Privacy Policy

What we collect

Account information. Your email address and, if you sign in with Google, the basic account identity Google returns. Authentication credentials are handled by our authentication provider, Supabase; Built to Last does not have access to your plaintext password.

Optional profile details. A preferred name and a ZIP or postal code, if you choose to enter them. Both may be left blank.

Communication preferences. Three optional preferences — product updates, regional events, and Founder's Dispatch. All three are off unless you turn them on, and you can change them in Account at any time. Service messages such as email confirmation and password resets are not marketing and are sent regardless.

Fuel records. Meals you log, including protein, carbohydrate, fiber, fat, and calorie values, your protein target and step goal, and any quick presets you create.

Forge records. Workout sessions: title, date and time, movements, load, repetitions, how a set felt, and your notes.

Ledger records. Daily check-ins (steps, weight, notes) and weekly audits (blood pressure, resting heart rate, waist measurement). Some accounts may still contain older heart-rate-variability and sleep fields from an earlier version of the app.

Feedback. Any message you send through the in-app feedback form, along with whether it came from a signed-in account or a guest session.

AI acknowledgements. A record that you acknowledged the Meal Scan or Operational Debrief notice, including which version of the wording and when.

Policy acceptance. A record that you accepted these documents, including the version and the time.

We do not collect your street address, phone number, date of birth, or payment information.

Technical information

Our hosting, authentication, and database infrastructure automatically processes ordinary technical data as part of serving the app: IP address, browser and device type, timestamps, requested pages, and error or security logs. This is standard operational and security logging.

Built to Last does not currently run advertising trackers or a dedicated production analytics product. That describes the app as it exists today, not a permanent commitment; if it changes, we will update this policy and post a new effective date.

Guest preview

Guest preview lets you explore the app with sample data held in your browser. Ordinary guest entries are not saved to our database and disappear when you leave. One exception: if you submit feedback as a guest, that message is stored so we can read it.

The two AI features

Meal Scan. If you use it, your meal photo is compressed on your device and sent through the Lovable AI gateway to an OpenAI model for analysis. Built to Last does not save the photo. The nutrition numbers that come back are estimates for you to review and correct before logging.

Operational Debrief. If you run it, selected records from your account — recent protein and fuel figures, workout sessions, weight, blood pressure, and resting heart rate — are sent through the same gateway to generate the written debrief. The result is general educational guidance, not medical advice.

Both features ask for your acknowledgement the first time you use them, and neither sends anything if you cancel. We describe only what this app does; we do not make claims about how long a third-party AI provider retains what it receives.

Who processes data for us

These are the providers we rely on to run the app. We are not claiming any particular contractual, retention, or deletion terms with them beyond their own published terms.

• Lovable — application hosting and the AI gateway that routes AI requests.
• Supabase — authentication and database storage.
• Google — only if you choose Google sign-in.
• OpenAI — the model that processes Meal Scan and Operational Debrief requests, reached through the gateway above.

No payment or marketing-email provider

There is currently no payment processor and no marketing-email service connected to Built to Last. If that changes, we will update this policy and note the new effective date.

Information stored on your device

Some things stay on your device and are not sent to us: in-progress workout drafts and rest timers, and guest preview data.

Where data is processed

Built to Last is operated from the United States, and data is processed there. If you use the app from elsewhere, you are sending your information to the United States.

How long we keep data

Your records stay in your account until you delete them or ask us to delete the account. There is no automatic purge and no fixed retention period today.

Feedback messages are an exception: if an account is deleted, the message may remain with its account link removed. Because you write the message text yourself, we cannot guarantee it contains nothing that identifies you.

Security

Each account's records are restricted at the database level so that only that account can read or change them, and authentication is handled by a dedicated provider. We take reasonable measures, but no online service can promise perfect security.

Your choices and requests

You can download your data and delete your account yourself, from the Account screen in the app. You can also email builttolasthealth@gmail.com from the address on your account to request access to your information, a correction, or deletion. Requests will be handled as required by applicable law.

• Change or clear your preferred name, postal code, and communication preferences in Account at any time.
• Edit or delete individual Fuel, Forge, and Ledger entries in the app.
• Download a copy of everything saved to your account from Account, under Your data.
• Delete your account and its records from Account, under Your data. Feedback messages may remain with their account link removed.
• Email builttolasthealth@gmail.com for access, correction, or deletion requests.

Changes

If this policy changes, we will post the revised version with a new effective date and, where the change is significant, ask you to review it in the app.