Privacy policy

Fortified Fuel Fitness & Nutrition, operated by Jeff Beck, Daphne, Alabama

Version 0.2, September 2026. Under review.

The short version

• We collect what we need to coach you: your name, contact details, date of birth, body weight and measurements, workout and food logs, photos of your meals and your progress, your weekly check-in answers, and your conversations with the AI coach.
• Health-related information, body measurements, photos and free-text health answers are sensitive. We collect them only with your explicit consent, and you can withdraw that consent.
• Coach Jeff reads your check-ins, your messages and your AI coach conversations so he can coach you. Nobody else at Fortified Fuel does, because there is nobody else.
• Your AI coach conversations are sent to our AI model provider to generate replies. The provider does not use them to train its models.
• Progress photos are stored privately, seen only by you and Jeff, and are used only to look at visible change. We do not estimate body fat from them, we do not run facial recognition, and we do not extract biometric identifiers.
• We do not sell your personal data and we do not share it for targeted advertising.
• Payments run through Stripe. We never see your full card number.
• You can access, correct or delete your data from inside the app, and you can ask us for a copy of it.
• You must be 18 or older to use Fortified Fuel.
• Questions: message Jeff in the app, or use the contact details on fortifiedfuel.fitness.

1. Who we are and what this policy covers

1.1 Fortified Fuel Fitness & Nutrition ("Fortified Fuel", "we", "us") is a subscription coaching business operated by Jeff Beck in Daphne, Alabama.

1.2 This policy explains what personal data we collect when you use the Fortified Fuel website at fortifiedfuel.fitness, the installable Fortified Fuel app (the "App"), and the coaching services we deliver through them (together, the "Service"). It also explains how we use that data, who we share it with, how long we keep it, and what rights you have.

1.3 This policy applies to members (people with an account), to people who sign up for our email list, and to visitors to our website. Where a section applies only to one of these groups, it says so.

1.4 This policy does not cover third-party websites or services we link to. Those have their own privacy policies.

1.5 If you are a vendor applying through our vendor intake process, the information you provide is covered by section 5.9 below.

2. Defined terms

2.1 "Personal data" means information that identifies you or could reasonably be linked to you. It includes the categories listed in section 3.

2.2 "Sensitive data" means health-related information, body weight and measurements, meal and progress photographs, free-text answers about your health, injuries, medications, sleep, stress or lifestyle, and any other information about your physical or mental health. Some state laws also treat precise location, financial account information and data about children as sensitive; we handle those as described in this policy. It also includes an audio recording you make when you answer a check-in by voice.

2.3 "Coach Jeff" or "Jeff" means Jeff Beck, the person who operates Fortified Fuel and delivers human coaching.

2.4 "AI coach" means the automated coaching assistant inside the App, which generates responses using an AI model provided by our AI model provider and is configured with Jeff's coaching methods.

2.5 "Sub-processor" or "service provider" means a third-party company that processes personal data on our behalf to help us run the Service. Section 6 lists them.

3. What we collect, where it comes from, why, and on what basis

3.1 The table below lists what we collect. "Sensitive" marks data we collect only with your explicit consent (see section 3.3). The "legal basis" column follows the structure used by European data protection law because the App is available outside the United States. If you are in the United States, you can read that column as "why we are allowed to".

3.2 What we do not collect. We do not collect full payment card numbers (Stripe handles those). We do not collect precise GPS location. We do not collect biometric identifiers (see section 4B). We do not ask for government ID numbers.

3.3 Sensitive data and explicit consent. Coaching does not work without information about your body and your health. Before you first enter sensitive data, the App asks you to confirm that you agree to Fortified Fuel collecting and using it as described in this policy. That consent is recorded in your account. You can withdraw it at any time (section 13). If you withdraw it, we stop collecting new sensitive data and delete what we hold, unless we have a legal reason to keep some of it (section 9). Withdrawing consent will limit or end the coaching we can provide, because we cannot adjust a program without the data.

