Privacy Policy
Effective date: 2026-08-17 Last updated: 2026-10-30
10X Performance FZE LLC ("10X") runs the coaching business at 10xpformance.com. It is registered in the Ajman NuVentures Centre Free Zone (ANCFZ), Government of Ajman, UAE, licence number 2628215355888, registered address BC-893596, 26th Floor, Amber Gem Tower, Ajman. I'm Mark Timlin. I coach at 10X and I'm its Manager. When this policy says "I", it means me acting for 10X, and 10X is the company responsible for your data.
This policy explains what personal data I collect when you apply for coaching, work with me as a client, use the 10X client app or visit the website. It also explains why I collect it, who handles it for me, how long I keep it, and how to use your rights over it.
Questions and requests go to mark@10xpformance.com. At 10X's current size I haven't appointed a dedicated Data Protection Officer. That address handles every data question and request directly.
1. Scope
This policy covers these groups: visitors to the website, people who apply for coaching or book a consult call ("applicants"), and people who become coaching clients ("clients"). Where a section applies to only one group, it says so. Sections 13 to 15 apply to clients. Section 12 covers 10X Daily, the free daily training: anyone who signs up to its email, joins its WhatsApp community, sends a result, or gets a message from 10X on Instagram.
2. Data I collect
If you apply or book a call:
- Your name, email, and answers to the application questions, submitted through the 10X application form.
- Booking details (date, time) if you book a consult call.
- Call recordings, transcripts, and notes from any consult call you take with me.
- The source you came through (for example, a specific ad or a link in an Instagram bio) and related tracking parameters, so I know what's working.
If you become a client:
- Everything above, plus:
- Training records: your program, session logs, training history, and performance data. They sit in TrainingPeaks and, for endurance training, are synced from your wearable through Intervals.icu. I also keep my own files on each client in Google Drive.
- A medical and injury screening record. You answer yes or no to each question on a short list of health and injury conditions. Section 15 says what I store and why.
- Nutrition and lifestyle information you share for coaching purposes (dietary habits, supplement use, sleep and recovery habits).
- Messages you send me through WhatsApp, TrainingPeaks comments, email, or the app, for coaching communication and day-to-day check-ins.
- Payment-related information, such as invoices and payment confirmations. Payments run through Stripe, which processes your card or bank details; I never see your full card number.
- Body metrics and testing results you give me or that I measure with you, where tracked.
If you use the client app:
In the first release of the app I may collect:
- Your sign-in email address, your time zone and units, and your notification choices.
- Your session logs, results and notes, and the analysis built from them.
- Body and recovery measures: weight, body composition, resting heart rate, heart rate variability, sleep and steps. They come from you or from your device (Section 13).
- The food you log.
- Voice notes you record, and the text transcript of each one.
- Your answers to the onboarding questions, including the health questions (Section 15).
- A record of what you agreed to in the app, and when.
- The push subscription from a device where you allow notifications (Section 7).
If you use the website:
- Website analytics and advertising data, described in Section 7.
- If you subscribe to one of my newsletters: your email address. For 10X Daily, see Section 12.
Where the data comes from:
Most of it comes from you: what you type, tap, say or log. Some comes from your devices, through Intervals.icu or, if you connect it, Garmin (Section 13). Some I create myself: your program, my notes and my analysis.
I don't collect more than I need for these purposes, and I don't sell your data.
3. Purposes and legal basis
I use your data to:
- Assess your coaching application and run the intake process.
- Deliver, personalise, and adjust your coaching program safely.
- Show you your own training, recovery and nutrition numbers in the app, and analyse the sessions you complete.
- Communicate with you about your training, your account, and (if you've opted in) the newsletter, and send you notifications about your program if you allow them.
- Review your records with an AI tool, as Section 14 explains.
- Process payment for services you've engaged me for.
- Improve my coaching methodology and the website, using aggregated or de-identified information where possible.
- Meet my own legal, tax, and accounting obligations.
The legal basis is your consent (given when you tick the consent checkbox on the 10X application form, or when you book or sign up) and the necessity of processing your data to perform the coaching agreement between you and 10X. Where I rely on consent, you can withdraw it at any time by emailing me; this doesn't affect anything I did before you withdrew it.
For health answers, the Garmin link, the AI processing in Section 14 and the assistant coach, I ask for your explicit agreement before I start, and you can withdraw it at any time. New clients agree in the app, before the step each agreement covers. If you're already a client, I ask you by message and record your reply.
For the one message I send a new Instagram follower about 10X Daily, I rely on my legitimate interest in telling people who chose to follow me what 10X Daily offers. Reply "stop" and I won't message you again.
