Skip to main content

Privacy Policy

Last updated: 2026-10-21

This Privacy Policy explains what personal data Elevate collects when you use the Elevate Coach, Elevate Nutri and Elevate Gym apps for mobile and desktop and the byelevate.app website (together, the “Service”), why we collect it, who we share it with and the choices you have.

1. Who we are

Elevate is operated by Capsule Codes (“Elevate”, “we”, “us”). We are responsible for the personal data processed through the Service as described in this policy. You can contact us at elevate@capsulecodes.com.

When a professional (a trainer, a nutritionist or a gym) uses Elevate to record information about their own clients or patients, that professional decides what to record and is responsible for having a valid reason to do so. We process that information on their behalf to provide the Service.

2. Information we collect

We collect only the information the Service needs to work:

  • Account data: your name, email address, role (trainer, nutritionist or client) and preferred language and, if you add them, a profile photo and a phone number. If you register with an email and password, the password is stored by our authentication provider in hashed form; we never see it in plain text.
  • Elevate Coach: training routines, days, exercises and sets, the workouts a client logs (exercises, sets, repetitions and weights) and the link between a trainer and their clients.
  • Elevate Nutri: meal plans, recipes, foods, food and water logs, nutrition goals and anthropometric measurements (weight, height, body circumferences, skinfolds and body composition results), together with the sex and date of birth that the measurement formulas need and any notes the nutritionist adds to a measurement. This is health data, a special category of personal data, and we treat it as such: only you and the professionals you are linked with can see it, as described in section 5.
  • Elevate Gym: gym details and logo, memberships and staff roles, invitations (including the invited email address), class schedules and bookings, services, appointments and practitioner availability, membership dues and payments the gym records, the gym’s income and expense records, and private notes a practitioner keeps about a patient (which are also health data).
  • Subscription data: which product and plan you have, its status and renewal dates, and your Stripe customer and subscription identifiers. You enter your card details on Stripe’s checkout page; we never receive or store card numbers.
  • Device data: if you allow notifications, the push notification token of your device, its platform (iOS or Android) and the Elevate app it belongs to, plus your notification preferences.
  • Data on your device: the apps work offline, so they keep a copy of your data in a local database on your phone or computer and synchronize it with our servers when you are online. That copy stays on the device until you remove the app or its data.
  • Technical data: like any online service, our hosting and backend providers process your IP address and basic request information (such as browser or app version) in server logs to deliver the Service and keep it secure.
  • Website: byelevate.app only uses the cookies needed to keep you signed in and to complete an invitation, and stores in your browser whether you dismissed the language suggestion. We do not use advertising or analytics cookies, and the apps contain no third-party analytics or advertising SDKs.

3. Google user data

If you choose “Sign in with Google”, Google shares with Elevate only the basic profile information covered by the openid, email and profile scopes: your name, your email address, your Google account identifier and the address of your profile picture. We do not request access to any other Google data, such as your contacts, calendar, files or Gmail.

We use this information only to create your Elevate account, sign you in and show your name in your profile. Sign-in is handled by our authentication provider, Supabase, which receives this data from Google on our behalf and keeps it with your sign-in record. We do not sell Google user data, use it for advertising, or share it with anyone else, except when the law requires it.

Elevate’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

You can remove Elevate’s access to your Google account at any time at https://myaccount.google.com/permissions. This stops future sign-ins with Google but does not delete your Elevate account; see section 6 for that.

If you choose “Sign in with Apple”, Apple shares your name and email address (or, if you choose to hide it, a private relay address created by Apple). We use them in the same limited way: only to create and sign in to your account.

4. How we use information

We use personal data to:

  • create and authenticate your account, store your data and keep it in sync across your devices;
  • let you work with the people you are linked with: trainers and their clients, nutritionists and their patients, and gyms with their staff and members;
  • send the notifications you have enabled (for example reminders and updates about invitations or bookings) and invitation emails;
  • process subscriptions and show your subscription status in the apps;
  • keep the Service secure, prevent abuse and fix errors;
  • comply with our legal obligations.