3.4 Information about other people. If you mention another person in a check-in, a message, or the community feed (for example a family member or your doctor), please only share what is needed. We treat that information under this policy.

4A. The AI coach

4A.1 What it is. The AI coach is an automated assistant. Its replies are generated by an AI model from our AI model provider (currently Anthropic), configured with Jeff's coaching methods and with the information in your account. It is not a person and it is not a medical professional. Coaching is not medical advice. The AI coach does not diagnose, prescribe, or make medical claims.

4A.2 What is stored. Every message you send to the AI coach and every reply it gives is stored in your account in our database (hosted by Supabase). We keep them so that you can look back at them, so that Jeff can review them, and so that the AI coach can keep context across conversations.

4A.3 Who reads them. Jeff can read your AI coach conversations. He does this to check the quality of the AI coach's replies, to understand where you are, and to follow up when something needs a human. Nobody else at Fortified Fuel reads them.

4A.4 Where they are sent. To generate a reply, your message, relevant earlier messages in the conversation, and relevant parts of your profile (for example your current program, recent check-in answers and goals) are sent to our AI model provider's servers. The provider processes that content to produce the reply and returns it to us.

4A.5 Not used to train the provider's models. We use our AI model provider under its commercial (API) terms. Under those terms the provider does not use your conversations to train its models. The provider may keep content for a short period for abuse and safety monitoring, after which it is deleted under the provider's retention terms.

4A.6 AI-drafted replies from Jeff. When you message Jeff directly, the AI may draft a reply for him. Jeff reads and approves every draft before it is sent to you. Drafts Jeff does not approve are not sent. The content of your message is processed by the AI model provider in the same way as section 4A.4.

4A.7 Voice notes. If you turn on voice notes, short text messages may be converted into audio in a voice modelled on Jeff's, using ElevenLabs. The text of the message is sent to ElevenLabs to generate the audio. This section covers the voice we send to you. For a check-in you record yourself, see section 4A.11. Voice notes are labelled as AI-generated.

4A.8 Crisis hold. If something you say to the AI coach suggests you may be in crisis or need professional help, the AI coach stops coaching, shows you crisis resources, and the conversation is flagged to Jeff so he can follow up with you personally. This is a safety feature. It means Jeff will see that conversation.

4A.9 What the AI coach does not do. It does not make decisions about your account, your billing or your access to the Service. Decisions about your program are reviewed by Jeff.

4A.10 Photographs of meals. When you photograph a meal so the app can log it, that photograph is sent to our AI model provider (currently Anthropic) to identify the food and estimate the portions. The provider processes the image to produce that result and returns it to us. Under its commercial terms the provider does not use your photograph to train its models. Progress photographs are never sent to the AI model provider (section 4B).

4A.11 Voice check-ins you record. If you answer a weekly check-in by speaking instead of typing, the audio you record is sent to ElevenLabs to be turned into text. The text is what is stored in your account and what Jeff reads. The recording is used for that transcription and nothing else: it is not used to identify you, no voiceprint is generated or stored, and it is not used to produce any voice. Speaking is always optional. You can type every check-in instead.

4B. Progress and meal photographs

4B.1 Where they are stored. Progress photos and meal photos are stored in private storage hosted by Supabase. They are not public. They are not posted to the community feed unless you post them yourself.

4B.2 Who can see them. You and Jeff. Nobody else, unless you give separate written consent for us to use a photo as a testimonial or transformation photo (section 3.1, last row), or unless disclosure is required by law (section 6.6).

4B.3 How they are used. Progress photos are used for one purpose: so that you and Jeff can see visible changes in your body over time. We do not use them to estimate body fat percentage. We do not use them to make medical or diagnostic claims. Meal photos are used to review what you ate and to help you and Jeff assess adherence to your nutrition plan.

