1. Scope and operator

This Privacy Notice applies to the Project Warfighter website and nationwide United States beta. Project Warfighter is operated by Dylan Seaton, an individual in Arkansas. Questions and privacy requests may be sent to privacy@neascan.org.

The separate Consumer Health Data Privacy Policy provides additional detail and choices for fitness, nutrition, readiness, and other health-related data. If that policy gives you greater protection for consumer health data, that protection applies.

2. Personal data we collect

We collect data you provide, data the app calculates from your entries, and limited technical data generated when you use the service.

• Account and profile: authentication email, Supabase authentication events, first name, last initial, optional display name, time zone, unit preference, and account status.
• Planning and assessment: selected standard, assessment date or window, chosen events, current, prior, baseline, and goal values, score estimates, equipment, availability, and limitation selections or brief other-limitation text.
• Workout and progress: plans, exercises, sets, repetitions, load, distance, duration, effort, optional heart rate, discomfort, notes, trends, checkpoints, streaks, level, and XP ledger events.
• Nutrition and wellness: age rather than birth date, formula sex category, height, weight, activity and goal categories, dietary pattern, allergies, avoided foods, food-search terms, UPC/EAN barcodes, food and drink entries, brands, servings, nutrient values, caffeine, alcohol, sleep, energy, stress, soreness, motivation, optional resting heart rate, pain or illness indicators, and resulting summaries.
• Connection and sharing: stable Friend Code, Wingman requests, connections, blocks, per-connection sharing settings, and the information selected for a progress-card image.
• Technical and security: session cookies, IP address, browser or device details, request timestamps, error and security events, and similar hosting or authentication logs needed to deliver and protect the service.

The member forms do not ask for a full date of birth, home address, government identifier, diagnosis, prescription list, or medical document. Hosting and security providers may infer an approximate location from an IP address; Project Warfighter does not ask for or store a beta member's state as a profile field.

3. Sources of personal data

• You, when you register, complete setup, log activity, request guidance, connect with a Wingman, or contact us.
• The Project Warfighter rules engine, when it calculates plans, categories, estimates, summaries, progress, or XP from your entries.
• Supabase, which provides database and authentication services.
• Vercel, which hosts and delivers the web application.
• USDA FoodData Central and Open Food Facts, which return public food or packaged-product records in response to a food search or barcode lookup.
• A referring member-controlled link, such as a Friend Code link you choose to open.

4. Why we use personal data

• Create, authenticate, support, and delete accounts.
• Save member choices and provide requested assessment estimates, plans, logs, trends, educational suggestions, and readiness summaries.
• Operate Friend Codes, connection requests, selected sharing, and downloaded progress cards.
• Protect accounts, enforce access controls, prevent abuse, debug failures, and maintain service reliability.
• Answer support and privacy requests, investigate incidents, and comply with applicable law.
• Improve beta usability and reliability using minimized or de-identified information where practical.

Project Warfighter does not use member personal data to train artificial-intelligence models. The current app uses deterministic rules and source-backed content for member plans, estimates, and educational suggestions.

5. When personal data is disclosed

• Supabase processes account, authentication, database, and related security data as a service provider.
• Vercel processes web requests and application data needed to host, run, secure, and troubleshoot the service.
• USDA FoodData Central receives the food-search text and pagination parameters that Project Warfighter sends from its server to return matching public food records.
• Open Food Facts receives the UPC or EAN barcode and requested product-data fields that Project Warfighter sends from its server to return a packaged-food record.
• Other members receive only information you deliberately make available through the current connection or sharing controls.
• Authorities or other parties may receive information when reasonably necessary to comply with law, protect rights or safety, investigate misuse, or respond to a valid legal process.
• A successor may receive data as part of a future reorganization or transfer, subject to applicable notice and consent requirements. There is no such transfer planned for this beta.

These food-provider requests originate from Project Warfighter's server and do not include your Project Warfighter account identifier, email address, authentication token, or browser IP address. The providers receive the search text or barcode and server request metadata and may maintain logs under their own privacy practices. A search term or barcode can reveal or allow an inference about food, nutrition, allergy, or dietary interests.

We do not sell personal data, use it for targeted advertising, or disclose it to data brokers. Friend Codes may appear in a share URL; the recipient, its messaging or social service, and hosting logs may retain that URL. Treat a Friend Code as shareable connection information rather than a secret credential.

6. Member-controlled sharing

Records are private by default. Accepting a Wingman connection does not expose all records. Current controls allow limited items such as level and XP to be shared per connection; medical limitations, nutrition details, assessment details, notes, email, and authentication data are not shared by default. A progress card is previewed before download. Once you send or download a copy, recipients may keep or forward it and the copy cannot be recalled through the app.

7. Retention and deletion

We keep personal data only for as long as reasonably needed to provide the beta, protect it, resolve requests or disputes, and meet legal obligations. Retention depends on the type of record and why it exists; we do not promise one fixed period for every category.

The verified account-deletion flow removes the authentication identity and associated live member records. Limited copies can remain temporarily in provider backups, security or authentication logs, legal records, or incident evidence until they expire or are no longer needed. Deleted information may persist in a copy another member downloaded or received outside the app.

8. Your choices and privacy rights

During the nationwide beta, we make the following request process available to United States members, subject to identity verification and applicable law:

• Ask whether we process your personal data and request access to it.
• Request correction of inaccurate profile or member-entered information.
• Request deletion of an account or specified records.
• Withdraw consumer health data consent, which stops new covered processing unless another legal basis applies.
• Appeal a denied privacy request by identifying the earlier request.

Use available account controls or email privacy@neascan.org from the account email. Describe the request and the relevant account or record category, but do not send passwords or unnecessary health details. We may request reasonable verification and will respond as required by applicable law. You may also contact your state attorney general or other regulator.

9. Consumer health data consent

Fitness, nutrition, readiness, limitation, pain, illness, body-measurement, and assessment information may be consumer health data. We request separate, affirmative consent before processing that information. You may withdraw consent without deleting your account, but features that require covered processing will stop until valid consent is provided again. Account deletion and privacy-request access remain available.

10. Security

We use measures such as authenticated sessions, owner-only database policies, least-privilege service access, migration review, and security testing. No website, transmission, or storage system is completely secure. Keep your account and email credentials secure and contact privacy@neascan.org if you suspect unauthorized access.

11. Adults and United States beta scope

Project Warfighter is not intended for anyone under 18, and we do not knowingly permit an under-18 beta account. The beta is intended only for participation from the United States. If we learn that an ineligible account was created, we may close it and delete associated data, subject to limited legal and security retention.

12. Changes and contact

We will publish material changes as a new dated version and request a new acknowledgment or consent when required. Versioned notices remain available so members can identify the text connected to an acceptance record.

Privacy questions, rights requests, appeals, and incident reports may be sent to Dylan Seaton at privacy@neascan.org.