Trust and security
Found a weakness? Tell us first.
If you think you have found a security problem in CoachTide, we want to hear about it. This page says how to report it, what we promise in return, and the few things we ask of you while you look.
Last updated October 2026. How we protect data day to day is on our trust and security page.
01
How to report
Email security@coachtide.com. A person reads every report. Please write to that address rather than posting in public, opening a support chat, or contacting a coach who uses CoachTide.
Please include no more of anyone's personal information than you need to show the problem. If you came across someone else's data, tell us what kind it was, not what it said.
02
What to include
- Where it is. The page or web address, and whether you were signed in as a coach, as a client in the portal, or not at all.
- How to see it for ourselves. The steps you took, in order. Screenshots or a short recording help.
- What someone could do with it. For example, read another practice's records, or act as someone they are not.
- How to reach you. So we can ask questions and tell you when it is fixed.
03
What we promise
- A reply within 3 business days to confirm we have your report.
- Straight answers. We will tell you whether we can see the problem, keep you posted while we work on it, and let you know when it is fixed.
- Telling the people affected. If a problem put coaches or their clients at risk, we will tell them what happened and what we did about it.
- Thanks, not threats. If you follow the guidelines below, we will not take legal action against you or report you to the police for your research. If someone else does, we will make it known that you acted in good faith and within these guidelines.
04
What we ask of you
Real coaches and their clients use CoachTide every day. These guidelines keep them safe while you look.
- Test only with an account that is yours. If you do not have one, email us before you start and we can talk about a test practice.
- Never look at, change, or delete anyone else's information. If you reach it by accident, stop there, do not keep a copy, and tell us.
- Do not slow the service down or flood it. No denial-of-service tests and no heavy automated scanning.
- Do not trick people. No phishing or social engineering of our team, of coaches, or of their clients.
- Give us a fair chance to fix it before you share it with anyone else, and agree a date with us before you publish.
05
In scope
- The CoachTide app at app.coachtide.com, including the client portal and the booking and payment pages.
- Our public website at coachtide.com.
- The coach websites CoachTide hosts on coachtide.com addresses.
- The emails CoachTide sends, and the links inside them.
06
Out of scope
We still read these, but they do not count as a security problem on their own.
- Problems in services we use but do not run, such as Supabase, Vercel, Stripe, PayPal or Google. Please report those to the company itself. Our sub-processors page lists them.
- Links a coach adds to their own pages or emails, such as their Zoom room or social profiles.
- Denial of service, spam, social engineering, and anything that needs physical access to a device.
- Reports from automated scanners with no working example of real harm.
- Missing security headers, cookie flags, or email settings (such as SPF, DKIM or DMARC) where you cannot show how it could be used against anyone.
- Clickjacking on pages with no sensitive action, and attacks that only work on yourself.
- Software version numbers or error messages that reveal nothing sensitive.
- Problems that only affect outdated browsers, or a device that is already compromised.
07
No bug bounty
CoachTide is a small team in beta, and we do not pay for reports. Please do not make a report conditional on payment. We are grateful for every report made in good faith, and we will tell you so.