4B.4 No facial recognition, no biometric identifiers. Fortified Fuel does not run facial recognition on any photograph. We do not extract, generate or store faceprints, scans of face or body geometry, or any other biometric identifier from your photos. We do not send your progress photographs to the AI model provider or to any vendor. Meal photographs are sent to the AI model provider to identify the food, and only for that purpose (section 4A.10); they are never analysed for biometric identifiers. Your photos are files in storage, viewed by people.

4B.5 State biometric laws. Some states, including Illinois, Texas and Washington, regulate the collection of biometric identifiers such as faceprints and scans of face geometry. This policy is written on the basis that Fortified Fuel does not collect any biometric identifier from any member, in any state. If we ever intend to, we will tell you first, ask for your separate written consent, and update this policy. A voice check-in recording is sent to ElevenLabs to be turned into text. It is not analysed for voice characteristics, no voiceprint is generated or stored, and the recording is not used to identify anyone.

4B.6 Tips for you. You do not have to include your face in progress photos. Cropping at the neck is fine and is common. You control what you upload.

5. How we use your data

We use personal data for the following purposes.

5.1 Delivering coaching. Building your training program and nutrition plan, delivering them through the App, and responding to your messages.

5.2 Program adjustment and weekly check-in review. Jeff reads your weekly check-in answers, your logs and your progress data each week and adjusts your program.

5.3 The AI coach. Generating replies, keeping context, and routing to Jeff where needed (section 4A).

5.4 Billing. Charging your plan, handling renewals, sending receipts and renewal reminders, processing refunds, and handling failed payments and chargebacks.

5.5 Accountability messages. Sending you reminders and nudges about workouts, check-ins, logging and streaks by push notification, email or text, according to your notification settings (section 8).

5.6 Community features. Displaying your posts, comments and display name in the community feed, and awarding badges.

5.7 Analytics and improvement. Understanding how the Service is used, which features work, where people get stuck, and which marketing brings people to us (section 7).

5.8 Security. Protecting accounts, detecting abuse and fraud, and keeping logs needed to investigate problems.

5.9 Vendor intake. If you apply as a vendor, we use the information you submit to assess whether to approve your product. We may keep that information for the life of any resulting relationship and for a reasonable period afterwards.

5.10 Legal. Complying with law, responding to lawful requests, enforcing our Terms, and establishing or defending legal claims.

5.11 With your consent. Anything else we ask you about and you agree to, such as using a testimonial.

5.12 We do not use your data to make automated decisions that have legal or similarly significant effects on you.

6. Who we share your data with

6.1 We share personal data only with the service providers below, only for the purposes shown, and only what each one needs. Each is bound by its own terms or a data processing agreement that restricts what it may do with the data.

6.2 Push notifications and texts. Push notifications are delivered through your device's operating system (Apple or Google) or your browser. Where you have agreed to receive text messages, they are delivered through Twilio. Those providers receive your device token or phone number and the message content.

6.3 Jeff. Jeff is the only person at Fortified Fuel who has access to member data. He does not share it with family, friends, other members, or other coaches.

6.4 Other members. Other members see only what you choose to post in the community feed, your display name, and your badges. They do not see your check-ins, logs, measurements, photos, messages or AI coach conversations.

6.5 Professional advisers. We may share limited data with our accountant, lawyer or insurer where needed for tax, legal or insurance purposes. They are bound by professional duties of confidentiality.

6.6 Legal requirements. We may disclose data if required by law, subpoena, court order or a lawful government request, or where we believe in good faith that disclosure is needed to protect someone's safety, to prevent fraud or abuse, or to enforce our Terms. Where the law allows, we will tell you before we disclose.

6.7 Business transfer. If Fortified Fuel is sold, merged, or transfers its assets, your data may be transferred to the new owner. We will notify you by email and in-app notice before that happens and tell you what choices you have, including the option to delete your account first.

6.8 Aggregated and de-identified data. We may use and share statistics that do not identify you, for example "members who log four workouts a week are more likely to hit their goals". We will not try to re-identify that data.

