Privacy Policy for FitCaddie

Introduction

FitCaddie - Software Secrets LLC ("we," "our," "us," or "Company") operates FitCaddie, available as a web application, mobile application, and website (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use it, how we share it, and the rights you have regarding your data.

This policy applies to all users of FitCaddie, regardless of location. We are committed to transparency and compliance with applicable privacy laws in the jurisdictions where our users reside, including the General Data Protection Regulation (GDPR) in the European Union and European Economic Area, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) in California, the UK General Data Protection Regulation (UK GDPR) in the United Kingdom, the Personal Information Protection and Electronic Documents Act (PIPEDA) in Canada, the Lei Geral de Proteção de Dados (LGPD) in Brazil, and the Privacy Act in Australia.

Effective Date: September 4, 2026
Last Updated: September 4, 2026

Information We Collect

We collect personal information from you in several ways:

Information You Provide Directly

• Account Registration: When you create an account, we collect your email address, your name if you provide one, and any other information you provide during registration.
• Onboarding and Fitness Profile: When you set up FitCaddie we ask about your goal, how much time you have to train, areas of your body that hurt or feel tight, and similar questions. We store these answers, and the mobility profile built from them, to personalize your daily plan. This is health-related information; we use it only to provide the Service and never for advertising.
• Activity and Progress Data: We store the content you create in the app, including daily check-ins (how you feel, pain and readiness ratings), completed sessions, round history, program enrollment, and exercise swaps such as "this hurts."
• Payment Information: When you purchase a plan through fitcaddie.com, payment information (including credit card details, billing address, and transaction history) is collected and processed by Stripe, Inc. (our third-party payment processor). We do not store your full payment card number; Stripe returns a customer identifier and the last four digits of the card, which we associate with your account. Purchases made through the iOS App Store are processed by Apple, and we receive only a limited purchase-receipt identifier (routed through RevenueCat, Inc., our mobile subscription infrastructure provider) confirming entitlement.
• Customer Support: When you contact us for support or assistance, we collect the information you provide in your message, including your name, email, and the details of your inquiry.
• Forms and Surveys: If you fill out forms on our website or participate in surveys, we collect the information you voluntarily provide.

Information Collected Automatically

• Device Information: We automatically collect information about the devices you use to access FitCaddie, including device type, operating system, browser type and version, mobile device identifiers, screen size, and device settings.
• Usage Data: We collect data about how you interact with our Service, including features used, pages visited, time spent in the app, actions taken, and performance metrics.
• Diagnostic and Performance Data: When the Service crashes, hangs, or encounters an unhandled error, we collect a diagnostic event (stack trace, device and OS metadata, and in the iOS app performance traces sampled at approximately 20% of sessions in production) and send it to Sentry, our crash and performance monitoring provider. See "Crash and Performance Monitoring" below for what is and is not included.
• Cookies and Tracking Technologies: We use cookies, web beacons, and similar technologies to collect information about your browsing behavior, preferences, and interactions with our Service (see the Cookies and Tracking Technologies section for details).
• Analytics Data: Our analytics tools collect information about your usage patterns to help us understand how users interact with FitCaddie and to improve the Service.

Information from Third Parties

• Third-Party Login Providers: If you sign in with Google, we collect the information Google shares with us, which may include your name, email address, and profile picture.

How We Collect Information

We collect information through the following methods:

• Forms: Account registration, onboarding, check-in, contact, feedback, and survey forms on our website and web app.
• Analytics Tools: Google Analytics and PostHog track your usage patterns and interactions with FitCaddie (with your consent). We also use DataFast, a privacy-focused web analytics service that measures aggregate site traffic and conversion goals without building cross-site profiles of you.
• Crash and Performance Monitoring: Sentry (Functional Software, Inc.) receives diagnostic events when FitCaddie crashes, hangs, or encounters an unhandled error.
• Payment Processors: Stripe, Inc. (for web purchases at fitcaddie.com) and Apple Inc. (for iOS App Store purchases) collect and process payment information when you make a purchase. RevenueCat, Inc. is used to verify and deliver App Store entitlements.
• Automatic Collection: Cookies, browser storage, log files, and similar technologies automatically collect data about your device and usage.
• Customer Support Channels: Email correspondence where you voluntarily provide information.
• Third-Party Login: Authentication data from Google when you use Google sign-in.

