Privacy Policy

How we handle your data.

Plain language. Real commitments. Last reviewed 2026-10-26.

Who this policy applies to

This policy covers everyone who uses Marrow. Coaches and instructors who run their practice on the platform, athletes and clients who train with those coaches, gym owners and studio admins, and visitors to marrowfitness.com. We wrote it in plain language so a non-technical person can read it without a dictionary. If you have a question, ask it on our contact page and a real person will answer.

What we collect

Depending on how you use Marrow, we collect some or all of the following.

  • Application and form submissions. Name, email, professional details, and anything you wrote in the open text fields.
  • Account data. Email for magic-link authentication, profile information, role (coach, athlete, gym admin), and the connection between coach and athlete accounts.
  • Training data. Programs, sessions, logged workouts, form videos you upload, notes between coach and athlete, nutrition ranges, and wearable-derived signals if you choose to connect a device.
  • Billing data. Name, billing address, and payment method tokens, handled by Stripe. Marrow never sees full card numbers.
  • Photos and diagnostics. Progress photos if you turn them on, and error reports and masked app screen recordings, as described in the sections below.
  • Operational data. IP addresses, browser type, device type. Used for abuse prevention and to keep the service running. Not used to track you across the web, apart from the Meta pixel on our public pages described in Advertising measurement with Meta.

What we don't collect

We count our own page views with Plausible Analytics, which sets no cookies. We don't run Google Analytics and there's no fingerprinting. We don't sell or license your data. The one advertising tool we use is Meta's, on our public website only, and it is described in full in Advertising measurement with Meta below. Nothing from inside the Marrow app, and nothing about a member's or athlete's account, training or signup, is ever sent to Meta.

We use two tools from Meta, the company behind Facebook and Instagram, to find out whether our advertising works: the Meta pixel and the Meta Conversions API. We use them on marrowfitness.com only, and in two places only.

  • Our public pages. On public pages such as our home page and our pricing page, the Meta pixel records that the page was viewed. It sets a small cookie on our site so Meta can recognise a repeat visit, and because your browser talks to Meta directly, Meta also sees your IP address and browser type, as it does on any site that uses the pixel. It is never loaded inside the Marrow app, on sign in or checkout pages, on any member or athlete page, or on a coach's or gym's own website.
  • When a coach or gym signs up. When a coach or gym owner finishes checkout for their own Marrow plan, we tell Meta a signup happened and what the plan costs each month, for example 99 US dollars for Solo Coach. It is sent once from your browser and once from our server, carrying the same event code so Meta counts it once. Member and athlete signups are never sent.

What is sent. The event, meaning a page view or a signup, and the page it happened on. For a signup, the plan and its monthly price. For a signup our server also sends your email address and your Marrow account number, each turned into a one way code before it leaves our server so Meta can match it to a Meta account without receiving the real value, along with your browser type, your IP address and the Meta cookie codes your browser already holds for our site, if it has any. We never send your name, your card details, your training data or anything from inside the app.

What Meta does with it. Meta uses it to report to us how many people who saw our ads went on to visit or sign up, and to show our ads to people more likely to be interested. Meta receives it as a separate company, under its own Business Tools Terms and its own privacy policy. Under some state privacy laws, including California's, sending this to Meta for advertising counts as sharing personal information. We do not sell it.

How to opt out.

  • Global Privacy Control. Turn on Global Privacy Control in your browser or a privacy extension. When your browser sends it, our pages do not load the Meta pixel and no signup event about you is sent to Meta, from your browser or from our server.
  • Your Meta settings. If you have a Facebook or Instagram account, the setting called Your activity off Meta technologies, in Meta's Accounts Center, lets you disconnect this activity from your account, and Ad preferences controls the ads you see.
  • Your browser. A content blocker stops the pixel. Blocking third party cookies stops Meta linking a visit to your Meta account.

Questions about any of this go through our contact page.

