Privacy Notice

Your information, handled with care

Due East Strength Co. is operated by Rob Murphy in The Hamptons, New York. This notice explains how we handle information when you use our app, member website, public website and coaching services. For privacy questions or requests, contact rob@dueeaststrength.com.

Due East provides general fitness education and wellness support, not medical care. Information you share with us does not create a physician-patient relationship, and this service is not an emergency service.

Information you provide

Depending on your membership and the tools you choose, we collect:

Account details: Your name, phone number, email address, password credentials and account preferences. We keep a protected password representation rather than storing your readable password.
Intake and preferences: Your adult-eligibility confirmation, goals, training experience, schedule, available equipment and answers used to prepare your experience. If supplied, this includes age, height, weight, calculation inputs, nutrition preferences and relevant restrictions.
Eligibility for automatic estimates: If you request an automatic nutrition estimate, the app stores whether you confirmed that the displayed pregnancy/breastfeeding, prescribed-diet, condition and eating-disorder-history exclusions do not apply. This sensitive eligibility answer is used only to decide whether the general estimate is available. You can skip the estimate and use your own targets.
Training and daily records: Plans, completed exercise, sets, feedback, journal entries, body weight, sleep, habits, food-macro and fluid entries, and targets you choose to track.
Communication, scheduling and support: Messages, appointment requests, proposed times, confirmations and information you send when asking for help. Support information can include your device model, operating-system version, purchase details and screenshots you choose to send.
Optional uploads: Progress photos and form-review images or videos you choose to provide. Videos may contain your voice and surroundings; do not include information about other people without permission.
Membership records: Your membership, payment status and subscription identifiers used to confirm access and manage your account.

Only provide information you are comfortable sharing and that is relevant to the service. An optional field remains optional, but information submitted to the service is still processed as described here. Do not use free-text fields to send passwords, payment-card numbers, government identification numbers or unrelated medical records.

How we use information

We use information to maintain your account, prepare and deliver plans, provide purchased coaching, display your records, respond to messages, arrange calls, confirm membership, deliver requested recovery emails, protect accounts and process privacy requests.

Where an enabled feature provides automatic plan adjustments or estimates, it uses the answers and activity relevant to that feature. Estimates are starting points, not medical advice or a guarantee of suitability. You can review applicable preferences and tracking targets in the app; contact us when a correction is not available through a self-service control.

Account and activity information

The service records limited activity needed to operate features, such as when you last opened the app, message-read status, acceptance of a particular terms version and relevant account-security events. These records can be linked to your account.

Available reminders depend on your choices and device permissions. Necessary replies, password-recovery messages, billing communications and privacy-request updates are distinct from optional activity reminders. Hosting and external resources may also process IP addresses, device/browser details and request or security logs.

Progress photos are private by default. A separate choice controls whether a progress photo is shared with your coach; accepting service terms is not permission to publish photos, use them in advertising or make them a testimonial.

Content you intentionally send for a coaching form review is provided for that review. Do not assume a video has had its sound, background or embedded information removed. Review the content before uploading it.

Service providers and third-party services

We use providers to host the service, store records and private media, deliver account emails, support scheduling and process subscriptions. Information handled on our behalf remains part of our privacy-request process; a provider's involvement does not automatically exempt it from deletion. We share information with these providers only to run the services described in this notice, and only with providers that protect it with the same or equal protection this notice describes.

The services below apply to the features and channels you use. Listing a payment or backup provider does not mean every checkout or backup feature is currently available:

Hosting and storage: Google Cloud Run hosts the shared member service and these legal pages. Cloudflare hosts our public website and provides the configured record and private-media services. Google Cloud Storage is being prepared for encrypted member backups; scheduled production member backups through that service are not yet operational. These services have distinct storage, recovery and deletion processes, not a single shared retention period (Cloudflare recovery, Google Cloud deletion).
Account email and support: Resend handles enabled account-email delivery; our business email provider holds messages you send to rob@dueeaststrength.com and other Due East support mailboxes, plus and applicable notification copies. Message bodies, delivery logs and internal recovery copies can have different retention periods (Resend privacy and retention, Google retention).
Scheduling: Google Calendar/Meet supports arranged calls, and Cal.com handles bookings made through our intro-call link. A cancelled appointment is not necessarily erased from all calendar, booking, email or recovery systems (Calendar deletion, Cal.com privacy).
Food search: USDA FoodData Central and Open Food Facts receive the food words or barcode number you search, without your name or account.
Shared foods: If you type in a food from its label and leave sharing on, we keep that food’s name, serving and nutrition numbers so other members can find it. It is not shown with your name or account. You can untick sharing before you add it, and you can ask us to remove a shared food.
Apple Health: With your permission, the iPhone app reads steps, sleep, heart rate, active calories and body weight from Apple Health to show them on your Today screen, and saves your finished sessions and weigh-ins to Apple Health. Information read from Apple Health stays on your iPhone and is not sent to Due East. You can change these permissions at any time in the Health app.
Legacy enquiries: Formspree may hold submissions from our public marketing forms and older signup path, and applicable review notifications. Our new enrollment flow does not send its intake through that legacy signup function; old submissions and delivered email copies still require separate handling (Formspree privacy).

Providers may process information in the United States and other locations described in their notices. A storage bucket's location does not establish that all service processing occurs there. We may disclose information when required by law or reasonably necessary to protect rights, safety and account security.

iPhone subscriptions, when available, use Apple. Web coaching subscriptions, when offered, use Stripe. We use subscription and transaction information to confirm your access; payment details entered into those providers' own payment interfaces are handled under their notices. These providers may independently retain records for legal, financial and fraud-prevention purposes (Apple App Store privacy, Stripe privacy). Their independently required records are distinct from the subscription identifiers and other copies we control.

