How it works, start to finish.

Everything a client sends you is encrypted on their device and sealed to a key only you hold. We cannot read any of it, which is the product — and it means we cannot recover it for you either.

If you forget your password and have no recovery code, every check-in, message and photo your clients have sent becomes permanently unreadable. Not withheld pending identity checks. Unreadable, to everybody, for good.

Pro asks you to acknowledge this before it will let you enrol anybody, and the server enforces the order rather than trusting the app to. A trainer who cannot read their roster is in a worse position than one who never built it.

The trial is a real seat rather than a demo mode: you can enrol clients, send work and read what comes back, and nothing is watermarked or withheld.

It takes no payment method, so it cannot roll into a charge you did not choose. When it ends the roster stays exactly where it is — the seat stops, not the relationships — and subscribing picks it up unchanged.

Generate an invitation, choose how many people may redeem it and how long it lives, and hand it over however you already talk to them. A code lasts thirty days unless you say otherwise, and you can revoke an unredeemed one at any time.

The reason invitations work this way is that we hold no client list. There is no route in the API that turns a person into an account — nobody can be looked up by name or by email, by us or by anybody else, because the server holds neither. The only way onto your roster is a code you issued.

One code can seed a whole intake: set it to twenty redemptions and send it to a gym floor, or set it to one and send it to a person.

Your client decides, category by category, what you are allowed to see. Every one starts off. They can turn any of them back off later without telling you, and the app will not pretend otherwise.

This is the single most common thing mistaken for a bug. If a client's measurements are missing, the first question is not whether the app broke — it is whether they have shared measurements with you. The permission history is on their card, with dates, so you can look rather than remember.

It also decides what you can send. A check-in rides the Check-ins permission, macro targets ride Nutrition, and feedback on a session rides Check-ins rather than Messages. If a send is refused, it is refused on one of these.

Each one is sealed to that client and to nobody else before it leaves your hands. Send to one person, or fan the same programme out to everybody on a block at once — a batch is one action, and one line on your sent list, however many people it reached.

A check-in is your questions, not ours. A macro target is calories and three macros, and it becomes the number their app measures the day against.

You can take a send back. If their phone has not fetched it yet, they will never see it. If it has, they have it, decrypted, on their device — and nothing we can do reaches that. The confirmation says so in those words, because a trainer who believes an un-send is a recall will not follow it with the correction that actually fixes it.

Workout logs set by set, the day's food against the target they were eating to, weigh-ins, seven tape sites, progress photos, check-in answers, and what they wrote to you — whatever they have shared.

Opening a progress photo is a deliberate act, and Pro never loads one on your behalf. Asking for the photo is what records that you looked at it, on their access log, so a screen that fetched them automatically would be writing "your trainer viewed this" every time you scrolled past.

Pick a span and Pro assembles a dated PDF: what you prescribed and when, every session they logged with the loads, the targets in force, check-ins and the answers given, weigh-ins and measurements, what was said, and what they told you about their own body. Nothing in it is summarised, scored or interpreted.

It is built on your device from your own decrypted history. There is no upload, no share link and no server round trip, which is the only arrangement under which a document containing somebody's injuries can honestly say it came from end-to-end encrypted records.

Two things it will not do. It states the kind and date of every programme and meal plan you sent but never their contents, because those were sealed to your client and your device kept no readable copy. And it counts progress photographs without including them: a file that travels by email is the wrong place for somebody's body.

A paused client stays on your roster and nothing flows either way until you both resume. Ending the relationship stops it permanently.

Nothing expires while somebody is on your roster — not their first check-in, not a weigh-in from two years ago. Twelve months after you END a relationship, all of it is deleted from our servers.