How we use your data

We use the data you submit to:

  • Run the platform, including coaching tools, athlete dashboards, and admin surfaces.
  • Authenticate you and keep your account secure.
  • Process payments for coach subscriptions and athlete billing.
  • Respond to applications, demo requests, and support questions as soon as we can.
  • Send platform onboarding details, transactional notifications, and the receipts you would expect.
  • Deliver messages your coach chooses to send you through Marrow, on the channels you yourself agreed to. The Messages from your coach section below explains how that works and what protects you.
  • Maintain a private record of your interaction with us.

Your phone number and text messages

We treat your phone number with the same care as the rest of your data. We do not sell your personal data or your phone number. We do not share it with third parties for their own marketing, and we do not let anyone else use it to market to you. The only companies Marrow lets touch your number are the named service providers that help us run the platform, such as our messaging and payment providers, and only so they can deliver the messages and services you asked for. No mobile information is shared with third parties or affiliates for marketing or promotional purposes.

One thing that sentence does not cover, so we are naming it here rather than leaving it implied. Your coach can connect their own AI assistant to their own Marrow account, and the owner of the gym you train at can connect one to their own gym console. A gym owner's connection never receives your phone number, your name, your email, or any other contact detail. Your coach's connection receives them only if your coach switches on Client profiles for their own account and you agree to it yourself, in your own Marrow account, and only for your coach's own record of you. You can take that back at any time. Message text is the one exception to that setting: a message reaches the assistant as it was written, so a name or detail typed into it travels with it either way. What each one can and cannot receive, and what each can do after its owner says yes, is written out in full under Connected AI assistants below.

Text messaging (SMS). Texting from Marrow's published business number is not available right now, so we do not send text messages from it. When it is available again, texting or calling that number will mean you consent to receive conversational text replies from us at the number you contacted us from, to answer your question, return a missed call, and help you with your account. We do not send marketing or promotional text blasts. Messages are sent only in reply to you, and message frequency varies based on how the conversation goes. Message and data rates may apply, depending on your carrier and plan.

You are always in control. Reply STOP to any message to opt out and we will not text you again. Reply HELP for help, or reach us on our contact page. Opting out of texts does not close your account or stop transactional notices you need, such as receipts and security alerts.

Texts from your coach or gym. Marrow's own business number, above, never texts you on a coach's behalf. A coach can connect their own texting number, on their own Twilio account, and their connected AI assistant can send you a text from that number, described under Connected AI assistants below. Each text goes only after your coach has read it and said yes to it, and only where a permission record covers you for texts from that coach. That record exists only if you said yes to texts yourself, in your Marrow account, and you can take it back there at any time. A texting permission your coach recorded for you is kept on file but sends nothing until you confirm it yourself. Daytime hours where you are and the daily caps in Messages from your coach apply to texts too, and replying STOP to your coach's number ends texts from it. A gym can save its own Twilio texting number on its Connections page, but nothing in Marrow sends a text from it today. The one way a gym can message you through Marrow is WhatsApp, and only after you message the gym there first, as set out under A gym's WhatsApp front desk.

A gym can connect its own WhatsApp number to Marrow through its own Twilio account. When you message that number, Marrow receives your message so the gym's front desk can answer it, and hand it to the gym's owner or managers when it cannot. Your messages also pass through WhatsApp and the gym's Twilio account.

Who answers. Most answers come from the gym's own details: hours, address, memberships, classes and links. If the gym has added its own Anthropic AI key on its Connections page, a question those details do not cover can go to Claude on that key, along with the gym's details, to write the answer. Without that key there are no AI replies and a person answers. When a conversation goes to a person, the gym's team is emailed your number, and the owner or a manager can reply to you on WhatsApp.

What we keep. Your WhatsApp number, the text of each message and a message id. We do not keep your WhatsApp profile name or any photos or files you send. Messages are deleted after 180 days. If you send the gym STOP on WhatsApp, we record it, and the gym can send you nothing more on WhatsApp until you write START.

Messages from your coach

Your coach can send you messages through Marrow. A message in your Marrow inbox, which you read inside the product. A push notification on your phone that tells you an inbox message arrived. An email. And, only from your coach's own connected texting number, a text, as the section above describes.

