KelseyJFit Privacy Policy

Effective / Last Updated: Oct 7, 2026

Kelsey Johnston, operating as KelseyJFit, a Wisconsin sole proprietorship (“KelseyJFit,” “we,” “us,” or “our”), operates the KelseyJFit iOS fitness app. This Policy explains how we collect, use, disclose, and retain personal information for the app, member accounts, subscriptions, and related support (the “Service”).

The Service is intended for eligible adults in the United States and Canada who meet the age requirements in Section 13, subject to the Terms of Use and availability in the applicable App Store storefront. This Policy covers these app services, not independently purchased coaching or general browsing of a separate website. The Consumer Health Data Privacy Notice following this Policy provides additional information for people protected by the U.S. consumer health data laws it identifies. Canadian privacy rights are addressed in this Policy, including Section 12. Accepting our Terms or acknowledging this Policy is not a substitute for any separate consent required by law.

1. Information You Provide

1.1 Account and Authentication Information

We collect your name, email address, and password when you register. We also maintain your account identifier, onboarding status, sign-in history, and authentication records to operate and secure your account. Passwords are stored as hashes, not readable passwords. Sign-in information is stored on your device to keep you signed in.

Email verification is required. Verification and password-reset messages contain codes and are delivered through Resend. The member registration form does not request your phone number, mailing address, date of birth, gender, or biography. You must meet the age requirements in Section 13; those requirements do not mean we collect a full birth date.

1.2 Workouts and Optional Progress Information

We collect the program and schedule you choose, including gym/home/hybrid training preferences, and your workout sessions, dates, completion status, exercise sets, repetitions, loads, and calculated training volume. Prior performance and personal records are derived from your workout history.

You may optionally record body weight in pounds; waist, hip, arm, and leg measurements in inches; and front, side, and back progress photos. These features support progress history and comparisons, including side-by-side photos. You can skip optional progress entries during onboarding.

Uploaded progress photos are stored privately for your progress history and comparisons. They are not publicly visible or shared with other members.

1.3 Support and Privacy Requests

If you contact us, we receive the contact information, message, and any attachments you choose to send. We use them to respond, resolve the issue, and keep appropriate request records. Avoid sending unnecessary sensitive information, payment-card numbers, passwords, or verification codes.

2. Subscription and Purchase Information

Apple processes monthly and annual App Store subscriptions and handles your Apple Account payment information. KelseyJFit does not receive or store your complete payment-card number or billing address.

RevenueCat receives your KelseyJFit account identifier and email address, purchase/restore information, subscription status, and device/app metadata needed for its service. We use this information to verify purchases, provide paid access, restore subscriptions, and address subscription issues.

We store subscription status, account identifiers, and limited transaction records to verify and reconcile purchases. Account deletion includes a request to delete your RevenueCat customer record, as described in Sections 9 and 10. Restoring a purchase to a different KelseyJFit account transfers the entitlement without transferring your original account’s progress history.

3. Technical and Operational Information

Our service providers process technical information associated with connections to the Service, including IP addresses, user agents, device/app context, request information, and operational logs, as relevant to their roles. Supabase processes authentication and backend traffic, including applicable authentication/security audit records that may contain email and IP address; RevenueCat processes subscription traffic; Cloudflare Stream processes video requests; and Expo processes app delivery/update traffic. Sentry’s crash-report configuration is described below.

After onboarding, the app asks for notification permission. If you allow notifications, or previously allowed them on your device, the app registers and stores an Expo push token and platform indicator after sign-in. We use this information to send new-program announcements. The app does not currently send workout reminders. The token supports notification delivery, not advertising tracking.

Sentry receives crash and error reports to help us identify and fix app problems. Reports may include your account identifier, device and app information, and technical details about the error. We do not intentionally include your name, email address, or IP address in these reports. We do not use separate product-analytics tools to track in-app events. Apple may separately receive diagnostics under your device settings and Apple’s own practices.

4. How We Use Information

We use information for the following purposes:

Create, verify, secure, and maintain your account and authenticate sign-in.
Deliver the programs and exercise videos you request and remember your program selection.
Save workouts and optional progress entries, calculate training history and performance, and display comparisons.
Verify purchases, administer subscriptions and restores, and provide paid access.
Send authentication emails, deliver new-program announcements through push notifications when you allow them, and respond to support and privacy requests.
Operate and update the app, investigate crashes and errors, prevent misuse, protect security, verify deletion and subscription processing, and comply with applicable legal obligations.

We use fitness and progress information to provide your requested features and protect those services. We do not use it to target advertising. If we propose a materially different use requiring notice or consent, we will provide that notice and obtain the required consent before proceeding. Where consent is required, we explain the purposes so you can make an informed choice. We do not require consent to processing beyond what is necessary to provide the product or feature you request as a condition of providing it.

5. Service Providers and Other Disclosures

5.1 Providers Used for the Service

We use the following providers for the stated purposes:

Supabase: account authentication, database, file storage, and backend functions. It processes account information, workouts, weight, measurements, progress photos, authentication and device tokens, and subscription-event records.
RevenueCat: App Store paywalls, purchase verification, restoration, and subscription access. It processes account identifiers, email, purchase/subscription information, and typical device/app metadata. It does not receive your workout logs, body measurements, weight records, or progress photos through our subscription integration.
Apple: App Store/StoreKit purchase processing and, where applicable, device push infrastructure. Apple handles your Apple Account and payment details under its own terms and privacy policy. App Store billing does not provide KelseyJFit with your complete payment-card information.
Cloudflare Stream: delivery of exercise demonstration videos and thumbnails. It receives information about the video requested and network information, such as IP address and browser or app details. Our video-delivery integration does not send your account identifier, email, or progress photos.
Resend: delivery of authentication emails. It processes recipient email addresses and message content, including verification and password-reset codes.
Expo: app delivery, updates, and push-notification infrastructure for new-program announcements. It processes related device/app and network information and registered push tokens. The current app does not provide workout reminders.
Sentry: crash and error reporting, using the information described in Section 3 to identify and fix app problems. Report retention is described in Section 10.

Vercel hosts the administrator content-management site and processes administrator sessions and site traffic, not member-app traffic.

Service providers acting for us must use information only for authorized service purposes and provide protections at least as protective as those described in this Policy. Apple also processes information for its own App Store services under its own policy. Our use of a provider does not remove our responsibility for our own data practices.

5.2 Access by Kelsey and Administrators

Your progress information and photos are private to your member experience. Other members cannot view them, and Kelsey and other admins cannot browse them through the content-management dashboard.

Authorized personnel and service providers may access relevant account, subscription, and progress records, including photos, when needed for legitimate service administration, support, security, or legal purposes. Private storage does not mean such authorized access is impossible.

5.3 Legal and Business Disclosures

We may disclose information where necessary and legally permitted to comply with law or valid legal process, protect security and rights, investigate fraud or misuse, or resolve a dispute. Any disclosure of consumer health data is also subject to the additional restrictions described in the Consumer Health Data Privacy Notice and applicable law.

If the business is involved in a merger, sale, or other transfer, information may be transferred subject to applicable law, appropriate confidentiality safeguards, and required notice or consent. KelseyJFit is a sole proprietorship and does not share information with corporate affiliates. We may also disclose information at your direction or with consent where required.

6. Fitness Information and Progress Photos

Workout history, weight, measurements, and body photos can reveal sensitive information about your physical condition. Some U.S. state laws treat this as consumer health data even though the app provides general fitness services. Canadian privacy laws may also treat this information as sensitive and require additional protections.

Optional progress information is used to maintain and display your chosen records. We do not sell the progress information collected for this Service or use it for targeted advertising. Publication as a testimonial requires your separate permission. We do not use progress photos for facial recognition or biometric identification. The app does not connect to health-record or device-health integrations.

Collection, use, and disclosure of sensitive fitness information are subject to your express consent where required by applicable law, unless a lawful exception applies. General acceptance of the Terms or this Policy does not replace that consent. You may decline optional weight, measurement, and photo entries without giving up other available features. You may withdraw consent by contacting us under Section 12; we will explain any effect on the features you use. The Consumer Health Data Privacy Notice below provides additional information where the identified U.S. laws apply.

7. Advertising, Analytics, and Tracking

For the app, account, and related support information covered by this Policy, KelseyJFit does not sell personal information or share it for targeted or cross-context behavioral advertising. The app has no advertising or separate product-analytics tools and does not track users across other companies’ apps or websites. We do not permit third parties to use information collected through the Service to track your activity over time across other companies’ apps, websites, or online services. Sentry is used for crash and error reporting.

