California Privacy Notice

In the past 12 months we have collected the following categories of personal information from California residents:

• Identifiers — email address, account ID, IP address.
• Customer records — display name and profile preferences you provide.
• Commercial information — subscription status and purchase history.
• Internet/network activity — basic device and browser metadata for diagnostics and abuse prevention.
• Health-related and biometric information you voluntarily log — body weight, body measurements, workout performance, optional progress photos. We treat this as Sensitive Personal Information ("SPI").

• Directly from you, when you create an account or use the Service.
• Automatically from your device when you use the Service (cookies, device metadata).
• From our authentication and infrastructure providers (e.g., Supabase) acting on our behalf.

• Provide and maintain the Service.
• Authenticate accounts and sync data across devices.
• Send transactional emails.
• Detect, prevent, and respond to fraud, abuse, and security incidents.
• Comply with legal obligations.

We use SPI only for the purposes for which you provided it (i.e., to display and track your own training). We do not use SPI to infer characteristics about you or for any secondary purpose that would trigger the right to limit.

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We have not sold or shared personal information of California residents (including minors under 16) in the past 12 months.

We disclose limited personal information to service providers acting on our behalf under written contracts that prohibit them from using your data for any other purpose. These providers include:

• Lovable Cloud / Supabase (backend hosting and storage).
• Cloudflare (edge hosting and DNS).
• Mailgun (transactional email delivery).
• ElevenLabs (text-to-speech, when enabled).

As a California resident you have the right to:

• Know what personal information we collect, use, disclose, and sell or share.
• Access and obtain a copy of the personal information we hold about you.
• Delete personal information we have collected from you, subject to legal exceptions.
• Correct inaccurate personal information.
• Opt out of sale or sharing of personal information. (Not applicable — we do not sell or share.)
• Limit use of sensitive personal information. (Not applicable — we already use SPI only for the purpose you provided it.)
• Non-discrimination for exercising your rights.

Email support@ironoasis.app from the email address associated with your account. We will respond within 45 days (extendable by another 45 days if reasonably necessary). We will verify your identity by confirming control of the account email.

You may use an authorized agent to submit a request on your behalf. We will require written authorization signed by you and may also verify the agent's identity.

We retain personal information for as long as your account is active, and for up to 30 days after account deletion (longer where required by law).

We do not offer financial incentives or price/service differences in exchange for the collection, sale, or retention of personal information.

We do not share personal information with third parties for their direct marketing purposes.

Our website does not currently respond to "Do Not Track" browser signals, because we do not track users across third-party sites in the first place.

RSS Digital LLC
California, USA
support@ironoasis.app