You decide, in your own account. You say yes to texts yourself, in your Marrow account, and you can take it back at any time. Your coach's AI sees your record by name only after you agree in your own account. Your coach cannot say yes to either one for you.

Texts are two separate choices. Texts from your coach about your training and sessions, and offers and news from your coach by text, each have their own box, and you tick only what you want. Texts come from your coach's own number. Message frequency varies, and message and data rates may apply. Reply STOP to stop at any time, or HELP for help. Saying yes is never a condition of training with your coach, and you can change either choice in Settings whenever you like.

Your coach decides to message you. Marrow never decides on its own. Every message from your coach needs a recorded human authority behind it: your coach pressing send inside Marrow, your coach saying yes to that exact message through their connected assistant, or a standing setting your coach or your gym switched on in advance under their own login. Those standing settings are follow ups to something a person started, such as up to two reminders of an invitation you have not answered, a check in when you have gone quiet, or an invitation to a quieter class time at your gym, and each one carries a way to stop it. Marrow runs the delivery and keeps the record. Apart from those, the only messages Marrow sends you are the account notices you need, such as receipts and security alerts. An invitation to join is one email plus at most two reminders, each with a stop link, and stopping ends the reminders.

An AI assistant sends only on your coach's yes. If your coach uses a connected assistant, described under Connected AI assistants below, that assistant can write a message and, after showing your coach exactly what would go and to whom, send it only if your coach says yes to that message. Your coach's words are recorded with the send. Every limit in this section applies to it exactly as it applies to your coach pressing send.

Permission is separate for each channel. Saying yes to email is not saying yes to anything else. Before a message can go out on a channel, a consent record has to exist for you, on that channel, for that kind of message. That record is created only when you yourself act on a Marrow surface, such as ticking a box or changing a setting in your Marrow account. If your coach records that you told them texts are fine, that note is kept, and it sends nothing until you confirm it yourself in Marrow. A record is never created by an AI and never created by an unattended job.

The record is permanent evidence. When you say yes, we record when you said it, where you said it, and the exact words you were shown. When you say no, in your settings or by replying STOP, we record that too. Consent records are never edited and never deleted, because they are the proof of what you agreed to. A no is final. If you opt out and later change your mind, saying yes again takes a fresh action from you.

Limits that hold on every message. Messages that interrupt you, such as a push notification or an email, are held to daytime hours where you are, 8am to 9pm in your own local time. A message due outside that window waits and goes out when the window opens. It is deferred, never dropped, so nothing your coach sends you silently disappears. There are also caps: by default one message per person per day, plus a daily cap on each account, so a runaway loop cannot become a flood. And the consent check runs again inside the same database step that records the send, so an opt out that lands moments before a send still wins.

You can take permission back at any time. Switch it off in your Marrow account settings, reply STOP to a text, use the opt out in the message itself where the channel carries one, or tell us on our contact page and we will switch that channel off for you. Your withdrawal is recorded the same way your yes was, and it stops future sends to you on that channel.

If you asked a coach a question and have not joined. When you contact a coach through a form on their Marrow page, that coach can answer you by email through Marrow. The basis for that reply is your own enquiry: you asked, they answered. The only thing that path can send is a reply, not a mailing list, and it can never send you a marketing text.

If a gym adds you as a visitor. A gym can add someone who visited or asked about it. Marrow then sends that person one email asking whether they want to hear from the gym, and sends nothing more until they say yes themselves. If they never confirm, nothing more comes, and the stop link in that email works at any time.

Where your data lives

Marrow application data is stored in the United States. The primary database is Supabase, hosted in the US, with row-level security enforced at the database layer. Static assets are delivered via Cloudflare's global edge for performance, while application reads and writes route to US origins. Plausible Analytics, hosted in the European Union, receives only anonymized, aggregated page-view counts and never individual identifiers.

Application form submissions reach the Marrow operator mailbox and are recorded in our leads pipeline. From there, they may be added to your coach or athlete account record if you sign up.

Sub-processors

Marrow uses a small number of third-party services to operate the platform. Each of them is named, with the data they touch and where they're located, on our canonical sub-processor page. We update that page before any new sub-processor goes live and we notify coaches in advance of material changes.

The current list covers Stripe (payments and coach payouts), Cloudflare (DNS, edge, compute, storage), Supabase (database, authentication, video storage), Kit (email sequences), Postmark (transactional email), Plausible Analytics (privacy-friendly analytics), Sentry (error monitoring), Upstash (background job queue), and Daily.co (virtual session video, activating with v1.1 in August 2026).

The canonical, always-current list lives at marrowfitness.com/legal/subprocessors. If the page below ever conflicts with that page, the sub-processor page is the source of truth.

Open item, under legal review. An AI assistant that a coach connects to their own Marrow account is chosen and paid for by that coach, not engaged by Marrow, so it is not a Marrow sub-processor in the way Stripe or Supabase is. Whether it must still be named on the sub-processor page, or covered there by explicit carve-out language, is with our counsel and is not settled yet. That counsel review is ongoing. Our current position is the one stated above, that an assistant a coach chooses and pays for is not a Marrow sub-processor in the way Stripe or Supabase is. If counsel rules that those vendors belong on the sub-processor list, they go on the list and we notify coaches.

Connected AI assistants

Marrow lets someone connect an AI assistant they already pay for to their own Marrow account. There are two kinds of connection and they reach different things, so both are written out below. A coach connection is your coach connecting an assistant to their own coaching account. A gym owner connection is the owner of a gym connecting one to their own gym console. In both cases the person connecting chooses that vendor and pays it directly. Marrow does not choose it, does not resell it, and has no agreement with it. Today the only client Marrow has run end to end is Claude, made by Anthropic. Any other client that speaks the same open protocol can be connected.

Because that assistant runs on their own vendor account, anything it is sent leaves Marrow's systems and lands with that vendor under that vendor's terms. So the honest question is not whether we trust them. It is exactly what can reach them, and exactly what they can do. Here is the whole list, for each kind of connection.

Nothing happens in one step. Reading is immediate. Anything that reaches a person, moves money, or changes what you can see is two steps and never one. First the assistant shows your coach, or your gym's owner, exactly what would happen and to whom. Then it acts only if they say yes to that exact thing, in their own words, and those words are recorded with the change. A yes to one thing is never a yes to another. Apart from a coach taking their own public page live or offline, none of these two step actions works at all until that person has accepted the version of their connection agreement that describes them, and Marrow can switch every one of them off at once. When that agreement changes, as it did on 2026-10-25, the actions wait until they accept the new version, and reading keeps working.

A coach connection

Your coach connects an assistant to their own account so it can help them run their coaching business the way their dashboard does: their page, their programs, their prices, their schedule, their clients and the people who have enquired. It works on your coach's own account and nobody else's.

How you appear on it. Unless your coach has switched on Client profiles and you have agreed to it in your own Marrow account, both described below, you appear on a coach connection as an opaque pointer, never by name. A pointer is a one way code standing in for you. It carries no name, no email, no phone number, and nothing derived from any of them. It cannot be reversed by the AI vendor. Marrow retains the means to match a pointer back to you, and Marrow alone. The same person training under two coaches produces two unrelated pointers.

What a coach connected assistant can read about you. The same records your coach can already open about you on their own Marrow dashboard, and only on your coach's own account.

  • Your training. The programs your coach assigned you, and the workouts and sessions you logged against them.
  • Your messages with your coach. Messages in your Marrow inbox between you and that coach, and your check ins.
  • Your nutrition. The plans and targets your coach set for you, and the food and meal records you chose to log.
  • Your measurements and readings. Body measurements and progress entries, and readings from a wearable you connected and shared with your coach.
  • Your bookings. Sessions and classes you are booked into with that coach.
  • Your payments to that coach. What you pay, what you have paid, refunds, and payment requests. Never your card details.
  • Counts across the roster. How many memberships are active, cancelled or past due, how many members sit on each tier, session pack usage in aggregate, and when something last happened.

What a coach connected assistant can do, only after your coach says yes. Each of these is two steps, as described above. A message, a post, a refund or a charge cannot be taken back once it has gone, and the first step says so.