Authentication tokens, purchase records, update requests, video-delivery logs, and crash/error reports support Service functionality, reliability, and security. They are not an advertising system. These statements concern the information and Service described in this Policy; they do not purport to describe unrelated website browsing or separately purchased coaching.

8. Device Permissions and Your Choices

The app requests camera access when you choose to take a progress photo and photo-library access when you choose a photo from your library. You can decline these permissions and use other Service features, and you can change permissions in iOS Settings. Removing a permission does not by itself delete a previously uploaded photo.

The app asks for notification permission after onboarding. You can decline notifications or disable them in iOS Settings. If you allow notifications, a device push token is registered as described in Section 3 and used to deliver new-program announcements. There is no current in-app notification-preference screen.

The app does not request microphone, precise location, contacts, motion, or health-data permissions. Choosing “gym,” “home,” or “hybrid” describes your training preference, not collection of your geographic location.

Authentication emails are necessary for account verification and password resets. No app marketing or workout-email campaign is currently active.

9. Account Deletion

Initiate account deletion in the app from Profile or the locked paywall screen, even without an active subscription. Follow the confirmation instructions, including typing DELETE. If you cannot access your account, contact us using Section 15.

Successful deletion removes your account and profile, workout history and exercise logs, weight and measurements, progress photos, program selections, and associated notification information from our active systems. You are then signed out. If an error occurs, retry or contact support. Subscription restoration does not restore deleted training or progress information.

As part of account deletion, KelseyJFit requests deletion of your associated RevenueCat customer record. Processing by RevenueCat may finish later. Limited operational records and residual provider or backup copies may remain as described in Section 10, subject to applicable deletion rights.

Deleting your account does not cancel an Apple App Store subscription. Cancel separately through Apple to prevent future renewal: https://apps.apple.com/account/subscriptions. You do not need to wait until your subscription expires to delete your KelseyJFit account.

10. Retention and Provider Copies

We keep account, training, and progress information while needed to provide your account and requested features, subject to your deletion choices and applicable law. Successful account deletion removes the active member records described in Section 9. It does not make every provider copy or historical log disappear instantly.

Limited subscription, deletion-request, and security records may remain where necessary and lawful to reconcile purchases, protect security, meet legal obligations, or resolve disputes. Subscription transaction records are ordinarily retained for up to 400 days, subject to applicable deletion rights. These records are not a continuing active member profile. Support and privacy-request correspondence is retained only as reasonably necessary for its purpose and applicable legal requirements.

Deleted database information may remain in routine database backups for up to 7 days. Authentication and security records, which may include email and IP addresses, may remain for up to 90 days. Sentry crash and error reports may remain for up to 30 days. These periods do not apply to every provider record or backup. Legally required breach records have a separate retention period, as explained in Section 11.

Apple independently maintains App Store subscription and billing history under its own policies. RevenueCat and other providers may retain limited residual records or backup copies according to their applicable retention practices.

Applicable preservation and deletion requirements take priority over routine retention schedules. General business interests do not create a blanket exception to consumer health data deletion rights. We handle requests and notify relevant providers as required by applicable law.

11. Security

We use technical and organizational safeguards intended to protect personal information, including encryption during transmission and storage, protected passwords, access restrictions, and private photo storage.

No system is completely secure. Protect your device, credentials, and email account and contact us promptly about suspected unauthorized access. We will provide notices of a security incident where required by law. This Policy does not promise that unauthorized access, loss, or interruption can never occur.

Where Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies, we will report a breach of security safeguards involving personal information under our control to the Office of the Privacy Commissioner of Canada and notify affected individuals if it is reasonable to believe that the breach creates a real risk of significant harm. We assess the sensitivity of the information and the likelihood of misuse. Reporting and notification will occur as soon as feasible after we determine that the breach has occurred. Notices will explain the breach, the information involved, the steps we are taking, steps you can take to reduce harm, and how to contact us. We will also notify other organizations or government institutions when legally required to reduce or mitigate harm, and comply with any additional applicable provincial or other breach-response requirements.