4. Recipients
I use the following service providers to run 10X. Each only receives the data it needs to do its job for me, under its own privacy terms:
| Provider | What it does for me |
|---|---|
| Shopify | Hosts the website and store |
| Cal.com | Runs consult-call booking |
| Fireflies.ai | Records and transcribes consult calls |
| Klaviyo | Sends newsletters (including the 10X Daily Sunday email) and application follow-ups, holds the 10X Daily list, and runs the site tracking in Section 7 |
| Cloudflare | Runs the website forms and holds what they collect, such as your name, email, phone number and application answers. It also hosts the client app on Cloudflare Pages |
| TrainingPeaks | Delivers your training program and holds your training data |
| Everfit | Holds your onboarding forms and signed coaching agreement and, for clients who use it, daily tasks and logs. It also holds training plans for the clients still on it while I move them to TrainingPeaks |
| Intervals.icu | Syncs your endurance training and recovery numbers from your wearable (for example Garmin). It is a separate company, and it holds your own account under its own privacy policy |
| Garmin | Sends me your activities and recovery numbers if you connect your Garmin account (Section 13) |
| Supabase | Runs the client app's database and sign-in, in its Frankfurt, Germany region |
| Resend | Sends the one-time sign-in code and app emails |
| Lovable | The tool the client app is built with. It holds no client data |
| Anthropic | Provides Claude, the AI model I use to help review training records (Section 14) |
| Stripe | Sends invoices and takes payment by card, Apple Pay or Google Pay |
| Zoho Books | Keeps my accounting records of invoices and payments |
| Google Workspace | Runs 10X's business email |
| Google Drive | Stores my coaching files, the 10X Daily results log and the 10X Daily message record |
| Meta (WhatsApp and Instagram) | Carries my WhatsApp messages with clients, runs the 10X Daily community on WhatsApp and carries the messages I send on Instagram |
Most of these providers are based outside the UAE and process data on servers in other countries, so using them involves transferring your data internationally. I use established providers who publish their own data protection and security terms, and I rely on your consent and on the necessity of these transfers to deliver the service you've signed up for. Supabase's data processing terms say it stores and mainly processes the app's data in the region I picked, with some exceptions. Intervals.icu says it processes data in Germany and Finland and may store it in the cloud using Google, Backblaze and Wasabi.
I don't sell, rent, or otherwise trade your personal data to third parties for their own marketing purposes. I won't use data from the client app for advertising.
I may also share data where the law requires it (for example, a lawful request from a UAE authority), or to protect my rights, safety, or property, or that of my clients.
5. Retention
While you're an active client: I keep your data for as long as you're coaching with me.
After you leave: I keep your file, including your training history, indefinitely, so that if you come back to 10X I can pick up from where you left off rather than starting from zero, and so you always have a record to fall back on. You can ask me to export a copy of your data, or to delete it, at any time, by emailing mark@10xpformance.com. I'll action a deletion request unless I have a legal reason to keep specific records (for example, invoices for tax purposes).
Data in the client app, including data from Garmin, follows a shorter rule: I delete it 12 months after your coaching ends, or sooner if you ask.
Voice notes: I delete the audio 90 days after it's transcribed. The transcript stays with your client file and follows the same 12-month rule as the rest of your app data. A delete control for voice notes in the app comes in a later release. Until then, ask me and I'll delete a voice note within 30 days.
Newsletter: if you've left as a client, I keep you on the newsletter list unless you opt out. You can opt out at any time using the unsubscribe link in any email I send, or by emailing me.
6. Your rights
You can ask me, at any time, by emailing mark@10xpformance.com, to:
- Access a copy of the personal data I hold about you.
- Correct anything that's inaccurate or incomplete.
- Delete your data (see Section 5 for what this means in practice).
- Give you a copy of your data in a portable format. The first release of the app lets you export your data yourself as a CSV file. A phone report and a desktop workbook come in later releases. Until they do, ask me and I'll export your data by hand.
- Object to, or ask me to stop, a particular use of your data.
- Withdraw consent you've previously given me, including the Garmin link (Section 13) and AI processing (Section 14).
I'll respond within a reasonable time. There's no automated decision-making that affects you: I make every call on your training myself. If you're unhappy with how I handle your data, email me first. You can also complain to the data protection authority in the country where you live.
7. Cookies, app storage and notifications
The website is public. It runs Shopify's own analytics and Klaviyo's site tracking, and it may use Google Analytics and the Meta Pixel to show me how visitors use the site and to measure my emails and advertising. Klaviyo's tracking can link your visits to your email address once you're on one of my lists. The site shows no cookie banner today, and I'm adding a consent step. You can block or delete cookies in your browser settings, and the site still works.
The client app keeps a sign-in session in your browser so you stay signed in, and stores its own files on your device so it opens quickly and works as an installed app. It sends push notifications only to a device where you allow them, and you can turn them off in the app or in your device settings. Notifications carry no health detail. They may name a session, its distance and its duration. In its first release the app runs no analytics, tracking or advertising tools.
8. Security
I take reasonable technical and organisational steps to protect your data, including restricting access to the people and systems that need it and using established, reputable service providers for storage and processing. Before any client data enters the app, these controls are in place: you sign in with a one-time code sent to your email, each client can see only their own records, and each job on the database has its own limited access role. No method of transmission or storage is completely secure, and I can't guarantee absolute security.
9. Age and children
You must be 18 or over to apply for or use the coaching services. If you're under 18, I can only take you on with your parent or legal guardian's consent, given directly to me before you begin. I don't knowingly collect personal data from anyone under 18 without that consent.
10X Daily is for adults only. You must be 18 or over to sign up to the 10X Daily email, join the 10X Daily community or send me a result, and the guardian-consent route above doesn't apply to it. If I find that someone on the 10X Daily list or in the community is under 18, I remove them that day and delete any result they sent.
10. Changes to this policy
I may update this policy as my practices change. I'll update the "Last updated" date above. For material changes affecting active clients, I'll email you, and I'll add a notice in the app as a second step. That includes any change to Section 13 or Section 14.
11. Contact us
10X Performance FZE LLC
BC-893596, 26th Floor, Amber Gem Tower, Ajman, UAE
mark@10xpformance.com
12. 10X Daily
10X Daily is my free daily training: a session published every day, a Sunday email and a WhatsApp community. 10X Performance FZE LLC (Section 11) is responsible for the data described here. You must be 18 or over to take part (Section 9).
The 10X Daily list (the Sunday email). When you sign up I collect your email address, your first name, the goal you choose and a label saying you signed up on the 10X Daily page. To sign up you answer the readiness screen (the age and health check on that page) and tick a box confirming you're 18 or over. I keep the date, the time and the version of the screen you passed. I don't keep your answers to the screen. You confirm your sign-up from an email I send you, and nobody is added to the list any other way. If you don't confirm, I delete your sign-up within two weeks. Klaviyo holds the list, sends the email and records which emails you open and which links you click. I use this to send you the Sunday email and to count how many people follow each goal. My legal basis is your consent. Unsubscribe with the link at the bottom of any email. I then keep your address only as "unsubscribed", so I don't email you again by mistake.
The 10X Daily community. The community runs on WhatsApp from the 10X business number (the number the community invite comes from). When you join, the admins can see your phone number and profile name. Other members of the community can't see your number unless they already have it. If you join the chat group, its members can see your number, as in any WhatsApp group, and they see what you post there. The admins are Mark Timlin and anyone who helps run 10X Daily and has agreed in writing to keep members' details confidential, all working from the 10X business number. WhatsApp's own privacy policy covers how WhatsApp handles your data. You can leave at any time. My legal basis is your consent, given when you join.
The 10X Daily results log. You can send a result to an admin on the 10X business number, or through the results box on the 10X Daily page once it's live. I log your first name, the result, and the goal and week it belongs to. An admin checks each result before it's shown anywhere. An approved result appears as your first name and the result only, marked as self-reported, in the community announcements, on the 10X Daily page and in Instagram stories I reshare. If you'd rather a result wasn't shown, say so when you send it, or ask me to take it down later. Taking a result down stops it being shown, within a day of you asking. The log row stays, marked as taken down, unless you ask me to delete your data (Section 6). My legal basis for showing a result is my legitimate interest in sharing real results from the people who train with me. I keep the log for 24 months after the result is approved.
The 10X Daily message record. When you follow one of my Instagram accounts, I may send you one message about 10X Daily. I keep your Instagram handle and the date I messaged you, so nobody gets the same offer twice. I keep this list for 12 months after I message you, except a handle that replied "stop", which I keep so I never message it again.
Daily totals. I count subscribers, community members and results each day. These totals hold no names.
Your rights in Section 6 apply to all of this. Email mark@10xpformance.com.
13. Garmin and other wearable data
You can sync a wearable so I coach you from your real numbers. Today that happens through Intervals.icu: you link your device to your own Intervals.icu account, you accept my coaching invitation there, and your activities and recovery numbers reach me from that account. Intervals.icu is a separate company with its own privacy policy.