How We Use Your Information

We process your personal information for the following purposes:

• Provide the Service: To deliver, maintain, and improve FitCaddie, including building and adapting your daily plan, tracking your progress, user authentication, account management, and technical support.
• Billing and Payments: To process payments, manage plans and renewals, send receipts, and maintain billing records.
• Communication: To respond to your inquiries, send transactional emails (confirmations, receipts, password resets, trial and renewal reminders), and provide customer support.
• Analytics and Research: To analyze usage patterns, understand user behavior, and conduct research to improve our Service and user experience.
• Marketing and Promotional Communications: To send promotional emails, updates about new features, and marketing materials (you can opt out of promotional communications at any time).
• Security and Compliance: To detect, prevent, and address fraud, abuse, security incidents, and other harmful activities; to comply with legal obligations; and to protect the rights, property, and safety of FitCaddie, our users, and the public.
• Legal Compliance: To comply with applicable laws, regulations, court orders, and government requests.

Lawful Bases for Processing (GDPR/UK GDPR)

For users in the EU, EEA, and UK, we process personal information on the following lawful bases:

• Contract: Processing necessary to provide the Service and fulfill our obligations to you.
• Legitimate Interests: Processing for analytics, marketing, security, fraud prevention, and service improvement, balanced against your privacy rights.
• Consent: For marketing communications, non-essential cookies, certain tracking activities (obtained via cookie consent banners and opt-in mechanisms), and the health-related answers you give during onboarding and check-ins.
• Legal Obligation: Processing required to comply with applicable law.

Information Sharing and Disclosure

We Do Not Sell Your Data

FitCaddie does not sell, rent, or share your personal information with third parties for their marketing or commercial purposes.

Limited Sharing with Service Providers

We share personal information with third parties only when necessary to provide our Service or comply with legal obligations:

• Payment Processors: We share billing identifiers and transaction metadata with Stripe, Inc. (for direct web purchases), with Apple Inc. (for iOS App Store purchases), and with RevenueCat, Inc. (for mobile entitlement verification) strictly to process payments and manage your plan.
• Analytics Providers: With your consent, we share usage data with Google Analytics (Google LLC) and PostHog, Inc. to analyze how users interact with our Service and improve performance. We also share aggregate, non-cross-site usage and conversion data with DataFast, a privacy-focused analytics service that runs on our website without advertising cookies.
• Authentication, Database, and Hosting: We use Google Firebase (Firebase Authentication, Firestore, and Firebase Hosting, all provided by Google LLC) to authenticate accounts, store your FitCaddie data, and serve the Service.
• Transactional Email: We use Resend, Inc. to deliver transactional emails such as password resets, trial and renewal reminders, and receipts.
• Legal and Compliance: We may disclose information when required by law, court order, or government request, or to protect the security, rights, and safety of our users and the public.

All third-party service providers are contractually obligated to use your information only as necessary to provide their services to us and to maintain the confidentiality and security of your data.

Crash and Performance Monitoring

We use Sentry, a service operated by Functional Software, Inc., to monitor application stability and diagnose problems in FitCaddie. When the Service encounters a crash, an unhandled error, an unresponsive UI ("app hang"), or a performance issue, Sentry receives a diagnostic event from your device.

The information sent to Sentry includes:

• Stack Traces: The technical record of what code was running when the issue occurred.
• Device and OS Metadata: Basic information such as operating system version, device model, browser version, and app version.
• App-Hang and Performance Traces (iOS app only): In the iOS app, performance and app-hang traces are sampled at approximately 20% of sessions in production. Our website and web app send error events only, not performance traces.
• Account Identifier: If you are signed in, the opaque user ID issued by Firebase that identifies your FitCaddie account.
• Paid Entitlement Flag (iOS app only): A tag indicating whether the account holds an active paid plan, so we can filter issues by entitlement.

Sentry is configured not to collect personally identifying information by default. We do not send your email address, your name, your IP address, or your onboarding and check-in answers to Sentry. We do not enable Sentry's Session Replay feature, so we never record your screen. Before an event leaves your device, a pre-send filter additionally removes fields whose names suggest sensitive content (in the iOS app) and scrubs URLs and event properties that could carry email addresses or access tokens (on the web).

