← Back to home

Privacy Policy

Last updated: [DATE] — DRAFT, pending legal review

1. What we collect

When you create an account and use the Rebuilt program, we collect:

• Account info: name, email address, password (encrypted)
• Intake screening answers (health-related questions used to check you're safe to start the program)
• Daily pain logs and exercise progress (which level you're on, per movement)
• Payment information, processed and stored by Stripe — we do not store your card details ourselves

2. Why we collect it

We use this information to run the program itself: screening you before you start, showing you the right exercises at the right level, tracking your progress, and processing payment. We do not sell your data to third parties.

3. Where your data lives

Account and program data is stored with Supabase (our database provider). Payment data is handled by Stripe. Both are standard, widely used infrastructure providers with their own security practices.

4. Health-related data

Your intake answers and pain logs are health-related information. We treat this data with extra care: it is only used to run your program, is not shared with third parties for marketing, and is never sold. If you are located somewhere with specific health-data protections (for example, the EU), you may have additional rights over this data — contact us to exercise them.

5. Your rights

You can request a copy of your data, ask us to correct it, or request deletion of your account and associated data at any time by emailing us.

6. Cookies and analytics

[TODO: list any analytics tools you add later, e.g. Google Analytics, Vercel Analytics, and what they track.]

7. Changes to this policy

We may update this policy as the program grows. Material changes will be communicated by email or in-app notice.

8. Contact

Questions about this policy or your data: [YOUR REAL CONTACT EMAIL]