Privacy Policy
Effective Date: June 22, 2026
Last Updated: September 13, 2026
1. Who We Are
BoddByTodd is a personalized fitness coaching platform operated by Todd Johnson, a kinesiologist based in California. We provide AI-assisted fitness programming, macro and workout tracking tools, and access to a dedicated fitness coaching application.
For any privacy-related questions or requests, contact us at: coach@boddbytodd.com
2. Data We Collect
We collect only the information necessary to deliver your personalized fitness program and operate the platform. This section also serves as our California “notice at collection”: the categories below are collected for the purposes in Section 3, kept for the periods in Section 5, and are never sold or shared for cross-context behavioral advertising. This includes:
Personal Identifiers
Full name, email address, and account credentials.
Health and Body Composition Data
Age, gender, height, weight, body fat percentage, neck circumference, waist circumference, hip circumference, injury history, stress level, sleep quality, daily activity level, sport or activity type, food preferences and restrictions, and alcohol consumption habits. This data is submitted voluntarily through the intake form and is used exclusively to generate your personalized program.
Payment Information
All payment processing is handled exclusively by Stripe, Inc. We never store, see, or have access to your credit card numbers or full payment details. We receive only a transaction confirmation and your email address from Stripe.
Usage Data
Workout logs, macro tracking entries, and features used within the app. Page-view and page-speed analytics (Vercel) are collected only if you accept analytics in the cookie banner — see Section 7.
Communications
Any messages you send through the contact form or directly to the coach email.
Free Starter Week & Reviews
If you request the free Starter Week we store your email address and where you signed up. If you leave a review we store the name and text you submit; reviews are only published after manual approval. Each form has its own consent checkbox and you can withdraw consent at any time by emailing us.
3. How We Use Your Data
- •To generate your personalized AI fitness program using the Anthropic Claude API.
- •To deliver transactional and program-related email communications via Resend.
- •To process payments via Stripe.
- •To store your program, tracking data, and account information securely in Supabase.
- •To improve the accuracy and relevance of your fitness program recommendations.
We do NOT:
- • Sell your personal or health data to any third party.
- • Use your health data for advertising or marketing profiling.
- • Share your data with anyone outside of the service providers listed in Section 4.
4. Third-Party Services
We work with the following third-party services to operate the platform. Each has its own privacy policy governing how they handle data:
Supabase
Database hosting and user authentication. Your account data, program data, and workout logs are stored on Supabase's secure cloud infrastructure. supabase.com/privacy
Stripe
Payment processing. All payment card data is handled exclusively by Stripe and never passes through our servers. stripe.com/privacy
Resend
Transactional email delivery (program delivery, welcome emails, support responses). resend.com/privacy
Anthropic (Claude AI)
AI program generation. Health and body composition data submitted in your intake form is sent to Anthropic's Claude API to generate your personalized fitness program. Anthropic does not retain API input data for model training purposes per their API data usage policy. anthropic.com/privacy
Vercel (hosting, analytics & speed insights)
Website hosting. Vercel processes your IP address in server logs to serve pages and protect against abuse. Vercel Web Analytics (cookieless page-view counts) and Speed Insights (page-load timings) only load after you accept analytics in the cookie banner — you can change that choice on the Cookie Policy page. vercel.com/legal/privacy-policy
Google Fonts
The Inter typeface is loaded from Google Fonts. Google receives your IP address and browser details when the font is requested; no cookies are set. policies.google.com/privacy
5. Data Retention
- •Account and program data: Retained for the duration of your active account plus 2 years after cancellation or account closure.
- •Health intake data: Retained for the duration of your active program plus 1 year.
- •Payment records: Retained for 7 years as required by IRS regulations.
- •Deletion requests: You may request complete deletion of your account and associated data at any time by emailing coach@boddbytodd.com. Payment records required by law will be retained.
6. Your Rights
GDPR — European Union Users
If you are located in the European Economic Area, you have the following rights regarding your personal data:
- • Right to access: Request a copy of the personal data we hold about you.
- • Right to rectification: Request correction of inaccurate or incomplete data.
- • Right to erasure: Request deletion of your personal data ("right to be forgotten").
- • Right to restrict processing: Request that we limit how we use your data.
- • Right to data portability: Request your data in a machine-readable format.
- • Right to object: Object to processing of your data for specific purposes.
To exercise any of these rights, email coach@boddbytodd.com. We will respond within 30 days.
CCPA / CPRA — California Residents
If you are a California resident, you have the right to:
- • Know what personal information we collect, use, and disclose, and to whom.
- • Access a copy of the personal information we hold about you.
- • Correct inaccurate personal information.
- • Delete your personal information, subject to legal exceptions.
- • Limit use of sensitive personal information. Your health and body-composition data is sensitive personal information; we use it only to build and adjust your program and never for advertising or profiling.
- • Opt out of sale or sharing — we do not sell or share your personal information and have not done so in the preceding 12 months, so there is nothing to opt out of.
- • Non-discrimination for exercising any of these rights.
To submit a request, email coach@boddbytodd.com from the address on your account (or have an authorized agent do so with your written permission). We will confirm receipt within 10 business days and respond within 45 days. We honor browser Global Privacy Control signals by keeping analytics off unless you opt in.
7. Cookies
BoddByTodd uses strictly necessary cookies set by Supabase to keep you logged in, plus a first-party cookie/localStorage entry that remembers your cookie choice. Without these you cannot stay logged in between pages.
With your consent we also load Vercel Web Analytics (cookieless page-view counts) and Vercel Speed Insights (page performance timings). These do not run until you accept them in the cookie banner, and you can change your choice at any time on the Cookie Policypage. We do not use advertising cookies, social-media pixels, or cross-site tracking, and we honor “Do Not Track” / Global Privacy Control signals by keeping analytics off unless you explicitly opt in.
You may also disable cookies in your browser settings, but doing so will prevent you from using the authenticated portions of the platform.
8. Children's Privacy (COPPA)
BoddByTodd is not intended for users under 18 years of age. We do not knowingly collect personal or health data from individuals under 18. If you are a parent or guardian and believe your child has submitted data through our platform, please contact us immediately at coach@boddbytodd.com and we will delete that information promptly.
9. Data Security
We take reasonable measures to protect your personal information from unauthorized access, disclosure, and loss:
- • All data transmitted to and from the platform is encrypted in transit using TLS (HTTPS).
- • Data stored in Supabase is encrypted at rest.
- • Database access is restricted by row-level security policies tied to authenticated user accounts.
- • Admin access requires a separate authentication credential not accessible to regular users.
No system is completely secure. If you believe your account has been compromised, contact us immediately at coach@boddbytodd.com.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify registered users by email at least 30 days before the changes take effect. The updated policy will also be posted on this page with a new "Last Updated" date. Your continued use of the platform after the effective date constitutes acceptance of the updated policy.
11. Contact
For any privacy-related questions, data requests, or concerns: