Privacy Policy

How we handle your data.

Plain language. Real commitments. Last reviewed 2026-10-31.

Who this policy applies to

This policy covers everyone who uses Marrow. Coaches and instructors who run their practice on the platform, athletes and clients who train with those coaches, gym owners and studio admins, and visitors to marrowfitness.com. We wrote it in plain language so a non-technical person can read it without a dictionary. If you have a question, ask it on our contact page and a real person will answer.

What we collect

Depending on how you use Marrow, we collect some or all of the following.

  • Application and form submissions. Name, email, professional details, and anything you wrote in the open text fields.
  • Account data. Email for magic-link authentication, profile information, role (coach, athlete, gym admin), and the connection between coach and athlete accounts.
  • Training data. Programs, sessions, logged workouts, form videos you upload, notes between coach and athlete, nutrition ranges, and wearable-derived signals if you choose to connect a device.
  • Billing data. Name, billing address, and payment method tokens, handled by Stripe. Marrow never sees full card numbers.
  • Photos and diagnostics. Progress photos if you turn them on, and error reports and masked app screen recordings, as described in the sections below.
  • Operational data. IP addresses, browser type, device type. Used for abuse prevention and to keep the service running. Not used to track you across the web, apart from the Meta pixel on our public pages described in Advertising measurement with Meta.

What we don't collect

We count our own page views with Plausible Analytics, which sets no cookies. We don't run Google Analytics and there's no fingerprinting. We don't sell or license your data. The one advertising tool we use is Meta's, on our public website only, and it is described in full in Advertising measurement with Meta below. Nothing from inside the Marrow app, and nothing about a member's or athlete's account, training or signup, is ever sent to Meta.

On marrowfitness.com we ask before anything optional runs. A small banner offers Accept and Reject, side by side and the same size. Until you choose Accept, nothing optional loads: no Meta pixel, no signup event sent to Meta from your browser or from our server, and no Sentry screen recordings. If you choose Reject, or never choose, none of that ever runs.

Your choice is kept in a cookie named marrow_consent on our own site for one year. Only we set it and only we read it. If your browser sends Global Privacy Control, we treat that as Reject and do not show the banner.

Some things run for everyone, because the site needs them to work and to stay up: Plausible visit counts, which set no cookies; Sentry error reports, without screen recordings; and Cloudflare, which runs and protects our site. Each is described below.

You can change your choice at any time with Your privacy choices at the bottom of every page, or here: change your privacy choice.

We use two tools from Meta, the company behind Facebook and Instagram, to find out whether our advertising works: the Meta pixel and the Meta Conversions API. We use them on marrowfitness.com only, in two places only, and only after you choose Accept in Your privacy choices.

  • Our public pages. On public pages such as our home page and our pricing page, the Meta pixel records that the page was viewed. It sets a small cookie on our site so Meta can recognise a repeat visit, and because your browser talks to Meta directly, Meta also sees your IP address and browser type, as it does on any site that uses the pixel. It is never loaded inside the Marrow app, on sign in or checkout pages, on any member or athlete page, or on a coach's or gym's own website.
  • When a coach or gym signs up. When a coach or gym owner finishes checkout for their own Marrow plan, we tell Meta a signup happened and what the plan costs each month, for example 99 US dollars for Solo Coach. It is sent once from your browser and once from our server, carrying the same event code so Meta counts it once. Member and athlete signups are never sent.

What is sent. The event, meaning a page view or a signup, and the page it happened on. For a signup, the plan and its monthly price. For a signup our server also sends your email address and your Marrow account number, each turned into a one way code before it leaves our server so Meta can match it to a Meta account without receiving the real value, along with your browser type, your IP address and the Meta cookie codes your browser already holds for our site, if it has any. We never send your name, your card details, your training data or anything from inside the app.

What Meta does with it. Meta uses it to report to us how many people who saw our ads went on to visit or sign up, and to show our ads to people more likely to be interested. Meta receives it as a separate company, under its own Business Tools Terms and its own privacy policy. Under some state privacy laws, including California's, sending this to Meta for advertising counts as sharing personal information. We do not sell it.

How to opt out.

  • Our privacy banner. Nothing from Meta runs until you choose Accept. Choose Reject, or change an earlier Accept to Reject with Your privacy choices at the bottom of any page, and our pages do not load the Meta pixel and no signup event about you is sent to Meta, from your browser or from our server.
  • Global Privacy Control. Turn on Global Privacy Control in your browser or a privacy extension. When your browser sends it, our pages do not load the Meta pixel and no signup event about you is sent to Meta, from your browser or from our server.
  • Your Meta settings. If you have a Facebook or Instagram account, the setting called Your activity off Meta technologies, in Meta's Accounts Center, lets you disconnect this activity from your account, and Ad preferences controls the ads you see.
  • Your browser. A content blocker stops the pixel. Blocking third party cookies stops Meta linking a visit to your Meta account.