For breaches subject to PIPEDA, we will keep a record of every breach involving personal information under our control, including breaches that do not require reporting or notification, for at least 24 months after the day we determine that the breach has occurred. These records will document the circumstances, information involved, risk assessment, and reporting and notification decisions, and will be available to the Office of the Privacy Commissioner of Canada on request. A longer period may apply where required by law. These limited compliance records are separate from the routine logs and active member records described in Sections 9 and 10.

12. Privacy Requests and U.S. and Canadian Rights

You may request access to, correction of, or deletion of your personal information, and information about its sources, uses, and disclosures. Depending on applicable U.S. state, Canadian federal, or provincial law, you may also have rights to withdraw consent, obtain a portable copy, appeal a denial, and be free from unlawful discrimination for exercising privacy rights. Where Quebec's portability right applies, you may request computerized personal information collected from you in a structured, commonly used format, or its transmission to a legally authorized person or organization, subject to the law's conditions and exceptions.

Email support@kelseyjfit.com with “Privacy Request” and describe what you need. We may request information reasonably necessary to verify your identity or an authorized representative’s authority; do not send a government ID unless we explain why it is necessary and how to provide it securely. We do not require a new account just to make a privacy request. You may also use this contact to withdraw consent, subject to legal or contractual restrictions and reasonable notice where applicable. We will explain relevant consequences: a feature may no longer be available if it requires the information, while declining optional progress entries does not prevent use of other available features. Withdrawal does not cancel an Apple subscription, and lawful limited retention is described in Section 10.

We will respond within the period required by applicable law, explain a denial or permitted extension, and provide applicable review or complaint instructions. For access requests under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), the usual response period is 30 days; any extension must be permitted by law and explained within the required time. Applicable provincial deadlines also govern. Requests are handled at no cost or only a charge permitted by law, disclosed in advance where required. You may ask us to review a decision by replying or emailing “Privacy Appeal” to the same address. This does not replace or shorten any right or deadline to contact a regulator.

Canadian users may raise a privacy complaint with the operator identified in Section 15 and, where the matter falls within its jurisdiction, the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or the relevant provincial privacy commissioner, including those in Alberta or British Columbia. U.S. users may contact their state attorney general or other relevant regulator. The Consumer Health Data Privacy Notice provides additional U.S. rights and response details. These provisions preserve rights under PIPEDA and applicable provincial or U.S. state laws; they do not assume that every statute applies to every person or record.

13. Adults Only

The Service is for adults age 18 and older. Canadian residents must also have reached the age of majority in their province or territory of residence (18 or 19, as applicable), as required by the Terms of Use. We do not knowingly provide accounts to minors or knowingly collect their personal information. If you believe a minor has created an account or submitted information, contact us so we can investigate and take appropriate deletion and account action.

14. U.S. and Canadian Users and Processing Locations

The Service is intended for users in the United States and Canada. KelseyJFit is operated from Wisconsin, United States. The providers identified in Section 5 may process or store information in the United States and other countries where they operate. Canadian users' information may therefore be processed outside Canada and, for Quebec users, outside Quebec. We do not promise that information remains in Canada or exclusively in the United States. Information processed abroad may be subject to foreign laws and lawful access by courts, law enforcement, or national security authorities; protections may differ from those where you live.

We remain responsible for personal information under our control when it is processed on our behalf, including applicable contractual safeguards and transfer requirements. You may contact the privacy contact in Section 15 for information about our service providers, cross-border processing, and safeguards. This disclosure is not a blanket consent to a transfer, use, or disclosure that would otherwise be unlawful, and it does not waive Canadian privacy rights.

15. Changes and Contact

We may update this Policy to reflect changes in the Service, practices, or legal requirements and will revise the date above. We will notify you of material changes by email or an in-app notice, and obtain consent where legally required before a new use or disclosure.

For support, privacy requests, complaints, or questions about processing outside Canada, contact the owner/operator below, who is responsible for personal information protection:

Kelsey Johnston, operating as KelseyJFit

Email: support@kelseyjfit.com

KelseyJFit Consumer Health Data Privacy Notice

Effective / Last Updated: Oct 7, 2026

This Notice explains consumer health data practices for the KelseyJFit iOS fitness service, operated by Kelsey Johnston, operating as KelseyJFit, a Wisconsin sole proprietorship. It supplements the KelseyJFit Privacy Policy for consumers protected by Washington's My Health My Data Act, Nevada's consumer health data law, and other applicable U.S. consumer health data laws. The statutory rights and procedures below apply where the relevant law covers you; they do not replace or restrict Canadian privacy rights described in the main Privacy Policy.

