1. Who we are and scope
This Privacy Policy explains how [COMPANY LEGAL NAME], operating the The Lift Loft app ("we", "us", or "our"), collects, uses, stores, and protects your personal information when you use our Service. This policy applies to information collected through our website, app, authentication emails, and any related support channels.
2. Information we collect
We collect the information needed to run your account and provide a personalised training experience. This includes identity information such as your name and email address, which we use to create your account and send sign-in codes.
Because The Lift Loft is a fitness and nutrition service, we also collect health and fitness information that you choose to enter. This may include your workout logs, sets, repetitions, weights lifted, body weight and measurements, fit-test results, progress photos, meal and diet preferences, fasting protocol selections, goals, and any notes or feedback you add. You control how much of this information you enter, and all data is kept isolated within your personal account.
For billing, your payment card details are collected and stored by Stripe, our payment processor. We do not collect or store full card numbers ourselves. We do store your subscription status, plan type, and Stripe customer or subscription identifiers so we can manage your billing.
We also collect technical and usage information such as device type, browser, IP address, session tokens, and in-app interaction data to help us operate, secure, and improve the Service.
3. How we use your information
We use your information to provide and personalise the Service, including generating your 90-day program calendar, adapting meal and fasting suggestions to your preferences, tracking your progress, and displaying your workout history. We use your email to send authentication codes, account notifications, billing communications, and occasional service updates.
We also process data for security and fraud prevention, to diagnose technical issues, to improve the app's features and reliability, and to comply with legal obligations. Where we use data for analytics or improvement, we aggregate or de-identify it wherever possible.
4. Legal bases and consent
We rely on different legal bases to process your information. These include performing our contract with you, complying with legal obligations, pursuing legitimate interests such as security and improvement, and your consent where required. Health and fitness information is considered sensitive under many privacy laws. By entering this information into the Service, you consent to us collecting and using it for the purposes described in this policy. You can withdraw that consent at any time by deleting the relevant data or closing your account.
5. Sharing and processors
We do not sell your personal information. We share data only with trusted service providers who help us operate the Service. These include Stripe for payment processing, Supabase / Lovable Cloud for database, authentication, and storage, Resend for email delivery, and hosting providers that run the app.
Each processor is contractually bound to use your data only for the services they provide to us and to maintain appropriate security. We may also disclose information if required by law, to protect our rights or safety, or in connection with a business sale or merger.
6. International transfers
Some of our service providers may process data outside Australia. When this happens, we take steps to ensure that appropriate safeguards are in place, such as standard contractual clauses or the provider's adherence to recognised privacy frameworks, so that your information remains protected.
7. Data security
We take reasonable technical and organisational measures to protect your information from unauthorised access, loss, or misuse. This includes encryption of data in transit, access controls for our infrastructure, and isolated, private storage for sensitive content such as progress photos. No system is completely secure, so we also encourage you to keep your email account and devices secure.
8. Retention
We keep your personal information for as long as your account is active or as needed to provide the Service. If you close your account, we will delete or de-identify your information within a reasonable period, except where we are required to retain it for legal, billing, or security purposes. You may request deletion at any time by contacting us at [CONTACT EMAIL].
9. Your rights
Under the Australian Privacy Principles and, where applicable, laws such as the GDPR, you have the right to access, correct, and delete the personal information we hold about you. You may also have the right to object to certain processing, request portability, or withdraw consent.
To exercise your rights, please contact us at [CONTACT EMAIL]. We will respond within a reasonable timeframe. If you are not satisfied with our response, you have the right to complain to the Office of the Australian Information Commissioner (OAIC) or, where applicable, your local data protection authority.
10. Cookies and local storage
We use cookies and browser local storage to maintain your authentication session, remember your preferences such as theme and dashboard layout, and support the secure operation of the Service. You can manage or delete these through your browser settings, but doing so may affect your ability to stay signed in.
11. Children
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email or through the Service. The updated policy will take effect from the date stated at the top of the document.
13. Contact
If you have any questions or concerns about this Privacy Policy or our handling of your personal information, please contact us at [CONTACT EMAIL].