Questions about any of this go through our contact page.

How we use your data

We use the data you submit to:

  • Run the platform, including coaching tools, athlete dashboards, and admin surfaces.
  • Authenticate you and keep your account secure.
  • Process payments for coach subscriptions and athlete billing.
  • Respond to applications, demo requests, and support questions as soon as we can.
  • Send platform onboarding details, transactional notifications, and the receipts you would expect.
  • Deliver messages your coach chooses to send you through Marrow, on the channels you yourself agreed to. The Messages from your coach section below explains how that works and what protects you.
  • Maintain a private record of your interaction with us.

Your phone number and text messages

We treat your phone number with the same care as the rest of your data. We do not sell your personal data or your phone number. We do not share it with third parties for their own marketing, and we do not let anyone else use it to market to you. The only companies Marrow lets touch your number are the named service providers that help us run the platform, such as our messaging and payment providers, and only so they can deliver the messages and services you asked for. No mobile information is shared with third parties or affiliates for marketing or promotional purposes.

One thing that sentence does not cover, so we are naming it here rather than leaving it implied. Your coach can connect their own AI assistant to their own Marrow account, and the owner of the gym you train at can connect one to their own gym console. A gym owner's connection never receives your phone number, your name, your email, or any other contact detail. Your coach's connection receives them only if your coach switches on Client profiles for their own account and you agree to it yourself, in your own Marrow account, and only for your coach's own record of you. You can take that back at any time. Message text is the one exception to that setting: a message reaches the assistant as it was written, so a name or detail typed into it travels with it either way. What each one can and cannot receive, and what each can do after its owner says yes, is written out in full under Connected AI assistants below.

Text messaging (SMS). Marrow Fitness messaging is a conversational, reply based text program on our published business number, 786 833 7303. If you text or call that number, you consent to receive conversational text replies from Marrow Fitness at the number you contacted us from, to answer your question, return a missed call, and help you with your account. We do not send marketing or promotional text blasts, and we never text anyone who has not contacted us first. Message frequency varies based on how the conversation goes. Message and data rates may apply, depending on your carrier and plan. For this program we collect your mobile number, the messages you send us and our replies, and your STOP and HELP requests, and we use them only to answer you, help you with your account, and respect your choice to opt out. The full program terms are in section 15 of our Terms of Service.

Text messaging originator opt in data and consent are never shared with any third parties or affiliates for marketing or promotional purposes. We do not sell or share your SMS opt in data or personal information with third parties for marketing purposes. The only outside companies that handle it are the messaging providers that deliver our texts, and only to deliver them.

You are always in control. Reply STOP to any message to opt out and we will not text you again. Reply HELP for help, or reach us on our contact page. Opting out of texts does not close your account or stop transactional notices you need, such as receipts and security alerts.

Texts from your coach or gym. Marrow's own business number, above, never texts you on a coach's behalf. A coach can connect their own texting number, on their own Twilio account, and their connected AI assistant can send you a text from that number, described under Connected AI assistants below. Each text goes only after your coach has read it and said yes to it, and only where a permission record covers you for texts from that coach. That record exists only if you said yes to texts yourself, in your Marrow account, and you can take it back there at any time. A texting permission your coach recorded for you is kept on file but sends nothing until you confirm it yourself. Daytime hours where you are and the daily caps in Messages from your coach apply to texts too, and replying STOP to your coach's number ends texts from it. A gym can save its own Twilio texting number on its Connections page, but nothing in Marrow sends a text from it today. The one way a gym can message you through Marrow is WhatsApp, and only after you message the gym there first, as set out under A gym's WhatsApp front desk.

A gym can connect its own WhatsApp number to Marrow through its own Twilio account. When you message that number, Marrow receives your message so the gym's front desk can answer it, and hand it to the gym's owner or managers when it cannot. Your messages also pass through WhatsApp and the gym's Twilio account.

Who answers. Most answers come from the gym's own details: hours, address, memberships, classes and links. If the gym has added its own Anthropic AI key on its Connections page, a question those details do not cover can go to Claude on that key, along with the gym's details, to write the answer. Without that key there are no AI replies and a person answers. When a conversation goes to a person, the gym's team is emailed your number, and the owner or a manager can reply to you on WhatsApp.

What we keep. Your WhatsApp number, the text of each message and a message id. We do not keep your WhatsApp profile name or any photos or files you send. Messages are deleted after 180 days. If you send the gym STOP on WhatsApp, we record it, and the gym can send you nothing more on WhatsApp until you write START.

