Privacy Policy

The short version

• We ask for what a booking actually needs, and not more.
• We never store your full Aadhaar number. Identity checks keep the last four digits and the result, nothing else.
• A coach's phone number and email address are never shown to parents, and a parent's are never shown to coaches.
• Alerts are off until you switch them on, and switching them off — or logging out — stops them immediately.
• WhatsApp updates are off unless you tick the box, and switching them off is one tap from your dashboard.
• There are no analytics, no advertising and no third-party trackers on this site. The only cookie we set is the one that keeps you logged in.
• We never sell your information, and we never share it for marketing.

Who is responsible for your information

Coachy.Club is operated by Coachy, registered at Century Eden, Bangalore. Under India's Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the information described on this page — which means we decide what is collected and why, and we are answerable for it.

If you would rather talk to a person about any of this, our Grievance Officer's contact details are at the bottom of this page.

What we collect from parents

• Your name, email address and phone number.
• Your PIN code, and the name of your apartment, gated community, layout or school. This is how we find coaches near you — it is the whole point of the platform.
• Your city and state.
• Your approximate location, only if you tap the button that asks for it. You can skip that and type your PIN code instead; nothing is lost if you do.
• Your bookings, and any notes you add to them.
• If you turn on alerts, we hold an address your browser issues for that one device, so we can send a notification to it. It is not tied to your phone number and cannot be used to identify or track you anywhere else. Turning alerts off, or logging out on that device, deletes it straight away.
• If you tick the WhatsApp box, we use the phone number you registered with to send you booking updates — trial requests, confirmations and cancellations, and nothing else. You can switch it off from your dashboard at any time, and we record the date you agreed so we can show why we messaged you.

What we collect about your child

If the coaching is for your child, we hold their name, age and — if you give it — their school. That is what lets a coach know who they are teaching and prepare accordingly.

The account belongs to you, the parent. Your child does not have a login, cannot sign in, and is never contacted by us directly. You give consent on their behalf when you register, and you can withdraw it at any time by asking us to delete their details.

We do not profile children, we do not track their behaviour, and we do not show advertising to anyone — so we certainly do not target it at children.

What we collect from coaches

• Your name, email address, phone number and the PIN codes you cover.
• Your professional profile: headline, biography, experience, languages, what you teach and what you charge.
• Your UPI ID, so parents can pay you.
• A photo of your face, which parents see on your profile. It is the only file we ask for when you register.
• We do not ask for or store any identity document — no Aadhaar card, PAN, passport or driving licence. Registration used to collect one; it no longer does. Coaches who uploaded a document before that change still have it on file, and can ask us to delete it.
• Identity and background check results — see the next two sections.
• If you start signing up and do not finish, we keep the name, email, phone number and PIN code you had entered, so that we can contact you to help you complete it. We never keep the password from an unfinished sign-up, and nothing you uploaded. You can ask us to delete this at any time using the contact details below.
• If you turn on alerts, we hold an address your browser issues for that one device, so we can send a notification to it. It is not tied to your phone number and cannot be used to identify or track you anywhere else. Turning alerts off, or logging out on that device, deletes it straight away.
• If you tick the WhatsApp box, we use the phone number you registered with to send you booking updates — trial requests, confirmations and cancellations, and nothing else. You can switch it off from your dashboard at any time, and we record the date you agreed so we can show why we messaged you.
• Where you say you are with a police clearance certificate when you sign up — that you have one, have applied, or will apply — and the date you said it. That is a note for our team to follow up, not a check in itself.

Aadhaar and identity verification

Parents trust this platform because coaches are checked. That check has to be done carefully, because Aadhaar data is some of the most sensitive information a person has.

Right now, no identity document is collected at all. Registration asks for a profile photo and nothing else, and Aadhaar verification is switched off, so no Aadhaar number is requested from anyone. The rest of this section describes what happens when we switch it on.

When a coach verifies their identity, the Aadhaar number is sent to our licensed verification provider to trigger a one-time password. It is never written to our database. What we keep is the last four digits, the name, year of birth, gender, state and PIN code that UIDAI returns, a photograph where one is provided, and whether the check passed.

Those details are visible only to our own administrators reviewing the verification. Parents are told only that a coach is verified — a badge, never a detail from it.

Identity verification can be switched off entirely for the platform. When it is off, no Aadhaar number is asked for at all.

