PRIVACY BASELINE
Collect less. Separate access. Make sharing visible.
These are the engineering commitments guiding the build. A final owner-approved privacy notice is required before production.
Minimal identity
The planned profile uses first name, last initial, optional display name, time zone, and unit preference. Authentication email remains separate. We do not plan to collect date of birth, full last name, government identifiers, address, phone, diagnoses, prescriptions, or medical documents.
Private by default
Each user-facing table and private storage path must have tested Row-Level Security before its feature ships. Interface checks help the experience, but database policy is the final access boundary.
No private values in telemetry
Names, email, assessment results, workouts, food, weight, pain, readiness answers, limitations, and notes are prohibited from product analytics. Operational diagnostics are limited to allowlisted, redacted attributes.
Deliberate sharing and deletion
Sharing will be opt-in, field-limited, expiring, auditable, and revocable. The privacy center will include consent and share history, revoke-all, export, individual-log deletion, and account deletion. Final retention and backup-expiry details require owner approval.