Messages from your coach

Your coach can send you messages through Marrow. A message in your Marrow inbox, which you read inside the product. A push notification on your phone that tells you an inbox message arrived. An email. And, only from your coach's own connected texting number, a text, as the section above describes.

You decide, in your own account. You say yes to texts yourself, in your Marrow account, and you can take it back at any time. Your coach's AI sees your record by name only after you agree in your own account. Your coach cannot say yes to either one for you.

Texts are two separate choices. Texts from your coach about your training and sessions, and offers and news from your coach by text, each have their own box, and you tick only what you want. Texts come from your coach's own number. Message frequency varies, and message and data rates may apply. Reply STOP to stop at any time, or HELP for help. Saying yes is never a condition of training with your coach, and you can change either choice in Settings whenever you like.

Your coach decides to message you. Marrow never decides on its own. Every message from your coach needs a recorded human authority behind it: your coach pressing send inside Marrow, your coach saying yes to that exact message through their connected assistant, or a standing setting your coach or your gym switched on in advance under their own login. Those standing settings are follow ups to something a person started, such as up to two reminders of an invitation you have not answered, a check in when you have gone quiet, or an invitation to a quieter class time at your gym, and each one carries a way to stop it. Marrow runs the delivery and keeps the record. Apart from those, the only messages Marrow sends you are the account notices you need, such as receipts and security alerts. An invitation to join is one email plus at most two reminders, each with a stop link, and stopping ends the reminders.

An AI assistant sends only on your coach's yes. If your coach uses a connected assistant, described under Connected AI assistants below, that assistant can write a message and, after showing your coach exactly what would go and to whom, send it only if your coach says yes to that message. Your coach's words are recorded with the send. Every limit in this section applies to it exactly as it applies to your coach pressing send.

Permission is separate for each channel. Saying yes to email is not saying yes to anything else. Before a message can go out on a channel, a consent record has to exist for you, on that channel, for that kind of message. That record is created only when you yourself act on a Marrow surface, such as ticking a box or changing a setting in your Marrow account. If your coach records that you told them texts are fine, that note is kept, and it sends nothing until you confirm it yourself in Marrow. A record is never created by an AI and never created by an unattended job.

The record is permanent evidence. When you say yes, we record when you said it, where you said it, and the exact words you were shown. When you say no, in your settings or by replying STOP, we record that too. Consent records are never edited and never deleted, because they are the proof of what you agreed to. A no is final. If you opt out and later change your mind, saying yes again takes a fresh action from you.

Limits that hold on every message. Messages that interrupt you, such as a push notification or an email, are held to daytime hours where you are, 8am to 9pm in your own local time. A message due outside that window waits and goes out when the window opens. It is deferred, never dropped, so nothing your coach sends you silently disappears. There are also caps: by default one message per person per day, plus a daily cap on each account, so a runaway loop cannot become a flood. And the consent check runs again inside the same database step that records the send, so an opt out that lands moments before a send still wins.

You can take permission back at any time. Switch it off in your Marrow account settings, reply STOP to a text, use the opt out in the message itself where the channel carries one, or tell us on our contact page and we will switch that channel off for you. Your withdrawal is recorded the same way your yes was, and it stops future sends to you on that channel.

If you asked a coach a question and have not joined. When you contact a coach through a form on their Marrow page, that coach can answer you by email through Marrow. The basis for that reply is your own enquiry: you asked, they answered. The only thing that path can send is a reply, not a mailing list, and it can never send you a marketing text.

If a gym adds you as a visitor. A gym can add someone who visited or asked about it. Marrow then sends that person one email asking whether they want to hear from the gym, and sends nothing more until they say yes themselves. If they never confirm, nothing more comes, and the stop link in that email works at any time.

Where your data lives

Marrow application data is stored in the United States. The primary database is Supabase, hosted in the US, with row-level security on its tables and Marrow's server checking access on every request it makes for you. Files you add, such as progress photos, body scan photos, lab report files and meal plan documents, are stored in Cloudflare R2. Static assets are delivered via Cloudflare's global edge for performance, while application reads and writes route to US origins. Our visit counts come from Plausible Analytics, hosted in the European Union, which sets no cookies. To count a visit, our server forwards the page address, the page you came from, your IP address and your browser type to Plausible. We do not store them, and Plausible reports to us only totals, never a list of visitors.

Application form submissions reach the Marrow operator mailbox and are recorded in our leads pipeline. From there, they may be added to your coach or athlete account record if you sign up.

Sub-processors

Marrow uses a small number of third-party services to operate the platform. Each of them is named, with the data they touch and where they're located, on our canonical sub-processor page. We update that page before any new sub-processor goes live and we notify coaches in advance of material changes.

The current list covers Stripe (payments and coach payouts), Cloudflare (DNS, edge, compute, and file storage for the photos and documents you add), Supabase (database and sign in), Kit (email sequences), Postmark (transactional email), Plausible Analytics (privacy-friendly analytics), Meta (advertising measurement on our public pages), Sentry (error monitoring and masked app screen recordings), Anthropic (Claude, only on an Anthropic key a gym or coach saves in Marrow themselves, described below), Telegram and Slack (notices to our own team), Mux (coach video hosting), Cal.com (booking a call with us), Google (fonts, and calendar or fitness accounts you choose to connect), and the wearable companies a member chooses to connect.

The canonical, always-current list lives at marrowfitness.com/legal/subprocessors. If the page below ever conflicts with that page, the sub-processor page is the source of truth.

Open item, under legal review. An AI assistant that a coach connects to their own Marrow account is chosen and paid for by that coach, not engaged by Marrow, so it is not a Marrow sub-processor in the way Stripe or Supabase is. Whether it must still be named on the sub-processor page, or covered there by explicit carve-out language, is with our counsel and is not settled yet. That counsel review is ongoing. Our current position is the one stated above, that an assistant a coach chooses and pays for is not a Marrow sub-processor in the way Stripe or Supabase is. If counsel rules that those vendors belong on the sub-processor list, they go on the list and we notify coaches.

Connected AI assistants

Marrow lets someone connect an AI assistant they already pay for to their own Marrow account. There are two kinds of connection and they reach different things, so both are written out below. A coach connection is your coach connecting an assistant to their own coaching account. A gym owner connection is the owner of a gym connecting one to their own gym console. In both cases the person connecting chooses that vendor and pays it directly. Marrow does not choose it, does not resell it, and has no agreement with it. Today the only client Marrow has run end to end is Claude, made by Anthropic. Any other client that speaks the same open protocol can be connected.

Because that assistant runs on their own vendor account, anything it is sent leaves Marrow's systems and lands with that vendor under that vendor's terms. So the honest question is not whether we trust them. It is exactly what can reach them, and exactly what they can do. Here is the whole list, for each kind of connection.

Nothing happens in one step. Reading is immediate. Anything that reaches a person, moves money, or changes what you can see is two steps and never one. First the assistant shows your coach, or your gym's owner, exactly what would happen and to whom. Then it acts only if they say yes to that exact thing, in their own words, and those words are recorded with the change. A yes to one thing is never a yes to another. Apart from a coach taking their own public page live or offline, none of these two step actions works at all until that person has accepted the version of their connection agreement that describes them, and Marrow can switch every one of them off at once. When that agreement changes, as it did on 2026-10-25, the actions wait until they accept the new version, and reading keeps working.

A coach connection

Your coach connects an assistant to their own account so it can help them run their coaching business the way their dashboard does: their page, their programs, their prices, their schedule, their clients and the people who have enquired. It works on your coach's own account and nobody else's.

How you appear on it. Unless your coach has switched on Client profiles and you have agreed to it in your own Marrow account, both described below, you appear on a coach connection as an opaque pointer, never by name. A pointer is a one way code standing in for you. It carries no name, no email, no phone number, and nothing derived from any of them. It cannot be reversed by the AI vendor. Marrow retains the means to match a pointer back to you, and Marrow alone. The same person training under two coaches produces two unrelated pointers.

What a coach connected assistant can read about you. The same records your coach can already open about you on their own Marrow dashboard, and only on your coach's own account.

  • Your training. The programs your coach assigned you, and the workouts and sessions you logged against them.
  • Your messages with your coach. Messages in your Marrow inbox between you and that coach, and your check ins.
  • Your nutrition. The plans and targets your coach set for you, and the food and meal records you chose to log.
  • Your measurements and readings. Body measurements and progress entries, and readings from a wearable you connected and shared with your coach.
  • Your bookings. Sessions and classes you are booked into with that coach.
  • Your payments to that coach. What you pay, what you have paid, refunds, and payment requests. Never your card details.
  • Counts across the roster. How many memberships are active, cancelled or past due, how many members sit on each tier, session pack usage in aggregate, and when something last happened.

What a coach connected assistant can do, only after your coach says yes. Each of these is two steps, as described above. A message, a post, a refund or a charge cannot be taken back once it has gone, and the first step says so.

