Legal
Privacy policy
Last updated 30 October 2026
The short version
- We collect what we need to run Athvilo for coaches, and nothing for advertising.
- Your clients’ data belongs to you, the coach. We process it only to run your app.
- Our own team can’t see who your clients are. Our admin tools show coaches, not clients.
- No ads, no tracking cookies, no selling or sharing data for marketing.
- You can ask us for a copy of your data, or to delete it, at any time.
- Who we are
- Coaches, clients and us
- What we collect
- Why, and on what legal basis
- Your clients’ data
- Cookies and local storage
- Who helps us
- Data outside Norway and the EEA
- How long we keep data
- Security
- Your rights
- Changes and contact
1. Who we are
Athvilo is made by CCC Playground, Norway. In this policy “Athvilo”, “we” and “us” mean CCC Playground.
Questions about privacy: [email protected].
2. Coaches, clients and us
Athvilo gives coaches their own branded app for their clients. That creates two different relationships:
- Coaches and visitors. When you visit athvilo.app, sign up as a coach, or use the coach tools, we decide how your data is used. We are the controller.
- Clients of a coach. When you use a coach’s app as their client, your coach decides what happens with your data. Your coach is the controller and we are their processor: we store and process it on their behalf, under a data processing agreement, and for nothing else. Questions about that data go first to your coach. We’ll help them answer.
3. What we collect
Visitors to athvilo.app
Our web server records technical request data (IP address, browser, time, page) to deliver the site and keep it secure. The sign-up form doesn’t send anything to us by itself: it opens your own email app, and we receive only what you choose to send.
Coaches and their assistants
- Account details: name, email address, your role, and the business details you give us (brand name, country, billing email).
- Your app’s branding: name, colours, logo, photos and video you upload.
- Your coaching content: programmes, membership tiers, meal plans and app settings. We keep these on our servers so your app works on any device you sign in on.
- Billing data: your plan terms, the number of active paying clients per day (a count, not who they are), invoices and payment status.
- Sign-in and security data: sign-in links we send, sessions (with IP address and browser), and a log of changes made in our admin tools.
- What you write to us, if you contact us.
Clients of a coach
Whatever the coach’s app needs to work: for example your name and email to sign in, your training plans and logs, messages with your coach, check-ins, and, if your coach turns them on, meal plans and fluid logs. See section 5.
We don’t ask for, and you shouldn’t enter, information Athvilo doesn’t need. Some training data, like injuries or health notes, can count as health data. Your coach is responsible for having a valid reason to collect it, usually your explicit consent.
4. Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing coach accounts, apps and support | Contract (Art. 6(1)(b)) |
| Sign-in links, security logs, preventing abuse | Legitimate interest in a secure service (Art. 6(1)(f)) |
| Billing and bookkeeping | Contract, and legal obligation under Norwegian bookkeeping law (Art. 6(1)(b) and (c)) |
| Replying when you contact us | Legitimate interest (Art. 6(1)(f)) |
| Running a coach’s app for their clients | We act on the coach’s instructions; the coach chooses the legal basis |
We don’t use personal data for advertising, we don’t sell it, and we don’t make automated decisions about you that have legal or similar effects.
5. Your clients’ data
- Client data is used only to run that coach’s app. We never use it for our own purposes, and never combine it across coaches.
- Our platform team can’t look up clients. Our admin tools show coaches, their assistants and the number of clients each coach has, never client names, emails or content. This is enforced in the database, not just hidden in the screens.
- Each coach’s data is kept separate from every other coach’s.
- A coach can export or delete their clients’ data. When a coach leaves Athvilo, we delete their clients’ data as described in section 9.
- A client’s personal data (profile, training logs, messages, notes, nutrition) is encrypted on the coach’s and the client’s own devices before it reaches us. We store it only in encrypted form and can’t read it: not our platform team, and not anyone with access to our servers or backups.
- We don’t store a client’s email address. When a coach invites someone, we send the invite and keep only a keyed fingerprint of the address, so the client can sign in later by typing it. The invite can greet the client by first name; we use that name for the email and don’t keep it.
6. Cookies and local storage
We use only what the service needs to work:
- A sign-in cookie per app (for example
athvilo.session_token), so you stay signed in. It is set only when you sign in. - Your browser’s local storage, to keep app settings such as language and the last page you had open.
- For coaches and their assistants, the browser’s own key storage (IndexedDB) holds this device’s encryption key. It never leaves the device: our servers only receive its public half and encrypted copies of keys.
No advertising, analytics or tracking cookies. Because everything we store is strictly necessary, there is nothing to consent to: the notice you see on your first visit just tells you this. Dismissing it stores one small note in your browser so it doesn’t come back.
7. Who helps us
We use a small number of providers, each bound by a data processing agreement and only allowed to use data to provide their service to us:
| Provider | What for | Where |
|---|---|---|
| Our own servers | Database, apps and backups | Norway. We plan to move to Hostinger servers in the USA; see section 8. |
| Cloudflare | Delivering the site securely (network, encryption in transit) | Global network; Cloudflare, Inc. is in the USA |
| Resend | Sending sign-in and service emails | USA |
| Stripe | Coach subscriptions: card payments, receipts and invoices. Stripe gets the coach’s name, email and card details, never client data. | Stripe Payments Europe (Ireland) and Stripe, Inc. (USA) |
We’ll update this list before adding a provider that handles client data, and tell coaches in advance.
8. Data outside Norway and the EEA
Our database and apps run on servers in Norway today. We plan to move them to servers rented from Hostinger in the USA. Before that move we’ll update this policy and tell coaches by email, so they can object or leave before it happens.
Where a provider handles data in the USA, the transfer relies on the EU–US Data Privacy Framework where the provider is certified, or otherwise on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.
9. How long we keep data
- Coach accounts: as long as the account is active. After an account is closed, we delete or anonymise its data within 90 days, except what the law requires us to keep.
- Clients’ data: as long as the coach keeps it in their app, and deleted within 90 days after the coach leaves.
- Invoices and bookkeeping records: 5 years, as Norwegian bookkeeping law requires.
- Sign-in sessions: up to 60 days in the apps, 7 days in our admin tools.
- Backups: overwritten after 14 days.
- Server request logs: kept for a short period for security, then deleted.
10. Security
Data is encrypted in transit. Coaches’ data is kept apart in the database, and our own team works through tools that can’t reach client identities. Sign-in uses one-time links instead of passwords for coaches and clients, and our admin access is limited to a small, named team with logged actions. No system is perfectly secure; if a breach affects your data, we’ll tell you and the Norwegian Data Protection Authority as the law requires.
11. Your rights
Under the GDPR you can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interest. Email [email protected]. If you’re a client of a coach, ask your coach first. We’ll help them respond.
You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live.
12. Changes and contact
If we change this policy in a way that matters, we’ll tell coaches by email before it takes effect, and update the date at the top.
Contact: CCC Playground, [email protected].