If you wear a Garmin, you will also be able to connect your Garmin account to the 10X app directly, once Garmin has accepted 10X into its developer program. Connecting is your choice. The app first explains in plain words what linking does, and it asks for your explicit agreement. It then sends you to Garmin's own sign-in and permission page, where you choose which kinds of data to share. I never see your Garmin password.
From Garmin I receive each completed activity (type, start time, duration, distance, average and maximum heart rate, device model, and the detail file with laps, intervals, heart rate, pace and power). I also receive your daily recovery numbers: resting heart rate, heart rate variability, sleep and steps, and weight and body composition if you use a Garmin scale. I ask for nothing else, and I don't store menstrual cycle data. I'll update this list to match Garmin's own categories once my developer access is approved.
I use this data to coach you. I compare what you did with what I prescribed, plan your next week, and show you your own analysis in the app. I don't sell Garmin data, I won't use it for advertising, and I won't use it to train any AI model.
Garmin data is stored in the app database with the rest of your record (Section 4), and Section 5 says how long I keep it. You can see your own data and I can see it. The providers in Section 4 that run the app can reach it, and Section 14 says what an AI tool reads.
You can disconnect at any time. Tell me and I remove 10X's access within a day; an in-app disconnect control follows in a later release. Disconnecting stops new data arriving. It doesn't delete the Garmin data I already hold: I delete that when you ask. You can email me to export or delete your Garmin data, and I act on a deletion request unless I must keep a specific record by law. Deleting data from the 10X app doesn't delete anything in your Garmin account.
I don't send your personal data to Garmin. The app may send the workouts I prescribe to your watch through Garmin's Training API, and the routes for running sessions through its Courses API, only after a separate notice and your explicit consent. Garmin's own privacy policy for Garmin Connect is at https://www.garmin.com/privacy/connect.
14. AI transparency statement
I use an AI model to help me coach. It is Claude, made by Anthropic.
I review your training data with Claude through limited roles. Claude reads the training records you log: your sessions, sets, results, heart rate and comments. It also reads the messages you send me and the notes I keep on how you're going, which can mention an injury you tell me about. That review can include the health screening answers you gave at onboarding. I transcribe voice notes on my own computer, and Claude may read the transcript, not the audio. It turns the records into tables and analysis, and it drafts coaching comments for me.
A person reviews every coaching decision. I check each table before it's saved, and I decide, edit and send every comment and every change to your program myself.
In the first release of the client app, the app itself calls no AI model. The analysis you see after a session comes from fixed rules.
Later I plan to add an assistant coach to the app. It will be an AI, and it will say so wherever it speaks. It will answer training questions and analyse your data, using your own training file and my methodology. Before it reads your records, the app will ask for your explicit agreement, and you will be able to withdraw that at any time.
You give explicit consent before any AI processing of your data: a tick in the app if you're a new client, a recorded reply to my message if you're already a client. You can withdraw it at any time by message.
I don't sell your data and I don't use it for advertising. The Model Improvement setting is switched off on every Claude account that reads client data, so your data is not used to train the model. Anthropic processes the records Claude reads, on my behalf. I use a consumer Max plan, under Anthropic's consumer terms.
I transcribe voice notes myself, on my own computer, so no third party processes the audio.
If you have a question about how I use AI, email mark@10xpformance.com. You can opt out of AI processing by messaging me on the 10X business number or emailing me, and I'll still coach you.
15. Health information
I ask a short list of health questions in your agreement pack and in the app. You answer yes or no to each one (for example a diagnosed medical condition, an injury or pain affecting training, pregnancy, or a few others; the full list is in your agreement pack and in the app). I store those answers, and nothing more detailed. I don't store diagnoses or medication names.
I treat your answers as sensitive health-related information and use them for one purpose only: to decide whether to follow up with you directly. If you answer yes to one or more, I don't route you through an automated medical questionnaire or a separate provider. I follow up with you one to one, before your program begins, to understand what's needed to coach you safely.
I don't ask for detailed medical information in the app or over WhatsApp. If you choose to mention a health detail in a voice note or a message, I keep it with the rest of your health information.
I ask for your agreement before I collect these answers. In the agreement pack that's a tick. The app asks again before the health questions, which are the last chapter of onboarding.
Your health answers, voice notes and device numbers such as heart rate and sleep are stored in the app database (Section 4). You can see your own, and I can see them. Section 14 says which of them an AI tool reads. You can ask me to delete this information at any time (Section 5).
10X provides fitness and performance coaching, not medical advice.