Privacy Policy
Version 1.10 · Last updated: October 13, 2026 · Effective: October 13, 2026
In case of any discrepancy, the Spanish version (Aviso de Privacidad) prevails.
1. Who is responsible for your data
| Controller | Alejandro Sánchez Saucedo, sole proprietor (persona física con actividad empresarial), Mexico |
| Address | Prolongación Matamoros #100, Eulalio Gutiérrez, C.P. 25903, Ramos Arizpe, Coahuila, Mexico |
| Privacy contact | privacidad@zanzahq.com |
| Brand | Zanza (trademark application pending before Mexico's IMPI; formerly "RoadToFit" / "Road") |
| Services | zanzahq.com, app.zanzahq.com (coach dashboard), api.zanzahq.com (API), and the Zanza mobile app for iOS and Android |
1.1 Who is responsible for what
Zanza is a two-sided platform. Depending on the case, there are two separate controllers over your data:
| Who | Decides | Examples |
|---|---|---|
| Zanza (us) | How the platform works: your account, security, retention, the coach directory, AI assistance features, and the infrastructure | Authentication, backups, encryption, retention periods |
| Your professional (coach, trainer, or nutritionist) | Their professional service: what they program for you, what they ask you, what measurements they take, and what they do with your results | The intake questionnaire, your plan, the measurements they record, the messages they send |
Your professional is an independent controller, not our employee or agent. They have their own privacy obligations and must give you their own privacy notice. If you use Zanza without a coach ("on my own" / self-coached mode), we are the only controller.
2. Who this policy covers
Athletes using the mobile app, professionals using the web dashboard, people who receive an email invitation or questionnaire, and visitors to our public websites. Every one of those emails carries a link to stop receiving them; if you use it, we keep your email address on a suppression list so we do not send you those emails again, from any professional (§10).
3. What personal data we process
🔴 marks sensitive personal data, which receives reinforced protection (§5).
3.1 Account and identity
Email, username, password (stored only as a bcrypt hash, never in clear text), Google or Apple sign-in identifier, first and last name, nickname, mobile phone, date of birth 🔴 and sex 🔴, language, time zone, currency, role, and account status.
Sex and date of birth are not decorative: they determine which normative tables a test is read against, the anatomical illustrations of the pain map, and lab reference ranges. Given their direct link to health, we treat them to the same standard as sensitive data.
3.2 Access and security
IP address and user agent for each session, session creation/expiry/revocation timestamps, a SHA-256 hash of your session token (never the token itself), and hashed verification and password-reset codes.
We also keep proof of consent: which document you accepted, in which version, when, and from which IP and device. The law requires us to be able to demonstrate your consent for sensitive data, and that is only possible if we record it.
We also keep an access log: which professional opened which section of your file, when, from which IP and with which device. It records the fact of looking, never what was looked at. Its purpose is narrow and worth stating plainly — if there is ever improper access, we can tell you exactly what was seen instead of having to assume the worst.
3.3 Health and training data 🔴
| Category | What it includes |
|---|---|
| Training log | Sets, reps, weight lifted, perceived effort (RPE/RIR), body side, machine variant, techniques used, duration, and date of each session |
| Pain and discomfort 🔴 | Discomfort level (1–10), body area marked on an anatomical map (front, side, or back view), and your free-text comments per exercise |
| Cardio and running | Duration, distance, pace, power (watts), cadence, elevation, and second-by-second heart-rate series; best efforts per distance |
| Daily health 🔴 | Resting heart rate, heart-rate variability (HRV) and daily steps (each day's total, to measure it against the step goal your coach assigns), read from Apple Health or Health Connect if you authorize it |
| Workouts outside your plan | Every workout your watch or band recorded (type, duration, distance, calories, average and max heart rate), only if you turn on the specific toggle |
| Anthropometrics 🔴 | Weight, height, skinfolds, girths, bone diameters, segment lengths, bioimpedance (lean mass, body fat %, phase angle) |
| Vital signs 🔴 | Blood pressure, resting heart rate, oxygen saturation, respiratory rate, temperature |
| Lab results 🔴 | Biochemical results you or your coach enter: lipid panel, glucose, hormone panel, thyroid, liver, kidney, hematology, electrolytes, vitamins and minerals, inflammation and muscle-damage markers — including the sample type (serum, plasma, whole blood, urine, or saliva) |
| Assessments and records | Physical test results, personal records, goals, and training reference values |
| Questionnaires 🔴 | The intake questionnaire your coach defines (may include injury history, illnesses, medication, or surgeries) and the daily readiness questionnaire (sleep, stress, fatigue, pain) |
| Photos and videos 🔴 | Body progress photos and technique videos you choose to upload, with their date and pose |
3.4 Location data
When you start a workout recording in the app, we use your device's GPS to compute distance, pace, and elevation in real time, including with the screen off.
