The Formulaic Privacy Policy

Effective Date: May 2, 2025

Hello and welcome to The Formulaic's Privacy Policy! Rach and Rye LLC d/b/a The Formulaic, Inc. ("The Formulaic," "we," "us," or "our") is a U.S.-based digital fitness service provider. We value your privacy and are committed to protecting your personal information. This Privacy Policy explains what information we collect, how we use and share it, and the rights and choices you have. It is designed to comply with applicable U.S. laws such as California's CCPA/CPRA, the European Union's General Data Protection Regulation (GDPR) as applicable, as well as other relevant privacy regulations.

Please read this policy carefully. By using The Formulaic's websites, applications, and services (collectively, our "Services"), you agree to the practices described in this Privacy Policy. If you have any questions, feel free to contact us using the information in the Contact Us section at the end.

Information We Collect

We collect various types of information from and about you when you use our Services. This includes information you provide to us directly, data collected automatically about your use of our Services, and information from third parties (like when you use a Google or Facebook login). Below we explain the categories of information we collect.

1. Information You Provide to Us:

When you interact with The Formulaic, you may provide personal information, including:

Account Information: When you sign up, we ask for information like your name, email address, username, and password. If you choose, you may also provide additional profile details such as a profile photo, gender, age, or other fitness-related information (e.g., fitness goals or preferences).
Contact Information: You may provide contact details such as an email address or phone number (for example, to receive updates or verify your account).
Payment Information: If you subscribe to a paid plan or make purchases through our Services, you provide payment details. Note: The Formulaic uses reputable third-party payment processors (e.g., credit card companies or app store providers) to handle your payment transactions. We do not store your full credit card numbers or banking details on our own servers, though we may keep basic transaction records (like the fact that you subscribed and the amount/date) for billing and accounting.
User-Generated Content: Any content you choose to upload or create on our platform is collected. For example, if our Service allows you to log workouts, enter your fitness activity, post comments in a community forum, or send messages to a coach or other users, we will collect that information. Please be mindful that information you share in community areas may be visible to others if those areas are public or shared with other members.
Feedback and Communications: If you contact us (for example, via customer support inquiries, emails, or surveys), we collect the information you give us, such as your name, contact information, and the content of your message. This also includes responses you provide if you participate in any research, surveys, or promotional campaigns we conduct.

2. Information from Third-Party Services:

We support social login options to make it easier for you to create an account and sign in. If you choose to register or log in via a third-party service like "Sign in with Google" or "Log in with Facebook," we will receive certain information from those services:

Social Login Data: The specific data we receive can vary by provider, but it often includes your basic profile information such as your name, email address, and profile picture from that account. For example, if you use Facebook Login, we may receive your Facebook-registered name and email. We use this information to create or log in to your account on The Formulaic. We do not receive or store your third-party account passwords.
Permissions and Control: We only collect the information that the third-party service shares with us based on your settings and their privacy policies. You can control what information is shared by adjusting your settings with the third-party service (for instance, you can control the permissions in your Facebook or Google account settings). We recommend reviewing the privacy policies of Google or Facebook if you use those login options, as those services independently collect and handle your data during the login process.
Social Media Features: Our Services might include features that integrate with social networks (such as "Share" buttons or links to our own social media pages). If you interact with those, the companies that operate those platforms may collect information through cookies or other tracking (see Cookies & Tracking Technologies below). Any data collected by those third-party sites is subject to their own privacy policies.

3. Information We Collect Automatically:

Like many digital services, The Formulaic and our third-party partners (such as analytics providers and advertising partners) automatically collect certain information about your device and how you interact with our Services. This may include:

Usage Data: We collect details about how you use our Services – for example, when you log in, which workouts or content you view, features you use, the time spent on different parts of our app or website, and any links you click. This helps us understand what content is popular and how users engage with our platform.
Device and Technical Data: We gather information about the device and software you use to access our Services. This includes your device type (e.g., iPhone, Android, or web browser), operating system version, unique device identifiers or advertising IDs, browser type, screen resolution, and settings. We also log certain network information such as your IP address, general location derived from IP (e.g., city or country), internet service provider, and device language settings.
Cookies and Similar Technologies: When you use our website (or sometimes within our app), we and our partners use cookies and similar tracking technologies (like web beacons, pixels, SDKs, or local storage) to collect data automatically. Cookies are small text files placed on your device that help us recognize you and remember your preferences. For example, cookies enable you to stay logged in, and they allow us to track your usage for analytics and advertising purposes. We provide more detail on cookies in the Cookies & Tracking Technologies section below, including how you can control or opt out of certain tracking.
Analytics Information: We use third-party analytics tools (such as Google Analytics) that utilize cookies and device identifiers to help us analyze user behavior. These tools collect information like which pages you visit, how often you use the app, events within the app (e.g., completing a workout), crash reports, and overall usage patterns. This information helps us troubleshoot issues and improve the performance and design of our Services.
Log Files: Our servers automatically record certain data in log files, including when you accessed our Service and what you did. These logs may include IP addresses, browser type, referring/exit pages and URLs, number of clicks, and other interactions. We use log data for security monitoring (for example, detecting malicious activity), as well as aggregating usage statistics.

4. Information We Do Not Collect (Sensitive Health Information)

User-Provided Fitness/Health Info: Any fitness or health-related information we collect comes directly from you on a voluntary basis (for example, if you manually input your weight, fitness level, or other metrics into our app). Providing this type of information is optional and is used solely to personalize your experience (such as tracking your progress or tailoring workout recommendations). We treat any such information as sensitive and private. It is not used for advertising purposes and is not shared with third parties except as needed to provide the service (for instance, storing it securely on our systems so you can review your progress).
No Medical Advice: Remember, The Formulaic is a fitness and wellness service, and any health-related information you provide is for your personal use in the app. We do not use that information to provide medical advice, and you should always consult a healthcare professional for medical or health concerns.