Exercise demonstrations use YouTube content and may open an embedded player or an in-app browser. YouTube describes collection on player loading and playback; privacy-enhanced mode limits personalization but is not a promise of no collection (YouTube developer policies, YouTube embedding help). Google's handling and retention of this information depend on the service, data and applicable settings (Google retention).

Where pages load Google Fonts, the request sends technical information including your IP address, requested resource and browser/referrer information to Google. Google says the Fonts API does not set or log cookies or use that information to create end-user profiles or for targeted advertising; it does not state a numeric retention period on the reviewed Fonts privacy page (Google Fonts privacy).

The released app does not use your health, fitness, nutrition, journal, photo, video or sensitive eligibility information for advertising. It does not sell that information or use it to build advertising profiles. If this practice changes, the notice and applicable choices must be updated before the new use begins.

We do not treat your acceptance of service terms as permission for marketing, public testimonials or optional public sharing. Any additional optional use requires its own applicable choice or authorization.

Recipe links, voice entry, Apple Watch and exports

Recipe links: If you paste a recipe page link, our server opens that public page to read its ingredient list. Only the link is used; nothing about you is sent to the site.
Voice food entry (iPhone): If you tap the microphone to log food, your iPhone turns your words into text, on the device when it can. We receive only the text, as if you had typed it. Audio is not recorded or kept by Due East.
More Apple Health information: With your permission, the iPhone app can also read heart rate variability and sleep stages to show your readiness line on your iPhone. Like other Apple Health information described above, it stays on your iPhone and is never used for advertising.
Apple Watch: The Due East watch app shows today's workout from your iPhone and sends sets you log back to it. It talks only to your iPhone.
Check-in export: Share my check-ins makes a file on your phone. Nothing is sent until you choose where to share it.

Keeping your account secure

Use a unique password and keep your recovery email current. Where email recovery is available, the recovery address must be verified. If recovery is unavailable or you cannot access that address, contact support without sending your password. We do not offer text-message recovery.

We use access controls and other safeguards intended to protect information. No system can guarantee perfect security. Contact us promptly if you suspect unauthorized use, but do not send your password by email.

Retention and account deletion

We retain personal information for the purposes described in this notice. We determine retention by whether your account and requested services remain active, whether information is needed to resolve a support request or dispute, applicable legal obligations, security needs and the relevant system's recovery process. Retention is not permission to use your information for an unrelated purpose.

Request deletion through available account-deletion controls or by emailing rob@dueeaststrength.com. We verify requests to protect your information, identify applicable records and respond within deadlines required by applicable law. We delete information that is no longer needed unless a permitted or required reason for retention applies. For provider-held records we cannot remove directly, we request appropriate deletion and distinguish confirmed removal from outstanding provider steps. Sending a request is not confirmation that a provider has completed deletion.

Confirmed in-app account deletion removes the account's active records and private uploaded media. We retain a restricted, limited privacy-request record for outstanding provider follow-up and deletion safeguards; this does not mean that all provider-held copies have been erased. Deletion from active systems and removal from other recovery copies are separate processes. Backup or recovery copies may retain information until their applicable deletion cycle completes. We do not use recovery copies for routine coaching or marketing. Before restoring records for normal use, we must reconcile verified deletion requests so that recovery does not knowingly reinstate a deleted account. Scheduled production member-record backups are not yet operational.

Providers apply separate recovery, security and deletion processes; their notices describe applicable practices, including Google Cloud's deletion process. We remain responsible for handling deletion requests concerning providers processing information for us. When a provider's completion date is not confirmed, we identify it as unconfirmed rather than report all copies erased. Provider involvement does not remove your applicable legal rights.

We may retain the minimum request and account identifiers, necessary dates and correspondence needed to verify and document a privacy request and prevent records from being restored improperly. We restrict these records to that purpose and review their continued need; they are not a copy of your training journal or media library.

Where permitted or required by applicable law, limited records may be retained for a documented legal obligation, transaction requirement, dispute or security investigation. We restrict access and use to that purpose and remove the records when the reason ends. Where legally permitted, our response explains what remains and why. We do not describe hiding a record, cancelling a booking or expiring a link as completed deletion.

Apple and any other payment provider you use may retain their own transaction records under their separate policies. Copies independently held by other recipients are also outside our direct deletion controls. Deleting your Due East account does not cancel an Apple subscription; manage or cancel renewal separately in your Apple subscription settings.

Payment interruptions and account closure

Ending paid access is not the same as deleting an account. Membership cancellation and payment interruptions are handled under the applicable subscription terms. This notice does not promise an automated payment-failure account-closure schedule. Privacy requests remain available regardless of membership status.

Once account deletion is completed, returning requires a new signup; deleted progress is not restored. Deleting the app, signing out or requesting account deletion does not by itself confirm cancellation of an Apple subscription. Follow the applicable provider's cancellation instructions to stop renewals, and rely on its cancellation confirmation.

Your choices and requests

You may ask to access, correct or delete information by contacting rob@dueeaststrength.com. We may ask for proportionate verification before acting. Do not send unnecessary sensitive documents with an initial request.

You can change available tracking preferences, photo-sharing choices and notification settings in the app or your device controls. Changes to an account's linked phone or email are not represented as a self-service feature of this first release; contact us for help. Any rights and response requirements that apply under law remain available regardless of your membership status.

Adults only and changes to this notice

This service is intended for adults aged 18 and older in the United States. Minors may not enroll through another person's account. Contact us if you believe a minor has provided information so we can investigate and take appropriate action.

This notice is effective October 22, 2026, version 2026-10-22. We will make material changes clear and obtain any additional consent required for a new use. A prior agreement to service terms is not blanket authorization for unrelated future uses of your information.