7. No sale of personal data, no targeted advertising, cookies and analytics

7.1 No sale. We do not sell your personal data, and we have not sold it in the last twelve months.

7.2 No sharing for targeted advertising. We do not share your personal data with third parties for cross-context behavioural advertising (advertising to you based on your activity across other websites and apps). We do not use third-party advertising cookies or pixels on the website or in the App.

7.3 First-party analytics. We run our own analytics inside the Service. We record which pages and features you use, when, from what type of device, and the UTM parameters and referral source on the link that brought you to us. This data stays with us and with our hosting and database providers. We use it to improve the Service and to see which marketing works.

7.4 Cookies we use. We use cookies and similar browser storage that are necessary for the Service to work: keeping you signed in, remembering your settings, protecting against cross-site request forgery, and running the App as an installable PWA (including offline caching). These are essential and cannot be turned off without breaking the Service. We may also set a first-party cookie or local storage value to remember the UTM source you arrived with.

7.5 Third-party cookies. We do not set third-party cookies.

7.6 Email tracking. Emails we send through Resend contain a small tracking image and tracked links that tell us if you opened the email or clicked a link. Most email apps let you block remote images, which prevents open tracking.

7.7 How to control cookies. Your browser settings let you view, block and delete cookies. Blocking essential cookies will stop you from signing in.

8. Marketing email and text messages

8.1 Two kinds of messages. We send transactional and service messages (receipts, renewal reminders, password resets, security alerts, check-in reminders, accountability nudges, replies from Jeff, notices about this policy or our Terms) and marketing messages (newsletters, offers, new programs, tips). You cannot opt out of transactional and service messages while you have an account, but you can control most accountability nudges in your notification settings.

8.2 Marketing email. We send marketing email only if you signed up for our list or created an account and did not opt out. Every marketing email includes an unsubscribe link, as required by the CAN-SPAM Act. Clicking it stops marketing email within ten business days. It does not stop transactional email.

8.3 Text messages. We send text messages only to a phone number you gave us and only after you agreed to receive texts. Texts may include accountability nudges and, if you separately agree, marketing. We do not send marketing texts without your express written consent, as the Telephone Consumer Protection Act (TCPA) requires. Reply STOP to any text to stop all texts from us; reply HELP for help. Message and data rates may apply. Your carrier is not responsible for delayed or undelivered messages.

8.4 Push notifications. You can turn push notifications on or off in the App or in your device settings at any time.

8.5 How to change your preferences. Notification and marketing preferences are in your account settings. You can also contact us (see the Contact section).

8.6 Consent for marketing email is separate from consent for the Service. You can refuse or withdraw marketing consent without affecting your membership.

9. How long we keep your data

9.1 We keep personal data only as long as we need it for the purpose we collected it, or as long as the law requires. The table below sets out how long we keep each kind of data.

9.2 Deletion in practice. When data is deleted, it is removed from our live database and storage. It may remain in encrypted backups until those backups are deleted on their rolling schedule (last row of the table). It may also remain with a service provider for the period shown in that provider's own terms, for example Stripe keeps transaction records to meet its own legal obligations.

9.3 Legal holds. If we are required to keep data because of a legal claim, investigation or legal obligation, we will keep it for as long as that requires and then delete it.

10. Security

10.1 We protect your data with measures that include:

• Encryption in transit. All connections between your device and the Service, and between the Service and our providers, use TLS.
• Encryption at rest. Our database and file storage, hosted by Supabase, are encrypted at rest.
• Access control. Jeff is the only person with access to member data. Access to the database and storage requires authentication, and row-level security rules restrict what the App can read to the signed-in member's own data.
• No full card numbers. Card details are entered directly into Stripe. We never receive, store or see your full card number.
• Password protection. Passwords are hashed by Supabase's authentication service. We cannot see your password.
• Private photo storage. Photos are stored in private buckets and served only through authenticated, time-limited links.
• Provider security. Our providers publish their own security practices and hold their own certifications. We rely on those, and on their contractual commitments to us.