By being transparent about what we collect and what we don't, we aim to give you control and clarity. If you ever have questions about the information you are asked to provide, please contact us.

How We Use Your Information

We use the personal information we collect for the following purposes, all in line with operating a digital fitness service and improving our offerings. We strive to only use your data in ways that you would expect from a fitness service, and if we want to use it for any unrelated purpose, we will seek your permission or ensure we have an appropriate legal basis. Specifically, The Formulaic uses your information to:

Provide and Improve the Service: We use data to create and manage your account, authenticate you when you log in, and deliver the features of our Services (for example, to stream workout videos, track your exercise progress, or display your logged activities). This also includes using data to personalize your experience – for instance, suggesting workout programs or routines based on your past activity or preferences. We analyze how users exercise and interact with our content to improve our training programs and add new features or content that we think you'll enjoy.
Customer Support and Communication: Your information helps us respond when you reach out for help. We use it to answer your questions, resolve issues, and make the app work smoothly with your devices. We may also send you important administrative communications about the Service. For example, we might send emails to inform you of changes to our terms or this privacy policy, confirm your subscription or payments, alert you about security issues or account changes (like a password reset), or let you know about new features that affect your use of the Service. These service-related communications are necessary for us to perform our contract with you and you may not be able to opt out of some of them (like critical security alerts).
Marketing & Promotional Communications: With your consent (or as otherwise permitted by law), we may use your contact information (like your email address) to send you newsletters, tips, motivational messages, special offers, or promotions about The Formulaic's products and events. For example, we might email you about a new training program we launched, a discount on a premium subscription, or our monthly fitness challenge. You are in control – if you no longer want to receive marketing emails or texts, you can opt-out at any time by clicking the "unsubscribe" link in the message or contacting us. We will not send you marketing communications if you have asked us not to. (This type of communication is optional and based on your consent where required by GDPR or other laws.)
Advertising and Retargeting: We use information about you to show you relevant advertising for The Formulaic on our Services and on third-party platforms. For instance, we (or third-party advertising partners acting on our behalf) might use cookies and pixels to record that you visited our website or used our app, and then use that to show you ads on other websites or on social media. We also may use your information to reach you (or others like you) with ads on platforms like Facebook or Google. One way we do this is through Facebook Advertising Tools such as the Facebook Pixel and Custom Audiences:

The Facebook Pixel on our site/app transmits certain information (like your user ID or device ID and what pages or content you viewed) to Facebook. This helps us measure the effectiveness of our Facebook ads and show you personalized ads. For example, if you visited our site and looked at a particular workout program, the pixel may enable us to later show you an ad for that program on Facebook or Instagram.
We may also utilize Facebook Custom Audiences, which means we might upload a list of email addresses (in a privacy-safe, hashed format) to Facebook in order to show targeted ads to our existing users (or find similar audiences). For instance, if you have signed up with The Formulaic, we might include your email in a hashed form to Facebook so that, if you are a Facebook user, you could see an ad about a new feature we're offering. Important: We only share this information with Facebook in compliance with applicable laws – for example, in the EU, we would do so only if we have your consent or another valid legal basis, and you have the right to object to this kind of processing.

Ad Choices: If you prefer not to receive personalized ads from us, you can opt out (see Your Rights & Choices below, such as the right to opt-out of "sale" or "sharing" of data under California law, or the right to object to processing for direct marketing under GDPR). Additionally, you can adjust your ad settings on platforms like Facebook and Google to control how your data is used for advertising across those platforms.
Analytics and Product Research: We use data (often aggregated or de-identified) to understand our user base and improve our Services. For example, we might look at overall usage trends to determine which features are most popular or where users might be encountering problems. This helps us troubleshoot issues, develop new features, and make informed decisions about our business. We may also conduct statistical analysis or surveys (with your consent if required) to get feedback. This category of use generally serves our legitimate interests in running and enhancing our service, but we ensure it does not override your rights and freedoms – when possible, we use aggregated data that does not directly identify individuals.
Security and Fraud Prevention: We are dedicated to keeping your data and The Formulaic's platform secure. We use information (like device identifiers, IP addresses, and unusual usage patterns) to monitor for and prevent fraud, abuse, security incidents, and other harmful activity. For example, we might use your IP and device info to detect if someone else is trying to log into your account, or to block spam or unauthorized integrations with our API. We may also use automated systems to help detect bot activity or violations of our Terms of Service. This processing is necessary to meet our legal obligations to protect data and also part of our legitimate interest in maintaining the integrity of our Service.
Legal Compliance and Enforcement: In certain cases, we need to use your information to comply with legal obligations or respond to lawful requests from authorities. For example, we may process personal data to fulfill tax and accounting requirements (like keeping transaction records), to respond to a court order or government inquiry, or to exercise or defend legal claims. We also may use and retain information as needed to enforce our Terms of Service or agreements (for instance, to investigate potential breaches, misuse of The Formulaic, or to address disputes).
Business Transfers: Although The Formulaic is currently an independent company, if in the future we undergo a business transition (such as a merger, acquisition by another company, or sale of all or part of our assets), user information (which may include your personal data) is typically one of the assets transferred to or acquired by a new owner. If that happens, we would ensure the new owner is contractually obliged to handle your personal data in line with this Privacy Policy (or you would be given notice and a chance to opt-out or delete your data if required by law). Using your data in anticipation of or as part of such a transaction is also done under legitimate interest of ensuring business continuity, and we will provide appropriate notice if your personal data will be subject to a different privacy policy as a result.

