Privacy Policy

1. Introduction

This Privacy Policy describes how Warrior Waypoint LLC ("Warrior Waypoint," "we," "us," or "our") collects, uses, discloses, and protects personal information when you use the StrengthTEN mobile and web application and related services (the "Service").

By creating an account, checking the in-app agreement box, accepting this policy in-app, or using the Service, you acknowledge the practices described here. If you do not agree, do not use the Service.

This Policy is intended for users in the United States. If you access the Service from other regions, see Section 12 (International users).

2. Who we are and how to contact us

Controller / business: Warrior Waypoint LLC Privacy contact: info@warriorwaypoint.com

For access, deletion, or other privacy requests, email the address above with "Privacy Request" in the subject line and enough information for us to verify your identity and locate your account.

3. Information we collect

We collect information in the following categories:

A. Account and identity. Email address, first and last name, display name, phone number, date of birth, profile photo, authentication identifiers from Apple Sign In, Google Sign-In, or other providers you choose, and Firebase user identifiers.

B. Profile and training data. Training maxes, optional body weight and body fat percent, optional physical sex (female, male, or prefer not to say) stored on your profile and, when provided, used as a soft prior for AI program suggestions, selected plan, preferences (including preferred rest days and AI Coach voice gender for spoken summaries), workout logs, progress metrics you enter, and related settings. Age may be derived from date of birth for personalization and AI program suggestions.

C. User content. Programs, videos, captions, thumbnails, ratings, comments, and other content you create or upload, including storage paths and download URLs.

D. Sharing and usage counters. When you share program links or publish Feed videos, we store that content metadata, moderation status, and monthly share-usage counters needed to enforce plan quotas.

E. Safety and trust. Content reports/flags (reason, target id, reporter id), moderation appeals (explanation, related video id, status), and related review notes needed to enforce Terms and Community Guidelines.

F. Referrals. Invite/referral codes, who referred whom, and bonus-day credit records needed to operate referrals and prevent abuse.

G. Billing and entitlement. Subscription and entitlement status, plan identifiers, trial/bonus day balances, App Store / StoreKit transaction identifiers when you purchase on iOS, and Stripe-related customer/subscription/Connect identifiers when you purchase on the web or Android or use creator coaching. Payment card numbers for Stripe purchases are processed by Stripe; we do not store full card numbers on our servers. Apple processes iOS In-App Purchases under Apple's terms.

H. Device and technical data. App version, device/platform signals reasonably needed to operate features (for example notification permission status), and IP address and security logs as processed by our infrastructure providers. We do not currently initialize a separate first-party analytics or crash-reporting SDK in the client; if we enable such tooling later, we will update this Policy. Apple and Google may still collect platform diagnostics under their own terms.

I. Communications. In-app support tickets you submit and view (category, subject, message, status, and replies), an email address you provide when contacting us before sign-in, messages you send us, and service emails we send you.

J. Gym session companion (where available on your device and build). If you use the in-session rest timer, we may schedule local device notifications that fire when rest ends, and optional training-reminder notifications you enable. If you Link a music remote on iOS, we process on-device connection state for Apple Music (MusicKit) and/or Spotify App Remote (when Spotify is enabled for that build) — including an on-device Spotify App Remote access token when you authorize Spotify, and temporary on-device album artwork used to show the now-playing chip. The music remote controls playback already running in Music or Spotify; it does not stream a StrengthTEN music catalog. If you use the Apple Watch companion, the phone may send session snapshots to your paired Watch (for example exercise name, set progress, and rest timing) and receive Watch commands (mark done, skip rest, start rest, finish workout). Spotify tokens and album artwork stay on the device; Watch session payloads use Apple WatchConnectivity between your phone and Watch.

We do not intentionally collect precise GPS location for core training features unless a future feature discloses that separately and obtains required consent.

4. Health, fitness, and motion data

If you opt in, we may process limited motion-related signals — for example step or pedometer data via platform APIs (Core Motion on iOS) — solely to enrich progress features you choose. This app does not currently use Apple Health / HealthKit APIs.

We do not sell health or motion data. We do not use motion data for advertising or for data brokering. You can revoke platform permissions in system settings and turn off in-app opt-ins. Training features work without motion permissions.

Exact data types we request will be listed in App Store privacy nutrition labels and platform permission strings. If labels and this Policy ever conflict on a shipped feature, the more specific in-product disclosure for that feature controls until we update this Policy.

5. How we use information

We use personal information to:

• Provide, operate, secure, and improve the Service (programs, logging, Feed, billing, coaching tools, referrals, in-app support, rest timer, music remote, and Watch companion where available); • Authenticate users and maintain accounts; • Personalize load suggestions and display progress you request; • Operate AI features you request (including sending necessary prompts, profile/training context such as optional physical sex as a soft programming prior, active program structure, recent workout-log summaries, and your AI Coach voice-gender preference to AI providers such as Google Gemini; storing AI job status, generated private programs, adjustment proposals you can accept or reject, bounded Q&A threads, training reviews, and optional spoken audio); • Schedule local rest-timer and training-reminder notifications you enable; • Moderate User Content (automated scanning and human review when enabled), process flags/reports and appeals, and enforce Terms and Community Guidelines; • Process payments and maintain entitlements via Apple In-App Purchase on iOS, Stripe on the web and Android and for creator coaching, and our backend; • Prevent fraud, abuse, spam, and security incidents; • Comply with law, respond to lawful requests, and protect rights, safety, and property; • Send transactional service notices (billing, security, policy updates). We do not sell personal information.