10.2 No system is perfectly secure. We cannot promise that data will never be accessed without authorisation. If we learn of a breach affecting your data, we will tell you as described in section 15.

10.3 What you can do. Use a strong, unique password. Do not share your login. Sign out on shared devices. Tell us immediately (see the Contact section) if you think your account has been accessed without your permission.

11. International transfers

11.1 Fortified Fuel is based in the United States.

11.2 If you are outside the United States. By using the Service you understand that your personal data, including sensitive data, will be transferred to, stored in, and processed in the United States, where privacy laws may be different from those in your country. Where the law requires consent for that transfer, you give it by creating an account and agreeing to this policy.

11.3 EU, EEA, UK and Swiss members. For members in the European Economic Area, the United Kingdom and Switzerland, we transfer data on the basis of the Standard Contractual Clauses approved by the European Commission (and the UK International Data Transfer Addendum for UK members), which are included in our Data Protection Addendum. You can request a copy of the Data Protection Addendum using the details in the Contact section. Our providers that receive data from EU and UK members rely on their own Standard Contractual Clauses or on the EU-US Data Privacy Framework where certified.

11.4 We are a small US business and human coaching is offered in the Daphne, Alabama area. We do not target the Service at people outside the United States, but the App is available anywhere and we honour the rights in section 13 for everyone.

12. Your choices inside the App

12.1 You can view and edit your profile, measurements, logs and photos at any time inside the App.

12.2 You can delete individual photos, logs and AI coach conversations without deleting your account.

12.3 You can delete your whole account from account settings. Deletion takes effect as described in section 9.

12.4 You can change notification and marketing preferences in account settings.

12.5 You can withdraw your consent to sensitive data collection in account settings (section 3.3).

13. Your rights

13.1 Rights everyone has. Wherever you live, you can ask us to:

• Access. Tell you what personal data we hold about you and give you a copy.
• Correct. Fix data that is wrong or incomplete.
• Delete. Delete your personal data. You can do this yourself in the App (section 12.3) or by contacting us. Some data may be kept where the law requires (section 9).
• Port. Give you your data in a common, machine-readable format so you can take it elsewhere.
• Withdraw consent. Stop us collecting or using data we collect on the basis of consent, including sensitive data. Withdrawal does not affect what was done before you withdrew.
• Opt out. Stop marketing email and texts (section 8).
• Not be discriminated against. We will not deny you service, charge you a different price, or give you a lower quality of service because you exercised any of these rights. If you withdraw consent to data we need to coach you, we may not be able to keep coaching you, but that is a consequence of the data being needed, not a penalty.

13.2 If you are in the EU, EEA, UK or Switzerland (GDPR and UK GDPR). In addition to the above, you have the right to restrict processing, to object to processing based on legitimate interest, to object to direct marketing at any time, not to be subject to a solely automated decision with legal or similarly significant effects, and to lodge a complaint with your national data protection authority (in the UK, the Information Commissioner's Office). We will respond within one month, which we may extend by two further months for complex requests if we tell you why within the first month.

13.3 If you are a California resident (CCPA/CPRA). In addition to the above, you have the right to know the categories of personal data we collect, the sources, the purposes, the categories of third parties we share with, and the specific pieces of data we hold (sections 3 and 6 set this out); the right to limit the use of your sensitive personal information to what is necessary to provide the Service (we already limit it in that way, and you can withdraw consent under section 3.3); and the right to opt out of sale or sharing (we do not sell or share, section 7). We will respond within 45 days, which we may extend by a further 45 days if we tell you why. We will confirm receipt of your request within 10 business days.

13.4 Other US states. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with comprehensive privacy laws have similar rights of access, correction, deletion, portability and opt-out. We extend the rights in section 13.1 to everyone, so you do not need to work out which law applies.

