How we keep your data safe
A short summary of how we protect your account and your athletes' training data.
Authentication
- Passwords need 8 to 72 characters, a number and a special character. We check this when you type it and again on our server.
- Passwords are hashed by our sign-in provider (Supabase Auth). We never see or store a plain password.
- You can sign in with Google instead of a password. A Google-only account can add a password later at any time.
Who Can See Your Data
- An athlete always sees their own workout history. Their coach sees it too.
- A gym owner or admin sees every coach's roster, not just their own; a substitute coach only gets access during an active, time-boxed coverage window and loses it automatically.
- The database itself enforces this (Postgres row-level security). It is not just hidden in the app, so nobody outside your coaching relationship can read it.
- Export (CSV/Excel/PDF) follows the same boundary: you can export your own data, and your coach/gym can export yours, and that's it.
Encryption & Storage
- All traffic is served over HTTPS/TLS.
- Data is stored in a managed Postgres database (Supabase), encrypted at rest by the hosting provider.
- API keys and other secrets used by the app are never exposed to the browser.
Platform Administration
- We run the business from a separate admin dashboard. It needs its own password and a one-time code sent to a private inbox. No VBar account can open it, including a coach's or an athlete's.
- It only shows totals, such as how many gyms and solo athletes there are. It never shows an athlete's name, workouts or messages.
Payments
- Stripe handles payments. Your card number goes straight to Stripe, and we never store it.
Account Deletion
- Deleting your account never deletes anyone else's data. If you are a coach, your athletes keep their own logged history.
- A gym owner cannot delete their account while they still own a gym. A coach cannot delete theirs while they still have active athletes. Sort those out first.
Found a security issue? We appreciate responsible disclosure. Email jbrantner10@icloud.com and we'll get back to you. See our Privacy Policy for how we handle your data more broadly.
Questions about security?
Tell us about your gym and we’ll walk you through how your data is protected.