By default, we do not store your route coordinates on our servers. What we store are derived metrics (distance, pace, speed, altitude per instant).
If you turn on "Save my route" in Settings (it is off by default), we also store the points of your route — latitude and longitude, each with the second of the session you passed there — with that workout, to show you the map and splits. If a coach trains you, they see it along with the rest of the session, and each time they open it is recorded in the access log (§3.2). You can turn it off at any time, and deleting a session deletes its route.
We do not track your location in the background outside a session you started, we never use it for advertising, and we never share it with advertisers.
3.5 Bluetooth sensors
If you connect a bike trainer or a heart-rate strap, we read its measurements (power, cadence, speed, heart rate) only while a workout is running. The app never scans for sensors in the background and never uses Bluetooth scanning to infer your location.
3.6 Your commercial relationship with your coach
If your coach uses the billing module, we record the agreed plan, its amount, billing cycle, payment dates, and payment method (cash, transfer, card, other).
That money does not go through Zanza: we neither charge nor receive it. What exists is a manual ledger kept by your coach.
If you buy a Zanza paid plan (a professional subscription or the athlete Pro plan), we do not take the payment ourselves: on the web it is processed by Stripe, and in the app it is taken by Apple or Google through your store account, with RevenueCat validating the purchase (§7.2). We receive and keep only the state of your subscription: which plan, the period, start and renewal dates, whether it is active or cancelled, and the customer identifier at the payment provider. We never ask for, see, or store card numbers, CVV, or bank details.
3.7 If you use the level calculators (visitors)
At zanzahq.com/nivel (strength) and zanzahq.com/nivel/carrera (running) anyone can work out their level with no account and no sign-up. There are three distinct moments here, and it is worth being precise:
Your numbers never leave your browser. The entire calculation runs on your device: what you type — your sex, weight, height, age, loads and race times — is never sent to our servers, neither while you calculate nor afterwards. You can read your full result and close the tab without ever telling us who you are. We use no cookies.
Two things are kept in your browser, and both can be deleted:
| What is stored | What for | How you remove it |
|---|---|---|
Your calculator profile — sex, unit, weight, height, age — in the browser's localStorage |
So you do not have to type it again next time you come to measure yourself. It does not include your loads or your race times | The "Olvidarlos" (forget) link, next to the fields |
A random browser identifier (zanza_aid) in localStorage, only if you accept it in the notice shown at the bottom on your first visit |
Counting how many people arrive, calculate and sign up, without knowing who they are. It is a random number: we do not cross-reference it with anything and we do not buy it from anyone | "Reject" in that notice, or "Privacy preferences" in the page footer; rejecting deletes it |
Your choice about that identifier (zanza_consent) |
Remembering whether you accepted or rejected, so we do not ask on every visit | Clearing the site data in your browser |
None of this travels to our servers on its own: it lives on your device until you delete it.
We do measure how the page is used, and it is worth saying so plainly. When you open a
calculator, when you see your result and when you press a button, we send our own server an
event with the name of what happened, the random identifier above if you accepted it and, if
you arrived from an ad, the utm_source. Without your permission the event is still sent, but
with no identifier and nothing stored in your browser: it counts the visit, not the person. Your data does not travel with it: not your weight, your height, your
age, your loads, your race times or your email. Your IP address is not stored alongside the
event. There is no Google Analytics, no Meta, no third party at all: the event never leaves our
infrastructure, is not used for advertising and is never sold (§3.9).
