Privacy Policy

1. Information We Collect

We collect the following categories of information:

Account information. When you create an account, we collect your email address, password (stored only as a cryptographic hash by our authentication provider), and the first name you provide. We do not store your password in plain text, and we do not have access to it.

Profile information.As you use the Service, we collect profile data associated with your account, including your membership tier (free, Momentum, Transformation), session progression index, streak counters, execution points (“LP”), display name, and — if you choose to link your Discord account — your Discord user ID. If you sign in with Google via OAuth, we receive your email address and basic Google profile information.

Usage information. We collect information about how you use the Service, including session start and completion events, proof submissions, nutrition entries, check-ins, cancellations, session realignments, and exercise performance logs.

User Content. We collect content you upload, including proof images (stored on our image hosting provider) and free-text nutrition descriptions.

Payment information. If you subscribe to a paid plan, our payment processor (Stripe) collects your payment method information, billing address, and email address. MBF does not receive, store, or have access to your full card number or bank account details. We receive only a customer identifier, subscription status, and billing metadata from Stripe.

Communications. If you email us, reply to our emails, or interact with the MBF bot on Discord, we collect the content of those communications along with the timestamps and identifiers necessary to respond.

Device and log information. Like most web services, our servers automatically record standard log data: IP address, browser type and version, operating system, referring URL, and timestamps of your requests. This information is used for security, fraud prevention, and debugging.

2. How We Use Your Information

We use the information we collect for the following purposes:

• To operate the Service. Authenticating your account, displaying your progression and session data, computing streaks and points, storing your workouts and nutrition entries, and delivering the features you use.
• To process payments. Charging your payment method through Stripe for paid subscriptions, managing billing cycles, and handling refunds.
• To deliver the AI coach. Sending necessary context (profile data, progression metrics, nutrition targets, recent activity, and the messages you send to the coach) to our AI provider so the coach can generate relevant responses.
• To send transactional emails. Delivering welcome emails, daily protocol prompts, progression notifications, reminders, billing receipts, and similar service-related communications.
• To analyze and improve the Service. Aggregating usage data to understand which features work and which do not, detecting patterns of churn or abuse, and improving the quality of the training programs and coaching.
• To prevent fraud and abuse. Detecting and responding to fraudulent payment activity, multi-account abuse, falsified proofs, scraping, and other violations of our Terms of Service.
• To comply with legal obligations. Responding to lawful requests from regulators, law enforcement, or courts, and maintaining records required by tax and accounting law.

3. Legal Bases for Processing (for Users in the European Economic Area and United Kingdom)

If you are located in the European Economic Area, United Kingdom, or another jurisdiction with similar data protection laws, we process your personal information on the following legal bases:

• Performance of a contract. When we process your information to provide you with the Service you have contracted for (account creation, session tracking, payment processing, delivery of the AI coach).
• Legitimate interests. When we process your information for our legitimate business interests, including securing the Service, preventing fraud, improving our programs, and communicating with you about the Service. We balance these interests against your rights and interests.
• Consent. Where required by law, we rely on your explicit consent — for example, if we were ever to introduce optional marketing communications, we would only send them if you opted in.
• Legal obligation. Where we must process information to comply with a legal duty (such as maintaining tax records).

4. Service Providers and Third-Party Tools

We rely on the following third-party service providers (“sub-processors”) to operate the Service. Each provider receives only the information necessary to perform its function, and each is contractually obligated or otherwise required to protect your information.

We do not sell your personal information to any third party. We do not share your personal information with advertising networks, data brokers, or analytics companies for their own marketing purposes.

If we ever add a new sub-processor or materially change how existing sub-processors are used, we will update this Privacy Policy and, where legally required, notify you.

5. Cookies and Local Storage

The Service uses a small number of cookies and local storage items, all of which are strictly necessary to operate the Service:

• Authentication cookies. Set by our authentication provider (Supabase) to keep you signed in across page loads.
• Session cookies. Used to maintain your active session and prevent cross-site request forgery.
• Local storage. Used to remember user interface preferences and cache data between visits.

We do not use third-party advertising cookies, we do not use tracking pixels from social networks, and we do not integrate any third-party analytics platforms in the Service. Because we do not use any non-essential cookies, no cookie consent banner is displayed.

6. Data Retention

We keep your personal information for as long as your account is active and for a reasonable period thereafter in case you reactivate your account. Specific retention periods depend on the type of data:

• Account and profile data. Retained for the life of your account. After account deletion, most account data is removed from our active systems within 30 days, except where longer retention is required by law.
• Payment records. Retained for at least seven (7) years after the date of the transaction to comply with United States tax, accounting, and audit requirements.
• Proof images. Retained for the life of your account. You may request deletion of specific proof images by emailing legal@mbflockin.com.
• Nutrition entries, session records, and exercise logs. Retained for the life of your account. You may request deletion by emailing legal@mbflockin.com.
• Communications with MBF. Retained for as long as necessary to respond to your inquiries and to document our interactions, typically not longer than three (3) years after the last communication.
• Server logs. Retained for up to 90 days for security and fraud prevention, then deleted or aggregated.
• Anonymized and aggregated data. We may retain anonymized data indefinitely for statistical, research, and improvement purposes. This data does not identify you.

7. Your Rights — All Users

Regardless of where you are located, you have the following rights with respect to your personal information:

• Access. You may request a copy of the personal information we hold about you.
• Correction. You may request that we correct inaccurate or incomplete personal information.
• Deletion. You may request that we delete your personal information, subject to legal retention obligations (such as payment records).
• Export. You may request that we provide your personal information in a machine-readable format.
• Opt-out of transactional emails. Transactional emails related to your active subscription (billing receipts, password resets, account security alerts) are required for the Service to function and cannot be disabled. Protocol progression emails during the free Lock-In Protocol can be stopped by cancelling your free trial account.

