Privacy policy.

The site you're reading is jonathanfors.com, the coaching practice of Jonathan Fors. The company behind it — and the data controller responsible for the personal data described here — is Jon Corp OÜ, registered at Sepapaja tn 6, 15551 Tallinn, Estonia.

"We" and "us" below mean that company. "I" means Jonathan, because most of what follows is one person reading your email and writing your training plan. For anything about your data, write to coach@jonathanfors.com — it reaches him directly, and there's no separate privacy desk to route it through.

This policy covers everything we run:

• The website at jonathanfors.com, including the group coaching waitlist and the Shuffle Club newsletter pages.
• The Shuffle Club newsletter itself.
• The intro call booking page and the athlete intake form.
• Coaching — one-to-one and group — including the messages, calls and training data that come with it.

It does not cover other people's sites we link to. Instagram, LinkedIn and anywhere else you might follow along are governed by their own policies.

Grouped by what you did, because that's how it actually arrives. Nothing here is collected speculatively — if a field isn't on a form, we don't have it.

Reading the site

Page views, the page you came from, and rough location by country — collected by Vercel Web Analytics, which sets no cookies and doesn't identify you. Separately, the Meta Pixel records the pages you visit along with your IP address and browser, and sets a cookie. See §4.

Subscribing to the newsletter

Your email address, and nothing else — that's the whole form. We also record which page you signed up from, so we can tell the newsletter apart from the waitlist.

Joining the group waitlist

Your email address, your first name and your running experience level. The name is so a message doesn't open "Hi there"; the level is so groups can be matched by ability, which is the point of the waitlist. If you refer someone, we also record that a referral came from you, so the extra entry in the draw can be credited.

Booking an intro call

Your name, email address, the slot you chose and anything you type into the booking form. This is handled by TidyCal, which also creates the calendar entry.

The athlete intake form

Your running history, current training, goals, past injuries and any health information you choose to share. This is the most sensitive thing we hold, and it exists for one reason: a coach who doesn't know about your knee will write you a plan that hurts it. The form is hosted by Notion.

Being coached

WhatsApp messages, notes from our calls, the training you log, how sessions went, and whatever you tell me about sleep, stress, work and injury along the way. Payment records too — though card details are handled by the payment provider and never reach us.

Emailing us

Whatever's in the email, kept in the mailbox like any other correspondence.

What sets a cookie

• The Meta Pixel. It loads on every page and reports your visit to Meta, along with your IP address, browser and the page you're on. It also reports when someone completes a signup, so we can tell whether an advert led to one. It sets cookies — _fbp and friends — which Meta can use to link your visit here to your Facebook or Instagram account.
• TidyCal, but only once you open the booking popup. Nothing loads from it until you click.
• YouTube, on the training video pages, and only when you press play. The embeds use the no-cookie domain, so simply loading the page sends nothing.

What doesn't

Vercel Web Analytics — the thing that tells us a page was read — sets no cookies and stores no identifiers. Our own fonts are served from this domain, so nothing goes to Google to render the page.

How to refuse it

• Block third-party cookies in your browser, or use its tracking protection — Safari, Firefox and Brave block the pixel by default.
• Turn off off-Facebook activity and ad personalisation in your Meta account settings.
• Use any content blocker. Nothing on this site needs the pixel to work — every page, form and booking link works fine without it.

The GDPR needs a legal basis for each use. Ours, in plain terms:

Consent

The newsletter, the waitlist, and the Meta Pixel's advertising use. You gave it by typing your address in or by browsing with tracking allowed, and you can take it back at any time — there's an unsubscribe link at the foot of every email.

Explicit consent

Health and injury information, under Article 9(2)(a). You choose what to tell us.

Performing a contract

Everything needed to actually coach you: your plan, your training data, our messages, your invoices.

Legitimate interests

Site analytics, keeping the site secure, and keeping records of who we've worked with. We've weighed these against your privacy; they involve no profiling and no decisions about you.

Legal obligation

Accounting records, which Estonian law requires us to keep for a set period whatever anyone would prefer.

We don't sell your data and we don't trade lists. We do use other companies to run the practice, and they process data on our instructions:

beehiiv

United States. Runs the newsletter and both signup lists — holds your email address, first name and experience level, and the referral tracking.

Vercel

United States, serving from Europe. Hosts the site and provides the cookieless analytics; server logs pass through it.

Meta

Ireland and the United States. The pixel described in §4, and WhatsApp, which is how coaching conversations happen.

TidyCal

United States. Intro call bookings and the calendar entry.

Notion

United States. Hosts the athlete intake form and its answers.

Google

United States. YouTube hosts the training videos, and Google Workspace the mailbox and calendar.

Accountants and advisers

Estonia. Invoices and payment records, where the law or a genuine dispute requires it.

If a court or a regulator legitimately requires us to hand something over, we will. Otherwise your data stays where it is.

Several of the companies above are based in the United States, so some of your data leaves the European Economic Area. Where it does, the transfer relies on the European Commission's standard contractual clauses, or on the EU–US Data Privacy Framework where the company is certified under it.

We're not going to pretend that's the same as your data never leaving Europe. It's the honest state of using ordinary tools to run a small coaching practice, and it's why the list above is short and why nothing sensitive goes into an advertising platform.

Newsletter

Until you unsubscribe, and then a record that you did so — which is how we avoid adding you back.

Group waitlist

Until the group programme has launched and the draw has been run, and for up to twelve months after that in case a place opens up. Ask to come off it sooner and you'll come off it sooner.

Intake forms

Twelve months, if you don't go on to be coached. If you do, it becomes part of your coaching record.

Coaching records

For as long as we're working together, and two years after that — coming back to running after a break is common, and your history is the most useful thing in the room when you do.

Invoices and accounts

Seven years, as Estonian accounting law requires. This one isn't ours to shorten.

Analytics and pixel data

Held by Vercel and Meta on their own schedules — around two years in Meta's case.

Under the GDPR you can ask us to do all of the following, and we won't make it difficult:

• See it. A copy of everything we hold about you.
• Correct it. If something's wrong, we'll fix it.
• Delete it. Bearing in mind we can't delete an invoice the tax authority requires us to keep.
• Take it with you. Your data in a portable format, including your training history.
• Restrict or object. Including objecting to anything we do on the basis of legitimate interests.
• Withdraw consent. At any time, without giving a reason. It doesn't undo what was done while consent was in place.

Email coach@jonathanfors.com and say what you want. We'll answer within a month, and there's no charge. We may ask you to confirm you're you — which is a protection for you, not an obstacle.

If we get it wrong, you can complain to Andmekaitse Inspektsioon (the Estonian Data Protection Inspectorate), or to the data protection authority in the country where you live. We'd rather you told us first, but it's your call.

The site is served over HTTPS. Accounts that hold your data are protected with two-factor authentication and a password manager. The beehiiv API key that handles signups lives on the server and never reaches your browser. Access is limited to the people who need it, which in practice means Jonathan.

No system is perfect. If something happened that put your data at real risk, we'd tell you and the regulator rather than hope nobody noticed.

We don't profile you and nothing about you is decided by a machine. Your training plan is written by a person — that's the offer, not a footnote.

The five free group coaching places are drawn at random from the waitlist. Nothing about you affects the outcome: not your experience level, not how early you signed up. Referring someone earns one extra entry, and that's the only thing that changes the odds.

Coaching is for adults. The services here aren't intended for anyone under 18 and we don't knowingly collect their data. If you think a child has signed up, tell us at coach@jonathanfors.com and we'll remove it.

When this changes, the date at the top changes with it. If a change actually matters — a new company handling your data, a new use for it — we'll say so in the newsletter rather than quietly editing the page.

Questions about any of it: coach@jonathanfors.com. A real person reads that address.