Diagnostic data is retained by Sentry per the data retention settings on our project. For Sentry's own privacy practices, seehttps://sentry.io/privacy/.

No Third-Party Marketing

We do not share your personal information with third parties for their own marketing or advertising purposes without your explicit consent.

Data Retention

We retain your personal information for as long as necessary to provide FitCaddie, fulfill the purposes described in this policy, and comply with applicable legal and tax regulations.

Retention Periods by Data Type

• Account Information: Retained for the duration of your account and for a reasonable period after account deletion to comply with legal and tax obligations.
• Onboarding, Check-in, and Progress Data: Retained for the duration of your account and deleted when you delete your account.
• Payment Information: Retained as required by tax and financial regulations, typically as long as necessary for accounting, auditing, and legal purposes.
• Usage and Analytics Data: Retained for a reasonable period to improve our Service; older analytics data may be aggregated or deleted periodically.
• Customer Support Records: Retained for a reasonable period to assist with future inquiries and resolve disputes.
• Marketing Communications: If you unsubscribe, we retain your email address on our suppression list to honor your opt-out preference.
• Device Identifiers and Cookies: Retained for the duration specified in each cookie's settings; most session cookies expire when you close your browser.

We review our retention practices regularly and delete data when it is no longer necessary. You may request deletion of your personal information at any time by contacting us (subject to legal and contractual limitations).

Your Privacy Rights

The rights available to you depend on your location. Below is a summary of your privacy rights under applicable laws.

Rights for EU/EEA and UK Residents (GDPR/UK GDPR)

You have the following rights:

• Right of Access: You may request a copy of the personal information we hold about you.
• Right to Rectification: You may request correction of inaccurate or incomplete personal information.
• Right to Erasure ("Right to be Forgotten"): You may request deletion of your personal information, subject to legal and contractual exceptions.
• Right to Restrict Processing: You may request that we limit how we process your information for certain purposes.
• Right to Data Portability: You may request a copy of your personal information in a structured, machine-readable format for transfer to another service provider.
• Right to Object: You may object to processing based on legitimate interests or marketing communications.
• Right to Withdraw Consent: If processing is based on your consent, you may withdraw that consent at any time.
• Right to Lodge a Complaint: You may file a complaint with the European Data Protection Board (https://edpb.europa.eu/) or your local supervisory authority.

Rights for California Residents (CCPA/CPRA)

You have the following rights:

• Right to Know: You may request what personal information we collect, use, and share about you.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to legal exceptions.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: You may direct us not to sell or share your personal information. (Note: We do not sell or share your data for cross-context behavioral advertising, but you may submit an opt-out request.)
• Right to Opt Out of Automated Decision Making: You may opt out of automated decision-making that produces legal or similarly significant effects concerning you.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.
• Right to Appeal: If we deny your request, you may appeal our decision.

California residents may submit requests by emailingsupport@fitcaddie.com. You may also designate an authorized agent to submit requests on your behalf.

Rights for UK Residents (UK GDPR)

UK residents have substantially the same rights as EU/EEA residents under the UK GDPR (see above). You may lodge complaints with the Information Commissioner's Office (https://ico.org.uk/).

Rights for Canadian Residents (PIPEDA)

You have the following rights:

• Right to Access: You may request access to personal information we hold about you.
• Right to Accuracy: You may request correction of inaccurate personal information.
• Right to Withdraw Consent: You may withdraw consent for processing, subject to legal obligations.
• Right to Complain: You may lodge a complaint with the Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca/).

Rights for Australian Residents (Privacy Act)

You have the following rights:

• Right to Access: You may request access to personal information we hold about you.
• Right to Correction and Completion: You may request correction of inaccurate personal information.
• Right to Complain: You may lodge a complaint with the Office of the Australian Information Commissioner (https://www.oaic.gov.au/).

Rights for Brazilian Residents (LGPD)

You have the following rights:

• Right of Access: You may request access to your personal information.
• Right of Rectification: You may request correction of inaccurate data.
• Right of Deletion: You may request deletion of data (subject to LGPD exceptions).
• Right to Data Portability: You may request your data in a portable format.
• Right to Opt Out of Processing: You may object to processing for certain purposes.
• Right to Complain: You may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) (https://www.gov.br/anpd/).