Only if you give us your email do we additionally store, and only this:
| Data | Detail |
|---|---|
| Email address | The one you type into the form at the end. It is optional: the full result is shown before we ask for it |
| The level you scored | The band per lift or per distance ("intermediate on bench press"). We do not store your sex, your weight, your height, your age, or the loads and times you entered: those stay in your browser |
| Campaign source | The utm_source parameter in the URL, if you arrived from an ad or a link |
We use it only to send you what you asked for: one email with your level table. We do not add you to any list or send you updates for leaving it (secondary purpose, §4.2). If someone types your email without being you, you get that single email with a level that is not yours, and a line telling you to ignore it. You can ask us to delete it at any time at privacidad@zanzahq.com, and you do not need an account to exercise that right.
3.8 Data stored on your device only
Session tokens (in the operating system's secure storage), local preferences, the draft of a
half-finished workout, a temporary response cache for poor connectivity, and — in the web
dashboard — localStorage for tokens and preferences. All of it is cleared when you sign out
or uninstall, except a random device identifier used to count app usage (§3.9), which is
cleared when you uninstall the app.
The public calculators also keep two things in localStorage: your calculator profile and a
random browser identifier (§3.7). There is no session to sign out of there, because there was
never an account: you clear them with the "Olvidarlos" link or by clearing the site data.
3.9 What we do NOT do
- ❌ No third-party analytics, no trackers. There is no Google Analytics, Firebase, Meta SDK, Mixpanel, or any other SDK that tracks your behaviour, and we do not measure how long you spend on each screen.
- ✅ We do count some steps inside the app and the dashboard, with our own events stored on our own server: that you started or finished sign-up or the intake questionnaire, viewed a plan offer, opened your plan, started or saved a workout, hit your plan's limit, or started a purchase. Each event carries its name, the platform, a random device identifier and, if you are signed in, your account. No content travels: not your loads, notes or answers. It tells us which parts of the product are used and where people get stuck; it never goes to third parties, is never used for advertising and is never sold.
- ✅ We do count the funnel on our public pages. Which page was opened, which calculator was used, who reached their result and which button they pressed. These are our own events, stored on our own server, with no personal data and no third party involved (§3.7). We list it here, among the things we do not do, because the line above would otherwise read as "we measure nothing" — and this we do measure.
- ✅ We do use error reporting (Sentry, see §7.2). We list it here for transparency even though it is not a tracker: something is sent only when the app, the dashboard, or the API fail. At that moment we send the exact point in the code that crashed, the device model and OS version, and the names of the screens you passed through just before. We do not send what you typed, your workouts, your photos, your name, your email, or your IP address. If nothing fails, nothing is sent.
- ❌ No advertising or analytics cookies. The only cookie is our own technical one, which keeps your dashboard session open (§11).
- ✅ There is a YouTube player in the help videos. Nothing at all loads from Google until you press a chapter — not even the thumbnail — and from that point YouTube receives your IP and may store data in your browser (§11.1).
- ✅ What your professional adds may come from elsewhere. Our catalog photos are served from our own domain (
img.zanzahq.com). But if your coach puts the address of a photo or video hosted on another site into their catalog, showing it to you means your browser or the app requests it from that site, which receives your IP address as with any web request. We send it nothing else. We list it here because the line above would otherwise read as "there is no third party at all", and that site is one. - ❌ We never sell or rent your personal data, under any circumstances.
- ❌ We never use your health data for advertising or marketing.
- ❌ We do not train AI models on your data, and we do not allow our providers to do so.
- ❌ No automated decisions with legal effects and no profiling of that scope. The AI tools your professional can use (§7.2) suggest things —a draft message, a reading of your data—; what is decided about your program, they decide.
- ❌ No server-side push notifications. Reminders are scheduled by your own phone; we hold no device push tokens.
4. Why we use your data
4.1 Primary purposes — required to provide the service
Creating and managing your account and authenticating you, and, if you buy a Zanza paid plan, managing your subscription and its billing (§3.6); linking you with your professional (or your athletes); showing your training plan and letting you log workouts; computing your progress (loads, volume, 1RM indices, records, adherence, fatigue, recovery); letting your professional review what you log, and helping them read it with AI assistance tools that only they see (§7.2); recording measurements, tests, and assessment results; storing your photos and videos and sharing them with your coach only when you mark each file; syncing the health data you authorize; sending transactional email (verification, password reset, invitations); maintaining security; keeping backups; and handling your rights requests and our legal obligations.
4.2 Secondary purposes — you can object without losing the service
Appearing in the public professional directory (professionals only, opt-in, off by default); product updates, surveys, and help material; measuring product usage with our own events (§3.9) and producing aggregated statistics to improve it — what comes out of that analysis is numbers that cannot identify you; and replying to anyone who leaves their email in the public level calculator (§3.7) — sending them their result in writing, and nothing else.
You may object at any time at privacidad@zanzahq.com. Objecting is never a reason for us to deny you the service.
4.3 GDPR legal bases (EEA / UK)
| Purpose | Legal basis |
|---|---|
| Account, plan, logging, progress | Contract (art. 6.1.b) |
| Health data, measurements, photos, questionnaires | Explicit consent (art. 9.2.a) |
| Apple Health / Health Connect sync | Explicit consent (art. 9.2.a), revocable |
| Security, abuse prevention, backups | Legitimate interest (art. 6.1.f) |
| Transactional email | Contract |
| Billing and management of your subscription | Contract (art. 6.1.b) |
| App and dashboard usage events (§3.9) | Legitimate interest (art. 6.1.f): knowing which parts of the product are used in order to improve it, with no content and no third parties |
| Product communications, public directory | Consent (art. 6.1.a) |
| Legal and tax obligations | Legal obligation (art. 6.1.c) |
5. Sensitive data: your express consent
Almost everything that makes Zanza useful is sensitive health data. Mexican law requires your express, written consent for it; the GDPR requires explicit consent.
Therefore: registration asks for a specific, separate acceptance for health data processing, not buried inside the Terms; Apple Health / Health Connect sync requires both the OS permission and a separate in-app toggle to share with your coach, both off by default; each photo and video has its own "share with my coach" switch, off by default; lab results only enter the platform if you or your coach type them in; and you may withdraw consent at any time (§9).
6. Where your data comes from
From you; from your professional (when they invite you, record measurements, or log a payment); from your device (GPS, Bluetooth, camera, photos, when you authorize them); from Apple Health or Health Connect if you authorize it — which may in turn contain data written there by Garmin, Whoop, Polar, Strava, or other apps you connected; and from Google or Apple if you use their sign-in (identifier and email only).
7. Who we share your data with
We never sell your data.
7.1 Your professional
That is the purpose of the service. Your coach sees your profile, logs, measurements, questionnaires, and progress. They see your photos and videos only if you marked that file as shared. When the relationship ends, your coach keeps the record of the period they trained you but stops receiving new data.
7.2 Processors acting on our behalf
Each one processes your data only on our instructions, under a data processing agreement (DPA) and Standard Contractual Clauses where applicable:
| Provider | Purpose | What it receives | Where |
|---|---|---|---|
| Railway | API servers and PostgreSQL database | All platform data | USA |
| Cloudflare | DNS, DDoS protection, Pages (hosting for the public zanzahq.com site), and R2 (photo and video storage) | Traffic, IP; media in a private bucket | Global / USA |
| Vercel | Hosting for the coach dashboard | Dashboard traffic and IP | USA |
| Sentry | Error reporting for the app, the dashboard, and the API, so we can fix them (§3.9) | The point in the code that failed, the device model, and its OS version. Never your name, email, IP address, or the contents of your workouts, photos, or answers | USA |
| Resend | Transactional email delivery | Your email address and the message content | USA |
| External artificial intelligence service | Assisting your coach, and you if you program yourself: (a) drafting follow-up messages, (b) analyzing your progress over a period to suggest adjustments to your program and (c) reading an uploaded routine (pasted as text, as a photo or as a PDF, or the text taken from an Excel file or a PDF in your own browser) to turn it into a plan that is reviewed before saving | (a) Your nickname and your weekly figures (sessions completed, discomfort level and your comments from that week). (b) Your nickname and aggregated figures for the period your coach chooses: adherence, volume, effort, performance, records, discomfort level by area, readiness, weekly check-in and, if you share them, resting heart rate and heart rate variability. Not your written comments. It may also include context your coach adds when requesting it, so the AI doesn't read as fatigue what has another explanation: dated periods (vacation or travel, illness, injury, a competition, a routine change) and a short note of theirs, which they are asked to write without names or diagnoses. (c) Whatever the uploaded document contains: the routine and, if present, names or other data that appear in it (so it's best to upload it without personal data). An Excel file or a PDF with text never leaves your browser: only the text taken from it is sent. In (a) and (b), never your full name, email, or phone | Outside Mexico (mainly USA) |
| Google (Drive) | Database backups | Full database copy | USA |
| Stripe | Charging subscriptions bought on the web | Your email, username, Zanza identifier, and the payment details you type directly on its page (we never see them) | USA |
| RevenueCat | Validating in-app purchases and knowing whether your plan is still active | Your Zanza identifier, the store purchase history, and technical device data | USA |
| Apple / Google | Sign-in, app distribution, and charging in-app purchases | Account identifier and, if you buy, what they need to charge you | USA |
About AI: what the model produces is a suggestion for your coach: a draft they read, edit and decide whether to send, or a reading of your data they use to adjust your program. Nothing is ever sent to you automatically, and none of it is a diagnosis or medical advice. We choose the AI provider and may change it, but any provider we use must commit by contract not to train its models on this data, not to keep it longer than needed to respond, and to keep it confidential. If you want to know which provider we use at a given time, ask us at privacidad@zanzahq.com. AI features are optional at the platform level and can be disabled entirely.
7.3 Outside the platform: WhatsApp
If your coach messages you on WhatsApp, that message travels through WhatsApp (Meta) under their terms, not ours. We only keep, where applicable, a copy of the proposed and sent text for your coach's log.
7.4 Inside the platform: the help videos (YouTube)
The video explanations for each screen are hosted on YouTube (Google) as unlisted videos.
YouTube is not a processor of ours, which is why it is not in the table above: it does not process your data on our behalf or under our instructions, and we have no data processing agreement with Google for this. It is a third party that you talk to, and only if you choose to play a video.
As long as you do not play one, your browser never once connects to Google. When you press a chapter, YouTube receives your IP address and knows which video you are watching, under its own terms. The full detail is in §11.1.
7.5 Transfers allowed without your consent
To competent authorities upon a duly founded request; where necessary to address a medical emergency that puts you at risk; to our legal or accounting advisors under confidentiality; and in a merger, acquisition, or sale of the business, with prior notice and the same protections.
8. International transfers
Our servers and providers are outside Mexico (primarily the United States). If you are in the EEA, the UK, or Switzerland, your data is transferred to a country without an adequacy decision, safeguarded by Standard Contractual Clauses with each provider and by supplementary technical measures: encryption in transit (TLS) and at rest, a private bucket with short-lived signed URLs, and minimization of what each provider receives.
The help videos are not one of these transfers: we send nothing to Google. It is your own browser that connects to YouTube when you press play, and it does so under Google's terms, not ours (§7.4 and §11.1).
You can request a copy of these safeguards at privacidad@zanzahq.com.
9. Your rights
9.1 GDPR (EEA / UK)
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent at any time, and lodging a complaint with your national supervisory authority.
