Privacy Policy

This policy explains what information Directive handles and what happens to it. It covers the Directive mobile app (the "App") and the website at directivefitness.com (the "Website"). Directive is published by Directive LLC, 952 Winchester Rd, Unit #308, Lexington, KY 40505 ("Directive", "we", "us").

In this policy, "personal information" means information that identifies you, relates to you, or could reasonably be linked to you. It includes the health and fitness information described in sections 1 and 2. It does not include information that has been de-identified or combined so that it can no longer reasonably be linked to you.

The App is available for iPhone. Where this policy mentions Android, Health Connect or Google Play, it applies once the App is available on Android.

The short version

• Everything you enter into the App, and everything it reads from your device's health service (Apple Health on iPhone, Health Connect on Android), is collected and stored only on your own device. The App does not transmit it to us or to anyone else, and we have no access to it. Your device's own backup may include it, as explained in section 6. Please review our separate Consumer Health Data Privacy Policy for the categories of health data we process, our specific purposes for collecting it, and your rights to access or delete your information. It applies to every user, and it gives residents of Washington, Nevada, