Carnet

Coach terms (Carnet)

Between the coach, the account holder who invites athletes (the coach, controller), and Cristian Crețan, Bucharest, Romania, carnet@carnet.coach (Cristian, processor). Last updated: 2026-10-19. Accepted in the app: the coach accepts these terms once, at their first start after this version, before Carnet opens their athletes.

Version française : carnet.coach/privacy/coach/fr/ (the two texts say the same; the English one governs if they differ). Privacy notice: carnet.coach/privacy/

  1. What this covers. The coach uses Carnet to plan and review the training of their athletes. Cristian runs Carnet and stores the athletes' training data for the coach: plans, logged sets, pain (EVA), sleep, stress, motivation, bodyweight and calorie check-ins, session posts, notes, library items and views. This includes health data. It lasts as long as the coach has athletes in Carnet, then clause 9 applies.
  2. Only on instructions. Cristian processes the data only to provide Carnet to the coach and their athletes, and as the coach instructs (using the app counts as an instruction). He does not use it for anything else, never sells it, runs no analytics or ads on it. If the law requires otherwise he tells the coach first, unless the law forbids that.
  3. Confidentiality. Cristian is the only person with access. Anyone he ever adds is bound to confidentiality first.
  4. Security. Data stays in the EU (Supabase, AWS Ireland). Access is limited by row-level security in the database (an athlete and their active coach only), TLS in transit, encryption at rest by the host, a nightly backup kept 30 days on an encrypted disk, and the operator's accounts protected by strong passwords and two-factor sign-in.
  5. Sub-processors. The coach agrees to Supabase Inc. (database, sign-in, file storage; EU region, Ireland) and Vultr (The Constant Company, LLC, USA; the virtual server in Chicago that serves the web app's code and this notice). Vultr is a US sub-processor for access logs only (IP address, time, path, kept 14 days): that server holds no training or account data, which goes from the browser straight to Supabase in Ireland. The web app also fetches fallback fonts from Google LLC (Google Fonts, USA) and iPhone push notifications go through Apple Inc. (USA); both receive only what that needs (an IP address, a push token and "<coach> planned week N"), never training data. Cristian tells the coach at least 30 days before adding or replacing a sub-processor, and the coach may object; if they cannot agree, the coach may leave and take an export.
  6. Helping with rights. Cristian helps the coach answer athletes' requests (access, export, correction, erasure, restriction), normally within 14 days of being asked. Requests are handled by hand for now (email, then an export or deletion by Cristian); export and deletion from inside the app are planned.
  7. Breaches. Cristian tells the coach without undue delay, and within 48 hours of becoming aware, of any breach affecting their athletes' data, with what is known and what is being done.
  8. Other help. Cristian gives the coach the information they reasonably need to show they comply (including for a data protection impact assessment) and answers reasonable questions about how data is handled.
  9. End. When the coach stops using Carnet, or Carnet shuts down (with at least 60 days' notice), Cristian gives the coach an export of their athletes' data on request and then deletes it from the live database within 30 days; backups expire 30 days later. Athletes keep their own accounts unless they ask otherwise. If the coach's own account is deleted, notes the coach wrote stay in the athletes' threads without the coach's name, so each athlete's history stays whole.
  10. Coach's side. The coach makes sure their athletes know their data is in Carnet and why (the privacy notice is at https://carnet.coach/privacy/, in French at https://carnet.coach/privacy/fr/), only invites people who agreed to use it and are 16 or older, and keeps their own sign-in to themselves. Each athlete also gives explicit consent for health data in the app, once: at first sign-in, or at the next start for people already using Carnet.

Romanian law applies.