Your Body Project: Privacy Policy

1.1Your Body Project (YBP) is a strength training application. This policy describes how YBP handles the information you give it.

1.2The service is provided by the operator of Your Body Project ("YBP", "we", "us"). You can reach us at any time through the contact options in section 15.

2.1This policy covers the YBP application and website: the account you create, the training features you use, and any contact you have with us through the service. Our commitment is to collect only what the service needs, explain it in plain language, and handle it carefully.

3.1Account. Your email address. Sign-in is passwordless: we send a one-time magic link to your email, and you can optionally sign in with a Google, Microsoft, or Apple account instead if you choose to link one. We do not store passwords.

3.2Profile and health information. Date of birth, sex, height, body weight, training goal, experience level, available training days and session length, gym memberships, muscle priorities, and any chronic injuries, pain, soreness, or daily readiness you report. We treat this health-adjacent information (injuries, pain, and body metrics) as sensitive information.

3.3Training activity. The workouts, sets, reps, and loads you log, your session check-ins, and your progress over time.

3.4Coaching messages. Any messages you send to the in-app AI coach.

3.5Billing. If you subscribe to a paid plan, payments are processed by Stripe. YBP does not store your full card details.

3.6Technical. Basic technical data needed to operate the service, such as your sign-in session.

4.1With your permission, the app reads health metrics from your phone's health platform (Google Health Connect on Android, Apple Health on iOS) and, if you link one, your Garmin account: sleep, heart rate, heart rate variability, resting heart rate, steps, body weight, and where available stress and energy scores.

4.2Workout heart rate is stored only for the time windows of your logged training sessions; heart rate outside your sessions is discarded and never stored.

4.3These metrics personalise your training readiness and trends. They inform, never replace, the answers you give in your daily check-in, and they are never used for advertising, never sold, and never shared with third parties.

4.4Revoking access in your device's health settings stops new collection immediately. Deleting your account permanently deletes every stored health metric, and your data export includes all of them.

5.1We use your information to create and adapt your training programme, run your account and sign-in, provide support when you contact us, and keep the service working and secure.

5.2We collect and use your information with your consent, which you give when you create an account and accept the Terms of Use, and as needed to provide the service you have asked us for. You can withdraw consent at any time by deleting your account.

6.1We collect your information directly from you, at sign-up and as you use the app, and from the health platforms you explicitly connect (section 4). We do not buy your information from third parties.

7.1We do not sell your information. We share limited data with the providers that make the service work: Google, Microsoft, or Apple, if you choose to sign in with one of them; Stripe, if you subscribe, for payment processing; and our email delivery provider, to send your sign-in links.

7.2We may disclose information where the law requires us to. If the service is ever transferred to a new operator, your information would transfer with it and remain protected by this policy.

8.1We use Google, Microsoft, or Apple sign-in if you choose to link one of those accounts, Stripe for billing, an email delivery provider to send sign-in links, and the health platforms you connect (Google Health Connect, Apple Health, or Garmin). Each of these providers has its own privacy policy governing how it handles your information.

9.1Sign-in is passwordless, sensitive credentials are encrypted at rest, and traffic to the service is served over HTTPS.

9.2Your data is stored on Google Cloud infrastructure located in Australia. If we become aware of a data breach that is likely to cause you serious harm, we will notify you and the relevant regulator.

10.1We keep your information while your account is active. When you delete your account, it is permanently erased. See your rights below.

10.2Encrypted database backups are kept for disaster recovery and expire on a rolling schedule; information from a deleted account disappears from backups as those backups expire.

11.1You can download a copy of all of your data at any time from your Profile, using the Download my data feature. You can permanently delete your account and all associated data from your Profile, or from the public account deletion page at /account-deletion. You may also ask us to correct your information.

11.2You may ask us for access to the information we hold about you, ask us to correct it, or complain about how we have handled it, using the contact options in section 15. If you are not satisfied with our response, you can raise your complaint with your local privacy regulator.

12.1YBP is intended for adults. You must be at least 18 years old, or the age of majority where you live, to use the service.

13.1We use a sign-in session cookie needed to keep you signed in. We do not run third-party advertising or behavioural tracking.

14.1When we update this policy, we will update the version number and date shown at the top of this page. For material changes, we will notify you.

15.1You can contact us through the feedback option in the app or by replying to any email the service has sent you. We will respond to privacy questions and complaints promptly, and section 11 describes how to escalate if you are not satisfied.