"Sell" / "share" for cross-context behavioral advertising: We do not sell personal information for money. We do not knowingly share personal information for cross-context behavioral advertising as those terms are used under California law. If that changes, we will update this Policy and provide required opt-outs.

6. Legal acceptance records

When you accept the Terms of Service and Privacy Policy — including by checking the required agreement box at sign-in or accepting an in-app update — we store the document versions you accepted, timestamps, acceptance source (for example signup or reacceptance), and an append-only history of acceptances associated with your account. We use this to demonstrate consent and to re-obtain acceptance when policies change.

7. How we disclose information

We disclose information to:

A. Service providers / processors who act on our instructions, including Google (Firebase Auth, Firestore, Cloud Storage, Cloud Functions, and related Google Cloud services such as Video Intelligence when content moderation is enabled); Apple (sign-in and In-App Purchases on iOS; MusicKit / WatchConnectivity when you use those features); Stripe (web and Android payments and Connect); AI model providers for AI Coach when you use that feature; and hosting/email/alerting tools we configure for operations (for example optional Slack alerts for admin support).

B. Music apps you choose to control. When you Link Apple Music or Spotify from StrengthTEN, those providers process playback control under their own terms. Spotify App Remote authorization may store an access token on your device so StrengthTEN can reconnect without prompting every time. We do not upload your Spotify token to our servers.

C. Other users, when you choose to share: unlisted or public programs (including programs you opt in for AI recommendations), Feed videos after approval, ratings, and profile information you make visible — including Coach public cards (bio, specialties, certifications) when you list yourself for matching. Creators and subscribers may see information necessary for coaching relationships you enter.

D. Professional advisors (legal, accounting) under confidentiality where needed.

E. Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality and notice where required.

F. Legal and safety: if required by law, regulation, legal process, or governmental request, or to protect the rights, safety, and property of Warrior Waypoint, our users, or the public.

We require processors to protect data appropriately under contracts where required.

8. Retention

We retain account, workout, and entitlement data while your account is active and for a reasonable period afterward as needed for billing, disputes, security, backups, and legal obligations.

Rejected, removed, or appealed media may be deleted when no longer needed, or retained briefly for abuse investigation and appeal review.

Support tickets, reports, appeals, audit logs, and consent records may be retained longer where needed for safety, fraud prevention, or legal compliance.

When you request account deletion, we will delete or de-identify personal information we control within a reasonable period, except records we must retain (for example payment records, consent/safety logs, or information needed to prevent repeat abuse), which we retain only as long as reasonably necessary for those purposes.

9. Security

We use administrative, technical, and organizational measures appropriate to the Service, including encrypted transport (HTTPS/TLS), access-controlled backend rules, and least-privilege server credentials for privileged operations. No method of transmission or storage is fully secure. You are responsible for protecting your device and account credentials.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have collected such information, contact info@warriorwaypoint.com and we will delete it promptly.

Sexual content involving minors is strictly prohibited, will be removed, and may be reported to authorities as required by law.

Users between 13 and the age of majority should use the Service only with parental/guardian consent as required by the Terms.

11. Your choices and rights (U.S.)

You may: update certain profile fields in the app (including clearing optional physical sex); change AI Coach voice gender; manage notification permissions in system settings (including rest-timer and training reminders); revoke health/motion permissions; disconnect music remote Link controls; sign out; submit an in-app support ticket; and contact us to request access, correction, or deletion of personal information we hold.

Depending on your state of residence (for example California, Virginia, Colorado, Connecticut, Utah, and others with consumer privacy laws), you may have rights to know/access, delete, correct, obtain a portable copy, and opt out of certain processing. We will not discriminate against you for exercising privacy rights.

To exercise rights, email info@warriorwaypoint.com. We may need to verify your identity. You may use an authorized agent where law allows, subject to verification.

California "Shine the Light": we do not disclose personal information to third parties for their own direct marketing in a manner that triggers separate Shine the Light disclosures, beyond what this Policy describes.

Do Not Track: the Service does not currently respond to browser DNT signals in a standardized way.

12. International users

We are based in the United States and may process information in the United States and other countries where our providers operate. Those countries may have different data-protection laws than your home country.

The Service is offered primarily to U.S. users. If you access the Service from the EEA, UK, Switzerland, or another region with additional privacy requirements, contact info@warriorwaypoint.com before relying on the Service for regulated processing; we may limit availability or update this Policy before expanding marketing to those regions.

13. Third-party links and SDKs

The Service may link to third-party sites, open Apple subscription management, open Stripe Checkout / Connect flows operated by Stripe, or open Apple Music / Spotify for playback control you initiate. We are not responsible for third-party privacy practices. Review their policies before providing information to them.

14. Changes to this Policy

We may update this Privacy Policy from time to time. When we do, we will bump the Privacy version in the app and require you to accept the updated policy before continuing where we use an in-app consent gate. The "Version" shown in-app is the controlling version for consent records.

15. Contact

Privacy questions and requests: Warrior Waypoint LLC info@warriorwaypoint.com You may also submit an in-app support ticket via Contact us or Help & Support.

If we publish a public website, the privacy contact listed there also applies.