To exercise any of these rights, email legal@mbflockin.com from the email address associated with your account.

8. California Residents' Rights (CCPA/CPRA)

If you are a resident of the State of California, you have additional rights under the California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”):

• Right to know. You may request that we disclose the categories of personal information we have collected about you, the sources of that information, the business purposes for collecting it, the categories of third parties with whom we share it, and the specific pieces of personal information we have collected about you.
• Right to delete. You may request that we delete the personal information we have collected from you, subject to certain exceptions (such as data required to complete a transaction, detect security incidents, or comply with legal obligations).
• Right to correct. You may request that we correct inaccurate personal information we hold about you.
• Right to opt out of sale or sharing. We do not sell your personal information, and we do not share your personal information for cross-context behavioral advertising. Because we do not engage in either activity, there is nothing for you to opt out of on this basis.
• Right to limit the use of sensitive personal information. We collect a limited amount of sensitive personal information (primarily your precise nutrition and fitness data). We use this information only for the purposes described in this Privacy Policy and do not use it for profiling in furtherance of decisions that produce legal or similarly significant effects.
• Right to non-discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not deny you the Service, charge you different prices, or provide a different level of quality because you exercised your rights.

To exercise any of your California rights, email legal@mbflockin.com from the email address associated with your account. We may need to verify your identity before fulfilling your request to prevent fraudulent access to your data.

Authorized agents. You may designate an authorized agent to submit requests on your behalf. We may require the agent to provide proof of authorization and may also require you to verify your identity directly.

9. European Users' Rights (GDPR/UK GDPR)

If you are located in the European Economic Area, United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR) and UK GDPR:

• Right of access to your personal information;
• Right to rectification of inaccurate or incomplete personal information;
• Right to erasure(“right to be forgotten”), subject to legal retention obligations;
• Right to restrict processing in certain circumstances;
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format;
• Right to object to processing based on legitimate interests;
• Right to withdraw consent at any time, where processing is based on consent (without affecting the lawfulness of processing before withdrawal);
• Right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, email legal@mbflockin.com. We will respond within 30 days, as required by GDPR.

10. How to Exercise Your Rights

To exercise any privacy right described in this Policy, email legal@mbflockin.com from the email address associated with your MBF account. Include the specific right you are exercising and any information necessary for us to locate your account and fulfill your request.

We will respond to your request within the legally required time frame — 45 days for CCPA requests (extendable by another 45 days if reasonably necessary), 30 days for GDPR requests, and a reasonable time for all others. Before fulfilling certain requests, we may need to verify your identity by matching the email address of the request to the account, confirming details known only to the account holder, or requesting additional information.

We do not charge a fee to respond to privacy rights requests, unless a request is manifestly unfounded, excessive, or repetitive, in which case we reserve the right to charge a reasonable fee or refuse the request as permitted by law.

11. Data Security

We implement and maintain reasonable administrative, technical, and physical security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:

• Encryption in transit. All data transmitted between your device and our servers is encrypted using TLS (HTTPS).
• Encryption at rest. Personal information stored in our databases (Supabase) is encrypted at rest according to industry standards.
• Hashed passwords. We never store your password in plain text. Passwords are hashed using industry-standard algorithms by our authentication provider.
• Access controls. Only authorized personnel with a legitimate business need have access to personal information systems, and access is logged and monitored.
• Presigned URLs for proof images. Proof images stored in Cloudflare R2 are served via time-limited presigned URLs, preventing unauthorized public access.

No system is perfectly secure. While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, and you should take care when using the Service.

Breach notification. In the event of a security breach that materially affects your personal information, we will notify affected users within a reasonable time, in accordance with applicable law. Notifications will be sent to the email address associated with your account.

12. Children's Privacy (COPPA)

The Service is not directed to children under the age of thirteen (13), and the Service requires users to be at least eighteen (18) years old per Section 3 of our Terms of Service. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe that a child under 13 has provided us with personal information, please contact legal@mbflockin.com immediately. We will investigate and, if we confirm the collection, delete the information from our systems.

13. International Data Transfers

MBF is based in the United States, and our primary service providers (Supabase, Stripe, Anthropic, Google, Discord, Resend) are also based in or operate significant infrastructure in the United States. One of our providers (Edamam) is based in the United Kingdom / European Union.

If you are located outside the United States, please be aware that your personal information may be transferred to, stored, and processed in the United States and other jurisdictions where data protection laws may differ from those of your country. By using the Service, you consent to the transfer of your information to the United States for processing.

Where required by law, we use appropriate safeguards for international data transfers, including standard contractual clauses where applicable.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, the addition of new features, new sub-processors, or changes in law. When we make material changes, we will notify you by email or through a prominent notice in the Service at least thirty (30) days before the changes take effect. Non-material changes may be made without notice.

The “Last updated” date at the top of this Policy indicates when it was most recently revised. Your continued use of the Service after the effective date of any modification constitutes your acceptance of the modified Policy.

15. Do Not Track Signals

Some web browsers include a “Do Not Track” (“DNT”) feature that lets you indicate that you do not wish to be tracked. Because there is no industry-standard way to respond to DNT signals, and because the Service does not engage in cross-site tracking or third-party behavioral advertising in the first place, we do not respond to DNT signals. If industry standards emerge around DNT, we will evaluate and update our practices accordingly.

16. Contact Us

If you have any questions about this Privacy Policy, your personal information, or how we handle data, please contact us at legal@mbflockin.com.

For all privacy-related requests, including data subject requests under CCPA/CPRA, GDPR, or any other applicable privacy law, please use the same email address. Include your full name, the email address associated with your MBF account, and a description of your request. We will respond within the legally required time frame.