  • Contact you. Send you a message in your Marrow inbox or an email, and send you a text from your coach's own connected texting number, never from Marrow's. Every rule under Messages from your coach still holds: a permission record for you on that channel, which for a text is your own yes in your Marrow account, daytime hours where you are, and the daily caps.
  • Invite you, or ask something of you. Send an invitation to join, a form to fill in, or a request for a review.
  • Change your schedule with that coach. Book, move or cancel a session or class you are on, the way the dashboard does.
  • Handle money with you. Refund one of your payments through Stripe, with the same limits the dashboard applies. Charge you, or send you a payment request. Turn on a price your coach set. Turning a price on never changes what an existing member already pays. If your coach raises what you already pay, the new price bills only after you accept it in Marrow. Until you do, your current price continues, and your coach may cancel your plan instead. A lower price applies straight away, and you are told.
  • Publish your coach's own work. Take your coach's public page live or offline, publish a program, and post to your coach's community or their own social and review accounts.

What a coach connected assistant can receive about people who enquired. If you contacted a coach through Marrow and have not signed up yet, your enquiry sits in that coach's own pipeline. Their assistant can read the shape of that pipeline and write a follow up for one entry in it.

  • Where an enquiry sits, and how long it has waited. The stage it is at, where it came from, for example a referral, an event, or a form on the coach's page, and three counts of days: how long it has sat at that stage, how long since the coach last logged contact, and how long since it first arrived.
  • Not your name. Your first name, last name, email address, phone number, any tags on you, and the note about what you were interested in are not read by the pipeline reads. Those columns are never asked for, so there is no answer the assistant could get them from.
  • An opaque per enquiry pointer. The same kind of code as the pointer above, so the assistant can point at one particular enquiry. It cannot be reversed by the AI vendor, and the same person sitting in two different coaches' pipelines produces two unrelated codes.
  • Counts across the pipeline. How many enquiries sit at each stage, how many arrived from each source, how many have never been contacted, and how many arrived in each month. Numbers only.
  • A follow up goes only after the coach says yes. The assistant writes it, shows the coach exactly what would go and on which channel, and it goes only on the coach's yes and only where a permission record covers you on that channel. For a text, that record is the texting box you ticked yourself on the coach's form. Without that permission it does not go, whatever the coach says.

What a coach connected assistant can receive about your coach's schedule as a whole. Your coach can ask how full they are, which hours of their week are quiet, and where the gaps sit. These reads carry no identity at all.

  • Counts, clock times and durations. Nothing else. How many sessions are scheduled or cancelled in a forward window of up to 90 days, how many seats those sessions hold and how many are taken, how many booking slots are open, and how many bookings are active or waiting. Then which weekday and hour each of those sits in.
  • Not you, and not a code standing in for you either. These reads ask for no member id, no booking id, no slot id, and no code derived from any of them, so there is no opaque pointer here at all. A session reaches the assistant as a time and a number and never as an attendee.
  • A booking is a separate act. When your coach's assistant books, moves or cancels a session you are on, it is acting on your booking, after your coach says yes, as described above. The utilisation reads in this list are not how it does that.

What a coach connected assistant can receive about money. It depends on the agreement your coach accepted. The tools that read revenue, show a client's billing, refund, charge or turn a price on reach a connection only when the coach on it has accepted the version of the connection agreement that describes them in plain words, and Marrow holds a switch over that surface as well. Where either one does not hold, no dollar amount reaches the assistant at all, and a request that names one of those tools is answered that the capability is unavailable.

  • Your coach's own business totals. What that coach took over a named window, what they refunded, what is left after Marrow's fee, their refund rate, how many transactions there were, the same figures split across the things they sell, and the same totals month by month.
  • Your billing with that coach. What you pay and have paid that coach, refunds, and payment requests, attached to your pointer, or to your name when Client profiles is on and you have agreed to it.
  • Money moves only on a yes. A refund, a charge or a payment request happens only after your coach has read the amount and who it is for and said yes. A price goes live only the same way.

What moves, and what does not. We will not describe this as a permanent absence, because it is not one. A coach who has not accepted the current agreement sends no amounts and can take none of the actions above. A coach who has can, on their own account and by their own decision, one yes at a time. What none of it reaches is anything in the list below.

Client profiles, which needs two yeses: your coach's and yours. It is off for every coach until that coach turns it on, on their own account, from their own Marrow dashboard. Even then, your coach's assistant sees your record by name only after you agree in your own Marrow account, and you can take that back at any time in your settings. Until both are true, you appear only as a pointer or inside a count, and nothing in the list below reaches the connection. Once both are true, your coach's assistant can work with your record by name on your coach's own account, and with nobody else's. Turning it off in Settings stops the assistant seeing you by name straight away. Messages you and your coach exchange in Marrow belong to your coach's account and can reach the assistant whether or not you agree.

  • Your name, your email address, your phone number, and your date of birth.
  • The training goals and the injury history you entered when you joined, so your coach's assistant can help write for the body you actually have.
  • Your coach's own notes about your training, which they wrote.
  • Whether your membership is active, and the dates your record was created and last changed.

