Privacy Policy

This policy explains what personal information we collect through the Diamond Physiques website and mobile app, why we collect it, who else can see it, and what you can do about it.

It is written to be read, not to be survived. If anything here is unclear, ask us.

Who we are. Diamond Physiques By Alex is a registered business name of Alexander Djurovic, a sole trader, ABN 69 247 339 445, based in Queensland, Australia. In this policy "we" and "us" mean that person and business, and "you" means a client or visitor.

Contact. alex@diamondphysiques.com — we answer privacy questions ourselves; there is no support desk in between.

1. The short version

We collect what we need to coach you, and nothing for advertising.

There are no analytics or tracking tools on our website or app. No Google Analytics, no Meta Pixel, no advertising SDKs, no session recording. We have never installed any.

We do not sell your information, and we do not share it with advertisers. Ever.

We hold no card or bank details at all. There are no in-app purchases.

You can delete your account, and everything attached to it, from inside the app.

2. What we collect

Information you give us

When you enquire. Your name, email address, and whatever you tell us in an enquiry or application form — including your training history, goals, and any injuries or health conditions you choose to mention.

When you become a client. Your name and email address, used to create your account.

When you use the app. Depending on what you use:

Training — the workouts assigned to you, and the sets, reps, weights and notes you log

Cardio — any runs, rides, walks or other cardio sessions you record, including how long they took, how far you went, the pace and calories you enter, and anything you note about them

Body measurements — weight, body fat percentage, and any other measurements you choose to record

Daily figures — your step count and hours slept, if you choose to record them

Progress photos — only if you upload them

Nutrition — foods and quantities you log, and the targets set for you

Weekly check-ins (online clients) — your answers, which include ratings of sleep, stress and diet, the number of sessions you completed, and anything you report about injuries or pain

Messages — what you send us through the app

Information collected automatically

Notification token. If you turn on notifications, your device gives us an anonymous token so we can send you a reminder. It identifies the device, not you personally. We stop using it when you sign out on that device, and it is deleted when you delete your account.

Cookies — there are two, and neither is for tracking. One keeps you signed in. The other is set only while you are resetting your password, contains nothing but a marker, and expires after 15 minutes. Both are strictly necessary for the site to work. We set no advertising or analytics cookies, and nothing we put in your browser identifies you or follows you to other sites.

Your IP address, when you open an invite link. Redeeming an invite records the IP address the request came from, so that someone cannot sit there guessing at invite links. It is used for that and nothing else, is not linked to your account, and is not used to work out where you are. These records are deleted after 90 days.

On your phone, the app stores your login session, any sets you have logged that are still waiting to reach us because you had no signal, and which workout you are part-way through. That is all of it, and it stays on your device. Signing out clears your login and deliberately leaves the other two alone, so a workout you logged without signal isn't lost. All of it goes when you delete the app.

We do not collect your location, contacts, browsing history, advertising identifiers, or data from other apps.

3. Health information — and why we ask for consent

Some of what we collect is health information, which Australian privacy law treats as sensitive and holds to a higher standard. That includes injuries, pain, body measurements including body fat, the cardio sessions you record, your step count and hours slept, sleep and stress ratings, and anything you tell us about a medical condition.

We collect it only with your consent, and only to coach you. By using the app and answering check-ins you are consenting to that. You can withdraw consent by deleting your account, or by asking us to remove specific information — see section 8.

Two commitments about health information specifically:

1. We do not share it with anyone outside the systems listed in section 5, all of which are infrastructure providers processing it on our behalf.

2. If you report an injury or pain, a human reads it. We do not and will not put an automated system in charge of deciding what to do about your body. Any automated feature we add for programming or nutrition will route an injury or pain report to your coach and stop there.

This app is not a medical service. We are personal trainers, not doctors. Nothing in the app is medical advice, and it is not a substitute for seeing a health professional.

4. Why we collect it

Name, email — to create your account, identify you, and contact you.

Enquiry answers — to decide whether we can help you, and how.

Training logs — to write your program, track your progress, and progress your loading safely.

Body measurements, photos — to show you change over time, and only what you choose to record.

Nutrition logs — to set and review targets with you.

Check-in answers — to coach you week to week, and to notice when something is wrong.

Injury and pain reports — to keep you safe and adjust what we ask you to do.