Where data protection laws such as the GDPR apply, we rely on the performance of our contract with you, your explicit consent for health data, our legitimate interest in keeping the Service secure, and our legal obligations. We do not sell personal data, we do not use it for advertising, and we do not make automated decisions that have legal effects on you.

5. How information is shared

Inside Elevate, information is shared only with the people you are linked with:

  • A trainer or nutritionist sees the data of the clients who accepted their invitation, and each client sees the plans and routines their professional creates for them.
  • If a client works with both a trainer (Coach) and a nutritionist (Nutri), each professional can see the other’s data about that client only while the client’s data sharing setting allows it. The client can turn it off at any time in the Coach app settings.
  • In a gym, the owner and administrators see the members, staff, bookings, payments and finances of their gym. A practitioner’s private notes about a patient are visible only to that practitioner, unless the patient agrees to share them with the gym’s service staff.

We use the following service providers to run Elevate. They process personal data only on our instructions and only to provide their service:

  • Supabase: authentication, database, file storage and server functions.
  • Stripe: payments and subscription billing on byelevate.app.
  • Vercel: hosting of the byelevate.app website.
  • Resend: delivery of invitation emails.
  • Expo push notification service: delivers notifications to your device through Apple Push Notification service (APNs) and Firebase Cloud Messaging (Google).
  • Google and Apple: only if you choose to sign in with them.

We may also disclose information when the law requires it, to protect the rights and safety of our users or of Elevate, or as part of a merger or acquisition, in which case this policy keeps applying to your data. We do not sell or rent personal data.

6. Data retention and deletion

We keep your data for as long as your account exists.

You can delete your account at any time from Settings → Delete account in any Elevate app. This permanently deletes your account and the personal data linked to it from our servers, and it cannot be undone. If you are the only owner of a gym, you first need to transfer it or close it. Records you created in another person’s file (for example, a measurement you took as a nutritionist) may stay in that person’s file without being linked to you. If you have a paid subscription, cancel it from your account on byelevate.app before deleting your account.

You can also ask us to delete your account by writing to elevate@capsulecodes.com from the email address of the account. Stripe keeps payment records for as long as tax and accounting laws require, and copies in our providers’ backups are removed as those backups expire.

Step-by-step instructions to delete your account

7. Security

All data travels encrypted (HTTPS/TLS) between the apps, the website and our servers. Database access rules make sure each user can only read the data they are allowed to see, and health notes are restricted to their author unless the patient agrees to share them. Passwords are never stored in plain text, and we never store card numbers. No system is completely secure; if a security incident affects your data, we will notify you and the authorities as the law requires.

8. Your rights

You have the right to:

  • access the personal data we hold about you;
  • correct it, either directly in the apps (for example, your profile) or by asking us;
  • delete it, as explained in section 6;
  • receive a copy of your data in a portable format;
  • object to or ask us to restrict certain processing;
  • withdraw your consent at any time, for example by turning off notifications or the data sharing setting.

To exercise any of these rights, write to elevate@capsulecodes.com. We reply within 30 days. Depending on where you live, laws such as the EU and UK GDPR or Argentina’s Personal Data Protection Law 25.326 grant you these rights, and you can also file a complaint with your data protection authority (in Argentina, the Agencia de Acceso a la Información Pública). If a professional or a gym recorded your data, you can also contact them directly.

9. Children

Elevate is not directed to children. You must be at least 16 years old (or the minimum age required in your country) to create an account. We do not knowingly collect personal data from children under 16; if you believe a child has given us personal data, contact us and we will delete it.

10. International transfers

Our service providers may store and process data in countries other than yours, including the United States. When that happens, we rely on the safeguards those providers offer, such as the European Commission’s standard contractual clauses.

11. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date above and, for significant changes, notify you in the apps or by email before they take effect.

12. Contact

For any question or request about privacy, write to elevate@capsulecodes.com.