletter preferences, troubleshoot problems, protect accounts, prevent abuse, and improve our services.

Staff review and operational tools may organize submissions, maintain contact records, record changes, and send confirmations or reminders. Sending a form does not subscribe you to every marketing message, and an AI response is not confirmation of a booking, payment, or application decision.

Max and other AI assistants

Ask COGI is the public website assistant. When you send a message, we send your question and recent conversation to an AI model through Lovable's AI Gateway, currently using OpenAI. Published COGI information and events help it answer. It does not look up your private account records or make bookings or registrations. Its conversation is saved in this browser until you reset it or clear site storage.

The staff assistant helps authorized COGI staff review information and prepare changes. Staff prompts and selected operational records can be sent through the same AI service. These records can include customer or attendee names, booking dates, registration and payment status, and submission status. Proposed changes require staff action before they are applied.

Max is the AI assistant in COGI Athletic. Depending on the feature and device, AI processing may use Apple's on-device models or a cloud provider, currently Google Gemini. Cloud conversations can include your message, recent exchanges, relevant screen and service context, and selected records such as training goals, equipment, workouts, assignments, trainer relationships, appointments, running performances, program information, and saved nutrition totals. Anything personal you type or say can be included. Guest conversations, where available, do not retrieve private account records.

Max's workout drafting and explanation tools process selected training facts to prepare suggestions or summarize activity. If you confirm a supported action, such as saving a workout or submitting a registration, the resulting record is handled by the relevant COGI service. Availability and controls can differ by app version and feature.

Voice features require microphone and speech-recognition permission. Speech is transcribed using Apple's speech-recognition services, which may process audio on the device or through Apple. The resulting text can be sent to the AI service. Max's cloud conversation requests send text and context, rather than raw microphone recordings.

AI providers process requests and responses under the service terms and data-processing arrangements applicable to the feature. Retention and model-improvement practices can differ by provider and configuration; this policy does not promise that every AI request is immediately deleted or excluded from provider training. Avoid sharing passwords, payment-card details, identity documents, or unnecessary sensitive information in chat.

You can use the website without Ask COGI and contact our team directly. Use available Max controls to manage cloud AI and saved conversation history, and device settings to revoke microphone or speech permissions. Clearing a chat or turning a feature off does not recall information already sent to a provider. AI can make mistakes and does not replace professional medical advice or human review.

COGI accounts and the connected app

The website provides the sign-in identity used by COGI Athletic. Account identifiers, authorization and session status, and the information needed for connected features pass between the website and the separate fitness service. This supports account eligibility checks, trainer access, appointments, events, and other features you use.

Fitness records may be stored on your device and in the fitness service when synchronization or a connected feature is used. Authorized trainers and staff can access information needed for their work and permitted client relationships. Signing out or disconnecting an app does not by itself erase previously saved service records; contact us about deletion across connected services.

Public information and rankings

Information intended for publication, such as an approved trainer profile or a published running result, can be viewed by other visitors. A leaderboard may show a display name, age group, event or distance, performance, achievement level, and date. Private contact information and exact birth dates are not part of the public leaderboard.

Youth results use a protected display name unless publication of the athlete's name is authorized through the applicable parent or guardian control. Consider what you choose to make public. Public material can be copied or indexed by others, so removing it from COGI may not remove copies elsewhere.

Log data, cookies, and browser storage

Our hosting, authentication, and diagnostic services may process IP addresses, device and browser details, requested pages, timestamps, session identifiers, request activity, and error information. We use technical information to deliver the service, understand usage, investigate failures, and prevent abuse. Some submission protections use a hashed connection identifier for rate limiting.

Cookies and similar storage support sign-in and site functionality. Local browser storage remembers your appearance preference, authentication session, and Ask COGI conversation. Browser controls let you clear or restrict cookies and site storage, but doing so may sign you out, remove preferences or chat history, or limit functionality.

The site loads fonts from Google, which receives the connection information needed to deliver them. Opening external maps, social media, or other linked services exposes your interaction to those services under their own privacy practices.

Service providers and information sharing

We use service providers to host and secure the website, authenticate users, store records and uploaded files, send email, support connected fitness services, and process AI requests. The website uses Lovable Cloud and its underlying Supabase services. AI processing includes the providers described above. Staff address-search tools use Google Places through Lovable and send the entered search text to that service.

Providers receive information needed to perform their functions. Authorized staff and trainers receive information appropriate to their responsibilities. We may also disclose information when you ask us to, when required by law, or when reasonably necessary to protect rights, safety, or the security of our services. Information may be processed in the United States and other countries where our providers operate.

Email and communications

We use your contact details for replies, account messages, registration confirmations, application communications, reminders, and other service-related notices. Our communication tools store recipient details, message content, consent and subscription preferences, and delivery, failure, or unsubscribe status.

You can unsubscribe from newsletters using the link in those emails or by contacting us. Unsubscribing from marketing does not stop messages needed to manage an account, registration, booking, or request.

Retention and deletion

We retain information as needed to provide the relevant service, maintain participation and business records, resolve disputes, meet legal obligations, and protect against fraud or abuse. Retention depends on the type of record and its purpose; there is no single deletion period for all information.

Ask COGI history remains in your browser until reset or cleared. Max can retain conversation history when its remember-history option is enabled; use its history controls to manage saved conversations. Provider logs, backups, submitted forms, and confirmed actions may have separate retention requirements. Deleting an account or local history does not necessarily delete all of those records immediately. Contact us to request review of information held across COGI services.

Security

We use safeguards such as authenticated access, database permissions, private file storage, and expiring file links to restrict access to nonpublic information. Device and service protections vary with the feature. No method of internet transmission or storage is completely secure, and we cannot guarantee absolute security. Keep your credentials private and sign out on shared devices.

Children and family information

COGI offers youth programs, and parents or guardians may provide information about children through family profiles, registrations, and program forms. That can include a child's name, date of birth, relationship to the account holder, participation details, and relevant consent records. Provide only information requested for the service.

Parents and guardians should manage submissions for children under 13. Children under 13 should not independently provide personal information through accounts or AI chat. If you believe a child has supplied information without appropriate parental involvement, contact us so we can review the situation and arrange appropriate correction or deletion. Parents and guardians can also contact us about their child's records or public display name.

Your choices and privacy requests

You may choose not to provide optional information, although some services require specific details. Use available account controls to update your profile, manage connected access, and review your registrations. You may also contact us to request access to, correction of, or deletion of personal information, or to ask about other privacy rights available where you live.

We may need to verify your identity and authority to act for another person before fulfilling a request. Some records may need to be retained for service, security, or legal reasons. We will explain applicable limitations when responding. Please do not send passwords or identity documents with your initial request.

Links to other sites

Our website may link to independently operated registration, retail, education, social media, and other services. Their collection of information and payment processing are governed by their own notices. This policy does not describe their practices. Review the privacy policy of any external service you choose to use.

Changes to this policy

We may update this policy as our services or practices change. We will post the updated policy here and change the date above. Where additional notice or consent is required, we will provide it. Please review this page periodically.