13.5 How to exercise your rights. Use the tools in the App (section 12), or contact us using the details in the Contact section with the subject line "Privacy request". Tell us which right you are exercising and the email address on your account.

13.6 Checking it is you. To protect your data, we need to be sure it is you. For requests made inside the App, being signed in is enough. For requests made outside the App, we will ask you to confirm from the email address on your account, and we may ask you one or two questions about your account that only you could answer. We will not ask for a copy of your ID unless there is no other way to confirm who you are.

13.7 Authorised agents. You can ask someone else to make a request for you. We will ask for written proof that you gave them permission, and we will still confirm your identity directly with you.

13.8 If we refuse a request. If we refuse a request, we will tell you why. You can ask us to reconsider by replying to our decision.

13.9 No fee. Requests are free. If a request is clearly repetitive or excessive, we may charge a reasonable fee or decline it, and we will tell you why.

14. Children

14.1 Fortified Fuel is for adults. You must be 18 or older to create an account or buy a plan. We ask for your date of birth at intake and again at checkout and refuse anyone under 18.

14.2 We do not knowingly collect personal data from anyone under 18. We do not direct the Service at children, and we do not knowingly collect data from children under 13, which is the age covered by the Children's Online Privacy Protection Act (COPPA).

14.3 If we learn that we have collected personal data from someone under 18, we will close the account and delete the data. If you believe someone under 18 has an account, contact us using the details in the Contact section.

15. Breach notification

15.1 Fortified Fuel is not a doctor, hospital or health plan, and it is not a covered entity under HIPAA. Your data with us is not protected health information under HIPAA. It is, however, health-related information, and we treat it as sensitive.

15.2 Because we hold health-related information in an app that you use to track your body, we will follow the Federal Trade Commission's Health Breach Notification Rule, which requires notice to affected people and the FTC, and in some cases the media, within 60 days of discovering a breach of unsecured health information. We will also follow Alabama's Data Breach Notification Act, which requires notice to affected Alabama residents, and in some cases the Alabama Attorney General, within 45 days of determining that a breach of certain personal information has occurred. If there is a breach affecting your data we will, where the law allows, tell you what happened, what data was involved, what we have done about it, and what you can do.

16. Do Not Track and Global Privacy Control

16.1 Some browsers send a "Do Not Track" signal. There is no common standard for how websites should respond, and we do not change our behaviour based on it, because we do not track you across other sites in the first place.

16.2 Some browsers and extensions send a Global Privacy Control (GPC) signal, which some state laws treat as a request to opt out of the sale or sharing of personal data. We do not sell or share personal data, so there is nothing to opt out of. If that ever changes, we will honour GPC signals as an opt-out request.

17. Changes to this policy

17.1 We may update this policy from time to time. When we do, we will change the version and date at the top.

17.2 If a change is material (for example a new category of data, a new purpose, a new provider that receives sensitive data, or a change to how AI coach conversations or photos are used), we will tell you in advance by email to the address on your account or by a notice inside the App before the change takes effect. If the change requires your consent under the law that applies to you, we will ask for it.

17.3 Continuing to use the Service after a change takes effect means you accept the changed policy, except where the law requires your express consent.

18. Other things you should know

18.1 Your Terms of Service. This policy is part of your agreement with us and should be read with the Terms of Service and the Health and Fitness Disclaimer. When you accept these Terms at checkout, you also accept this policy.

18.2 Testimonials. If you gave written consent for us to use a testimonial or transformation photo, you can withdraw it at any time by contacting us. We will stop using it in new materials. Materials already printed or published before you withdrew may remain where we cannot practically recall them.

18.3 Nevada residents. We do not sell personal data as defined under Nevada law.

18.4 Accessibility. If you need this policy in another format, contact us and we will help.

Contact

Fortified Fuel Fitness & Nutrition Operated by Jeff Beck Daphne, Alabama

Message Jeff in the app, or use the contact details on fortifiedfuel.fitness.