Privacy Policy

FuelTheGains ("we", "us", "our") is the data controller responsible for your personal data. For any questions regarding this policy or your data, contact us at support@resend.fuelthegains.com.

We collect the following categories of data:

• Personal information: name, email address, and authentication credentials (password hash or Google OAuth profile).
• Biometric data: age, gender, height, weight, activity level, and body composition data you provide for meal plan generation and progress tracking.
• Payment data: subscription status and billing information. Payment details (card numbers) are processed and stored exclusively by Stripe — we never store your full card information.
• Usage data: meal plan history, meal logs, weight logs, and calorie/macro calculations generated through the Service.

We process your data under the following legal bases (GDPR Article 6):

• Contract performance: to provide you with the Service, generate meal plans, and manage your subscription.
• Consent: for sending marketing communications and processing biometric data for personalized nutrition plans.
• Legitimate interest: to improve the Service, prevent fraud, and ensure security.
• Legal obligation: to comply with applicable laws and regulations.

We use the following third-party services to operate FuelTheGains:

• MongoDB Atlas: cloud database hosting for storing your account and meal plan data. Data is stored in secured, encrypted clusters.
• Stripe: payment processing for subscriptions. Stripe handles all payment card data in compliance with PCI DSS standards. Stripe Privacy Policy.
• Resend: transactional email delivery for account verification, welcome emails, and password resets. Resend Privacy Policy.
• Google OAuth: optional authentication provider. When you sign in with Google, we receive your name and email address from your Google profile. Google Privacy Policy.

We retain your personal data for as long as your account is active or as needed to provide the Service. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law. Anonymized and aggregated data may be retained indefinitely for analytics and service improvement.

Under the General Data Protection Regulation, you have the right to:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure: request deletion of your personal data ("right to be forgotten").
• Data portability: receive your data in a structured, machine-readable format.
• Restriction: request that we limit the processing of your data.
• Objection: object to processing based on legitimate interests or for direct marketing.
• Withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at support@resend.fuelthegains.com. We will respond within 30 days.

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you the following additional rights:

• Right to Know: you may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: you may request deletion of the personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale: we do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your CCPA rights (e.g., by denying services, charging different prices, or providing a different quality of service).

Categories of personal information collected (as defined by the CCPA): identifiers (name, email), biometric information (height, weight, age), commercial information (subscription and payment history), and internet or electronic network activity (usage data and meal logs).

To exercise your CCPA rights, contact us at support@resend.fuelthegains.com. We will verify your identity before processing your request and respond within 45 days.

FuelTheGains uses localStorage to store your authentication token (JWT). We do not use tracking cookies or third-party advertising cookies. No cookie consent banner is required as we only use strictly necessary storage mechanisms for the Service to function.

The Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete such information.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including where our third-party service providers operate. In such cases, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, to protect your data.

We implement industry-standard security measures to protect your data, including password hashing with Argon2, encrypted database connections, HTTPS enforcement, and JWT-based authentication. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this page periodically.

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our Data Protection Officer at support@resend.fuelthegains.com.

If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority. In France, this is the CNIL (Commission Nationale de l'Informatique et des Libertes).