Privacy Notice

Your information, handled with care

Due East Strength Co. is operated by Rob Murphy in Hamptons, NY. This notice explains how we handle information when you use our app, member website, public website and coaching services. For privacy questions or requests, contact [email protected].

Due East provides general fitness education and wellness support, not medical care. Information you share with us does not create a physician-patient relationship, and this service is not an emergency service.

Information you provide

Depending on your membership and the tools you choose, we collect:

Account details: Your name, phone number, email address, password credentials and account preferences. We keep a protected password representation rather than storing your readable password.
Intake and preferences: Your adult-eligibility confirmation, goals, training experience, schedule, available equipment and answers used to prepare your experience. If supplied, this includes age, height, weight, calculation inputs, nutrition preferences and relevant restrictions.
Eligibility for automatic estimates: If you request an automatic nutrition estimate, the app stores whether you confirmed that the displayed pregnancy/breastfeeding, prescribed-diet, condition and eating-disorder-history exclusions do not apply. This sensitive eligibility answer is used only to decide whether the general estimate is available. You can skip the estimate and use your own targets.
Training and daily records: Plans, completed exercise, sets, feedback, journal entries, body weight, sleep, habits, food-macro and fluid entries, and targets you choose to track.
Communication, scheduling and support: Messages, appointment requests, proposed times, confirmations and information you send when asking for help. Support information can include your device model, operating-system version, purchase details and screenshots you choose to send.
Optional uploads: Progress photos and form-review images or videos you choose to provide. Videos may contain your voice and surroundings; do not include information about other people without permission.
Membership records: Your membership, payment status and subscription identifiers used to confirm access and manage your account.

Only provide information you are comfortable sharing and that is relevant to the service. An optional field remains optional, but information submitted to the service is still processed as described here. Do not use free-text fields to send passwords, payment-card numbers, government identification numbers or unrelated medical records.

How we use information

We use information to maintain your account, prepare and deliver plans, provide purchased coaching, display your records, respond to messages, arrange calls, confirm membership, deliver requested recovery emails, protect accounts and process privacy requests.

Where an enabled feature provides automatic plan adjustments or estimates, it uses the answers and activity relevant to that feature. Estimates are starting points, not medical advice or a guarantee of suitability. You can review applicable preferences and tracking targets in the app; contact us when a correction is not available through a self-service control.

Account and activity information

The service records limited activity needed to operate features, such as when you last opened the app, message-read status, acceptance of a particular terms version and relevant account-security events. These records can be linked to your account.

Available reminders depend on your choices and device permissions. Necessary replies, password-recovery messages, billing communications and privacy-request updates are distinct from optional activity reminders. Hosting and external resources may also process IP addresses, device/browser details and request or security logs.

Progress photos are private by default. A separate choice controls whether a progress photo is shared with your coach; accepting service terms is not permission to publish photos, use them in advertising or make them a testimonial.

Content you intentionally send for a coaching form review is provided for that review. Do not assume a video has had its sound, background or embedded information removed. Review the content before uploading it.

Service providers and third-party services

We use providers to host the service, store records and private media, deliver account emails, support scheduling and process subscriptions. Information handled on our behalf remains part of our privacy-request process; a provider's involvement does not automatically exempt it from deletion.

The services below apply to the features and channels you use. Listing a payment or backup provider does not mean every checkout or backup feature is currently available:

Hosting and storage: Google Cloud Run hosts the shared member service. Perplexity hosts these public legal pages. Cloudflare provides the configured record and private-media services. Google Cloud Storage is being prepared for encrypted member backups; scheduled production member backups through that service are not yet operational. These services have distinct storage, recovery and deletion processes, not a single shared retention period (Perplexity privacy, Cloudflare recovery, Google Cloud deletion).
Account email and support: Resend handles enabled account-email delivery; the dedicated Due East Gmail mailbox holds support messages and applicable notification copies. Message bodies, delivery logs and internal recovery copies can have different retention periods (Resend privacy and retention, Google retention).
Scheduling: Google Calendar/Meet supports arranged calls, and Cal.com handles bookings made through our intro-call link. A cancelled appointment is not necessarily erased from all calendar, booking, email or recovery systems (Calendar deletion, Cal.com privacy).
Legacy enquiries: Formspree may hold submissions from our public marketing forms and older signup path, and applicable review notifications. Our new enrollment flow does not send its intake through that legacy signup function; old submissions and delivered email copies still require separate handling (Formspree privacy).

Providers may process information in the United States and other locations described in their notices. A storage bucket's location does not establish that all service processing occurs there. We may disclose information when required by law or reasonably necessary to protect rights, safety and account security.

iPhone subscriptions, when available, use Apple. Web coaching subscriptions, when offered, use Stripe. We use subscription and transaction information to confirm your access; payment details entered into those providers' own payment interfaces are handled under their notices. These providers may independently retain records for legal, financial and fraud-prevention purposes (Apple App Store privacy, Stripe privacy). Their independently required records are distinct from the subscription identifiers and other copies we control.