1. Categories and Sources

We collect workouts, exercise sets, repetitions, loads, completion dates, training volume, selected programs and training preferences, and the weight, waist/hip/arm/leg measurements, and progress photos you choose to provide. We derive prior-performance comparisons and personal records from your workout history.

Account identifiers, email, subscription information, and technical records of fitness-service or video use may also qualify as consumer health data when they identify you as seeking or using fitness services or are linked to physical-condition information. Crash and error reports may include an account identifier, device/app information, and technical error details. Sources are you, your use of the app, records derived from that use, and providers supporting authentication, purchases, delivery, diagnostics, and storage.

2. Purposes and Choices

We collect and use these categories to provide the programs, workout records, progress tracking, photo comparisons, account access, subscriptions, and support you request. We also protect the security and integrity of those services and meet applicable legal obligations.

Weight, measurements, and photos are optional. We process consumer health data as necessary to provide your requested service or with the consent required by applicable law. Where separate consent to collection or sharing is required, general agreement to our Terms does not replace it. You may withdraw consent by contacting us; this may prevent us from providing a feature that needs the information.

We do not sell consumer health data collected for this Service, use it for targeted advertising, or use progress photos for biometric identification. We do not permit third parties to use information collected through the Service to track your activity over time across other companies’ apps, websites, or online services.

3. Categories Disclosed and Recipients

Supabase processes account-linked workout records, weight, measurements, photos, and related identifiers for account hosting and storage. RevenueCat and Apple process subscription-related information; RevenueCat also receives your account identifier and email. Resend processes email addresses and authentication messages. Cloudflare Stream processes video requests and network information; our video-delivery integration does not send your account identifier or email. Expo processes applicable app delivery/update information and push tokens. Sentry processes account identifiers, device/app information, and technical error details; we do not intentionally include name, email, or IP address in those reports.

These providers receive the categories needed for their services, not every category of your progress data. In particular, the subscription and video integrations do not send them your progress photos or measurement records. KelseyJFit has no corporate affiliates receiving consumer health data.

Authorized operational personnel may access information for necessary administration, support, security, and legal tasks. The content-management dashboard does not let Kelsey or other admins browse member progress. Other disclosures occur only at your direction, with required consent, or as specifically permitted by applicable law, including valid legal obligations or a legally permitted business transfer. General retention or disclosure language does not override consumer health data restrictions.

4. Access, Withdrawal, and Deletion

Where the applicable consumer health data law provides these rights, you may confirm whether we collect or share your consumer health data, obtain access, learn the recipients and their contact mechanisms, withdraw consent to collection or sharing, and request deletion. You may review your workout and progress records in the app and contact us to request corrections. We do not discriminate unlawfully because you exercise these rights.

Email support@kelseyjfit.com with “Health Data Request.” Identify your account email and the request. We may reasonably authenticate your identity without requiring a new account. Information requests are generally free, subject only to exceptions allowed by law.

For Washington requests, we respond within 45 days of receipt, with one additional 45-day period when lawfully necessary and explained. Nevada provides a 45-day response period after authentication and permits a limited extension, but requires deletion action within 30 days after authentication. Applicable shorter or more protective requirements control.

Successful in-app account deletion removes active account and progress records and requests deletion of your RevenueCat customer record. It does not cancel an Apple subscription. Limited subscription, security, and other records or provider backups may remain as described in the Privacy Policy. Consumer health data deletion requests also apply to relevant retained records and providers, subject to applicable legal requirements and exceptions; routine retention schedules do not limit your statutory rights.

5. Appeals

If we deny your request, reply to the decision or email support@kelseyjfit.com with “Health Data Appeal.” We will provide a written decision and reasons within 45 days of receiving an appeal under the applicable Washington or Nevada law. If denied, we will provide the appropriate attorney general complaint mechanism. These procedures do not restrict other remedies available under law.

6. Changes and Contact

We will update this Notice when health data practices materially change and notify you by email or an in-app notice. Where required, we will obtain your consent before collecting, using, or sharing additional categories of consumer health data, using it for new purposes, or sharing it with additional recipients.