Lawful Bases for Processing (GDPR):

If you are in the European Economic Area (EEA), United Kingdom, or another region with similar laws (like Italy or Spain), we must have a valid legal basis to process your personal information. We generally rely on the following lawful bases:

Performance of a Contract: Much of our data processing is to provide you with the Services you requested under our Terms of Service (for example, when you sign up and use the app, we process your data to maintain your account, deliver workouts, etc.). This is necessary for the contract between you and us.
Consent: We rely on your consent in certain situations, such as when we send you promotional communications, or place non-essential cookies (e.g., analytics or advertising cookies) on your device, or when we process sensitive personal data you choose to give us (if any). When we rely on consent, you have the right to withdraw it at any time. For instance, you can opt-out of marketing emails by unsubscribing, or withdraw consent for cookies by adjusting your cookie settings. Withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal.
Legitimate Interests: We process some data for purposes that are in our legitimate interests (or those of third parties) – for example, to improve our services, secure our platform, present relevant advertising, or carry out business analytics. When we do this, we carefully consider and balance any potential impact on your rights. We will not process personal data under legitimate interest if our interests are overridden by the impact on you (like if it would be excessively intrusive). You have the right to object to processing based on legitimate interests (see Your Rights below).
Legal Obligation: In some cases, we need to process data to comply with a legal obligation, such as retaining certain records for tax purposes, or responding to valid legal process (warrants, subpoenas) if required by law.
Vital Interests/Public Interest: These bases are less likely to apply, but if ever we needed to process data to protect someone's life, vital interests, or for a task in the public interest that has a clear basis in law, we would do so in compliance with GDPR. (For example, in extremely rare emergency situations we might share information to assist with an urgent medical situation).

If you have questions about the legal basis for specific processing, please contact us and we will explain our practices in more detail.

Cookies & Tracking Technologies

Like most online services, The Formulaic uses cookies and similar tracking technologies to provide, protect, and improve our Services. This section explains what these technologies are and how we use them, as well as your choices regarding them.

1. What Are Cookies and Tracking Technologies?

Cookies: Cookies are small text files placed on your computer or mobile device when you visit a website. They allow the site (or a third party) to recognize your device and store some information about your preferences or past actions. Cookies can be "first-party" (set by The Formulaic's website) or "third-party" (set by other companies' services that we use, such as analytics or advertising providers).
Other Tracking Technologies: In addition to cookies, we may use technologies like web beacons (tiny graphic images embedded on pages or in emails that signal when you view them), pixels (like the Facebook Pixel mentioned earlier, which is a small snippet of code on our site that sends information to Facebook), local storage objects (which can store data in your browser), or software development kits (SDKs) in our mobile app (which function like cookies for app environments by using mobile identifiers). These technologies help us count users, see how our site/app is used, or determine whether an email was opened, among other things.

2. How We Use These Technologies:

We use cookies and similar tools for a few key purposes:

Necessary Operations: Some cookies are essential for our website and services to function properly. For example, we use cookies to keep you logged in as you navigate between pages, to remember items in your cart (if we ever offer e-commerce or subscription checkout on a web page), or to maintain session state in the app. These are often called "necessary" or "required" cookies, and without them, the service might be unusable or much less convenient. They also help with security (for instance, to help prevent fraud or unauthorized access).
Functional and Performance: We use these to remember your preferences and to analyze how our Services are performing. For instance, a cookie might remember your preferred language or that you already completed a tutorial so we don't show it again. We also use analytics cookies (like Google Analytics cookies) to gather information about user interactions (pages visited, features used, what leads users to our site, etc.). This data helps us improve site navigation, app design, and overall user experience. They are not strictly necessary, but greatly help us enhance the product.
Advertising and Personalization: Cookies and pixels are used to deliver relevant content and ads, both on our site and elsewhere. For example, we (and third-party ad partners) might use targeting cookies to limit the number of times you see the same ad and to measure the effectiveness of ad campaigns. If you've expressed interest in a certain fitness program on our site, cookies and ad trackers can help ensure you see an ad for that program later, rather than a completely unrelated ad. These technologies also help in building "lookalike" audiences – finding people with similar interests to show our ads to, which is a common advertising practice. We also may use cookies set by social media platforms when you click a "share" button or when you use the social login, which can collect data about your browser to facilitate those integrations.

3. Third-Party Cookies and Partners:

We work with third parties that deploy their own cookies or tracking tech through our Services. Key examples include:

Analytics Providers: As noted, we use Google Analytics (provided by Google) to understand how users use our site. Google Analytics may set cookies or read cookies on your device and transmit data about your usage to Google's servers (which may be in the U.S. or other countries). We have configured Google Analytics to anonymize IP addresses for EU users when possible, but some data still might be considered personal data. Google acts as our service provider for analytics, meaning they use the data only to provide insights to us and not for their own advertising. You can opt out of Google Analytics by installing Google's opt-out browser add-on or via our cookie consent tools where applicable.
Advertising Partners: Partners like Facebook, Google Ads, or others may use cookies or pixels to collect information on our site for advertising. For instance, as described, the Facebook Pixel allows Facebook to see that someone visited our site or took an action in our app, and then associate that information with a Facebook user (if applicable) to assist in ads. Similarly, if we run ads via Google Ads or other ad networks, those may set cookies to measure results or prevent you from seeing the same ad too many times. These third parties may act as our processors (using the data only on our instructions) or, in some cases, as independent controllers (using the data for their own purposes, such as improving their advertising services). In the latter case, they should provide you notice and choice about their use of the data (for example, Facebook's Privacy Policy will cover what they do with Pixel data).
Social Media Widgets: If our Service includes features from social networks (like an embedded Instagram feed, a "Like" button, or the ability to share content to Facebook/Twitter), those third parties may set cookies or collect usage data through their widget. For example, if you visit a page on our site with a Facebook "Like" button, Facebook might be able to collect your browser info even if you don't click the button, due to how the technology works. We want to make you aware that we cannot control these third-party tracking technologies. They are governed by the privacy policies of the third parties.

