Belay is a text-message coaching service. It works by knowing your training week and remembering what you told it, so it holds real information about you. This page says exactly what that is, who else sees it, and how to get it back or get rid of it.
What we collect
Only what the service needs to run. In full:
- Account. Your email address, and a password stored only as a hash by Supabase Auth. We never see your password.
- Phone and consent. Your mobile number, whether you opted in to SMS, and the timestamp of that opt-in. The timestamp is kept as the record of your consent, which we are required to be able to produce.
- Training profile. Your phase, your split, the time you usually train, your timezone, an optional target date, the days you cannot train, and the weak points you describe at signup.
- Coaching history. The text of messages sent to and from you, sessions and the days they sit on, a log of sessions completed, missed and rescheduled, the travel windows you text in, and the schedule of messages queued for you.
- Billing references. A Stripe customer ID and subscription ID. These are opaque identifiers. We never receive or store your card number — Stripe collects it on its own pages and we never see it.
What we do not collect
- No card or bank details, ever. Those live with Stripe.
- No location beyond the timezone you type in yourself. We do not use GPS, IP geolocation, or any device sensor.
- No analytics, no advertising pixels, no session recording, no fingerprinting, no third-party trackers of any kind. The site loads no script and no font from any other company's server. See the Cookie Policy.
- No health records. Your “weak points” are self-reported training habits, not medical information, and Belay is not a medical service.
Why we are allowed to hold it
Most of it because we cannot deliver the service you bought without it (performance of a contract). Your phone number is held on the separate basis of your consent, given by ticking the SMS box, and you can withdraw that at any time by replying STOP or by clearing your number in Settings. We do not rely on “legitimate interests” for anything, because we do not do anything with your data beyond running the service.
Who else sees it
Four companies, each doing one job. We have no other sub-processors, and we do not sell, rent, or share your personal information with anyone for advertising or for any other company's own purposes.
Text messages. We will not share your mobile number or your SMS opt-in data with third parties or affiliates for their marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties. We send up to 2 messages per day, plus replies to your texts. Message and data rates may apply. Reply STOP to unsubscribe at any time, or HELP for help.
| Company | What it receives | Why |
|---|---|---|
| Supabase, Inc. | Everything listed above | Database, login, and the servers that run Belay |
| Twilio, Inc. | Your phone number and the text of each message | Sending and receiving the SMS |
| Anthropic, PBC | Your phase, split, coaching tone, weak points and recent messages. Not your email, not your phone number, not your billing IDs. | Writing the wording of the coaching texts |
| Stripe, Inc. | Your email and whatever billing details you give Stripe directly | Taking the payment |
All four are US companies and your data is processed in the United States. Each is engaged under its own data processing agreement.
How it is protected
- Every secret — payment keys, SMS credentials, model keys — lives server-side. None is present in the code your browser downloads.
- Row-level security in the database means one account cannot read another's rows, and consent fields are not writable from the browser at all.
- Every message you send is stripped of control characters and length-capped before it reaches the model, and every message we send is scanned for leaked credentials and for links to anywhere other than startbelay.com before it goes out.
- Our own logs record only the last four digits of your phone number.
No system is perfectly secure, and we do not promise one. If a breach affects your data we will tell you and the relevant regulator within the time the law allows.
How long we keep it
- While your account is open, we keep it.
- If you delete your account, it goes immediately and the deletion cascades to every table listed above.
- If your subscription ends and you do not delete the account, everything is purged automatically 90 days after cancellation by a job that runs weekly.
- Encrypted database backups are held by Supabase for up to 30 days, so deleted data can persist in a backup for that long before ageing out.
- Stripe keeps its own billing records for as long as financial law requires it to, typically seven years. Deleting your Belay account does not delete those, and we cannot delete them for you.
Your rights, and how to use them
Two of them are buttons rather than requests, which is deliberate — you should not have to email anyone to get your own data:
- Get a copy. Settings → Download my data gives you a JSON file of all eight tables we hold on you, immediately.
- Delete everything. Settings → Delete my account removes your login and cascades the deletion through every table. It cannot be undone.
- Stop the texts without closing the account: reply STOP to any message, or PAUSE to hold everything and pay nothing until you text RESUME.
For correction, restriction, objection, or anything the buttons do not cover, email support@startbelay.com. We answer within 30 days. We will never charge you for exercising a right and will never degrade the service because you did.
If you are in California (CCPA/CPRA): the rights above are your rights to know, delete, and correct. We do not sell or share personal information as those terms are defined, and we do not process it for cross-context behavioural advertising, so there is no “Do Not Sell or Share” link to offer — there is nothing for it to switch off. You may use an authorised agent.
If you are in the EEA or UK: Belay is sold in the United States and can only text US mobile numbers, so we do not offer the service to you. If you reached us anyway, you keep your rights of access, rectification, erasure, restriction, objection and portability, and you may complain to your supervisory authority.
Children
Belay is for adults. It is not directed to children, we do not knowingly collect anything from anyone under 18, and if we learn that we have, we delete it. See the Terms, which set 18 as the minimum age.
Automated decisions
A language model reads your replies to work out what you meant and writes the wording of the texts you get. It does not decide anything about your money or your account. Where a session gets moved to is decided by ordinary code following the rules you set, not by the model. No automated decision here has a legal or similarly significant effect on you.
Changes
If we change this policy in a way that matters, we will change the effective date at the top and tell you by email or text before it takes effect. Continuing to use Belay after that is how you accept it.