Privacy Policy

Last updated: October 21, 2026

This policy explains what Enchanted Rose Enterprises LLC, doing business as Enchanted Fitness ("we"), collects, why, how we use it, who we share it with, and the rights you have over your own data. It applies to the Service at enchantedfitnessapp.com, staging and preview builds we operate for testing, and any future domain we publish it at.

The Service is in private beta. Features, providers, and data flows may change while we test, but we will keep this policy current when those changes affect your personal data.

1. Age requirement

The Service is for adults only. We do not knowingly collect information from anyone under 18. If you believe a minor has created an account, email coaching@enchantedfitnessapp.com and we will remove the account and associated data.

2. Data we collect

We collect only what is needed to operate your account and the Service:

Account data: email, display name, hashed password, account creation date, last-login time, optional avatar photo.
Profile data: body stats and goals you enter during onboarding, equipment you own, nutrition preferences (dietary style, allergies, cooking ability, budget), workout preferences, health conditions, injuries, and optional body composition fields.
Activity data: workout logs, meal logs, journal entries, progress measurements, uploaded photos, messages you send us, and activity counts derived from the above.
Billing data: on the website, payment method details are processed and stored by Stripe. We store a Stripe customer identifier, subscription identifier, and subscription status, but never your full card number. For purchases made in the iPhone, iPad, or Android app, Apple or Google processes the payment and holds your payment details. We store the transaction record the store sends us: identifiers for the purchase and the subscription, the product, the price and currency, the store's country or region, the dates, and the status. We never receive your card number, and we do not receive your Apple or Google account email address through the store.
Device and session data: IP address, browser user agent, session cookies set by our auth provider, and basic error reports. These are used to keep you logged in, investigate bugs, and rate-limit abuse.
Analytics: page views and anonymized performance metrics via Vercel Web Analytics and Speed Insights. These do not set a tracking cookie or associate page views with your identity beyond the current session.

3. How we use your data

To provide the Service: render your dashboard, generate workouts and meal plans, score your compliance, route messages, and show progress over time.
To personalize your plans, including AI-generated plans.
To process subscription payments and issue invoices.
To send transactional email (welcome, payment issues, password resets).
To detect, prevent, and investigate fraud, abuse, or security issues.
To debug errors, test beta flows, and improve reliability.
To comply with legal obligations.

We do not sell your personal data, and we do not use your data for third-party advertising.

4. Third-party services (sub-processors)

We use the following providers to operate the Service. Each has its own privacy policy and you are subject to it when we pass your data through:

Supabase - authentication, database, file storage (avatars, exercise media).
Vercel - hosting, edge network, analytics, speed insights.
Stripe - payment processing for purchases on the website, subscription management, invoice delivery, the self-serve billing portal.
Apple - payment processing and subscription management for purchases made in the iPhone and iPad app through the App Store.
Google - payment processing and subscription management for purchases made in the Android app through Google Play.
Resend - transactional email delivery.
Anthropic (and/or other providers routed through Vercel AI Gateway) - AI models used to generate workouts and meal plans. To build your workouts and meal plans, the health and body information you give us (including your goals, body measurements, health conditions, injuries, and pregnancy status) is sent to the model provider.

We add or change sub-processors as the Service evolves; we update this list when we do.

5. Cookies and similar technologies

We use cookies only for authentication (to keep you logged in), for basic preferences (for example, whether you have dismissed the age-gate modal), and for the anonymous analytics pings above. We do not use third-party advertising trackers.

6. How long we keep your data

While your account is active, we keep your data for as long as it is needed to provide the Service. When you confirm deletion of your account, your access to the Service ends immediately and any subscription you bought on the website is canceled. A subscription you bought through the App Store or Google Play is not canceled by deleting your account: we are not able to cancel it for you, so you must cancel it in that store's subscription settings. Your data is not destroyed at the moment you confirm. Instead, a 30-day waiting period begins.

During that 30-day window you may change your mind. To undo the deletion request, email coaching@enchantedfitnessapp.com before the window ends and we will cancel the deletion.

After the 30 days pass, everything personal is permanently erased: your profile, your workout history, your nutrition history, your messages, your check-ins, your progress photos, your uploaded files, and your login itself. The erasure runs on a nightly schedule, so it usually completes within a few days after the window ends. Erased data cannot be recovered.

Two categories of data are kept. Payment records are retained because tax and financial regulations require it (typically seven years in the U.S.); those records are held by Stripe, Apple, or Google, whichever processed the payment, and our internal purchase records are stripped of any connection to you. We also keep anonymous, aggregate service counters that cannot identify anyone.

You do not need to sign in to request deletion. You may start a deletion request at /account-deletion: enter your email address there and we will send you a one-time link to confirm the request.

7. Your rights

Depending on where you live, you may have the following rights:

Access - request a copy of the personal data we hold about you.
Correction - ask us to fix inaccurate data.
Deletion - ask us to delete your account and your data (see section 6; access ends immediately, and your personal data is permanently erased after a 30-day waiting period during which you may undo the request).
Objection / restriction - object to or restrict certain kinds of processing.
Portability - receive an export of your data in a machine-readable format. Click Download my data on your Settings page to get an instant JSON file with everything we hold.
Withdraw consent - where processing is based on your consent, you can withdraw it at any time.

To exercise any of these rights, email coaching@enchantedfitnessapp.com. We may ask you to verify your identity before acting on a request.

8. Security

We use industry-standard practices to protect your data: TLS for data in transit, encrypted database storage via Supabase, hashed and salted passwords, service-role keys held only in server environments, and strict row-level security on tables that contain personal data. No system is perfectly secure; we cannot guarantee that a determined attacker will never succeed. Notify us immediately if you believe your account has been compromised.

9. International transfers

We are based in the United States and store data in U.S. regions of our providers. If you are in the EEA, UK, or elsewhere, your data is transferred to the U.S. when you use the Service. We rely on the legitimate-interests and contract-performance bases under the GDPR for these transfers.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be noted by updating the "Last updated" date at the top. If a change meaningfully expands what we collect or how we use it, we will notify you by email or in-app banner before it takes effect.

11. Contact

Privacy questions, requests, or complaints:
coaching@enchantedfitnessapp.com
By post: Enchanted Fitness, PO Box 205, Morristown, NY 13664, United States. Enchanted Fitness is operated by Enchanted Rose Enterprises LLC.