  • Contact you. Send you a message in your Marrow inbox or an email, and send you a text from your coach's own connected texting number, never from Marrow's. Every rule under Messages from your coach still holds: a permission record for you on that channel, which for a text is your own yes in your Marrow account, daytime hours where you are, and the daily caps.
  • Invite you, or ask something of you. Send an invitation to join, a form to fill in, or a request for a review.
  • Change your schedule with that coach. Book, move or cancel a session or class you are on, the way the dashboard does.
  • Handle money with you. Refund one of your payments through Stripe, with the same limits the dashboard applies. Charge you, or send you a payment request. Turn on a price your coach set. Turning a price on never changes what an existing member already pays. If your coach raises what you already pay, the new price bills only after you accept it in Marrow. Until you do, your current price continues, and your coach may cancel your plan instead. A lower price applies straight away, and you are told.
  • Publish your coach's own work. Take your coach's public page live or offline, publish a program, and post to your coach's community or their own social and review accounts.

What a coach connected assistant can receive about people who enquired. If you contacted a coach through Marrow and have not signed up yet, your enquiry sits in that coach's own pipeline. Their assistant can read the shape of that pipeline and write a follow up for one entry in it.

  • Where an enquiry sits, and how long it has waited. The stage it is at, where it came from, for example a referral, an event, or a form on the coach's page, and three counts of days: how long it has sat at that stage, how long since the coach last logged contact, and how long since it first arrived.
  • Not your name. Your first name, last name, email address, phone number, any tags on you, and the note about what you were interested in are not read by the pipeline reads. Those columns are never asked for, so there is no answer the assistant could get them from.
  • An opaque per enquiry pointer. The same kind of code as the pointer above, so the assistant can point at one particular enquiry. It cannot be reversed by the AI vendor, and the same person sitting in two different coaches' pipelines produces two unrelated codes.
  • Counts across the pipeline. How many enquiries sit at each stage, how many arrived from each source, how many have never been contacted, and how many arrived in each month. Numbers only.
  • A follow up goes only after the coach says yes. The assistant writes it, shows the coach exactly what would go and on which channel, and it goes only on the coach's yes and only where a permission record covers you on that channel. For a text, that record is the texting box you ticked yourself on the coach's form. Without that permission it does not go, whatever the coach says.

What a coach connected assistant can receive about your coach's schedule as a whole. Your coach can ask how full they are, which hours of their week are quiet, and where the gaps sit. These reads carry no identity at all.

  • Counts, clock times and durations. Nothing else. How many sessions are scheduled or cancelled in a forward window of up to 90 days, how many seats those sessions hold and how many are taken, how many booking slots are open, and how many bookings are active or waiting. Then which weekday and hour each of those sits in.
  • Not you, and not a code standing in for you either. These reads ask for no member id, no booking id, no slot id, and no code derived from any of them, so there is no opaque pointer here at all. A session reaches the assistant as a time and a number and never as an attendee.
  • A booking is a separate act. When your coach's assistant books, moves or cancels a session you are on, it is acting on your booking, after your coach says yes, as described above. The utilisation reads in this list are not how it does that.

What a coach connected assistant can receive about money. It depends on the agreement your coach accepted. The tools that read revenue, show a client's billing, refund, charge or turn a price on reach a connection only when the coach on it has accepted the version of the connection agreement that describes them in plain words, and Marrow holds a switch over that surface as well. Where either one does not hold, no dollar amount reaches the assistant at all, and a request that names one of those tools is answered that the capability is unavailable.

  • Your coach's own business totals. What that coach took over a named window, what they refunded, what is left after Marrow's fee, their refund rate, how many transactions there were, the same figures split across the things they sell, and the same totals month by month.
  • Your billing with that coach. What you pay and have paid that coach, refunds, and payment requests, attached to your pointer, or to your name when Client profiles is on and you have agreed to it.
  • Money moves only on a yes. A refund, a charge or a payment request happens only after your coach has read the amount and who it is for and said yes. A price goes live only the same way.