Notification token — to send you a check-in reminder.

We do not use any of it for advertising, profiling, or automated decisions that affect you without a human involved.

5. Who else can see it

Nobody, except the infrastructure providers we use to run the service. They process your information on our behalf, under their own security obligations, and are not permitted to use it for their own purposes.

Supabase — database, sign-in, and progress photo storage. Sydney, Australia (ap-southeast-2).

Vercel — website and app hosting. Global edge network.

Resend — sending emails to you. United States.

Expo — delivering push notifications to your device. United States.

Newie — the payment platform Alex uses for coaching fees. It receives your name and email address, and nothing else. Darwin, Northern Territory, Australia.

Newie is not like the four above, and the sentence at the top of this section does not describe it. It is an independent business rather than a provider handling information on our behalf: it has its own legal obligations, including tax and anti-money-laundering record-keeping, and it uses what we give it to meet them. Its privacy policy also allows information to be stored, processed in, or transferred to countries outside Australia, including the United States — so unlike your training and health data, the name and email address it holds may leave the country.

Your training data, health information and progress photos are stored in Australia. Email and notification delivery involve providers in the United States, which means the content of an email we send you, and the text of a notification, passes through servers outside Australia.

Progress photos are held in a private storage bucket. They are not publicly addressable and cannot be reached by a URL alone. Exercise demonstration images and videos are in public storage, because they are library content shown to every client — they contain nothing personal about you.

We will disclose information without your consent only where the law requires it — for example a court order — or where there is a serious and imminent threat to someone's life or health.

6. Financial information

We hold no financial information about you. No card numbers, no partial card numbers, and no bank details are collected, processed or stored — not by the app, not by this website, and not in our database.

The app also does not sell anything. There are no in-app purchases.

7. How long we keep it

While you are a client, and while you have an account. Training history is only useful because it is long — deleting last year's logs would remove the thing that shows you progressed.

When you delete your account, we delete it. Not archive, not anonymise — delete. See the next section for exactly what goes.

If you enquire and never become a client, we keep your enquiry so we can follow up, and delete it on request.

Invite-link IP records are deleted after 90 days. They exist only to stop someone guessing at invite links, and are no use to anyone after that.

8. Your rights, and how to use them

Delete your account. In the app: More → Delete account. It asks you to confirm, then removes:

your sign-in and password

your client record

every workout, session and set you logged

your body measurements and progress photos, including the image files themselves

your nutrition logs and targets

your check-in answers

your messages

your notification tokens

your email address from our email records

It cannot be undone, and we cannot restore it afterwards.

Get a copy of your information. Ask us and we will send you everything we hold about you, in a readable format, within a reasonable time and at no cost.

Correct something. Tell us and we will fix it.

Ask us to delete something specific rather than everything — for example one progress photo, or an answer you would rather not have given. Ask and we will remove it.

Complain. If you think we have mishandled your information, tell us first and we will investigate and respond. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

If you are in the European Union or the United Kingdom, you have further rights under the GDPR, including data portability and objecting to processing. Contact us and we will honour them.

9. Security

All traffic is encrypted in transit (HTTPS).

Your information is protected at the database level by access rules that scope every query to the account making it. A client can only ever read their own records; this is enforced by the database, not only by the app.

Progress photos are in a private bucket, not public storage.

We do not store passwords ourselves — authentication is handled by Supabase, and passwords are hashed and never visible to us.

We do not email you your password, and we will never ask you for it.

No system is perfectly secure. If a breach ever occurs that is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

10. Children

The app is not intended for anyone under 16. We do not knowingly create accounts for under-16s. If you are a parent or guardian and believe we hold information about your child, contact us and we will delete it.

Where we coach a minor with parental consent, that arrangement is agreed directly with the parent or guardian, in writing, before any account is created.

11. Changes to this policy

If we change what we collect or who we share it with, we will update this policy and change the date at the top. If a change materially affects you, we will tell you directly rather than relying on you noticing.

12. Contact

Alexander Djurovic, trading as Diamond Physiques By Alex.

ABN 69 247 339 445

alex@diamondphysiques.com

Queensland, Australia

Who collects this

Alexander Djurovic, sole trader, trading as DIAMONDPHYSIQUESBYALEX.
ABN 69 247 339 445
Queensland, Australia
alex@diamondphysiques.com