Zanza does not direct its service to the European Union — we do not advertise there, we do not price in euros, and we have no EU establishment — but we honour these requests wherever you live.
9.2 Mexico — ARCO rights
Access, Rectification, Cancellation, and Objection. Write to privacidad@zanzahq.com with your name, a contact email, a copy of official ID, and a clear description of your request. We respond within 20 business days and, where applicable, act within the following 15 business days. Free of charge.
9.3 United States
Zanza is available in the United States. There is no general federal privacy law, so what applies to you depends on your state.
California (CCPA/CPRA). Right to know, delete, correct, limit the use of sensitive personal information, and not be discriminated against for exercising them. We do not sell or share personal information as defined by the CCPA, and we do not use it for cross-context behavioral advertising.
Consumer health data (Washington and Nevada). Washington's My Health My Data Act and Nevada's equivalent protect health data with no company-size threshold: they apply from the first user. If you live in those states, we collect your health data only with your consent, we do not sell it, and sharing it with anyone other than your professional would require your specific authorization. You can withdraw consent and request deletion at privacidad@zanzahq.com.
HIPAA does not apply to us. We are not a health plan, a health care provider, or a clearinghouse, and neither is your professional when training you. HIPAA not applying does not mean your data is unprotected: it is protected by this policy, Mexican law, and the state laws above.
9.4 Self-service
Edit your profile in the app or dashboard; turn off a photo or video's "share with my coach" switch; turn off health sync in Settings and/or revoke the permission in Apple Health or Health Connect; sign out of your devices.
Withdraw your health data consent: from the app, under Settings → Withdraw health data consent, or from Your account in the dashboard. From then on we store no new health data and ask you for it again; what is already stored is not deleted on its own — that is what deleting your account is for.
Delete your account: from the app, under Settings → Delete account, or from Your account in the dashboard, immediately; or write to privacidad@zanzahq.com from your account email and we will delete it within 30 calendar days. What is deleted and what is kept is detailed at https://zanzahq.com/eliminar-cuenta.
9.5 If you need this policy in another format
If a disability makes this policy hard to read as published, write to privacidad@zanzahq.com and we will send it in a format you can use — plain text that works with a screen reader, large print, or audio. It is free, and you do not have to tell us why you are asking.
The same applies to the Terms of Service and to exercising any of the rights above: if email does not work for you as a channel, tell us what does and we will use it. A right you can only exercise through a channel you cannot use is not a right.
10. How long we keep your data
| Data | Retention |
|---|---|
| Account and profile | While your account is active |
| Training logs, measurements, tests, records | While your account is active — this is your history, and its value is the multi-year comparison |
| Technique videos | For as long as your plan covers them and until you delete them: the free plan keeps 3 at a time and Pro has no piece limit. Videos uploaded before September 9, 2026 are still deleted ~90 days after upload, under the lifecycle rule they were stored with |
| Files your coach attaches when correcting you | The same as the video they answer: they are part of your record and count towards your space |
| Account unused for 12 months | Your photos and videos are removed after three email notices in the preceding 90 days, and deleted 30 days later. Your workouts, logs, measurements and records are NOT touched and your account still exists: simply signing in keeps everything |
| Progress photos | While your account is active, or until you delete them |
| Sessions (IP, user agent) | Up to 30 days after expiry or revocation |
| Access log for your file | 12 months. Longer than sessions on purpose: improper access is usually discovered months later, and a short window would erase precisely the period we would need to reconstruct |
| Verification and reset codes | 30 minutes (reset) or until used |
| Unaccepted invitations | 7 days |
| Coach message drafts | For the duration of the coaching relationship |
| Accounting and tax records | As required by applicable law (in Mexico, up to 5 years) |
| "No more emails" list | Your email address and the date, for as long as the service exists: deleting it would mean emailing you what you asked us not to. To be removed from the list, write to privacidad@zanzahq.com |
| Backups | The 14 most recent copies (about two weeks). Deleted data leaves the live database immediately and the backups within that window |
When you delete your account, we erase or anonymize your data except what we must keep by legal obligation or to demonstrate compliance.
