Privacy Policy

Last updated: July 27, 2026

This policy explains what Enchanted Fitness ("we") collects, why, how we use it, who we share it with, and the rights you have over your own data. It applies to the Service at enchantedfitnessapp.com, staging and preview builds we operate for testing, and any future domain we publish it at.

The Service is in private beta. Features, providers, and data flows may change while we test, but we will keep this policy current when those changes affect your personal data.

1. Age requirement

The Service is for adults only. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, email coaching@enchantedfitnessapp.com and we will remove the account and associated data.

2. Data we collect

We collect only what's needed to operate your account and the Service:

Account data: email, display name, hashed password, account creation date, last-login time, optional avatar photo.
Profile data: body stats and goals you enter during onboarding, equipment you own, nutrition preferences (dietary style, allergies, cooking ability, budget), workout preferences, health conditions, injuries, and optional body composition fields.
Activity data: workout logs, meal logs, journal entries, progress measurements, uploaded photos, messages you send us or the AI coach, grades, streak counts, and rewards derived from the above.
Application data: answers you submit on the coaching application form, plus any admin notes about your review.
Billing data: payment method details are processed and stored by Stripe. We store a Stripe customer identifier, subscription identifier, and subscription status, but never your full card number.
Device and session data: IP address, browser user agent, session cookies set by our auth provider, and basic error reports. These are used to keep you logged in, investigate bugs, and rate-limit abuse.
Analytics: page views and anonymized performance metrics via Vercel Web Analytics and Speed Insights. These do not set a tracking cookie or associate page views with your identity beyond the current session.

3. How we use your data

To provide the Service: render your dashboard, generate workouts and meal plans, score your compliance, route messages, and show progress over time.
To personalize coaching output, including AI-generated plans and responses.
To process subscription payments and issue invoices.
To send transactional email (welcome, application status, payment issues, expiry nudges, password resets).
To detect, prevent, and investigate fraud, abuse, or security issues.
To debug errors, test beta flows, and improve reliability.
To comply with legal obligations.

We do not sell your personal data, and we do not use your data for third-party advertising.

4. Third-party services (sub-processors)

We use the following providers to operate the Service. Each has its own privacy policy and you are subject to it when we pass your data through:

Supabase - authentication, database, file storage (avatars, exercise media).
Vercel - hosting, edge network, analytics, speed insights.
Stripe - payment processing, subscription management, invoice delivery, the self-serve billing portal.
Resend - transactional email delivery.
Anthropic (and/or other providers routed through Vercel AI Gateway) - AI models used to generate workouts, meal plans, and coach messages. Message content you send the AI coach is forwarded to the model provider for inference.
Telegram - tester coordination and bot messages, only when you choose to use those channels.

We add or change sub-processors as the Service evolves; we update this list when we do.

5. Cookies and similar technologies

We use cookies only for authentication (to keep you logged in), for basic preferences (e.g. whether you've dismissed the age-gate modal), and for the anonymous analytics pings above. We do not use third-party advertising trackers.

6. How long we keep your data

While your account is active, we keep your data for as long as it is needed to provide the Service. When you confirm deletion of your account, your access to the Service ends immediately and any active subscription is canceled. Your data is not destroyed at that moment. Instead, a 30-day waiting period begins.

During that 30-day window you may change your mind. To undo the deletion request, email coaching@enchantedfitnessapp.com before the window ends and we will cancel the deletion.

After the 30 days pass, everything personal is permanently erased: your profile, your workout history, your nutrition history, your messages, your check-ins, your progress photos, your uploaded files, and your login itself. The erasure runs on a nightly schedule, so it usually completes within a few days after the window ends. Erased data cannot be recovered.

Two categories of data are kept. Payment records are retained because tax and financial regulations require it (typically seven years in the U.S.); those records are held by our payment processor, and our internal purchase records are stripped of any connection to you. We also keep anonymous, aggregate service counters that cannot identify anyone.

You do not need to sign in to request deletion. You may start a deletion request at /account-deletion: enter your email address there and we will send you a one-time link to confirm the request.

7. Your rights

Depending on where you live, you may have the following rights:

Access - request a copy of the personal data we hold about you.
Correction - ask us to fix inaccurate data.
Deletion - ask us to delete your account and your data (see section 6; access ends immediately, and your personal data is permanently erased after a 30-day waiting period during which you may undo the request).
Objection / restriction - object to or restrict certain kinds of processing.
Portability - receive an export of your data in a machine-readable format. Click Download my data on your Settings page to get an instant JSON file with everything we hold.
Withdraw consent - where processing is based on your consent, you can withdraw it at any time.

To exercise any of these rights, email coaching@enchantedfitnessapp.com. We may ask you to verify your identity before acting on a request.

8. Security

We use industry-standard practices to protect your data: TLS for data in transit, encrypted database storage via Supabase, hashed and salted passwords, service-role keys held only in server environments, and strict row-level security on tables that contain personal data. No system is perfectly secure; we cannot guarantee that a determined attacker will never succeed. Notify us immediately if you believe your account has been compromised.

9. International transfers

We are based in the United States and store data in U.S. regions of our providers. If you are in the EEA, UK, or elsewhere, your data is transferred to the U.S. when you use the Service. We rely on the legitimate-interests and contract-performance bases under the GDPR for these transfers.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be noted by updating the "Last updated" date at the top. If a change meaningfully expands what we collect or how we use it, we will notify you by email or in-app banner before it takes effect.

11. Contact

Privacy questions, requests, or complaints:
coaching@enchantedfitnessapp.com