Two things are true of everything above whatever the setting says. It is your coach's own record of you and it is reachable only from your coach's own connection, so no other coach and no other coach's assistant can see you through it. And none of it is anything your coach could not already read on their Marrow dashboard, under their own login. The connection decides whether their assistant can help them with it. It does not decide what your coach can see.

What a coach connected assistant can never receive or do. These are not settings. There is no tool on the coach surface that reaches them, on any account, in any state of any switch or agreement.

  • Another coach's anything. Another coach's clients, records, messages, prices, programs or page. Nothing on the connection accepts an identifier that points outside your coach's own account.
  • A score of you. Nothing on the connection scores your form or grades you as a person. Your form check videos and your progress photos are not sent to it.
  • Your mailing address.
  • Your card details or your billing address.
  • Marrow's own prices and your coach's own Marrow billing. What Marrow charges your coach, and your coach's own subscription and billing with Marrow, are not on the connection at all.
  • The controls that hold it in check. How much your coach lets it do on its own, the switch that stops it, your coach's decision to let it handle money, and the keys that connect it. Only your coach, signed in to Marrow, can change those, and only Marrow can override them.
  • Files. It cannot upload a file, a photo or a video to Marrow.

A gym owner connection

If you train at a gym rather than with a solo coach, that gym's owner can connect an assistant to their gym console. It works one level up from a coach connection. It looks at the gym: who is on the roster, which trainers are ready to sell, how busy the schedule is, and how the gym is set up. It does not look down into any one member.

What a gym owner connected assistant can receive. This is everything it touches.

  • The gym's own record. Display name, city, locations, onboarding state, whether payouts are set up, the brand colours on file, and how many trainers, gym plans, fee templates, events and saved reports exist.
  • The trainer roster. Each trainer's display name, role, status, location identifier, and invite and join dates, and the gym's managers and the locations each one covers. This is staff information, not member information.
  • Readiness per trainer. Whether an active trainer has a published page, a live price, programs, and payments enabled. Whether the thing exists, never the trainer's own content and never a price figure.
  • Members as pointers. Each member appears as an opaque pointer with their trainer, their status, when they were last active and whether they use the app. Never by name.
  • Roll ups across the roster. Counts for a forward window of up to 90 days, per trainer and in total: class sessions, class attendees, open booking slots, bookings, pending requests, slot utilisation, and how many active athletes each trainer has. Numbers only.
  • The gym's commercial setup. Gym owned membership plans, the fee templates that decide what a trainer is paid, the team fee and split settings, and the gym's events, each with the fields the console already shows.
  • The owner's own reports and change log. Reports the connection saved for that owner, and the record of changes made through it with the before and after value of each field it touched.
  • Where your branded app is up to. Which step of the build it is on, whether that step is moving, and whether anything is waiting on the owner. It never claims Apple has approved anything, and it says plainly when it could not check rather than reporting that nothing has started.
  • The shape of the month. Counts bucketed over a window so an owner can see whether the gym is growing.
  • The words on the gym's own public page. The headline, the description, the list of what the gym offers, and the wording of its enquiry form. Never a trainer's page.

What a gym owner connected assistant can do, only after the owner says yes. Each is two steps, exactly as for a coach.

  • Run the team. Invite or remove a trainer, invite or remove a manager and set which locations a manager covers, and invite or end an outside trainer.
  • Set the money rules. Set a trainer's team fee and the gym's billing and revenue splits, and switch a gym plan or a fee template on or off.
  • Move a member between trainers. Transfer a member from one of the gym's trainers to another.
  • Publish the gym's own work. Change the gym's details and its public page, take that page live or offline, connect its own web address, apply its brand colour, and publish, cancel or announce a gym event. Announcing an event notifies the people it is for through Marrow.
  • Let Marrow support in, for a set time. Open access for a named Marrow support person for a stated reason and a fixed time of up to fourteen days, or end it early. Every one of those is on the gym's own access record.

What a gym owner connected assistant can never receive or do. These are not settings either. There is no tool on the gym surface that reaches them.

  • Any individual member's identity or contact details. No member name, email address, phone number or mailing address, and no member id. You appear only as a pointer or inside a count.
  • Any member's health, body or nutrition record, or their messages. Attendance and totals yes. One named person's body data or conversations never.
  • A trainer's own content or prices. Not their page copy, not their programs, not their price figures, not their client records. A gym owner's assistant cannot write to any of it either.
  • Your money directly. It cannot refund you, charge you, or change what you pay.
  • The controls that hold it in check. Switching a trainer's sign in off or on, the switch that stops the connection, and the keys that connect it stay with the owner, signed in to Marrow. Marrow's own prices and the gym's own Marrow billing are not on the connection at all.

