Privacy Policy

The short version

I'm a one-person coaching business. I collect the information I need to coach you well, I store it securely, and I don't sell it or share it with anyone who isn't helping me run the business. Your journal entries stay yours, the app doesn't show them to me. If you ever want to see what I hold on you, or want it deleted, email me and I'll sort it.

The rest of this page is the detail.

Who I am

This site and the Performance OS app are run by JOD Limited, trading as Jamie O'Donnell Coaching, based in Nelson, New Zealand, working with clients online and in person.

For anything to do with your privacy or your information, email hello@jamieodonnell.me. I handle these myself, so you're not going through a support desk.

What this covers

Three things: this website, including enquiries and advertising; the Performance OS app at app.performanceos.online; and the coaching work itself, including calls, messages and the notes that come out of them.

If you're just browsing the site, only the website section below applies to you.

Part one: this website

Enquiries and bookings

When you book a call or fill in a contact form, your name, email and whatever you've written come through to my inbox and into GoHighLevel, the booking and customer system I run the business on.

I use that to reply to you and to keep track of our conversation. Marketing emails only go out if you've explicitly opted in, and every one has an unsubscribe link.

Analytics and advertising

The website uses Google Analytics 4, which tracks anonymous usage patterns like which pages get visited, how long people stay and roughly where in the world they are. It also uses the Meta Pixel, which measures whether my Facebook and Instagram ads are working, by recording page views.

You can opt out of Google Analytics with Google's browser opt-out extension, and you can control Meta's tracking through your Facebook ad preferences or the Digital Advertising Alliance.

This is the website only. The app runs no analytics and no advertising trackers of any kind.

Instagram and Facebook comment automation

If you comment a keyword on one of my posts to get a resource sent to you, the system records your username, your user ID, what you commented and whether the message got delivered. That's used for one thing, sending you what you asked for.

Want it gone? Email hello@jamieodonnell.me with the subject "Data Deletion Request". Full details are on the data deletion request page.

No payments on the site

No payment processing happens on this website, so no card or bank details are collected or stored here.

Cookies

The website sets cookies through Google Analytics, the Meta Pixel and the GoHighLevel booking widget. The app sets only what it needs to keep you signed in and remember your settings, with no advertising cookies and no third-party tracking.

Part two: coaching clients and the app

This part applies once we work together.

What I collect

Your account details. Your name, email address and a password. Passwords are handled by Supabase Auth, which stores them hashed. I never see your password and it is never stored in my own database.

What you put into the app. Goals, plans, projects and tasks, habits and how you tracked them, journal entries, check-in and reflection answers, and the notes attached to your coaching calls.

Health and wellbeing information. Training and workout logs, body weight, progress photos if you upload them, breathing sessions, and how you rated your stress, energy and readiness. If you choose to connect Apple Health, that adds things like sleep, heart rate variability and resting heart rate. This is sensitive information and I treat it that way. Connecting Apple Health is entirely optional and you can disconnect it at any time.

Calendar information, but only if you choose to connect Google Calendar or Outlook. The app reads your events so your plan and your real week line up, and writes the blocks you create back to your calendar. You can disconnect at any time.

Coaching call content. Notes and summaries from our calls, and in some cases a transcript. There's a section below on how AI is involved in that, because you should know exactly what happens.

Messages you send me in the app.

Basic technical information, such as when you signed in and, if you turn on notifications, the details needed to send them to your device.

How AI is used, and where it isn't

I want to be straight with you about this, because most policies bury it.

Call notes. I run coaching calls on Google Meet. Google's AI assistant, Gemini, takes notes during the call and writes a summary document. The app then pulls that document into your call record, where I use it to draft your action items and my follow-up. This means the content of our calls is processed by Google, and in some cases by Anthropic's Claude, which helps me turn those notes into a clear recap.

You will always be told before a call is noted this way, and you can ask me not to. Just say so and I'll turn it off for your calls. It makes my admin slower and costs you nothing.

In-app AI insights. The app has a feature that looks at patterns in how you plan and follow through, and writes a short coaching prompt. It is currently switched off. If I turn it back on, I'll tell you first. When it was running it worked on summary numbers only, never on the words in your journal.

Your journal text is not sent to any AI service. Not for insights, not for summaries, not for anything. If that ever changed, I'd tell you before it happened, not after.

