S K I L L H E X
Privacy policy
Who we are
SkillHex is training-tracking software operated by Domingo Figueroa, New York, USA, reachable at dfigueroa@skillhex.app.
If you train with us, we hold records about your training. This page says exactly what those records are, who can see them, and what you can ask us to do with them.
What we collect, and why
Your account
- Email address — how you sign in and how we send password resets.
- Password — stored only as a cryptographic hash by our authentication provider. We cannot see it and neither can your instructor.
- Sign-in dates — the last time you signed in.
Your profile
Name, and optionally a photo, a training goal, an Instagram handle, a short bio, and a colour for your radar chart.
Your training record
- Attribute scores — your instructor's rating of you on each attribute, 0–10, and when each was last trained.
- Sessions — the date, name and intensity of each session logged, and which attributes and moves it worked. Sessions you log yourself are marked as self-logged and do not affect your scores.
- Skill progressions — which levels of which skills you've achieved.
- Snapshots — dated copies of your scores, so progress can be charted.
- Badges and awards — what you've earned and when.
Your photos and videos
Progress photos and videos you upload to your gallery, and any your instructor posts for you (always labelled as posted by the coach). They are held in private storage and served only through short-lived signed links to signed-in accounts allowed to see them. Your videos are private to you unless you switch on sharing with your coach. Deleted items sit in Recently Deleted for 7 days and can then be removed permanently.
Coach notes and your replies
Notes your instructor writes about you, dated, and comments you write in reply. You can read every note about yourself.
WHOOP data — only if you connect it
If you choose to connect a WHOOP device, we store for each day: your recovery score, heart-rate variability, resting heart rate, sleep duration and sleep performance, and day strain. That is all — we do not store raw heart-rate streams, workouts, location, or anything else from WHOOP.
- Connecting happens on WHOOP's own consent screen. The keys WHOOP issues us are stored server-side in a form no user of the app — including you and your instructor — can read.
- Your instructor sees these daily numbers by default, because SkillHex is a coaching tool; you can switch that off in your profile at any time, and switching it off is invisible to the instructor.
- Disconnecting (in your profile, or by revoking SkillHex inside WHOOP's own app) stops all collection and deletes our keys immediately. Days already synced remain in your log as part of your training history; you can ask us to delete those too.
- These numbers are wellness measurements from a consumer device. They are not a medical assessment or diagnosis, and SkillHex gives no medical advice.
Feedback and technical records
- Ideas and bug reports you submit, with your name attached, so we can follow up.
- Push notification subscriptions — only if you turn notifications on.
- Presence — whether you're currently online, and when you were last seen.
- An audit log — a record of who changed what and when, including changes made by your instructor.
What we do not collect
- No analytics, no advertising trackers, no third-party marketing pixels.
- No payment information.
- No location data.
- No medical records. Attribute scores are your instructor's subjective coaching assessment, not a clinical measurement. WHOOP numbers, if you connect them, are consumer wellness data as described above.
Who can see your information
You can see everything about yourself.
Your instructor can see every member's training record — that is the nature of the tool. Two exceptions are yours to control: progress videos you haven't shared, and WHOOP numbers if you've switched sharing off.
Other members see only what you deliberately publish. Profiles are private by default; a public profile shows a fixed, limited set of fields — never your ratings, sessions, notes, media or WHOOP data.
This is enforced in the database itself through row-level security, not merely hidden in the interface. Another member's login physically cannot read your training record.
Nobody else. We do not sell your information, share it with advertisers, or disclose it to third parties except the service providers below, or where legally required.
Service providers
| Provider | What they hold | Where |
|---|---|---|
| Supabase (on AWS) | The database, authentication, private file storage — everything above | United States |
| Vercel | Hosting for the application itself | United States |
| GitHub | Nightly database backups, in a private repository | United States |
| WHOOP | Only if you connect it: WHOOP already holds your device data under their own privacy policy; we read the daily summaries described above | United States |
| Google (Gemini API) | Only if you turn on the Training Assistant: a de-identified summary of your own training record (never your name, notes, or anyone else's data), on Google's paid tier, which does not train on submitted data | United States |
YouTube (via youtube-nocookie.com), Bilibili, or Cloudflare Stream are contacted only when you actually press play on a demonstration video. Your browser's push service is used only if you enable notifications.
How long we keep it
- Your training record is kept while you are a member, and for 12 months after you leave, so a returning student's history is still there. Ask and we'll delete it sooner.
- Backups are kept for 60 days; a deletion can take up to 60 days to clear them.
- The audit log is kept for 24 months.
Your rights
Write to dfigueroa@skillhex.app and you can:
- See everything we hold about you — we'll send it as a file.
- Correct anything wrong — much of it you can already edit in the app.
- Have it deleted — permanently, including your media and WHOOP days.
- Withdraw from the public directory, disconnect WHOOP, or unshare your videos at any time, in the app, immediately.
If you are in the EU or UK, the GDPR gives you these rights as a matter of law, plus the right to complain to your data protection authority. If you are in California, the CCPA gives you comparable rights.
Children
SkillHex is not intended for anyone under 18. We do not knowingly collect information from under-18s. If you believe a minor has an account, contact us and we will delete it.
Security
Row-level security in the database so members cannot read each other's records; column-level privileges so a member cannot change their own permissions; server-side-only storage for integration keys; an audit log; nightly off-site backups. No system is perfectly secure, and we won't claim otherwise. If something goes wrong that affects your information, we will tell you.
Changes
If this policy changes materially, we'll tell members rather than quietly editing the page. This version: 9 August 2026.