4. Your Choices: Managing Cookies and Tracking:

We believe you should have control over the data collected by cookies and similar technologies. Here's how you can manage your preferences:

Browser Settings: Most web browsers allow you to refuse or delete cookies. You can set your browser to block all cookies or to alert you when a cookie is being set. Each browser is different, but you can usually find these options under the "Settings" or "Privacy" menu of your browser. Please note, if you disable cookies entirely, our website (and others) may not function properly – for example, you might not be able to log in or use certain features that rely on cookies.
Cookie Consent Banner (for EU/UK users): If you are visiting from certain countries (like those in the EU, including Italy and Spain), you may see a cookie consent banner or pop-up on our site when you first visit. This banner allows you to accept or reject different categories of cookies (except the strictly necessary ones). You can use that tool to customize your preferences. If you later change your mind, you can typically find a link to our "Cookie Settings" at the bottom of our site to update your choices or withdraw consent.
Opt-Out of Targeted Ads: Even if you disable cookies, you might still see general ads about The Formulaic on other platforms, but they will not be personalized based on data from cookies. If you want to further control interest-based advertising, you can use industry opt-out tools. For example, the Network Advertising Initiative (NAI) and the Digital Advertising Alliance (DAA) offer websites where you can opt out of many participating ad companies' targeted ads – see NAI's opt-out page or DAA's opt-out page. For mobile apps, you can usually limit ad tracking by adjusting your device privacy settings ("Limit Ad Tracking" on iOS or "Opt out of Interest-Based Ads" on Android). These opt-outs are generally device-specific.
Do Not Track: Some browsers have "Do Not Track" (DNT) features that send a signal to websites to request that your browsing not be tracked. The web industry is currently still looking for a common standard to handle DNT. As a result, our site does not respond to DNT signals at this time. We will update this policy if that changes in the future.

By using our Services, you consent to the use of cookies and tracking technologies as described (to the extent consent is required by law). We aim to be transparent about our practices, but if you have any questions or if there's something you're unsure about in our use of cookies, please contact us.

How We Share Your Information

We understand that sharing of personal information is a sensitive topic. The Formulaic does not sell your personal information to third parties for money. However, we do share certain information with third parties in order to run our business and provide our Services to you. We also may share data for advertising purposes as described, which could be considered a "sale" or "sharing" under some privacy laws (like the CCPA/CPRA's definitions – see Your California Privacy Rights for details). In all cases of sharing, we only share the minimum information necessary for the purpose, and we have contracts or safeguards in place to protect your data. Here are the types of third parties and situations in which we share user information:

Service Providers (Processors): We employ other companies and people to perform tasks on our behalf – and they are bound to keep your information secure and use it only for the services they provide to us. For example, we use cloud hosting providers (to store our database and run our app), email service providers (to send out verification or newsletter emails), analytics services (to help us understand app usage), and customer support tools. These providers might process personal data as part of their work (e.g., our email provider will handle your email address to send messages, our cloud provider stores your account info on their servers). We ensure through contracts that they cannot use your data for their own purposes and must handle it under strict confidentiality and security standards.
Advertising and Marketing Partners: As described in the Advertising section, we may share certain limited information with marketing partners to reach you with ads or offers. This includes:

Social Media Advertising Partners: We may share identifiers and usage data with platforms like Facebook, Instagram, Google, or others to facilitate targeted advertising. For example, sharing a hashed email or phone number with Facebook to create Custom Audiences (so our ads can be shown to existing users or people with similar interests), or allowing Google to collect certain data via our site for remarketing. We also might share your device identifiers with advertising networks to measure ad effectiveness. These partners may act as "service providers"/"processors" in some cases, or as separate "controllers" in others (using the data for their own ad ecosystem purposes). In jurisdictions where required, we will ask for your consent before engaging in this kind of data sharing (for instance, via the cookie consent for advertising cookies or via obtaining opt-in for email-based Custom Audiences in the EU). You have the right to opt out of this sharing as described in Your Rights & Choices.
Email Marketing and CRM: If we use a marketing platform to send newsletters or promotions, that platform will have access to your email address and name for the purpose of sending those emails on our behalf. They are not allowed to use your info for anything else.

Payment Processors: If you make purchases, your payment information will be handled by third-party payment processors (such as Stripe, PayPal, Apple App Store, Google Play, or others depending on how you subscribe). Those third parties specialize in payment processing and have their own privacy and security practices. We share information such as your name, email, and purchase details as needed to process the payment. We do not receive or store your sensitive payment card details from these processors (other than perhaps the last four digits for reference, card type, and billing ZIP for record-keeping). The payment processors may be independent controllers of your payment information, as they require that data to process transactions and comply with their legal obligations (like anti-fraud and financial regulations). We recommend you review the privacy policy of whichever payment method you use for more details on their practices.
Affiliates and Business Partners: At present, The Formulaic is an independent company and not part of a larger corporate group. If in the future we have affiliates, parent, or subsidiary companies, we might share your information within that corporate family in accordance with this policy (for example, to streamline services or because a subsidiary is providing part of the service to you). We will update this policy and let you know if we start sharing data with any new affiliates. Separately, we sometimes partner with other companies to offer co-branded services or promotions. If you explicitly sign up for a co-branded event or offer (for example, a fitness challenge in partnership with a nutrition company), we might share information with that partner with your consent or as necessary to administer the program. We will make it clear at the point of collection (for example, on the sign-up form) if your data will be shared with a partner, and why.
Legal and Safety Disclosures: We may disclose information about you if required to do so by law or legal process, or if we have a good faith belief that such disclosure is reasonably necessary to:

Comply with applicable law, regulation, legal process (such as a subpoena or court order), or enforceable governmental request.
Enforce our Terms of Service or other agreements, investigate potential violations, or protect the security or integrity of our Services (for example, sharing data with law enforcement regarding fraudulent or hacking activities).
Protect the rights, property, or safety of The Formulaic, our employees, our users, or the public. This could include sharing information with credit card companies or law enforcement agencies for fraud protection, or addressing emergencies that pose a threat to anyone's safety.

Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your information may be transferred as part of such a transaction. This would be done in compliance with applicable data protection laws. Any new owner or reorganized entity will be required to honor the commitments we have made in this Privacy Policy regarding your personal data (unless you're notified otherwise and given a chance to opt-out, if required by law).
No Sale of Personal Information (for Monetary Consideration): We want to reiterate that we do not sell your personal information for money. In other words, we don't give your name or email or any other personal details to unaffiliated companies for their own marketing purposes in exchange for payment. The only "selling or sharing" that occurs is in the context of allowing third-party cookies/trackers for advertising or uploading customer lists to ad platforms, which some privacy laws interpret as a "sale" or "share" (because something of value – your attention or the ability to show you ads – is obtained). We treat this kind of data sharing with the utmost care and provide you the ability to opt out of it.

If you ever have questions about who we share your information with, please contact us. We can provide more detailed information depending on your inquiry, and for residents of certain jurisdictions (like California), we detail additional specifics in the relevant section below.

International Data Transfers

The Formulaic is based in the United States, and the majority of our systems and data storage are located in the U.S. If you are using our Services from outside the U.S. (for example, in Italy, Spain, or elsewhere in Europe), this means that your personal information will likely be transferred to and processed in the United States, as well as potentially other countries where our service providers are located or have servers (for instance, our cloud hosting or content delivery providers might use data centers globally).

Privacy Laws and Protections: Different countries have different data protection laws. The U.S. may not have the same level of data protection as the laws in your home country. However, if we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the U.S. or any other country that hasn't been deemed "adequate" by the EU, we take steps to ensure your data is afforded a high level of protection. Our measures include:

Standard Contractual Clauses (SCCs): We use the European Commission's approved Standard Contractual Clauses as a legal mechanism for data transfers. These are contractual commitments between companies transferring personal data, binding them to protect the privacy and security of data in line with EU standards. In practice, this means that whenever we transfer your personal data to our U.S. servers or to a third-party service provider in another country, we have an agreement in place requiring the recipient to protect your data to GDPR standards.
Additional Safeguards: In addition to SCCs, we evaluate on a case-by-case basis if supplementary measures are needed for specific transfers. This might include encryption of data in transit and at rest, ensuring data is pseudonymized where possible, and carefully vetting the security practices of our partners. We also monitor legal developments (such as any guidance from EU authorities or treaties between countries) to maintain compliance.
EU-U.S. and Swiss-U.S. Data Privacy Framework: The U.S. and EU have been working on frameworks to ease data transfer concerns (formerly "Privacy Shield," now updated with a new Data Privacy Framework mechanism). If The Formulaic decides to certify under any such framework or use it in addition to SCCs, we will update this policy. As of the effective date above, we rely primarily on SCCs for EU data transfers.

By using the Service or providing us information, you consent to the transfer of your personal data to the U.S. and other jurisdictions as described in this policy (to the extent this consent is required and valid in your jurisdiction). Where consent is not the basis for transfer, we assure you that we will handle your data in accordance with this policy and applicable law regardless of where it is processed.

If you are in the EU/EEA, UK, or Switzerland and have questions or concerns about international data transfers, you can contact us (see Contact Us section). In some cases, you have the right to request details of the safeguards we use (for example, a copy of the SCCs relevant to your data – though we may need to redact some parts for confidentiality).

We also want to note: The Formulaic does not engage in cross-border transfers that are not necessary. We don't, for example, unnecessarily route EU user data to unrelated third countries. Transfers happen mainly because our main operations are in the U.S. and we use U.S.-based cloud services. We will continue to monitor the legal landscape and collaborate with our users and regulators to ensure compliance with international data transfer rules.

Data Retention

We retain personal information for as long as needed or permitted in light of the purpose(s) for which it was collected and consistent with applicable law. The criteria we use to determine retention periods include:

Duration of Your Use of Services: We keep your account information while your account is active. If you have an account with us, we will retain your data for as long as you maintain that account. Workout logs, progress data, and other information you store in our app will be kept until you delete it or delete your account (unless we have a compelling reason to delete it sooner or keep it longer).
Consent and Preferences: If you provided information based on consent (e.g., marketing email lists) and later withdraw consent or opt-out, we will stop using that data for that purpose. However, we might keep a record of your opt-out request (for example, your email) to ensure we don't accidentally send you marketing again.
Legal Obligations: We may need to retain certain information for a set period as required by law. For example, financial transaction records are often kept for a number of years for tax or accounting audits. If we deleted such records immediately upon account deletion, we might violate laws requiring us to maintain evidence of transactions. Similarly, if you made any purchases, we may retain some basic data to show we delivered the service and to comply with financial regulations.
Dispute Resolution and Enforcement: If there's an outstanding issue, claim, or dispute involving your data or account (for example, an unresolved complaint, or a legal hold due to litigation), we will retain the necessary information until the issue is resolved. We also keep records to enforce our agreements and to prevent harm (for instance, information about accounts banned for misconduct may be retained to block future accounts).
Security and Backups: Even after you delete information from your account or request deletion, it might not be immediately removed from our backup systems. We typically remove deleted data from active databases promptly, but it might remain in secure backups for a period (since it's impractical to immediately purge all backup copies). We protect any data in backups with strong security and eventually overwrite or delete it according to our retention schedules.

When we no longer have a legitimate need to retain your personal information, we will securely dispose of it or anonymize it (so it can no longer be associated with you). For example, we might aggregate and anonymize usage data so it can be used for statistical purposes without identifying any user.

If you decide to delete your account, we will delete or de-identify your personal data, except for information we are required or permitted to keep by law (as outlined above). We describe how you can delete your account or request deletion in the Your Rights section below.