What moves, and what does not. We will not describe this as a permanent absence, because it is not one. A coach who has not accepted the current agreement sends no amounts and can take none of the actions above. A coach who has can, on their own account and by their own decision, one yes at a time. What none of it reaches is anything in the list below.

Client profiles, which needs two yeses: your coach's and yours. It is off for every coach until that coach turns it on, on their own account, from their own Marrow dashboard. Even then, your coach's assistant sees your record by name only after you agree in your own Marrow account, and you can take that back at any time in your settings. Until both are true, you appear only as a pointer or inside a count, and nothing in the list below reaches the connection. Once both are true, your coach's assistant can work with your record by name on your coach's own account, and with nobody else's. Turning it off in Settings stops the assistant seeing you by name straight away. Messages you and your coach exchange in Marrow belong to your coach's account and can reach the assistant whether or not you agree.

  • Your name, your email address, your phone number, and your date of birth.
  • The training goals and the injury history you entered when you joined, so your coach's assistant can help write for the body you actually have.
  • Your coach's own notes about your training, which they wrote.
  • Whether your membership is active, and the dates your record was created and last changed.

Two things are true of everything above whatever the setting says. It is your coach's own record of you and it is reachable only from your coach's own connection, so no other coach and no other coach's assistant can see you through it. And none of it is anything your coach could not already read on their Marrow dashboard, under their own login. The connection decides whether their assistant can help them with it. It does not decide what your coach can see.

What a coach connected assistant can never receive or do. These are not settings. There is no tool on the coach surface that reaches them, on any account, in any state of any switch or agreement.

  • Another coach's anything. Another coach's clients, records, messages, prices, programs or page. Nothing on the connection accepts an identifier that points outside your coach's own account.
  • A score of you. Nothing on the connection scores your form or grades you as a person. Your form check videos and your progress photos are not sent to it.
  • Your mailing address.
  • Your card details or your billing address.
  • Marrow's own prices and your coach's own Marrow billing. What Marrow charges your coach, and your coach's own subscription and billing with Marrow, are not on the connection at all.
  • The controls that hold it in check. How much your coach lets it do on its own, the switch that stops it, your coach's decision to let it handle money, and the keys that connect it. Only your coach, signed in to Marrow, can change those, and only Marrow can override them.
  • Files. It cannot upload a file, a photo or a video to Marrow.

A gym owner connection

If you train at a gym rather than with a solo coach, that gym's owner can connect an assistant to their gym console. It works one level up from a coach connection. It looks at the gym: who is on the roster, which trainers are ready to sell, how busy the schedule is, and how the gym is set up. It does not look down into any one member.

What a gym owner connected assistant can receive. This is everything it touches.

  • The gym's own record. Display name, city, locations, onboarding state, whether payouts are set up, the brand colours on file, and how many trainers, gym plans, fee templates, events and saved reports exist.
  • The trainer roster. Each trainer's display name, role, status, location identifier, and invite and join dates, and the gym's managers and the locations each one covers. This is staff information, not member information.
  • Readiness per trainer. Whether an active trainer has a published page, a live price, programs, and payments enabled. Whether the thing exists, never the trainer's own content and never a price figure.
  • Members as pointers. Each member appears as an opaque pointer with their trainer, their status, when they were last active and whether they use the app. Never by name.
  • Roll ups across the roster. Counts for a forward window of up to 90 days, per trainer and in total: class sessions, class attendees, open booking slots, bookings, pending requests, slot utilisation, and how many active athletes each trainer has. Numbers only.
  • The gym's commercial setup. Gym owned membership plans, the fee templates that decide what a trainer is paid, the team fee and split settings, and the gym's events, each with the fields the console already shows.
  • The owner's own reports and change log. Reports the connection saved for that owner, and the record of changes made through it with the before and after value of each field it touched.
  • Where your branded app is up to. Which step of the build it is on, whether that step is moving, and whether anything is waiting on the owner. It never claims Apple has approved anything, and it says plainly when it could not check rather than reporting that nothing has started.
  • The shape of the month. Counts bucketed over a window so an owner can see whether the gym is growing.
  • The words on the gym's own public page. The headline, the description, the list of what the gym offers, and the wording of its enquiry form. Never a trainer's page.