Exercise demonstrations use YouTube content and may open an embedded player or an in-app browser. YouTube describes collection on player loading and playback; privacy-enhanced mode limits personalization but is not a promise of no collection (YouTube developer policies, YouTube embedding help). Google's handling and retention of this information depend on the service, data and applicable settings (Google retention).

Where pages load Google Fonts, the request sends technical information including your IP address, requested resource and browser/referrer information to Google. Google says the Fonts API does not set or log cookies or use that information to create end-user profiles or for targeted advertising; it does not state a numeric retention period on the reviewed Fonts privacy page (Google Fonts privacy).

The released app does not use your health, fitness, nutrition, journal, photo, video or sensitive eligibility information for advertising. It does not sell that information or use it to build advertising profiles. If this practice changes, the notice and applicable choices must be updated before the new use begins.

We do not treat your acceptance of service terms as permission for marketing, public testimonials or optional public sharing. Any additional optional use requires its own applicable choice or authorization.

Keeping your account secure

Use a unique password and keep your recovery email current. Where email recovery is available, the recovery address must be verified. If recovery is unavailable or you cannot access that address, contact support without sending your password. We do not offer text-message recovery.

We use access controls and other safeguards intended to protect information. No system can guarantee perfect security. Contact us promptly if you suspect unauthorized use, but do not send your password by email.

Retention and account deletion

We retain personal information for the purposes described in this notice. We determine retention by whether your account and requested services remain active, whether information is needed to resolve a support request or dispute, applicable legal obligations, security needs and the relevant system's recovery process. Retention is not permission to use your information for an unrelated purpose.

Request deletion through available account-deletion controls or by emailing [email protected]. We verify requests to protect your information, identify applicable records and respond within deadlines required by applicable law. We delete information that is no longer needed unless a permitted or required reason for retention applies. For provider-held records we cannot remove directly, we request appropriate deletion and distinguish confirmed removal from outstanding provider steps. Sending a request is not confirmation that a provider has completed deletion.

Confirmed in-app account deletion removes the account's active records and private uploaded media. We retain a restricted, limited privacy-request record for outstanding provider follow-up and deletion safeguards; this does not mean that all provider-held copies have been erased. Deletion from active systems and removal from other recovery copies are separate processes. Backup or recovery copies may retain information until their applicable deletion cycle completes. We do not use recovery copies for routine coaching or marketing. Before restoring records for normal use, we must reconcile verified deletion requests so that recovery does not knowingly reinstate a deleted account. Scheduled production member-record backups are not yet operational.

Providers apply separate recovery, security and deletion processes; their notices describe applicable practices, including Google Cloud's deletion process. We remain responsible for handling deletion requests concerning providers processing information for us. When a provider's completion date is not confirmed, we identify it as unconfirmed rather than report all copies erased. Provider involvement does not remove your applicable legal rights.

We may retain the minimum request and account identifiers, necessary dates and correspondence needed to verify and document a privacy request and prevent records from being restored improperly. We restrict these records to that purpose and review their continued need; they are not a copy of your training journal or media library.

Where permitted or required by applicable law, limited records may be retained for a documented legal obligation, transaction requirement, dispute or security investigation. We restrict access and use to that purpose and remove the records when the reason ends. Where legally permitted, our response explains what remains and why. We do not describe hiding a record, cancelling a booking or expiring a link as completed deletion.

Apple and any other payment provider you use may retain their own transaction records under their separate policies. Copies independently held by other recipients are also outside our direct deletion controls. Deleting your Due East account does not cancel an Apple subscription; manage or cancel renewal separately in your Apple subscription settings.

Payment interruptions and account closure

Ending paid access is not the same as deleting an account. Membership cancellation and payment interruptions are handled under the applicable subscription terms. This notice does not promise an automated payment-failure account-closure schedule. Privacy requests remain available regardless of membership status.

Once account deletion is completed, returning requires a new signup; deleted progress is not restored. Deleting the app, signing out or requesting account deletion does not by itself confirm cancellation of an Apple subscription. Follow the applicable provider's cancellation instructions to stop renewals, and rely on its cancellation confirmation.

Your choices and requests

You may ask to access, correct or delete information by contacting [email protected]. We may ask for proportionate verification before acting. Do not send unnecessary sensitive documents with an initial request.

You can change available tracking preferences, photo-sharing choices and notification settings in the app or your device controls. Changes to an account's linked phone or email are not represented as a self-service feature of this first release; contact us for help. Any rights and response requirements that apply under law remain available regardless of your membership status.

Adults only and changes to this notice

This service is intended for adults aged 18 and older in the United States. Minors may not enroll through another person's account. Contact us if you believe a minor has provided information so we can investigate and take appropriate action.

This notice is effective September 24, 2026, version 2026-09-24. We will make material changes clear and obtain any additional consent required for a new use. A prior agreement to service terms is not blanket authorization for unrelated future uses of your information.