How to Exercise Your Rights

To exercise any of your privacy rights, please contact us at:

Email: support@fitcaddie.com

You can also delete your FitCaddie account and all associated personal data yourself at any time from the Account page in the web app (fitcaddie.com/app/account) or in the iOS app (Account > Delete Account).

Please include sufficient detail in your request so we can identify you and locate your information. We will respond to your request within the timeframes required by applicable law, typically within 30 days. In some cases, we may request additional information to verify your identity. If we cannot fulfill your request, we will explain the reason and provide information about appeals or complaints.

Children's Privacy

FitCaddie is not intended for children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information and terminate the child's account promptly.

Consistent with our Terms of Service, users under 18 may use FitCaddie only with the involvement and supervision of a parent or legal guardian. For users between 13 and 18 years old, we collect minimal personal information and use it only to provide the Service. We do not use data from minors for advertising or marketing.

If you are a parent or guardian and believe your child has provided personal information to FitCaddie without your consent, please contact us immediately atsupport@fitcaddie.com, and we will take appropriate action.

International Data Transfers

FitCaddie operates globally, and your personal information may be transferred to, stored in, and processed in countries other than your country of residence. These countries may have data protection laws that differ from those in your home country.

Transfer Mechanisms

When we transfer personal information internationally, we implement appropriate safeguards:

• Standard Contractual Clauses (SCCs): For transfers from the EU/EEA to countries outside the EU/EEA, we use Standard Contractual Clauses approved by the European Commission.
• Adequacy Decisions: Where applicable, we rely on adequacy decisions by relevant authorities that deem recipient countries to have adequate privacy protections.
• Consent: We may obtain your explicit consent for transfers to countries without equivalent data protections.

Data Processing Locations

Your information is primarily processed in the United States, the European Union, and other jurisdictions where FitCaddie operates. By using FitCaddie, you consent to the transfer of your personal information to countries outside your country of residence, including the United States, for the purposes described in this policy.

Security Measures

We implement comprehensive technical and organizational measures to protect your personal information from unauthorized access, alteration, disclosure, and destruction:

• Encryption: Data transmitted to and from FitCaddie is encrypted using industry-standard TLS/SSL encryption.
• Secure Storage: Personal information is stored on secure servers with restricted access, firewalls, and intrusion detection systems.
• Access Controls: We limit access to personal information to employees and service providers who need it to perform their job functions, and we require them to maintain confidentiality. Your FitCaddie data is readable only by your own signed-in account.
• Authentication: Account access is protected by passwords or Google sign-in.
• Data Minimization: We collect and retain only the personal information necessary to provide the Service.
• Regular Security Audits: We conduct regular security assessments to identify and remediate vulnerabilities.
• Incident Response Plan: We maintain an incident response plan to detect, respond to, and mitigate security breaches.

While we implement strong security measures, no system is completely secure. We cannot guarantee absolute security of your personal information. If you believe your account or personal information has been compromised, please contact us immediately atsupport@fitcaddie.com.

Cookies and Tracking Technologies

FitCaddie uses cookies, browser storage, web beacons, pixels, and similar tracking technologies to enhance your experience, remember your preferences, and analyze usage patterns.

Types of Cookies Used

• Essential Cookies and Storage: These are necessary for the basic functionality of FitCaddie, including authentication, session management, security, and keeping a local copy of your plan so the app works quickly. They do not require consent.
• Analytics Cookies: We use cookies from Google Analytics and PostHog (with your consent) to collect information about how you use FitCaddie, including pages visited, features used, and time spent in the app. DataFast sets a first-party visitor identifier used only to measure our own site's traffic and conversions. These help us understand user behavior and improve our Service.
• Preference Cookies: These remember your preferences and settings, such as your cookie choice and display preferences, so you don't have to reconfigure them on each visit.
• No Advertising Cookies: We do not use advertising or marketing cookies, and no partner places cookies on your device to track your activity across other websites for advertising purposes.

Managing Your Cookie Preferences

• Browser Controls: Most web browsers allow you to refuse cookies or alert you when cookies are being sent. You can manage cookie settings through your browser preferences. Note that disabling cookies may limit certain features of FitCaddie.
• Opt-Out of Analytics: You can opt out of Google Analytics tracking by visitinghttps://tools.google.com/dlpage/gaoptoutor installing the Google Analytics Opt-out Browser Add-on.
• Cookie Consent Banner: When you first visit FitCaddie, we display a cookie consent banner allowing you to accept or decline non-essential cookies.

The iOS App and Tracking

Our iOS app does not track you across other companies' apps or websites. It does not use the Identifier for Advertisers (IDFA), does not request App Tracking Transparency permission (because it performs no tracking that would require it), and its Apple privacy manifest declares no tracking and no tracking domains. The analytics inside the app (PostHog and Sentry) measure only your use of FitCaddie itself and are linked at most to your FitCaddie account identifier.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by:

• Posting the updated policy on FitCaddie with a new "Last Updated" date
• Sending you an email notification at the email address associated with your account
• Requiring you to accept the updated policy before continued use of the Service

Your continued use of FitCaddie after such notifications constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy periodically to stay informed about how we protect your personal information.

Platform Privacy Requirements

Apple iOS App Store

FitCaddie is available on the Apple App Store and complies with Apple's App Store Review Guidelines regarding privacy and data protection.

App Privacy Details and Data Transparency: The data practices described in this Privacy Policy align with the App Privacy Details (privacy nutrition labels) configured in App Store Connect. Our App Privacy Details clearly disclose all data collected by FitCaddie and third-party SDKs, including the purposes for collection, whether data is linked to user identity, and whether data is used for tracking across other apps and websites.

Data Collection and Use: In the iOS app we collect your email address, your FitCaddie account identifier, the content you create in the app (onboarding answers, mobility profile, daily check-ins, session logs, round history, program enrollment), purchase/entitlement status, and product-interaction analytics. Data is collected to provide the Service, communicate with you, process purchases, perform analytics, and for security and legal compliance. The third-party SDKs in the app are Firebase (authentication and data storage), RevenueCat (subscription entitlements), PostHog (product analytics), and Sentry (crash and performance monitoring).

Health and Fitness Data: The onboarding answers and check-ins you enter (goal, available time, areas that hurt, readiness) are stored in your FitCaddie account and used only to build your plan. The iOS app does not read from or write to Apple Health (HealthKit) unless a future version asks for that permission explicitly, in which case we will update this policy first.

No Tracking: The iOS app performs no cross-app or cross-site tracking. Its Apple privacy manifest declares no tracking and lists no tracking domains, it does not use the Identifier for Advertisers (IDFA), and it does not present an App Tracking Transparency prompt because none is required. We do not share personal information with third parties for their marketing purposes.

Notifications: If you turn on reminders, the iOS app requests the standard iOS notification permission and uses it only to deliver the reminders you set. You can turn reminders off in the app or in iOS Settings at any time.

Data Deletion and User Rights: You can delete your FitCaddie account and associated personal data directly in the app (Account > Delete Account), athttps://fitcaddie.com/app/account, or by contactingsupport@fitcaddie.com. Deletion requests are processed within 30 days. You also have rights to access, correct, and port your data as described in the Your Privacy Rights section of this policy.

Children: FitCaddie is not intended for children under 13, and under-18 use requires parental involvement as described in our Terms of Service and the Children's Privacy section above.

Data Security: We implement encryption, secure storage, access controls, and regular security reviews to protect user data from unauthorized access and disclosure.

Contact Information

Privacy Contact Email:support@fitcaddie.com

Company / Legal Entity: FitCaddie - Software Secrets LLC

Service / Product Name: FitCaddie

Website: https://fitcaddie.com/

Mailing Address:
155 31st Street
Ogden, UT 84401

Response Time: Privacy requests are answered within the timeframes described in the Your Privacy Rights section.

Supervisory Authority Links (for applicable jurisdictions):

• European Union / European Economic Area:https://edpb.europa.eu/
• United Kingdom: https://ico.org.uk/
• California: https://cppa.ca.gov/
• Canada: https://www.priv.gc.ca/
• Brazil: https://www.gov.br/anpd/
• Australia:https://www.oaic.gov.au/