Police clearance certificates

Coaches upload a Police Clearance Certificate, which we store privately — never in a publicly reachable folder — and serve only to the coach who uploaded it and to the administrator reviewing it. As with identity, parents see a badge and a date, not the document.

Support tickets

When you raise a support ticket, we hold what you wrote, anything you attached, and our replies. Our team also keeps internal notes on a ticket; those are not shown to you, and they are used to coordinate a response, not to record opinions about you.

Attachments are stored privately and served only to you and to our team.

Records we keep of what happened

Every significant action on the platform — a registration, a booking, a verification decision, a configuration change — is written to an audit log with who did it and when. This is how we can answer a question about what happened to your account, and how we notice misuse.

We also record every notification we send you, and whether it was delivered, so that "I never got the email" is a question with an answer.

Why we are allowed to hold it

For almost everything on this page, the basis is your consent, given when you register and tick the box confirming you have read this policy. You can withdraw that consent at any time, and we will delete your account and the information attached to it.

Some records outlive a deletion request because the law says they must — payment and tax records in particular. Where that applies, we keep only what is required and nothing else.

Who else sees your information

We do not sell your information to anyone, and we do not share it for advertising. A small number of services help us run the platform and necessarily handle some of it:

• Our email provider, which delivers booking confirmations, verification results and support replies. It sees your email address and the content of those messages.
• Our Aadhaar verification provider, which performs the identity check for coaches.
• Our hosting provider, on whose server the platform and its database run.
• A mapping service, which converts approximate coordinates into a PIN code when you use the "find my location" button. Your browser never contacts it directly — our server does — and it receives the coordinates only, with nothing that identifies you.
• A push notification service — Google's, Apple's or Mozilla's, depending on the browser you use — if you turn on alerts. It carries the notification to your device but cannot read it: every message is encrypted to a key that only your own browser holds. It does see that a message was sent to your device, and when.
• Meta (WhatsApp), if you turn on WhatsApp updates. Unlike the push service above, Meta can read these messages: it sees your phone number, your name and the booking detail in the message. That is how WhatsApp works, and it is the reason the channel is off until you ask for it.

Cookies

One cookie, which keeps you signed in. It is marked HttpOnly so that scripts cannot read it, and it lasts thirty days or until you log out.

There is no analytics cookie, no advertising cookie and no third-party tracker on this site. We are not asking you to trust us on that: open your browser's developer tools and look.

Alerts do not use a cookie either. If you turn them on, your browser gives us an address for that device and nothing more — there is no identifier stored on your phone that follows you to other sites.

How long we keep things

When you delete your account, your personal information and your child's are removed from the live platform. Backups made before that point roll off on the schedule above.

• Your account and its information: for as long as you have an account with us.
• An unfinished sign-up: 30 days, after which it is deleted automatically. It is deleted immediately if you complete your registration.
• Audit log entries: 90 days by default, after which they are removed from the live database.
• Nightly archives and database backups on our server: 7 days by default.
• Support tickets: for as long as your account exists, so that you and we can look back at what was agreed.
• The address for a device you turned alerts on for: until you turn them off, log out on that device, or uninstall the app — whichever comes first. If your phone tells us the address is no longer valid, we delete it that moment.
• The date you agreed to WhatsApp updates: until you switch them off, which clears it.

How we protect it

• Passwords are stored as bcrypt hashes. Nobody at Coachy.Club can see your password, and we will never ask you for it.
• Identity documents and ticket attachments are stored outside the public web folder and served only through a route that checks your session first.
• Changing your password signs out every other device, so a compromised session ends when you reset.
• Access to administrative screens is limited by role, and the most sensitive of them — the audit log and the data archives — are restricted to a single super-administrator account.

Your rights

Under the DPDP Act you can ask us to show you what we hold about you, correct anything wrong, delete it, or withdraw your consent. You have the same rights over your child's information, as the person who gave consent for it.

The quickest route is to raise a support ticket from your dashboard: it already knows who you are, which saves us having to verify you separately, and it gives you a written record of what we said. You can also write to the Grievance Officer below.

We will respond within the time the law allows, and if we cannot do what you have asked we will say why.

Grievance Officer

In line with the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000, complaints about how your information has been handled can be made to:

The Grievance Officer, Coachy, Century Eden, Bangalore. Email: support@coachy.club.

If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

Changes to this policy

If we change what we collect or what we do with it, we will update this page and change the date at the top. Where the change is significant, we will email you about it rather than hoping you notice.