The full text an owner accepts is the gym connection agreement.

Small rosters, said plainly. A count can still point at a person when the number is small. If a coach has one member past due, a count of one past due member is about that member, even when the count itself carries no name. The same holds on the gym side. If one trainer has one active athlete, a count of one is about that athlete. That is a limit of counts, not a loophole, and your coach and your gym already know who their members are. We are naming it so the guarantees above are not read wider than they are.

What they type is on them. A connected assistant is that person's own chat window. If your coach, or your gym's owner, types something about you into it, or saves it into a report through that connection, that is content they wrote, not data Marrow handed over. Everyone who connects an assistant must first accept an agreement that makes them responsible for their vendor choice, for that vendor's data handling settings, and for what they say yes to. A coach accepts the connection agreement. A gym owner accepts the gym connection agreement.

Control and questions. A coach connects, and revokes, from their own dashboard. A gym owner connects, and revokes, from their gym console. Either way it loses access immediately, and Marrow can disable every connection at once. Your side is yours too: in your Marrow account settings you can agree to be shown by name, or take that back, and say yes or no to texts. If you want to know whether the coach you train with, or the gym you train at, has an assistant connected, ask them, or reach us through our contact page and we will tell you.

Off until you turn them on. Progress photos are optional. You turn them on in the Marrow app, and until you do, we store no photo you take.

What we store. Up to three photos a day: front, side and back. Before a photo leaves your phone, the app shrinks it so its longest side is no more than 1024 pixels and saves it as a JPEG. With each photo we store the date, the pose, an optional note you write, and the time it was uploaded. The photo files sit in a private storage bucket at Cloudflare and are never on a public web address. The date, pose and note sit in our database at Supabase. Your phone keeps a copy of your latest photos so they load quickly, and that copy is cleared when you sign out or turn photos off.

Who can see them. You can. A coach can see them only while you are on that coach's client list and have photos turned on. Every time a photo is opened, we check who is asking before we send it, and the link that shows it stops working after 10 minutes. Gym owners and gym admins do not see your photos unless they are also your coach.

Deleting them. You can delete one day's photos, and they stop showing to you and your coach straight away. You can also turn progress photos off at any time. When you do, all your photos stop showing to anyone straight away, and we then delete the photo files from storage.

Lab reports you add are private to you, your coach sees them only if you turn sharing on (it starts off, and you can turn it off any time), we never sell them, and you can delete one report or all of them, file included, any time. When a report reaches its retest date we send you one reminder, at 10am in your own time zone, or at 2pm Eastern time if you have not set one. If a delay on our side misses that time, the one reminder goes out at the next chance: later that day, before 9pm your time, or at the same time on one of the next two days.

Marrow sends no member or coach data to an AI provider. The one exception is an Anthropic key a gym or coach saves in Marrow themselves: a gym's WhatsApp front desk, the website studio and a coach's client list import can then send what that job needs to Claude on that key, under their own account with Anthropic. A client list import sends only the column names and what the values look like, never the values. Members cannot connect their own Claude or ChatGPT to a Marrow account yet. A coach can connect their own to their own Marrow account, and that AI reads what the coach lets it read through that connection, under the coach's own account with that company. To bring in a file, such as a lab report, a photo of a body scan sheet, a meal plan, or a program a coach brings across from another app, you show it to your own Claude or ChatGPT there and paste its answer back into Marrow; a coach whose AI is connected can also let it write the answer in as a draft. Marrow checks only the shape of what comes back, and nothing is saved until you check it and save it. You can always type the values in instead. In Drop anything, a coach's page for adding several files at once, a file Marrow cannot place on its own is not sent anywhere: the coach picks what kind of file it is.

Meal ideas and a grocery list now come from the Claude or ChatGPT you already use, not from Marrow. If you connect it to your Marrow account, it reads your targets and today's log through your connection, under your own account with that company, and writes the ideas in its own chat. Marrow sends nothing to an AI for this and saves none of it.

A program draft is now written by the Claude or ChatGPT you already use, not by Marrow. If you connect it to your Marrow account, it reads your program and history through your connection, under your own account with that company, and can save a draft into your account. Marrow sends nothing to an AI for it. Nothing in a draft is medical advice. If you have a coach, the draft goes to your coach as a proposal and cannot change your coach's program.

You can ask your own Claude or ChatGPT about one of your lab reports. Marrow gives you a prompt with that report's marker table for you to copy into it. Marrow sends nothing to an AI for this, and your AI reads nothing in Marrow and writes nothing back. What it tells you is general education, not medical advice, and your coach is the person to ask.

