LOADOUT Privacy Policy

Last updated: June 14, 2026 Effective date: June 14, 2026

LOADOUT (“we,” “our,” “us”) respects your privacy. This Privacy Policy explains what information we collect when you use the LOADOUT mobile and web application (the “Service”), how we use it, who we share it with, and the choices you have.

By using LOADOUT, you agree to the practices described here. If you do not agree, do not use the Service.

1. Information We Collect

1.1 Account information

When you sign in with Google, we receive:

• Your name
• Your email address
• Your Google account profile picture (if available)
• A unique Google ID identifier

We never see or store your Google password.

1.2 Fitness information you provide

You voluntarily provide the following data so the Service can function:

• Workout history: exercises performed, sets, reps, weights, dates, durations
• Body metrics (optional): body weight, units preference (imperial/metric)
• Gym profiles: gym name, type (commercial/home/custom), available equipment, plate inventories
• Goals and preferences: training goal, days per week, session length, difficulty level
• Injury or limitation notes you choose to enter
• Notes attached to specific exercises or sessions
• Blocked exercises and substitutions you’ve configured

1.3 Subscription and payment information

If you subscribe to a paid plan (Pro, Elite, or Founding Lifetime), payment is processed by Stripe, Inc. We do not see or store your full credit card number, expiration date, or CVC. From Stripe we receive only:

• Your Stripe customer ID
• Your subscription status (active, canceled, past due, etc.)
• The price ID you purchased
• Subscription start and renewal dates
• Refund and dispute events

1.4 Usage data

We automatically collect basic technical information to operate and improve the Service:

• Device type and operating system version
• App version
• Approximate region (derived from IP address — we don’t store precise location)
• Time-stamps of API requests
• Crash reports and error logs
• Counters for AI generations and other rate-limited features

We do not use tracking cookies, advertising IDs, or third-party advertising SDKs.

2. How We Use Your Information

We use the data described above to:

1. Provide the Service. Generate AI-powered workout plans, save your workout history, calculate progress and personal records, and surface exercise alternatives that match your equipment.
2. Authenticate you. Confirm it’s you each time you sign in, and keep your session secure.
3. Process payments. Charge your subscription, handle renewals, issue refunds, and manage your tier.
4. Send transactional and lifecycle emails. Subscription confirmations, payment receipts, trial reminders, win-back emails, and security notices. You can opt out of lifecycle emails at any time via the unsubscribe link in any email.
5. Improve the Service. Diagnose bugs, monitor performance, understand which features are used, and prioritize roadmap items.
6. Enforce our Terms. Detect abuse, fraud, or violations of our Terms of Service.
7. Comply with law. Respond to lawful requests, court orders, and regulatory obligations.

We do not sell your personal information to anyone, ever.

3. Who We Share Information With

We share data only with the third parties listed below, only when necessary, and only the data each service needs to function. Each of these vendors has its own privacy practices and security commitments.

We do not share your raw workout history with Anthropic or any other AI vendor. When generating AI plans, we send the smallest necessary context (equipment available, preferences, recent training volume summary), not your entire log.

We may also disclose information if compelled by law, subpoena, or other legal process, or to protect the rights, property, or safety of LOADOUT, our users, or others.

4. Data Retention

• Active accounts: We retain your data as long as your account is open.
• Deleted accounts: When you delete your account, we erase your fitness data, gym profiles, and personal identifiers within 30 days, except where retention is required by law (e.g. payment records for tax purposes, typically 7 years per US IRS rules).
• Backups: Encrypted database backups may persist for up to 90 days, after which deleted data is permanently purged.
• Anonymized data: We may retain aggregated, de-identified statistics (e.g. “X workouts were logged in May”) indefinitely. This data cannot be used to identify you.

To delete your account, email privacy@loadoutfitness.com with the subject “Delete my account.” We will confirm within 7 business days.

5. Your Privacy Rights

5.1 All users

You can:

• View your account information in the Profile tab
• Export your workout history (request export@loadoutfitness.com)
• Correct or update your information in the Profile tab
• Delete your account (privacy@loadoutfitness.com)
• Unsubscribe from non-essential emails via the link in any email footer

5.2 California residents (CCPA / CPRA)

Under the California Consumer Privacy Act, you have the right to:

• Know what personal information we collect, use, and share
• Access the specific pieces of personal information we hold about you
• Delete your personal information
• Correct inaccurate personal information
• Opt out of any “sale” or “sharing” of personal information — we don’t sell or share for cross-context behavioral advertising, so this opt-out is unnecessary in practice
• Non-discrimination for exercising any of these rights

To exercise these rights, email privacy@loadoutfitness.com.

5.3 European Economic Area, UK, and Switzerland (GDPR)

If you are in the EEA, UK, or Switzerland, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Delete your data (“right to be forgotten”)
• Restrict or object to certain processing
• Receive a copy of your data in a machine-readable format (“data portability”)
• Withdraw consent at any time
• Lodge a complaint with your local data protection authority

Our legal bases for processing are:

• Contract (Article 6(1)(b)) — to provide the Service you signed up for
• Legitimate interest (Article 6(1)(f)) — to operate, secure, and improve the Service
• Consent (Article 6(1)(a)) — for marketing communications, which you can withdraw any time

To exercise these rights, email privacy@loadoutfitness.com.

6. Children’s Privacy

LOADOUT is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately at privacy@loadoutfitness.com and we will delete it.

For users between 13 and 17, we recommend parental involvement when using LOADOUT, especially with any features involving payments or fitness goal-setting.

7. Security

We protect your data with:

• HTTPS encryption (TLS 1.2+) for all data in transit
• Encryption at rest for our MongoDB database
• Session-based authentication with secure, server-issued tokens
• Stripe handles all payment card data (PCI DSS Level 1 certified)
• Limited employee access to production data, on a need-to-know basis

No system is perfectly secure. While we take reasonable precautions, we cannot guarantee absolute security of your information.

8. International Data Transfers

LOADOUT is operated from the United States. By using the Service, you understand and agree that your information may be transferred to and processed in the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses for transfers from the EEA, UK, or Switzerland.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by an in-app notice before the changes take effect. The “Last updated” date at the top of this page will always reflect the most recent version.

10. Contact Us

For privacy questions, data requests, or any other inquiries:

Email: privacy@loadoutfitness.com Website: https://loadoutfitness.com Mailing address: [Add your business address when you have one]

We aim to respond to all privacy requests within 30 days.