Data Security

We take the security of your personal information seriously. The Formulaic implements a variety of administrative, technical, and physical safeguards designed to protect your data against unauthorized access, theft, and loss. However, no method of transmitting or storing data is 100% secure, so we cannot guarantee absolute security. We encourage you to also do your part in protecting your information.

Security Measures We Use Include:

Encryption: We use encryption to protect data in transit and at rest. For example, our website and app use HTTPS/TLS encryption for all data transfer, which protects information exchanged between your device and our servers from eavesdropping. Sensitive information (like passwords) is stored in an encrypted or hashed form.
Access Controls: We limit access to personal information to only those employees, contractors, and service providers who need access to perform their duties. They are bound by strict confidentiality obligations. Our internal policies prevent unauthorized access, use, or modification of your data. We also require account authentication for users (choose a strong password and keep it confidential; if you use social login, ensure your third-party account is also secure).
Monitoring and Testing: We regularly monitor our systems for possible vulnerabilities and attacks. We use firewalls and intrusion detection systems to guard our network. We also periodically test and evaluate the effectiveness of our security measures, and update them in light of new threats or advances in security technology.
Incident Response: In the event of a data breach or security incident, we have procedures in place to respond promptly. Part of our plan includes notifying users and relevant authorities of breaches as required by law. We hope to never have to use this, but we're prepared nonetheless.

Your Responsibilities: You play an important role in keeping your information secure. Please maintain the secrecy of your account credentials. Do not share your password with others, and use unique, strong passwords for our Service and your email account (since email can be used for password resets). If you suspect any unauthorized access or suspect that your account or information has been compromised (for example, you notice unfamiliar activity on your account), please notify us immediately so we can help secure your account.

Despite our efforts, no security measure is perfect. Cyber threats evolve rapidly, and there's always some risk. We cannot fully guarantee the security of data transmitted to our site; any transmission is at your own risk. Once we receive your data, we do our best to protect it on our systems. If you have questions about the security of The Formulaic, feel free to reach out via the contact information below.

Your Privacy Rights and Choices

You have important rights and choices regarding your personal information. Depending on where you live, you may be entitled to exercise certain privacy rights under applicable laws like the GDPR for EU users (including users in Italy and Spain) and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) for California residents. We are committed to honoring your rights and have outlined them here in a user-friendly way. Even if you do not reside in these regions, we provide many of these controls to all our users as a matter of transparency and fairness.

Rights for EEA/UK/Swiss Users (GDPR Data Subject Rights)

If you are located in the European Economic Area (EEA) or a country with similar laws (such as the United Kingdom or Switzerland), you have the following rights regarding your personal data, under the GDPR and local implementations of it. These include:

Right to Access: You have the right to request a copy of the personal data we hold about you and to obtain information about how we process it. This is often called a "Data Subject Access Request."
Right to Rectification: If any of your personal information is inaccurate or incomplete, you have the right to ask us to correct or update it.
Right to Erasure (Right to be "Forgotten"): You can request that we delete your personal data under certain circumstances. This is not an absolute right, but we will honor it if: the data is no longer needed for the purposes it was collected; you withdraw consent (and we have no other legal basis to keep processing); you object to processing based on legitimate interest (and we have no overriding grounds to continue); we unlawfully processed the data; or to comply with a legal obligation. Please note there are exceptions – for example, we might retain some information if necessary for legal claims or required by law (as outlined in Data Retention above). If you want to delete your account or data, the easiest way is by contacting us directly. We will respond and delete data as required, and confirm when it's done.
Right to Restrict Processing: You have the right to request that we limit the processing of your data in certain situations. This could apply if you contest the accuracy of your data (while we verify it), if our processing is unlawful but you prefer restriction over deletion, or if you need us to keep data for establishing/exercising legal claims while we might otherwise delete it, or if you have objected to processing and await verification of overriding grounds.
Right to Object: You have the right to object to our processing of your personal information when that processing is based on legitimate interests (or performed in the public interest/exercise of official authority). If you object, we will review the reasons and stop processing unless we have compelling legitimate grounds that override your interests, rights, and freedoms or if processing is needed for legal claims. Importantly, you have an absolute right to object to processing of your personal data for direct marketing purposes at any time. This means if you object to use of your data for marketing (including any profiling related to direct marketing), we will cease that use.
Right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another controller (for example, another app or service), when the processing is based on your consent or a contract and is carried out by automated means. In simpler terms, for certain data, we'll help you get a copy that you can take to another service. If technically feasible, you can also ask us to send it directly to the other company if our systems allow it.
Right Not to be Subject to Automated Decision-Making: The GDPR provides that you have the right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you, unless it's necessary for entering into or performing a contract, based on your consent, or explicitly authorized by law with safeguards. The Formulaic's processing of your data does not involve any fully automated decisions that have a legal or significantly impactful effect on you. While we may use algorithms to suggest content (like recommending workouts) or for fraud detection, these do not rise to the level of legal or similarly significant impacts. There's always some human oversight or the ability to intervene.
Right to Withdraw Consent: If we rely on consent for any processing, you have the right to withdraw that consent at any time. This typically applies to things like marketing emails (where you gave consent) or connecting to Apple Health or other integrations (which we don't do currently). Withdrawing consent will not affect processing already done, but it will stop that particular processing going forward.
Right to Complain to a Supervisory Authority: We would appreciate the chance to address your concerns directly, but you also have the right to lodge a complaint with an independent data protection authority about how we handle your data. If you are in Italy, you can contact the Garante per la Protezione dei Dati Personali; if in Spain, the Agencia Española de Protección de Datos (AEPD); or the supervisory authority in your country of residence or work.

How to Exercise These Rights: You can exercise your rights by contacting us (see Contact Us below). For certain requests, we might need to verify your identity to ensure we're protecting your information from unauthorized access (for example, we don't want to give your data to someone pretending to be you). Verification might involve confirming your email address or asking for information that confirms you are the account owner. We will respond to your request as soon as possible, and at least within the timeframes required by law (generally within one month for GDPR, with possible extension if the request is complex – but we will inform you if an extension is needed).

There is usually no fee for exercising your rights. However, if a request is manifestly unfounded or excessive (for example, repetitive), we may either charge a reasonable fee or refuse to act on it, but we would provide an explanation in such cases.

We want you to have control over your data, so please do reach out if you have any questions or requests regarding your personal information.

California Privacy Rights (and Similar U.S. State Laws)

If you are a California resident, you have specific privacy rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) (effective January 1, 2023). Other states like Colorado, Connecticut, Virginia, and Utah have also passed consumer privacy laws with similar rights. The Formulaic is committed to extending appropriate rights and choices to users in the U.S. as well. In this section, we focus on California rights for simplicity, but if you are a resident of another state with privacy laws, you can exercise similar rights and we will honor them in accordance with applicable law.

Categories of Personal Information Collected: The CCPA requires us to disclose the categories of personal information we collect and purposes, which largely align with what we've described throughout this policy. In the past 12 months, we may have collected the following categories (as defined by California law):

Identifiers: Such as your name, email address, username, IP address, device identifiers, and login name.
Customer Records Information: This includes contact details (like phone number if provided) and payment information (note: we do not keep full financial account numbers, but we process payments).
Characteristics of Protected Classifications: We generally do not collect sensitive characteristics like race, ethnicity, or religious beliefs. We might collect age or gender if you provide them in your profile, but this is optional. (Any such info is used to personalize your experience – e.g., offering age-appropriate fitness content – and not for unlawful discrimination.)
Commercial Information: Records of products or services purchased or considered. For example, which subscription plan you have, if you took advantage of a promotional offer, or your purchase history within our app (like if you bought add-on content).
Internet or Other Electronic Network Activity: This includes browsing history, search history, and interactions with our app/website and ads. For instance, information on how you use our website or app (pages viewed, links clicked) and our advertisements on third-party sites.
Geolocation Data: We do not typically collect precise geolocation (e.g., your exact GPS location) unless you explicitly permit and use a feature that needs it (which our current service does not have, except possibly deriving city level from IP). We do collect general location data (such as city, state, or country inferred from your IP address, or if you enter your location in your profile).
Sensory Information: Not commonly collected, but if you voluntarily upload photos (profile picture or other images) or videos to our community, that would be visual information we collect. We do not record phone calls.
Inferences: We may draw inferences about your preferences or characteristics to personalize your experience. For example, if you consistently do yoga workouts, we might infer you enjoy yoga and recommend more of that content. These inferences are used to improve our Services and marketing, and are not sold to third parties.

Purposes for Collecting/Using Personal Information: We collect and use the above information for the business and commercial purposes outlined in How We Use Your Information, such as providing the Service, personalization, marketing, security, analytics, and so forth. All these purposes are ones the CCPA/CPRA consider "business purposes" or "commercial purposes" for which personal information may be used.

Disclosure of Personal Information: In the last 12 months, we have disclosed the above categories of personal information to third parties for business purposes. The categories of third parties correspond to what we described in How We Share Your Information (service providers, advertising partners, payment processors, etc.). For example, we may disclose identifiers and internet activity to our analytics and advertising partners; we disclose customer records info to our payment processor to complete transactions; etc.

We do not sell personal information for money. However, the CCPA's definition of "sell" includes some transfers of data that involve benefit to us, even if no money is exchanged. Specifically, the use of third-party advertising cookies and the sharing of identifiers for targeted advertising might be considered a "sale" or "sharing" of personal information under California law. In CCPA terms:

"Sale" is sharing of personal info for valuable consideration (broadly defined).
"Sharing" (a term introduced by CPRA) specifically covers sharing of personal info with third parties for cross-context behavioral advertising (targeted ads based on personal info obtained from activity across different businesses/services).

Under these terms, The Formulaic may be deemed to have "sold" or "shared" identifiers and internet activity information (like cookie IDs, advertising IDs, usage data) to advertising partners (like Facebook, Google) for the purpose of showing you targeted ads. We want to be very transparent: we don't hand over your data to brokers or data resellers, but when we allow third-party advertising cookies on our site or use tools like Facebook Custom Audiences, those could fall under "sale"/"sharing" definitions because they involve providing personal info (e.g., a cookie ID or hashed email) to a third party (ad network) that then uses it to help target ads.

Your California Privacy Rights: As a California consumer, you have the following rights under CCPA/CPRA:

Right to Know: You have the right to request that we disclose what personal information we have collected about you in the past 12 months, including the specific pieces of information, the categories of sources, the purposes for collecting it, and the categories of third parties with whom we share it. You also have the right to know if we have sold or shared your personal information (as defined by law) or disclosed it for a business purpose.
Right to Delete: You can request that we delete the personal information we have collected from you (and direct our service providers to do the same). As with the GDPR right to erasure, there are some exceptions – for example, we may retain information needed to complete the transaction for which it was collected, detect security incidents, comply with legal obligations, or other reasons allowed by CCPA. But if none of those exceptions apply, we will delete the data and confirm with you once it's done.
Right to Correct: Under CPRA, California residents have the right to request correction of inaccurate personal information maintained by us. If you believe any information we hold about you is incorrect, please let us know. After verifying your identity and validating the request, we will correct the information where required. In many cases, you can also correct or update info yourself through your profile or account settings (e.g., change your email, update your weight or goals if you entered them wrong, etc.).
Right to Opt-Out of Sale or Sharing of Personal Information: You have the right to tell us not to sell or share your personal information (as those terms are defined in California law). As explained, while we do not sell data for money, we might share data for advertising that could legally be considered a "sale" or "sharing". California law gives you the right to opt out of that. You can opt out of targeted advertising cookies on our site by adjusting your cookie preferences (e.g., via the cookie banner or settings). You can also contact us to register an opt-out, especially tied to your account or identifiers (so we avoid using your data in things like Custom Audiences). We have also provided links to industry opt-outs in the Cookies & Tracking section. If required, we will enable a "Do Not Sell or Share My Personal Information" link or mechanism on our website to facilitate this request (in jurisdictions where this is mandated, such as California). Once you opt-out, we will (a) stop any "sale" of your data, and (b) instruct our partners to stop using data obtained from our site for those purposes for your browser (to the extent they can). If you come back with a different browser or device, you may need to opt-out again because the opt-out might be stored in a cookie.
Right to Limit Use of Sensitive Personal Information: CPRA introduced a right to limit the use of "sensitive personal information" (SPI) if a business uses SPI for reasons beyond what's necessary to provide the services. SPI includes things like precise geolocation, health data, and certain financial information. We want to clarify that The Formulaic does not use or disclose sensitive personal information for purposes that would trigger this right. The limited sensitive info we might have (like health or fitness info you optionally provide, or approximate location from IP) is used only to serve you (e.g., customizing your fitness plan) and not for inferring characteristics or showing you ads. Therefore, there is no additional use of SPI that you would need to limit. If in the future we contemplated using SPI for other purposes, we would implement a "Limit Use of My Sensitive Info" mechanism as required.
Right of Non-Discrimination: We will not discriminate against you for exercising any of these rights. This means we won't deny you our Services, charge you different prices, or provide a lesser quality of service just because you exercised your privacy rights. (However, note that if deletion of data or opting out of certain uses makes it impossible for us to provide all or some aspect of the Services.)

How to Exercise California/US Privacy Rights: If you are a California resident (or a resident of another state with similar rights) and you want to exercise your access, deletion, correction, or opt-out rights, you can contact us through the methods listed in Contact Us below. Please indicate which right you are requesting to exercise.

We will need to verify your identity to process certain requests, especially for access or deletion of data. This is to ensure we don't give someone else's data to you or delete someone else's data improperly. Verification might involve checking that the request comes from the email associated with your account or asking for additional information. For significant requests, we may require a signed declaration confirming your identity. If you have an account, logging into the account to make the request is often sufficient verification.

For opt-out of sale/sharing, we will honor that based on your request (usually verification is not needed for an opt-out request except to the extent we need to make sure we apply it correctly to your data).

Shine the Light: California's "Shine the Light" law (Civil Code § 1798.83) allows California residents to ask companies once a year for a notice describing what categories of personal information we share with third parties for their direct marketing purposes. However, The Formulaic does not share your personal information with unaffiliated third parties for their own direct marketing (without your consent). Therefore, we believe there's no such sharing to report under that law. If you have questions about this or require further information, you can contact us.

Additional Notes for Other Regions

Nevada Residents: Nevada law gives consumers in Nevada the right to request that a website operator not sell their personal information for monetary consideration to certain other parties. We do not sell personal information for monetary consideration, but if you are a Nevada resident, you can still email us a request to not sell your information in the future just in case our practices change. We will place you on a do-not-sell list.
Other U.S. States: As mentioned, states like Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and Utah have privacy laws effective in 2023 giving consumers rights similar to California (access, delete, opt-out of targeted ads/sales, etc.). If you are a resident of one of these states, you can exercise your rights in the same way described above and we will process your request in accordance with applicable state law. Generally, the rights and our responses will mirror what we've outlined for California (minus some terminology differences). We are working to ensure compliance with all such laws. If any divergence is needed, we will update our practices and this policy accordingly.

Our goal is to provide a consistent and user-friendly experience regarding privacy rights, regardless of your location. We will continue to update our privacy practices as laws evolve, so you may see updates to this section from time to time.

Children's Privacy

The Formulaic's Services are not intended for children under the age of 13. We do not knowingly collect personal information from anyone under 13 years old. Additionally, if you are in the European Union (or countries with similar rules), our Services are not directed to children under the age at which parental consent is required (under GDPR, this age is 16 by default, but it may be lowered to 13 or 14 by certain countries – for example, 14 in Italy and Spain). We do not knowingly collect data from children under such ages either without appropriate consent.

If you are under the minimum age applicable in your country, please do not use The Formulaic or provide any personal information to us. If we learn that we have inadvertently collected personal information from a child without proper consent, we will take steps to delete that information promptly.

Parents or guardians who believe that The Formulaic might have collected personal information from their child can contact us (see Contact Us below) and request that the data be removed.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, and other factors. When we make changes, we will update the "Effective Date" at the top of the policy. If the changes are significant, we may also provide a more prominent notice or seek your consent as required by law – for example, by emailing you or posting a notice in the app.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information. Your continued use of our Services after any update to this Privacy Policy will constitute your acknowledgment of the changes and agreement to be bound by the updated policy, as applicable.

For any material changes, especially those affecting users in jurisdictions with specific notice requirements (like the EU or California), we will take appropriate measures to inform you in advance and, if required, to obtain your consent.

Contact Us

Thank you for reading our Privacy Policy. We hope it clearly explains how we handle your personal information. If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, here's how you can reach us:

Email: You can email our privacy team at privacy@theformulaic.com. This is often the fastest way to get a response regarding privacy matters or to exercise your rights described above.

We are happy to answer questions or help resolve any issues you have about your privacy and our data practices. Your trust is extremely important to us, and we welcome your feedback.

Thank you for being a part of The Formulaic community! We are dedicated to safeguarding your privacy while you pursue your fitness journey with us. Remember, you are in control of your data – and we're here to help in any way we can to ensure you feel secure and empowered. Stay healthy and stay informed!