Privacy Policy
Effective Date: June 22, 2026
Last Updated: June 22, 2026
1. Who We Are
BoddByTodd is a personalized fitness coaching platform operated by Todd Johnson, a licensed kinesiologist based in Winchester, California. We provide AI-assisted fitness programming, macro and workout tracking tools, and access to a dedicated fitness coaching application.
For any privacy-related questions or requests, contact us at: coach@boddbytodd.com
2. Data We Collect
We collect only the information necessary to deliver your personalized fitness program and operate the platform. This includes:
Personal Identifiers
Full name, email address, and account credentials.
Health and Body Composition Data
Age, gender, height, weight, body fat percentage, neck circumference, waist circumference, hip circumference, injury history, stress level, sleep quality, daily activity level, sport or activity type, food preferences and restrictions, and alcohol consumption habits. This data is submitted voluntarily through the intake form and is used exclusively to generate your personalized program.
Payment Information
All payment processing is handled exclusively by Stripe, Inc. We never store, see, or have access to your credit card numbers or full payment details. We receive only a transaction confirmation and your email address from Stripe.
Usage Data
Pages visited, features used, workout logs, macro tracking entries, and session duration within the app.
Communications
Any messages you send through the contact form or directly to the coach email.
3. How We Use Your Data
- •To generate your personalized AI fitness program using the Anthropic Claude API.
- •To deliver transactional and program-related email communications via Resend.
- •To process payments via Stripe.
- •To store your program, tracking data, and account information securely in Supabase.
- •To improve the accuracy and relevance of your fitness program recommendations.
We do NOT:
- • Sell your personal or health data to any third party.
- • Use your health data for advertising or marketing profiling.
- • Share your data with anyone outside of the service providers listed in Section 4.
4. Third-Party Services
We work with the following third-party services to operate the platform. Each has its own privacy policy governing how they handle data:
Supabase
Database hosting and user authentication. Your account data, program data, and workout logs are stored on Supabase's secure cloud infrastructure. supabase.com/privacy
Stripe
Payment processing. All payment card data is handled exclusively by Stripe and never passes through our servers. stripe.com/privacy
Resend
Transactional email delivery (program delivery, welcome emails, support responses). resend.com/privacy
Anthropic (Claude AI)
AI program generation. Health and body composition data submitted in your intake form is sent to Anthropic's Claude API to generate your personalized fitness program. Anthropic does not retain API input data for model training purposes per their API data usage policy. anthropic.com/privacy
5. Data Retention
- •Account and program data: Retained for the duration of your active account plus 2 years after cancellation or account closure.
- •Health intake data: Retained for the duration of your active program plus 1 year.
- •Payment records: Retained for 7 years as required by IRS regulations.
- •Deletion requests: You may request complete deletion of your account and associated data at any time by emailing coach@boddbytodd.com. Payment records required by law will be retained.
6. Your Rights
GDPR — European Union Users
If you are located in the European Economic Area, you have the following rights regarding your personal data:
- • Right to access: Request a copy of the personal data we hold about you.
- • Right to rectification: Request correction of inaccurate or incomplete data.
- • Right to erasure: Request deletion of your personal data ("right to be forgotten").
- • Right to restrict processing: Request that we limit how we use your data.
- • Right to data portability: Request your data in a machine-readable format.
- • Right to object: Object to processing of your data for specific purposes.
To exercise any of these rights, email coach@boddbytodd.com. We will respond within 30 days.
CCPA — California Residents
If you are a California resident, you have the right to:
- • Know what personal information is collected about you and how it is used.
- • Request deletion of your personal information.
- • Opt out of the sale of your personal information — we do not sell your data.
- • Non-discrimination for exercising your privacy rights.
To submit a CCPA request, email coach@boddbytodd.com.
7. Cookies
BoddByTodd uses authentication cookies set by Supabase to maintain your logged-in session. These cookies are strictly necessary for the platform to function — without them, you cannot remain logged in between pages. We do not use advertising cookies, third-party tracking cookies, or analytics cookies that share your data with external parties.
You may disable cookies in your browser settings, but doing so will prevent you from using the authenticated portions of the platform.
8. Children's Privacy (COPPA)
BoddByTodd is not intended for users under 18 years of age. We do not knowingly collect personal or health data from individuals under 18. If you are a parent or guardian and believe your child has submitted data through our platform, please contact us immediately at coach@boddbytodd.com and we will delete that information promptly.
9. Data Security
We take reasonable measures to protect your personal information from unauthorized access, disclosure, and loss:
- • All data transmitted to and from the platform is encrypted in transit using TLS (HTTPS).
- • Data stored in Supabase is encrypted at rest.
- • Database access is restricted by row-level security policies tied to authenticated user accounts.
- • Admin access requires a separate authentication credential not accessible to regular users.
No system is completely secure. If you believe your account has been compromised, contact us immediately at coach@boddbytodd.com.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email at least 30 days before the changes take effect. The updated policy will also be posted on this page with a new "Last Updated" date. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.
11. Contact
For any privacy-related questions, data requests, or concerns: