Privacy Policy

1. Introduction

AllStrong ("we," "us," or "our") operates AllStrong (the "Service") at https://allstrong.app. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our Service, whether as an individual consumer, a gym owner, or a gym member.

By using the Service, you agree to the collection and use of information in accordance with this Policy.

Consumer Health Data Privacy Policy

This policy also serves as our Consumer Health Data Privacy Policy as required under applicable state laws, including the Washington My Health My Data Act.

2. Information We Collect

2.1 Information You Provide

• Account information: Name, email address, and password when you register.
• Profile information: Any additional details you add to your profile.
• Payment information (consumer subscriptions): Collected and processed by Stripe, Inc., our payment processor, on Stripe's hosted checkout page. Stripe receives your card details, billing name, email address, and transaction details. We receive confirmation of payment, your subscription status, and Stripe's identifiers for your customer record; we do not receive or store your payment card number.
• Payment information (gym member billing): Handled by Stripe, Inc. via Stripe Connect. Payment card data, bank account data (for ACH transfers), and billing addresses are collected and processed by Stripe on behalf of your gym. We do not store card numbers or bank account details. When you save a card for your gym, we keep Stripe's identifiers for your customer record and the saved card, together with the card brand, last four digits and expiry month and year, so that you and your gym can see which card is on file. See Section 4 for details.
• Communications: Messages you send us for support or feedback.
• In-app messages: If you use in-app messaging (e.g., coach-member communication within a gym), message content is stored on our servers.

2.2 Information Collected Automatically

• Usage data: Pages visited, features used, time spent, and interactions with the Service.
• Device information: Browser type, operating system, IP address, and device identifiers.
• Cookies and tracking: See Section 8 (Cookies).

2.3 Health and Fitness Data

We collect health and fitness data you choose to share, including activity metrics, biometric measurements (weight, body composition, heart rate, steps), sleep data, nutrition data, and wearable device data (via Apple HealthKit on iOS and Health Connect on Android). This information is used solely to provide the tracking and analysis features of the Service and is not shared with health insurers, employers, pharmaceutical companies, or advertisers.

Under the CCPA, health and biometric data is classified as "sensitive personal information." See Section 5 for your rights regarding sensitive personal information.

2.4 Gym Membership Data

If you are a member of a gym that uses the AllStrong platform, we collect:

• Attendance records: Check-in dates, times, and methods.
• Class bookings: Class registrations, cancellations, and waitlist history.
• Coaching session history: Scheduled sessions, session types, and completion status.
• Benchmark and workout results: Performance scores, personal records, and workout logs recorded through the gym platform.
• Staff notes: Notes created by gym staff regarding your membership (general, coaching, billing, or medical notes as categorized by staff).
• Waiver signatures: Digital signatures on gym liability waivers, health questionnaires, and other gym-required documents.

2.5 Nutrition and Food Data

When you log food or scan barcodes, we may query third-party nutrition databases (USDA FoodData Central, Open Food Facts) to retrieve nutritional information. These queries transmit food names or barcode numbers — not your personal information — to these public databases.

2.6 Photos and Files

If you upload photos (e.g., body composition scan printouts), they are stored securely using Cloudflare R2 (S3-compatible cloud storage) and processed by our AI provider for data extraction. Photos are associated with your account and can be deleted at any time.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service.
• Process transactions and manage your subscription.
• Facilitate gym member billing through Stripe Connect on behalf of participating gyms.
• Send transactional emails and account notifications.
• Respond to your support requests and communications.
• Analyze usage patterns to improve features and user experience.
• Generate churn risk scores and retention analytics for gym owners (based on attendance patterns and engagement metrics — not personal health logs).
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not sell your personal information to third parties.

4. How We Share Your Information

We may share your information with:

• Service providers: Third-party vendors who help us operate the Service (hosting, payment processing, email delivery, error monitoring, cloud storage). These providers are contractually obligated to use your information only as directed.
• Stripe, Inc.: Our payment processor. For consumer subscriptions, you pay on Stripe's hosted checkout page and manage or cancel your subscription through Stripe's hosted subscription page; Stripe receives your card details, billing name, email address, and transaction details, and we receive confirmation of payment and your subscription status. For gym member billing via Stripe Connect, each participating gym maintains a Stripe connected account, and Stripe receives payment card data, bank account information (for ACH transfers), billing addresses, and transaction amounts necessary to process member charges. Stripe's privacy policy at https://stripe.com/privacy governs how Stripe handles this data. We do not store card numbers or bank account details — all payment credentials are held by Stripe. For a card you save for your gym, we keep only Stripe's identifiers and the card brand, last four digits and expiry date, which we show to you and to your gym as the card on file.
• Anthropic, PBC: Our AI provider. Text you enter in chat features and photos you upload for analysis may be processed by Anthropic's Claude AI in accordance with their privacy policy. We do not send your health data to Anthropic for purposes other than providing the chat and analysis features you initiate. Under its commercial terms, Anthropic does not use this data to train its models.
• AI applications you connect (MCP Connector): If you choose to connect a third-party AI application to your account through our MCP Connector, we disclose the specific categories of health and fitness data you approve directly to that application, at your direction, for as long as the connection is active. A Connected App is an independent third party, not one of our service providers: it is not under contract with us, and its own privacy policy governs what it does with the data. See Section 4.2.
• Google / Firebase: For authentication and account management. If you sign in with Google, we receive your name and email address from Google. Firebase processes authentication tokens and account events.
• Sentry (Functional Software, Inc.): For application error monitoring and performance tracking. Sentry receives technical error data (stack traces, device info, request metadata). We strip personally identifiable information (request bodies, auth headers, cookies) before transmission. Sentry does not receive your health or fitness data.
• Google LLC (Google Analytics): Aggregate usage analytics on our public website (allstrong.app) and our public gym web pages — page address (with any query string removed, apart from campaign tags), referring page, device and browser information, and an approximate location derived from your IP address. Google Analytics does not run inside the signed-in app or the gym dashboard and receives no health, member or waiver data. Until October 1, 2026 it also ran on the gym dashboard, where it received the addresses of pages staff visited (which included internal record identifiers, not names) and the same device information; it received no page content. Between June 25, 2026 and October 1, 2026, the web address of our upgrade and checkout pages and of the sign-up confirmation page included the user's email address and account identifier, so Google Analytics received those two values for users who reached those pages. No health logs, names, passwords or payment details were included. We have corrected this so that Google Analytics receives page addresses without any query string other than campaign tags, we have shortened the retention period on that analytics data, and we have asked Google to delete the data it received.
• Vercel, Inc.: Hosts our gym dashboard and gym web pages. Vercel receives the request metadata needed to serve those pages (your IP address, the page requested, browser and device information); the dashboard then loads your data directly from our application servers (Hetzner, below), and Vercel does not store your account or health data.
• Hetzner Online GmbH: Hosts our application servers in the United States. Everything you send to the Service, including health data, is processed on these servers.
• Neon, Inc.: Hosts our database in the United States, where your account and health data are stored.
• Telnyx, Inc.: Provides the phone and text-messaging service for gyms that turn it on. Telnyx receives the gym's phone numbers, the numbers of people who call or text the gym, the content of text messages, voicemail audio and the transcripts we make of it, and call recordings where the gym has enabled recording. Telnyx is a service provider under contract and does not use this data for its own purposes.
• HybridAF: Door-access and check-in for gyms that use it. We send HybridAF your name, email address, mobile number, account identifier and whether your membership currently allows entry, and we receive from it the time of each check-in. HybridAF receives no health or fitness data.
• Cloudflare, Inc.: Carries traffic between your device and our servers, so it handles your data, including health data, in transit; and stores uploaded photos and files (Cloudflare R2).
• Render, Inc.: Hosts our public website (allstrong.app) and the web version of the app. Render receives the request metadata needed to serve those pages (your IP address, the page requested, browser and device information); according to Render, it does not create request logs for static sites such as ours. The web app then loads your data directly from our application servers (Hetzner, above), and Render does not store your account or health data. Since April 28, 2026, the app's link to our upgrade and checkout pages has included your email address and account identifier in the page address, so Render received those two values with each such request. We removed them from the link on October 13, 2026; copies of the app installed before that date keep sending them until updated. No health logs, names, passwords or payment details were included.
• Resend (Resend, Inc.): For transactional email delivery (e.g., password reset emails, account notifications).
• Gym owners and staff: If you are a member of a gym that uses the AllStrong platform, gym staff with appropriate roles may access certain data about you through the gym dashboard. See Section 4.1 for details on what is and is not shared.
• Other members of your gym (leaderboards): only if you turn leaderboards on for that gym; they see your name and your best results, as described in Section 4.1. Off by default.
• Legal requirements: We may disclose information when required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect our rights or the safety of others.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as a business asset.

We do not share your health or fitness data with health insurers, employers, pharmaceutical companies, or advertisers. The only exception is an application you yourself choose to connect through our MCP Connector (Section 4.2): we do not screen Connected Apps by industry, so whether to connect any particular app is your decision.

4.1 Gym Data Sharing

If you are a member of a gym that uses the AllStrong platform, the following data sharing rules apply:

Data accessible to your gym's staff/coaches:

• Attendance records and check-in history
• Class bookings and cancellations
• Benchmark and workout results
• Coaching session history and notes
• Churn risk indicators (derived from attendance patterns)
• Staff notes associated with your membership
• In-app messages exchanged with gym staff
• The brand, last four digits and expiry date of a card you have saved for the gym (never the card number)

Leaderboards (off by default): if you turn on leaderboards for a gym, other members of that gym can see your name and your best result for each benchmark, class or challenge you log there. Turn it off at any time in that gym's privacy settings. Your email address is never shown.

Data NOT accessible to your gym:

• Personal health logs (nutrition tracking, calorie intake, meal data)
• Sleep tracking data
• Mood and wellness entries
• AI chat history (conversations with the AI health coach)
• Wearable device data (heart rate, steps, etc.)
• Data from other gyms if you are a member of multiple gyms

Data isolation: If you are a member of multiple gyms on the AllStrong platform, each gym can only access data related to your membership at that specific gym. Your data is isolated between gym organizations.

Revoking gym data access: You may revoke your gym's access to your data at any time by ending your membership or by contacting us at support@allstrong.app. Upon revocation, your gym will no longer be able to view your data through the dashboard, though records of past attendance and transactions may be retained for the gym's accounting and legal compliance purposes.

4.2 Third-Party AI Connector Data Sharing

AllStrong's MCP Connector lets you optionally connect a third-party AI application (a "Connected App") to your account. This section explains what is shared, why, with whom, and how to stop it.

You control what is shared. When you connect a Connected App, you choose which categories of data ("scopes") to share — for example, meals, sleep, workouts, or biometric measurements — and, separately, whether to allow that app to add or change data on your behalf. Nothing is shared until you affirmatively approve it on a screen that names the app, lists the categories, states the purpose, and tells you how to disconnect. That approval is a separate consent, specific to that connection, in addition to anything you agreed to when you created your account.

Why we share it. We disclose the data you select for one purpose only: so the Connected App can use it to respond to your requests and provide its own service to you. We receive no payment or other consideration from any Connected App, and the data is not used for advertising.

Who receives it. The specific Connected App you approve, which is an independent third party — not part of AllStrong, not our service provider, and not under contract with us. Once the app has received data, its own privacy policy and terms govern how it stores, uses, retains, and further discloses it. We do not review, endorse, or vouch for any Connected App's data-handling practices, security, or legal compliance, and we encourage you to read its privacy policy before connecting it.

What we log. Each time a Connected App reads or writes data through the MCP Connector, we record the app's identity, the data category involved, and the outcome (success, denied, or error). We do not log the content of the data itself in this audit trail. We use the log to enforce your scope choices, to tell you which apps have received your data if you ask, and to detect misuse.

Eligibility. The MCP Connector is available only to independent accounts held by users aged 18 or older. Teen accounts (13–17) and Child Profiles cannot be connected to any third-party AI application, and no teen-account or Child Profile data is ever accessible through the MCP Connector.

Revoking access. You can disconnect a Connected App at any time in the AllStrong app under Settings → Connected Apps → Disconnect, or by emailing support@allstrong.app from the address on your account. Disconnecting immediately stops all future data sharing with that app. It does not retroactively delete data the app already received — for that, contact the app directly. If you ask us to delete your health data (Section 11), we will also notify every Connected App with which we have shared it of your deletion request.

5. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) and regulations effective January 1, 2026. We honor these rights for every user, whether or not a law requires it.

• Right to Know: You may request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the third parties with whom we share it.
• Right to Delete: You may request that we delete the personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale/Sharing: We do not sell or share (for cross-context behavioral advertising) your personal information. If you connect a third-party AI application through our MCP Connector, we disclose the data categories you select to that application at your direction; we receive no payment or other consideration for that disclosure, and it is not used for advertising.
• Right to Limit Use of Sensitive Personal Information: Your health, fitness, and biometric data constitutes "sensitive personal information" under the CCPA. You may request that we limit our use and disclosure of your sensitive personal information to purposes necessary to provide the Service. We use sensitive personal information only to provide the features you request (health tracking, fitness analysis, AI coaching) and do not use it for purposes beyond what is necessary to provide the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights.

Responding to Requests: We will respond to verifiable consumer requests within 45 days of receipt. If we need additional time, we will notify you of the extension (up to an additional 45 days).

Authorized Agents: You may designate an authorized agent to make requests on your behalf, subject to verification.

To exercise your rights, contact us at support@allstrong.app.

5.1 Automated Decision-Making Technology (ADMT)

Our Service uses AI-powered features (such as the chat-based health coach and gym churn prediction system) that process your personal information to provide personalized health and fitness recommendations and retention analytics. These AI features assist you in tracking and understanding your health data and help gym owners understand engagement trends. They do not make legally significant or similarly consequential decisions about you (such as decisions affecting your access to healthcare, insurance, employment, or financial services). Churn risk scores are advisory only and do not automatically trigger membership changes. As required by CCPA regulations, if our use of automated decision-making changes in the future, we will update this policy and provide appropriate notice and opt-out mechanisms.

6. Data Retention

We retain your personal information for as long as your account is active or as needed to provide the Service. We delete or anonymize your personal information within 45 days of a verified deletion request, except where retention is required by law.

After your account is deleted we may keep statistics that no longer identify you, and we commit not to try to re-identify anyone from them.

Records of the privacy choices you make in the app (for example, whether you turned a gym leaderboard on or off), reduced to the choice, its date and the version of the text you saw, are kept for six years after the choice ends or your account is deleted, so that we can show what you agreed to. They contain no health data.

For gym memberships billed through Stripe Connect, we keep the membership billing record, payment history and the record of your agreement to the membership's automatic-renewal terms (including the confirmation email we sent you) for up to 7 years after the membership ends, for tax, accounting and legal-compliance purposes. These records are kept even if you delete your account or your gym removes you, and contain no health data.

7. Data Security

We implement commercially reasonable technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction. These measures include encrypted data transmission (TLS), AES-256-GCM encryption for sensitive stored data (including gym API keys), access controls, role-based dashboard permissions, security headers, prompt injection defense, and regular security reviews.

Payment data is processed and stored by Stripe in PCI DSS-compliant environments. We do not store payment card numbers or bank account details on our servers. For a saved card we keep only the brand, last four digits and expiry date, which cannot on their own be used to make a charge.

No method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

7.1 Breach Notification

In the event of a breach of unsecured health information, we will notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery, as required by the FTC Health Breach Notification Rule. For breaches affecting 500 or more individuals, we will also notify the Federal Trade Commission within the same timeframe. Breach notifications will include the types of information involved, a description of the breach, and steps you can take to protect yourself.

8. Cookies and Tracking

We use cookies and similar tracking technologies to:

• Keep you logged in to the Service.
• Remember your preferences.
• Analyze usage patterns to improve the Service.

You can control cookies through your browser settings. Disabling cookies may affect the functionality of the Service.

We do not use third-party advertising cookies or tracking pixels for advertising purposes.

On our public website and public gym web pages, Google Analytics sets cookies to measure aggregate usage (see §4).

9. Third-Party Services and Links

The Service integrates with the following categories of third-party services:

• Authentication: Google (via Firebase) for account sign-in
• AI Processing: Anthropic for chat and health analysis features
• Payment (consumer and gym platform subscriptions): Stripe — hosted checkout and subscription management
• Payment (gym member billing): Stripe via Stripe Connect — each gym maintains its own Stripe connected account for processing member payments
• Hosting: Hetzner for application servers, Neon for the database, Cloudflare for network delivery and file storage
• Email: Resend for transactional email
• Error Monitoring: Sentry for application error tracking
• Storage: Cloudflare R2 for file uploads
• Nutrition Data: USDA FoodData Central and Open Food Facts (public databases)
• Wearable Integration: Apple HealthKit (iOS) and Health Connect (Android) — on-device only; data is read locally and transmitted to our servers only with your permission
• AI Connector Apps (optional, user-initiated): Any third-party AI application you choose to connect through our MCP Connector receives only the data categories you approve, for the purpose stated in Section 4.2.

We are not responsible for the privacy practices of third parties. We encourage you to review the privacy policies of any third-party services you use.

10. International Data Transfers

Your information may be transferred to and processed in the United States. If you are located outside the United States, your use of the Service constitutes consent to transfer your information to the United States.

11. Your Rights and Choices

You may:

• Access and update your account information through your account settings.
• Delete your account in the app under Profile → Delete Account, or by contacting us at support@allstrong.app. We will delete your data within 45 days of a verified request.
• Opt out of marketing emails by clicking the unsubscribe link in any marketing email, or by clearing the "marketing emails" checkbox at signup.
• Request a copy of your personal data under Profile → Export Data in the web version of the app, or by contacting us.
• Revoke gym data access by ending your gym membership or contacting us.
• Manage or revoke third-party AI connections at any time under Settings → Connected Apps in the app.
• Withdraw consent for health data collection at any time. Withdrawing consent may limit the features available to you.

11.1 Marketing Consent — Unbundled, Independently Revocable

When you sign up, you are required to accept our Terms of Service and this Privacy Policy (one checkbox). You are separately shown a second, pre-checked checkbox asking whether you want to receive product updates, tips, and occasional offers ("marketing emails"). These two consents are unbundled: declining marketing emails does not prevent you from using the Service or starting a free trial. You may uncheck the marketing box at signup, or unsubscribe at any later time using the link in every marketing email, without affecting your account.

Transactional and account-relationship emails (welcome, billing, password reset, security alerts, onboarding nudges during your active trial) are not subject to the marketing opt-in and will be sent as long as you have an active account. This is permitted under CAN-SPAM, GDPR Article 6(1)(b) (contract-necessary communications), and CASL's implied-consent provisions for existing business relationships.

For every marketing consent grant or withdrawal, we record the timestamp, IP address, and browser user-agent as an audit trail. This lets us honor and defend your choice.

12. State Health Data Privacy Laws

12.1 Washington My Health My Data Act

If you are a Washington resident, or your consumer health data is collected in Washington, you have rights under the Washington My Health My Data Act (RCW 19.373) in addition to those described elsewhere in this Policy.

What we collect and why. We collect consumer health data — including fitness metrics, nutrition and meal data, sleep data, body measurements and other biometric measurements, and health check-ins — only to the extent necessary to provide the health-tracking, analysis, and coaching features you use, and only when you choose to enter that data or connect a source of it (such as a wearable). The categories, sources, and purposes are described in Sections 2 and 3.

Sharing. We share consumer health data with: (1) the service providers that process it on our behalf, as listed in Section 4; (2) if you are a member of a gym on our platform, that gym's staff, who see the benchmark, workout and attendance records listed in Section 4.1, because that is part of the membership you asked for; (3) if you turn on leaderboards for a gym, the other members of that gym, who see your name and your best result for each benchmark, class or challenge you log there — leaderboards are off by default, turning one on is a consent separate from anything you agreed to when you created your account or joined the gym, and you can turn it off at any time in that gym's privacy settings; and (4) if you choose to use our MCP Connector, a third-party AI application you select. Sharing with a Connected App happens only after you give a separate, specific consent for that connection, on a screen that tells you which data categories will be shared, why, with whom, and how to stop it. That consent is separate from, and in addition to, anything you agreed to when you created your account. We do not share your consumer health data with any other third party.

No sale. We do not sell, and do not offer to sell, consumer health data.

Your rights. You may (a) confirm whether we are collecting, sharing, or selling your consumer health data and access it, including a list of every third party and affiliate with whom we have shared it and an email address or other online way to contact each of them; (b) withdraw consent to our collection or sharing of your consumer health data at any time — for a Connected App, under Settings → Connected Apps; for a leaderboard, in that gym's privacy settings; for other health data, by deleting it in the app or contacting us; and (c) have your consumer health data deleted. When you ask us to delete, we delete it from our active systems within 30 days and from archived backups on their normal cycle (no later than six months), and we notify every affiliate, processor, contractor, and third party with whom we have shared it — including any Connected App — of your request.

How to exercise these rights. Email support@allstrong.app from the address on your account, or use the in-app tools. We respond within 45 days; if we need more time we will tell you why and take no more than 45 additional days. If we refuse a request, you may appeal by replying to our decision; we will answer your appeal in writing within 45 days, and if we deny it we will tell you how to submit a complaint to the Washington Attorney General. We will not discriminate against you for exercising any of these rights.

12.2 Connecticut

If you are a Connecticut resident, you have rights under the Connecticut Data Privacy Act, as amended effective July 1, 2026. That law applies to us because the health and fitness data you give us is "sensitive data" and "consumer health data" under it.

Consent. We process your health data only with your consent, which we ask for as described in Sections 11.1 and 12.1, and we limit that processing to what is reasonably necessary to provide the features you use. You may revoke that consent at any time in the same places you gave it (Settings, or Settings → Connected Apps for a Connected App) or by emailing support@allstrong.app; we stop the processing you revoked within 15 days.

Your rights. You may confirm whether we are processing your personal data and access it; correct inaccurate data; delete it; and obtain a copy of it in a portable and readily usable format. We do not sell your personal data, do not use it for targeted advertising, and do not use profiling to make any decision that produces a legal or similarly significant effect about you, so there is nothing to opt out of; if that ever changes we will add the opt-out here first. The only profiling we do is a churn score that estimates how likely a gym member is to let a membership lapse; gym staff see it as a hint, it produces no decision about you, and you may ask us what it says about you and the data it used.

Large language models. We do not collect, use or sell your personal data for the purpose of training large language models, and our AI provider (Section 4) may not use it to train its models.

How to exercise these rights. Email support@allstrong.app from the address on your account, or use the in-app tools. We respond within 45 days; if we need more time we will tell you why and take no more than 45 additional days. If we refuse a request you may appeal by replying to our decision; we will answer in writing within 45 days, and if we deny the appeal we will tell you how to submit a complaint to the Connecticut Attorney General. We will not discriminate against you for exercising any of these rights.

We monitor emerging state health data privacy laws (including those in Nevada and other states) and will update this policy as needed to comply with applicable requirements. If you have questions about your rights under your state's laws, contact us at privacy@allstrong.app.

13. Children's Privacy

AllStrong is a general-audience health and fitness service. We do not permit independent accounts for children under 13, but parents and legal guardians may track a child's health data through a Child Profile linked to their own adult account. Sections 13.1–13.7 below describe exactly how we handle that data and explain your rights as a parent under the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506; 16 C.F.R. Part 312), the California Consumer Privacy Act (CCPA) teen provisions, and related state privacy laws.

13.1 Children Under 13 — Child Profiles with Verifiable Parental Consent

Independent accounts blocked. Our signup flow requires a date of birth, and any user whose date of birth indicates they are under 13 is refused an independent account. If we learn that an independent account was created by or for a child under 13 without verifiable parental consent, we will delete that account and all associated personal information promptly.

Parent-managed Child Profiles. A parent or legal guardian with their own AllStrong account may create a Child Profile for a child under 13 through the "My Family" section of the mobile app. Before the Child Profile can be used to log any health data, we must obtain Verifiable Parental Consent (VPC) using an FTC-approved method.

VPC method — credit-card authorization. Per 16 C.F.R. § 312.5(b)(2), we verify parental identity by authorizing a one-time $0.50 charge on a credit or debit card in the parent's name, via Stripe (our payment processor). The charge is immediately refunded in full — we never retain the money. The bank notification of the charge reaching the account holder is the "verification" step COPPA contemplates. We store the Stripe PaymentIntent ID as proof that the authorization occurred and that we verified it. See §13.3 for how long consent records are kept and §13.7 for our children's data retention policy.

What we collect for a Child Profile:

• First name (and optional nickname)
• Date of birth (required to confirm under-13 status and compute age-appropriate guidance)
• Optional: biological sex, height, weight, activity level
• Health data the parent logs on behalf of the child: meals (with nutrition), workouts (type + duration), sleep (quality + notes), water intake, height/weight/resting-heart-rate measurements

What we do NOT collect from Child Profiles:

• Location data, device identifiers, or advertising IDs
• Social features, friend lists, public profiles, or direct messaging
• Usage for behavioral advertising, profiling, or cross-site tracking
• Any data not directly logged by the parent

13.2 Parental Rights Under COPPA

As the parent or legal guardian of a child whose data we collect, you have the following rights — all exercisable directly from within the AllStrong app or by contacting us at privacy@allstrong.app:

• Review all information we have collected for your child (view in-app or request export)
• Request deletion of your child's data at any time (in-app or by email)
• Refuse further collection by revoking parental consent — this permanently deletes all associated health logs within 30 days
• Refuse to consent to our sharing personal information — we do not sell, share for cross-context behavioral advertising, or disclose Child Profile data to any third party other than the limited service providers listed in §13.5 below
• Be notified before we collect a new category of personal information from your child (we will seek fresh consent)
• We will never condition your child's participation on collecting more information than is reasonably necessary to provide the Service

13.3 Revoking Consent and Deleting a Child Profile

You may revoke consent at any time by (a) tapping "Delete Child Profile" in the child's settings, (b) contacting privacy@allstrong.app, or (c) mailing the contact address in §15. Revocation has these effects:

• The Child Profile is immediately marked deleted and no new data can be logged for the child.
• Within 30 days of revocation, an automated data-purge job permanently deletes every health log we collected for the child (meals, workouts, sleep, biometrics, water) and scrubs personally-identifying fields on the Child Profile record itself.
• The consent record itself is kept after revocation, because if our compliance with children's privacy law is ever questioned we need to be able to show that a parent really did consent, for which child, and how we verified it. That record contains the internal account identifiers for the parent and the Child Profile, the verification method, the payment-authorization reference used to verify the parent, the categories of data consented to, when consent was granted, and when and why it was revoked. It contains no health logs. We delete it six years after consent is revoked, the Child Profile is deleted, or the profile is converted to an independent teen account, whichever is latest. The IP address and browser user-agent recorded at the moment of consent are deleted within 30 days of revocation, along with the child's health logs.

13.4 Teens Aged 13–17

Users aged 13–17 may create independent AllStrong accounts. At signup, teens affirm that a parent or guardian has approved the creation of the account (industry-standard self-attestation; COPPA itself does not apply at age 13 or older).

For teen accounts:

• Teen accounts cannot connect third-party AI applications through the MCP Connector (Section 4.2). This is enforced at the account level.
• We apply the highest default privacy settings available on the Service. Features that would expose teen data beyond our service providers are opt-in.
• We do not sell or share personal data of users we know to be under 16 without opt-in consent, consistent with CCPA/CPRA § 1798.120(c) for California residents and with equivalent state laws elsewhere.
• Teens may connect Apple HealthKit or Google Health Connect under the OS-level permissions already granted to them on their device; we do not impose an additional parental-approval layer for these OS integrations.
• Substance logging (alcohol, nicotine), medication tracking, and other adult-only features are not available on teen accounts.

13.5 Third Parties Involved With Child Data

Child Profile data is stored on the same infrastructure described in §4 (Hetzner, Neon, Cloudflare), with the same contractual protections. We do not share Child Profile data with advertising networks, analytics providers, data brokers, or any third party whose purpose includes profiling or marketing. The only third parties who ever process Child Profile data are:

• Stripe — processes the one-time $0.50 VPC authorization + refund (for parents of under-13 children). Stripe receives the parent's card number and the $0.50 transaction. No child data is ever sent to Stripe.
• Anthropic — if the parent uses the AI assistant to log meals/workouts on behalf of the child, the assistant processes the natural-language input under the data-minimization rules in §4. No child data is used to train Anthropic's models (per their API Terms).
• Hetzner (application hosting), Neon (database), Cloudflare (network delivery and object storage) — infrastructure providers contractually bound to process data only as directed by us.
• No third-party AI connections. Child Profiles cannot be connected to the MCP Connector or to any third-party AI application. The connection is rejected at the account level, not only by policy, and no Child Profile data is accessible through the MCP Connector.

No other third-party data sharing, advertising, or cross-context behavioral advertising involving Child Profile data is permitted under any circumstances.

13.6 Age Transitions

When a child in a Child Profile reaches age 13, we notify the parent and offer the option to (a) keep the Child Profile as-is under parent oversight, or (b) convert it to an independent teen account. A converted teen account starts fresh: the Child Profile's health logs are not carried over. For 30 days after conversion the parent can still view and export those logs; at the end of that window we delete them, together with the child's name, date of birth and the other Child Profile details, as set out in §13.7. The parental consent record is kept as described in §13.3.

When a teen account holder reaches age 18, any parental visibility or data-sharing grants created during the teen years are automatically revoked. The user (now an adult) may re-grant visibility voluntarily.

13.7 Children's Data Retention Policy

This section is our written data retention policy for personal information collected from children under 13, published here as part of our online privacy notice.

What we collect from a child, and why. Through a parent-managed Child Profile we collect the health and activity information the parent chooses to log — meals, workouts, sleep, water, and biometric measurements — together with the child's first name, date of birth, and an internal profile identifier. We collect it for one purpose: to provide the family-tracking features the parent signed up for. We do not use children's information for advertising, we do not sell it, and we do not use it to train AI models.

Why we need to keep it while the profile is active. A health and fitness log is only useful as a history. We retain the child's logged data for as long as the parent keeps the Child Profile active, so the parent can see trends over time.

When we delete it.

After the 30-day purge, all that remains of a deleted Child Profile is an internal identifier with no name, no birth date and no health information attached to it. We keep that identifier only for as long as we keep the parental consent record it is linked to, so that the consent record still shows which profile the parent consented for. We do not retain children's personal information indefinitely.

A parent may ask us to delete their child's information at any time (§13.2), and Washington residents have additional deletion rights described in §12.1.

After deletion we may keep statistics that no longer identify you or your child, and we commit not to try to re-identify anyone from them.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notification at least 30 days before the changes take effect. Your continued use of the Service after the effective date constitutes acceptance of the revised Policy.

Version history (most recent first):

• v1.16 (2026-10-13) — §4 and §12.1: name your gym's staff and, if you turn leaderboards on, the other members of that gym as recipients of your benchmark and workout results; §12.1 says where to turn a leaderboard off. §4: Render hosts our website and the web version of the app (the previous version said Render only received requests from older versions of the app), does not create request logs for them according to Render, and since April 28, 2026 has received your email address and account identifier in the address of our upgrade and checkout pages when opened from the app; we removed them from the link on October 13, 2026, and copies installed before then still send them until updated.
• v1.15 (2026-10-13) — §4: names Vercel, Telnyx and HybridAF and what each receives, and says Anthropic does not train its models on chat data. §4.1: leaderboards are off by default and show other members only your name and best results, never your email; the wearable line no longer mentions a coaching-feature exception (none exists). §5: we honor these rights for every user, whether or not a law requires it. §6: privacy-choice records are kept six years. §6 and §11: we delete your data within 45 days of a verified request (was 90 days); Washington health data keeps the 30-day active-system deletion in §12.1. §11: in-app Delete Account, and Export Data in the web version. §12.2: Connecticut rights, including that we do not use your personal data to train large language models.
• v1.14 (2026-10-12) — §6: for gym memberships billed through Stripe Connect, names what we keep (billing record, payment history, the record of your agreement to the automatic-renewal terms and the confirmation email), that it is kept for up to 7 years after the membership ends even if you delete your account or your gym removes you, and that it contains no health data. Effective on posting.
• v1.13 (2026-10-07) — §4, §9, §13: application hosting moves from Render to Hetzner (US); names Neon (database) and Cloudflare (network delivery) as recipients; Render may still receive requests from older app versions until October 9, 2026. Effective on posting.
• v1.12 (2026-10-06) — §2.1, §4, §7, §9: consumer subscriptions, offered when checkout is open, are paid through Stripe (hosted checkout and subscription management) and Whop is no longer used; Gym Platform subscriptions have been billed through Stripe since April 2026. Corrects the description of who receives payment data. §6 and §13.7: statistics that no longer identify you or your child may be kept after deletion. §15: identifies the operator and adds a telephone number. Effective on posting.
• v1.11 (2026-10-02) — §2.1, §4, §4.1 and §7: when a gym member saves a card through Stripe, we keep Stripe's identifiers and the card brand, last four digits and expiry date, shown to the member and the gym as the card on file; card numbers and bank account details are still never stored. Discloses a feature that had stored no card details at the time of posting; effective on posting.
• v1.10 (2026-10-01) — §4 Google Analytics bullet: adds that we have shortened the retention period on our Google Analytics data and asked Google to delete the email addresses and account identifiers it received between June 25 and October 1, 2026. Effective on posting.
• v1.9 (2026-10-01) — §4 Google Analytics bullet: adds that between June 25 and October 1, 2026, Google Analytics received the email address and account identifier of users who reached our upgrade, checkout or sign-up confirmation pages, because those values were in the page address; corrected October 1. Effective on posting.
• v1.8 (2026-10-01) — §13.6 corrected: a Child Profile converted to a teen account starts fresh, and its logs and details are deleted 30 days after conversion (previously described as migrated, which the Service never did; no Child Profile had been converted). §13.7 gains a row for that deletion. §4 and §8 now disclose Google Analytics on our public website and gym web pages, including that it ran on the gym dashboard until October 1, 2026. Effective on posting.
• v1.7 (2026-10-01) — §13 corrected. Removed the statement that parental consent records are retained indefinitely and that such retention is required by the FTC; neither was accurate. Consent records now have a defined six-year retention period and the retained fields are described in full (§13.3). Added §13.7, our written children's data retention policy. This version narrows what we keep and changes nothing about what we collect or share; it is effective on posting.
• v1.6 (2026-09-03) — §4.2 "Revoking access" and §12.1(c) now state, without qualification, that we notify every Connected App we've shared data with when you request deletion. This is accurate because Connected Apps are now required to provide a contact address to register at all (enforced at registration, not just described here) — closing the gap an earlier draft would have disclosed rather than fixed.
• v1.5 (2026-09-03) — Adds §4.2 (Third-Party AI Connector Data Sharing) and corresponding references in §4, §5, §9, §11, §13.4, and §13.5; rewrites §12.1 (Washington My Health My Data Act) to describe consumer-health-data sharing, the right to a list of recipients, and the request and appeal process. This version discloses an optional, opt-in feature that shares data only with your separate consent; it changes nothing about how existing data is handled, and is effective on posting.
• v1.4 (2026-04-18) — §13 Children's Privacy rewritten to reflect the Child Profiles feature. Adds detailed COPPA procedures, Verifiable Parental Consent via Stripe $0.50 authorization, parental rights and data-deletion pipeline, teen-account defaults, third-party disclosure limitations, and age-transition mechanics. No other sections materially changed.
• v1.3 (2026-04-18) — Added §11.1 (unbundled marketing consent + audit trail).
• v1.2 (2026-04-11) — Added Stripe as a platform billing vendor + gym data sharing + WA MHMD disclosure.

15. Contact Us

For privacy-related questions or to exercise your rights:

AllStrong
AllStrong and the Strongly brand are operated by Daniel Swick, doing business as AllStrong.
Mailing address: 3660 Briarcliff Road, Nashport, OH 43830
Telephone: 740-403-9774
Email: support@allstrong.app
Privacy-specific requests: privacy@allstrong.app
Website: https://allstrong.app