You put health data about real people into PTToolBox. This page describes how it is protected. We would rather tell you what is true today than claim more than we do.
Encryption
All traffic between you and PTToolBox is encrypted with HTTPS. Your data is stored in Google Firebase, which encrypts it at rest. Passwords are never stored by us in readable form; our authentication provider stores them hashed.
Keeping coaches’ data apart
This is the part that matters most for a multi-coach tool. Every record - every client, check-in, workout and note - is tagged with the owning coach’s account, and the database refuses any read or write that crosses accounts. That rule is enforced on the server, not in the browser, so it holds even against someone using developer tools rather than the app. One coach cannot reach another coach’s data.
Billing and plan data
The fields that decide what you pay for - your plan and its status - can only be written by our server, through the payment webhook. The database refuses to let the browser change them, so an account cannot grant itself a plan it has not paid for.
Payments
Payments run through Stripe. Card details go straight to Stripe and never pass through or rest on our servers, which keeps card data out of scope for us. Stripe is certified to the highest level of the PCI Data Security Standard.
How AI is used
When you use an AI feature, only the relevant client context is sent to Anthropic’s Claude API over an encrypted connection, and nothing is sent unless you use the feature. Anthropic does not train its models on data sent through the API.
Collecting less
The roster view is built to read from a small summary held on each client rather than trawling their full history on every load, which means less data moving on ordinary use. Medical-screening flags are recomputed live from the source and are not copied into that summary.
Backups and availability
Data is stored on Google’s managed infrastructure, which replicates it for durability. As noted in the Terms of Service, we do not promise uninterrupted availability. Keep your own copies of anything you cannot afford to lose.
What we do not yet claim
PTToolBox is an independent product. We do not hold formal certifications such as ISO 27001 or a SOC 2 report, and we will not imply that we do. The protections above are real; the paperwork that some larger buyers require is not yet in place, and we will say so plainly if you ask.
Reporting a problem
If you find a security issue, please tell us before disclosing it publicly, at jswiftfitness@gmail.com. We will acknowledge you, investigate, and keep you informed. We will not pursue good-faith researchers who report responsibly and do not access or alter other people’s data in the process.