Your coach can ask Marrow's co-pilot to draft a short message to you. Marrow fills in a plain template for your coach to edit and sends nothing about you to an AI. If your coach drafts it with their own Claude or ChatGPT connected to their Marrow account, you appear to that AI as described under Connected AI assistants above: as a coded pointer, never by name, unless your coach has switched on Client profiles and you have agreed in your own Marrow account. Your coach reads the draft before anything is sent to you.

When you use our free starter week page, we keep your email, your answers and which of the two boxes you ticked. We use them to show you your plan, to email it to you only if you ticked Email me my plan, and to send you occasional Marrow coaching tips only if you ticked Send occasional Marrow coaching tips. The plan is a hand written week matched to your answers, and nothing you enter is sent to an AI provider. If you copy the prompt we offer into your own Claude or ChatGPT, that company handles it under your own account. You can unsubscribe at any time.

We use Sentry, listed with our sub-processors above, to find and fix crashes and bugs.

In the Marrow app. When the app hits an error, it sends Sentry a report with the technical details of the error, the app version and a short trail of recent steps in the app. Before a report leaves your phone, we remove your email address, username and IP address, and we strip any field that looks like health or body data, such as weight, body fat, measurements, calories, heart rate, sleep, steps and workouts.

Screen recordings in the app. Sentry records a replay of the screen for about 1 in 10 app sessions, and for any session where an error happens. In every recording all text, all images and all icons and drawn graphics are masked, so your name, your numbers, your messages and your photos are hidden. The recording shows the layout of the screen and the steps taken.

On our website. Most pages on marrowfitness.com load Sentry's browser script to catch errors on the page. It is not loaded on our sign in pages, our checkout pages or our member sign up page, and it does load on other pages, including account setup and settings pages. Errors it catches are sent from your browser straight to Sentry, which receives them over the internet like any website you visit. When our servers hit an error, Sentry receives the page address, the type of request, your browser type and a one way code made from your IP address instead of the address itself. We remove email addresses, passwords, login tokens and payment keys from these reports before they are sent. Sentry keeps this data for the period set by our Sentry plan and then deletes it.

Screen recordings on our website. Only if you choose Accept in Your privacy choices, described above, and your browser does not send Global Privacy Control, Sentry keeps a short replay of a page when an error happens on it. In every recording all text is masked and all images and media are blocked, so it shows the layout of the page and the steps taken, not what you typed or read. Without Accept, no recording is made and the recording code is not loaded. We never record a session that has no error.

Inside the Marrow app and the signed in dashboards, we do not yet record which buttons you press or which screens you open, beyond the error reports and screen recordings described above. During coach signup and onboarding, Plausible counts a few steps, such as a checkout being started, without cookies and without your name.

If we start counting how people use Marrow's features, so we can see what helps and what gets in the way, we will update this section before it starts and list it in the app store privacy labels. We will tell you what is counted and how long it is kept. We never use it for advertising and never sell it.

Marrow is for adults. You must be 18 or older to use it. When you set up a member account in the Marrow app, or sign up on our website as a member, coach or gym owner, we ask you to confirm you are 18 or older before you can finish, and on the website we record when you confirmed. We do not ask for your date of birth. A coach can add a date of birth to a client record, and Marrow refuses one under 18 and shows the coach any record that already carries one, so it can be put right. We do not knowingly collect personal information from anyone under 18. If you think someone under 18 is using Marrow, tell us on our contact page.

Athletes

If you are an athlete, your data is processed by Marrow on behalf of the coach you train with. Marrow does not market its own products to athletes. What reaches you through Marrow is account notices, messages from your coach or gym, and the reminders and invitations described under Messages from your coach, each with a way to stop it. For solo coach accounts, coaches own the relationship with their athletes and may export athlete data at any time. For studio and gym accounts, the gym owns the member relationship at the platform level, and coaches keep a copy of their own programming work, matching the terms of service. On termination of a coach's account, athletes are given 30 days to migrate their training history before deletion.

Your rights

You can export a full copy of your data or close your account at any time from your account settings. You can also reach us through our contact page to ask what we have on you, request deletion, or correct errors. We respond inside 30 days. Step by step instructions for deleting your account, and what is deleted and kept, are on our account deletion page. If you're in the EU, UK, or California, you have specific rights under GDPR or CCPA. We honor all of them.

How long we keep it

Application data: 12 months unless you become a customer. After that, we retain it as part of your customer record. Customer training data is retained for the life of your account. When you close your account, erasure starts no sooner than 30 days after you confirm, so you can export your data or ask us to undo the close. If you ask us to delete sooner, we delete within 30 days.

Updates to this policy

We'll update this page when our practices change. The "last reviewed" date at the top tracks every revision. If a change is material, we'll email you.

Contact

Marrow Fitness
Miami Beach, FL
Privacy questions go through our contact page.