What a gym owner connected assistant can do, only after the owner says yes. Each is two steps, exactly as for a coach.

  • Run the team. Invite or remove a trainer, invite or remove a manager and set which locations a manager covers, and invite or end an outside trainer.
  • Set the money rules. Set a trainer's team fee and the gym's billing and revenue splits, and switch a gym plan or a fee template on or off.
  • Move a member between trainers. Transfer a member from one of the gym's trainers to another.
  • Publish the gym's own work. Change the gym's details and its public page, take that page live or offline, connect its own web address, apply its brand colour, and publish, cancel or announce a gym event. Announcing an event notifies the people it is for through Marrow.
  • Let Marrow support in, for a set time. Open access for a named Marrow support person for a stated reason and a fixed time of up to fourteen days, or end it early. Every one of those is on the gym's own access record.

What a gym owner connected assistant can never receive or do. These are not settings either. There is no tool on the gym surface that reaches them.

  • Any individual member's identity or contact details. No member name, email address, phone number or mailing address, and no member id. You appear only as a pointer or inside a count.
  • Any member's health, body or nutrition record, or their messages. Attendance and totals yes. One named person's body data or conversations never.
  • A trainer's own content or prices. Not their page copy, not their programs, not their price figures, not their client records. A gym owner's assistant cannot write to any of it either.
  • Your money directly. It cannot refund you, charge you, or change what you pay.
  • The controls that hold it in check. Switching a trainer's sign in off or on, the switch that stops the connection, and the keys that connect it stay with the owner, signed in to Marrow. Marrow's own prices and the gym's own Marrow billing are not on the connection at all.

The full text an owner accepts is the gym connection agreement.

Small rosters, said plainly. A count can still point at a person when the number is small. If a coach has one member past due, a count of one past due member is about that member, even when the count itself carries no name. The same holds on the gym side. If one trainer has one active athlete, a count of one is about that athlete. That is a limit of counts, not a loophole, and your coach and your gym already know who their members are. We are naming it so the guarantees above are not read wider than they are.

What they type is on them. A connected assistant is that person's own chat window. If your coach, or your gym's owner, types something about you into it, or saves it into a report through that connection, that is content they wrote, not data Marrow handed over. Everyone who connects an assistant must first accept an agreement that makes them responsible for their vendor choice, for that vendor's data handling settings, and for what they say yes to. A coach accepts the connection agreement. A gym owner accepts the gym connection agreement.

Control and questions. A coach connects, and revokes, from their own dashboard. A gym owner connects, and revokes, from their gym console. Either way it loses access immediately, and Marrow can disable every connection at once. Your side is yours too: in your Marrow account settings you can agree to be shown by name, or take that back, and say yes or no to texts. If you want to know whether the coach you train with, or the gym you train at, has an assistant connected, ask them, or reach us through our contact page and we will tell you.

Off until you turn them on. Progress photos are optional. You turn them on in the Marrow app, and until you do, we store no photo you take.

What we store. Up to three photos a day: front, side and back. Before a photo leaves your phone, the app shrinks it so its longest side is no more than 1024 pixels and saves it as a JPEG. With each photo we store the date, the pose, an optional note you write, and the time it was uploaded. The photo files sit in a private storage bucket at Cloudflare and are never on a public web address. The date, pose and note sit in our database at Supabase. Your phone keeps a copy of your latest photos so they load quickly, and that copy is cleared when you sign out or turn photos off.

Who can see them. You can. A coach can see them only while you are on that coach's client list and have photos turned on. Every time a photo is opened, we check who is asking before we send it, and the link that shows it stops working after 10 minutes. Gym owners and gym admins do not see your photos unless they are also your coach.

Deleting them. You can delete one day's photos, and they stop showing to you and your coach straight away. You can also turn progress photos off at any time. When you do, all your photos stop showing to anyone straight away, and we then delete the photo files from storage.