11. Cookies and similar technologies
We use no advertising, analytics, or third-party cookies.
We use a single cookie, our own and technical: the one that keeps your session open in the
web dashboard. It is HttpOnly (no script on the page can read it) and only travels to our API.
It needs no consent because without it you cannot sign in. Everything else is local storage,
which, unlike a cookie, does not travel to our server on every request:
| Technology | Where | What for | Necessary? |
|---|---|---|---|
| Own session cookie | Coach web dashboard | Renewing your session without retyping your password | Yes |
localStorage |
Coach web dashboard | Your session and dashboard preferences | Yes |
| OS secure storage | Mobile app | Your session tokens | Yes |
| Local preferences and cache | Mobile app | So the app remembers your settings and works on a bad connection | Yes |
| Local preferences | Mobile app | A random device identifier used to count app usage (§3.9) | No |
localStorage |
Public calculators on zanzahq.com |
Remembering your profile for next time | No: a convenience |
localStorage |
Public calculators on zanzahq.com |
A random browser identifier used to count the funnel (§3.7) | No: only with your permission |
localStorage |
Public pages on zanzahq.com |
Remembering whether you accepted or rejected that identifier | Yes: without it we would ask on every visit |
What is marked necessary is needed for the service to work, and you clear it by signing out, clearing browser data, or uninstalling. What the calculators store is not needed for anything: the page calculates just the same without it, and you remove it with the "Olvidarlos" link without losing any functionality.
11.1 The help videos (YouTube)
Every screen has a help button, and some carry a video explanation. Those videos are hosted on YouTube (Google), not on our servers. Since that is exactly what the rest of this section promises we do not do, here is the full detail.
Before you press: nothing. Opening the help shows only our own content — what the screen is, the glossary, and the chapter index of the video — served from our own server. We do not even load the video thumbnail, because requesting it would already be a connection to Google. If you never press a chapter, your browser never talks to YouTube, and none of what follows happens.
When you press a chapter, your browser or the app connects to YouTube: the player comes from
youtube-nocookie.com and, in the app, its control script from youtube.com. From that moment,
YouTube:
- receives your IP address and what any browser sends when requesting something (browser type, operating system, language). This is unavoidable: it is what is needed to deliver the video;
- may store data in your browser or inside the app related to playback;
- knows which help video you are watching and therefore which Zanza screen you were on.
We use YouTube's no-cookie mode, in the dashboard and in the app, which avoids advertising cookies and prevents what you watch from being used to personalise ads for you. Even so, it is not "no data at all": the list above happens regardless, and we would rather say so than hide behind the name of the mode.
What Google does NOT get: your name, email, phone, workouts, measurements, photos, or any of your answers. We send it nothing — the video is requested from your browser, and all that travels is what travels with any web request.
What YouTube does with that is governed by Google's privacy policy, not by this policy, because at that moment we are not in the middle.
How to avoid it entirely: do not play the videos. The written help — what each screen is and the whole glossary — is the same with or without video, you lose no functionality, and it depends on nobody but us.
12. How we protect your data
Passwords hashed with bcrypt (12 salt rounds); HTTPS/TLS everywhere; session tokens stored
as SHA-256 hashes with rotation and revocation, and held in the OS secure storage on the
phone; photos and videos in a private bucket served through signed URLs that expire in
about an hour, with the object path chosen by the server rather than the client; verified
access control (every route touching an athlete's data checks for an active coach↔athlete
relationship — audited 2026-08-25 with no findings); an access log recording who opened
which section of an athlete's file, when and from where — never the content — so that after
an incident we can say precisely what was seen; rate limiting on login, registration,
and password reset; generic password-reset responses so nobody can enumerate accounts;
Cloudflare in front of the API; security headers on the dashboard; and encrypted, verified, rotated
backups (each copy is encrypted before it leaves our server).
No system is infallible. If a breach materially affects your rights, we will notify you and the competent authority within the legal deadlines (72 hours under the GDPR).
