Privacy Policy
DRAFT — pending attorney review
1. Who we are
Brightway Operations LLC ("we," "us") operates the NoPlateau app and website (the "App"). This policy explains what we collect, why, who we share it with and your choices. Effective date: [effective date]. We do not sell your personal information. People in Washington, Nevada and other states with consumer health data laws should also read our Consumer Health Data Privacy Policy, which is a separate document.
2. What we collect
Account: your email address. Your password is handled by our sign-in provider and stored only in scrambled (hashed) form; we never see it. Training data you enter: exercises, sets, reps, weights, effort ratings, workout times and durations, notes, templates, programs, weekly plans, charts you choose and settings such as units and rest timers. Body measurements and body weight you choose to add. Journal entries and goals you write. Age confirmation: a yes/no that you are 18 or older (no birthdate). Legal records: which version of our documents you accepted, when, and your email while your account exists. Feedback you send. Technical information kept by our hosting provider for security and reliability, such as IP address, device type, app version and timestamps.
3. What we do not collect
Progress photos stay on your phone and are never uploaded to us. We do not collect your precise location, contacts, advertising identifiers, or data from Apple Health or Health Connect. We do not use third-party advertising or analytics trackers in the App, and no third party collects information about your activity across other apps or websites through the App. Reminders are scheduled on your phone.
4. Where it comes from
Directly from you when you use the App, and automatically from your device when it connects to our servers.
5. How we use it
To run the App: save and sync your data across devices, show your history, progress, records, plans, suggestions and reminders; to respond to feedback and support requests; to keep the App secure, prevent abuse and fix problems; to record your agreement to our terms; and to meet legal obligations. We do not use your information for targeted advertising or to build profiles for others, and we do not use automated decisions that have legal or similarly significant effects on you.
6. Who we share it with
Service providers that process data only on our instructions to run the App, under contracts that limit their use: Supabase (database, sign-in and hosting, on servers in the United States), Apple and Google (app distribution, and payments for purchases made in the iPhone or Android app), and, when used, an email delivery provider (for sign-in and password emails) and a payment processor (for plans bought on our website). A coach, only if you choose to share with them. We may disclose information if the law requires it, to protect anyone's safety or our legal rights, or as part of a merger, acquisition or sale of assets (this policy would continue to apply). We do not sell your personal information, share it for cross-context behavioral advertising, or share it with third parties for their own direct marketing.
7. Do Not Track
Because we do not track you across other apps or websites, we do not change anything in response to "Do Not Track" or similar browser signals; there is nothing to turn off.
8. How long we keep it
We keep your data until you delete your account. When you delete your account in the App, we delete your account, workouts, templates, programs, custom exercises, measurements, journal, settings and feedback, and progress photos are removed from that phone. We keep a minimal record that our legal documents were accepted (document, version and date) linked only to a one-way scrambled (hashed) version of your email, to show that our terms were agreed to. Copies may remain in routine encrypted backups for a limited time before being overwritten.
9. Your rights and choices
Everyone, wherever they live, can: see and export their data in the App (Profile → Export my data); correct it in the App; delete their account and data in the App (Profile → Delete account), or, without the App, by requesting it at https://noplateau.app/delete-account; withdraw consent to our processing of consumer health data by deleting their account; and ask us to confirm what we hold and who we have shared it with. To make any request, email privacy@noplateau.app. We respond within 45 days (we may extend once by 45 days and will tell you why). We may need to verify your identity first. You may use an authorized agent. If we deny a request, you can appeal by replying to our decision; we will answer the appeal within 45 days and, if we deny it, tell you how to contact your state attorney general. We never treat you differently for using these rights. Requests are free up to twice a year.
10. California
We are not currently a "business" that must comply with the California Consumer Privacy Act (we are below its size thresholds), but we give everyone the rights in Section 9. We do not sell or share personal information, and we do not use sensitive personal information to infer characteristics about you. Under California's "Shine the Light" law, we do not share personal information with third parties for their direct marketing.
11. Security and breaches
We use industry-standard protections, including encrypted connections, hashed passwords and database rules that let each account reach only its own data. No system is perfectly secure, so please use a strong, unique password. If a breach affects your information, we will notify you and the authorities as the law requires, including under the FTC Health Breach Notification Rule where it applies.
12. Age
The App is only for people 18 and older and is not directed to children. If we learn someone under 18 has an account, we will delete it.
13. Changes
If we make material changes, we will notify you in the App and ask you to review the new version before continuing. The effective date shows when it last changed.
14. Contact
Brightway Operations LLC, 3400 Cottage Way, Ste G2 #36993, Sacramento, CA 95825. Privacy requests: privacy@noplateau.app. Other questions: support@noplateau.app. Website: https://noplateau.app.