Lab reports you add are private to you, your coach sees them only if you turn sharing on (it starts off, and you can turn it off any time), we never sell them, and you can delete one report or all of them, file included, any time. When a report reaches its retest date we send you one reminder, at 10am in your own time zone, or at 2pm Eastern time if you have not set one. If a delay on our side misses that time, the one reminder goes out at the next chance: later that day, before 9pm your time, or at the same time on one of the next two days.

Some parts of Marrow can read a file for you, so you do not have to type it in: a lab report, a photo of a body scan sheet, a meal plan, or a program a coach brings across from another app. These readers use Anthropic, the maker of Claude. We send Anthropic only the file you chose to have read, over an encrypted connection, and only when you add a file to be read. What it read comes back to you to check, and nothing is saved until you check it and save it. In Drop anything, a coach's page for adding several files at once, a file we cannot place on our own is sent once so the reader can say what kind of file it is, and the coach sees that before anything is saved.

We use Sentry, listed with our sub-processors above, to find and fix crashes and bugs.

In the Marrow app. When the app hits an error, it sends Sentry a report with the technical details of the error, the app version and a short trail of recent steps in the app. Before a report leaves your phone, we remove your email address, username and IP address, and we strip any field that looks like health or body data, such as weight, body fat, measurements, calories, heart rate, sleep, steps and workouts.

Screen recordings in the app. Sentry records a replay of the screen for about 1 in 10 app sessions, and for any session where an error happens. In every recording all text, all images and all icons and drawn graphics are masked, so your name, your numbers, your messages and your photos are hidden. The recording shows the layout of the screen and the steps taken.

On our website. Most pages on marrowfitness.com load Sentry's browser script to catch errors on the page. It is not loaded on our sign in pages, our checkout pages or our member sign up page, and it does load on other pages, including account setup and settings pages. Errors it catches are sent from your browser straight to Sentry, which receives them over the internet like any website you visit. When our servers hit an error, Sentry receives the page address, the type of request, your browser type and a one way code made from your IP address instead of the address itself. We remove email addresses, passwords, login tokens and payment keys from these reports before they are sent. Sentry keeps this data for the period set by our Sentry plan and then deletes it.

Marrow is for adults. You must be 18 or older to use it. When you set up a member account in the Marrow app, or sign up on our website as a member, coach or gym owner, we ask you to confirm you are 18 or older before you can finish, and on the website we record when you confirmed. We do not ask for your date of birth. A coach can add a date of birth to a client record, and Marrow refuses one under 18 and shows the coach any record that already carries one, so it can be put right. We do not knowingly collect personal information from anyone under 18. If you think someone under 18 is using Marrow, tell us on our contact page.

Athletes

If you are an athlete, your data is processed by Marrow on behalf of the coach you train with. Marrow does not market its own products to athletes. What reaches you through Marrow is account notices, messages from your coach or gym, and the reminders and invitations described under Messages from your coach, each with a way to stop it. For solo coach accounts, coaches own the relationship with their athletes and may export athlete data at any time. For studio and gym accounts, the gym owns the member relationship at the platform level, and coaches keep a copy of their own programming work, matching the terms of service. On termination of a coach's account, athletes are given 30 days to migrate their training history before deletion.

Your rights

You can export a full copy of your data or close your account at any time from your account settings. You can also reach us through our contact page to ask what we have on you, request deletion, or correct errors. We respond inside 30 days. Step by step instructions for deleting your account, and what is deleted and kept, are on our account deletion page. If you're in the EU, UK, or California, you have specific rights under GDPR or CCPA. We honor all of them.

How long we keep it

Application data: 12 months unless you become a customer. After that, we retain it as part of your customer record. Customer training data is retained for the life of your account. When you close your account, erasure starts no sooner than 30 days after you confirm, so you can export your data or ask us to undo the close. If you ask us to delete sooner, we delete within 30 days.

Updates to this policy

We'll update this page when our practices change. The "last reviewed" date at the top tracks every revision. If a change is material, we'll email you.

Contact

Marrow Fitness
Miami Beach, FL
Privacy questions go through our contact page.