13. Minors
Zanza is for people aged 18 and over. The Terms of Service (§3.1) require it as a condition of use, and in the app the athlete also declares it by ticking a specific box when creating their account. We store that acceptance with its date. We do not verify age with documents — we do not ask for ID to register — and we do not knowingly collect data from minors. Professionals must not create accounts for minors or enter their data. If we detect an account belonging to someone under 18 we will suspend it and delete the data. Contact privacidad@zanzahq.com if you believe a minor has given us data.
14. Changes to this policy
The current version will always be at https://zanzahq.com/privacy with its version number and date. For material changes — a new purpose, a new category of data, or a new provider with access to health data — we will notify you by email or in the app before it takes effect, and we will ask for renewed consent where the law requires it.
14.1 What changed
| Version | Date | What changed |
|---|---|---|
| 1.10 | October 13, 2026 | §7.2 declares that the AI analysis of your progress may also include context your coach adds when requesting it —dated periods such as vacation, illness, injury or a competition, and a short note of theirs without names or diagnoses— so that an absence with an explanation isn't read as fatigue or dropout. It doesn't change which of your figures are sent |
| 1.9 | October 13, 2026 | §7.2 declares a third use of the AI service that already existed and wasn't written down: reading a routine (text, photo or PDF) to turn it into a plan that is reviewed before saving. It says what it receives —whatever that document contains— and that an Excel file or a PDF with text is converted in your browser and only the text is sent |
| 1.8 | October 13, 2026 | §7.2 names the AI provider by its category —an external artificial intelligence service— instead of its brand, and sets the conditions any provider we use must meet. It declares a new feature: your coach can request an AI analysis of your progress over a period, which receives your nickname and aggregated figures for that period, including resting heart rate and its variability if you share them, without your written comments. §4.1 adds that help to the primary purposes, and §3 clarifies that the AI suggests and your coach decides |
| 1.7 | October 11, 2026 | §3.9 no longer mentions GitHub — catalog photos are now served from img.zanzahq.com — or the professional's profile photo, which can now only be one they upload; instead it declares that whatever your coach adds to their catalog from other sites is requested from those sites. §3.7 and §11 say the public pages' identifier is only stored if you accept it, and §11.1 that the app also uses YouTube's no-cookie mode. §2 and §10 declare the "no more emails" list for invitations and questionnaires, and §9.4 that the health data consent can also be withdrawn from the account itself |
| 1.6 | October 10, 2026 | Corrects what the policy said differently from what the platform does. §3.4 declares the GPS route stored if you turn on "Save my route" (off by default). §3.6 and §7.2 declare Zanza's paid plans and Stripe and RevenueCat as processors. §3.9 and §11 declare the usage events of the app and dashboard, the random device identifier and the dashboard's technical session cookie. §3.9 declares the images loaded from elsewhere (GitHub and a professional's profile photo), and §11.1 that the app connects to youtube.com. §3.7 and §4 limit the calculator email to what you asked for — your result, no updates. §4 adds billing and usage events to the purposes, §9.4 account deletion from the app, and §12 that backups are encrypted. None of this starts today: it was already happening, and the policy did not say so |
| 1.5 | September 14, 2026 | §3.3 adds daily steps to the daily health read from Apple Health or Health Connect: each day's total, to measure it against the step goal your coach assigns. They reach your coach only through the same “Share with my coach” toggle in the app |
| 1.1 | September 3, 2026 | Spells out what the public calculators keep in your browser — your profile, so you do not have to retype it, and a random identifier — and that we count the funnel on those pages with our own events (§3.7, §3.8, §3.9 and §11). No new purposes and no new data on our servers |
| 1.0 | August 25, 2026 | First version |
15. Contact
| Privacy and data rights | privacidad@zanzahq.com |
| General | hola@zanzahq.com |
| Address | Prolongación Matamoros #100, Eulalio Gutiérrez, C.P. 25903, Ramos Arizpe, Coahuila, Mexico |
Drafted from the actual state of the product on August 25, 2026; reviewed on September 3, 2026.