Your information isn't used to train AI models. I use these services on business terms that don't allow your content to be used for model training, and I've chosen the settings that keep it that way. What I can't do is personally guarantee how another company behaves. If a provider ever changed its terms, I'd move or tell you.

Your journal is private

The app tells you this on screen and I'll repeat it here, because it's a deliberate design decision rather than a nice sentence.

I can see that you journalled and how consistently you've been doing it. I don't see the words. The app doesn't show me your entries anywhere, and when I'm signed into your account view during a call, the journal screen shows me a notice instead of your writing. There's an automated check that fails the build if anyone ever removes that lock, including me.

The honest footnote: I built the app and I run its database, so I have administrator access the way any small software owner does. I need it to fix faults and run backups. I don't use it to read client journals, and the app is deliberately built so I never stumble across them in the course of coaching you.

What I use your information for

To coach you. To run the app and keep your account working. To prepare for our calls and follow up afterwards. To send you the things you've asked for, like call reminders and check-in nudges, which you control in your notification settings. To handle invoicing, tax and the ordinary legal obligations of running a business.

I don't sell your information, I don't rent it, and I don't share it for anyone else's marketing.

Who else touches your information

I run a small business on other people's infrastructure, so a handful of companies process your information on my behalf. They're bound to use it only to provide their service to me.

• Supabase stores the database, your login and your uploaded files
• Netlify hosts the website and the app
• Google for Workspace, Meet, Gemini call notes, Calendar and Drive
• Microsoft if you connect an Outlook calendar
• Zoom if we use a Zoom room for a call
• Anthropic for the AI described above
• Resend sends the app's emails, like sign-in codes and call reminders
• GoHighLevel holds enquiries, bookings and email contact
• Apple if you connect Apple Health, which syncs from your own device

My accountant sees financial records, not your coaching content. Beyond that, I'd only disclose your information if the law required it, or if someone's safety was at serious risk.

No other client is shown your information. The app separates every account at the database level, so one client's login can't reach another's data, and the only person who sees your coaching content is me.

Where your information is stored

The database sits in Supabase's Tokyo region, in Japan. The other services above are mostly based in the United States and store information there.

That means your information is held outside New Zealand. Under the Privacy Act 2020 I need to be upfront about that, and I need to be satisfied those providers protect your information to a comparable standard. They're all established providers operating under recognised privacy frameworks and contractual protections.

How it's kept safe

Every account is walled off from every other one at the database level, so the system itself won't serve your data to another user even if something goes wrong in the app. Connections are encrypted. Passwords are hashed by the authentication provider, not stored by me. Accounts are created by invitation rather than open signup. I review the security settings regularly and fix what needs fixing.

As the person who built and runs the app, I hold administrator access to the database for maintenance, fault-fixing and backups. That's unavoidable in a business this size, and I use it for keeping the thing working, not for reading your material.

No system is perfect and I won't claim mine is. If something does go wrong and your information is put at risk, I'll tell you, and I'll notify the Office of the Privacy Commissioner where the law requires it.

Part three: the bits that apply to everyone

How long I keep things

• Enquiries and contact records, while we're talking and for a reasonable period afterwards so I've got the history if you come back.
• Website analytics, per Google's own retention, which is currently around 14 months.
• Your coaching information and app account, while you're a client and for two years after we finish, so your history is still there if you return. After that I delete it, and you can ask me to delete it sooner.
• Financial records, seven years, because New Zealand tax law requires it.

Your rights

Under the Privacy Act 2020 you can ask me for a copy of everything I hold on you. You can ask me to correct anything that's wrong. You can ask me to delete your information, and I'll do it unless I'm legally required to keep a specific record.

Email hello@jamieodonnell.me and I'll respond within 20 working days, which is the timeframe the Act sets. Right now I handle these by hand, so tell me what you're after and I'll put it together properly.

As a client you can also turn off notifications, disconnect Apple Health or your calendar, and ask me to stop AI note-taking on your calls, all without affecting your coaching.

If you're under 18

I coach some younger athletes. If you're under 18, a parent or guardian needs to agree to this policy and to you using the app before you start.

Complaints

If I've handled your information badly, tell me first at hello@jamieodonnell.me and I'll fix it.

If you're not happy with how I've responded, you can complain to the Office of the Privacy Commissioner at privacy.org.nz or on 0800 803 909.

Changes

If I change this policy in a way that matters, I'll tell my clients rather than quietly updating the page. The date at the top shows when it last changed.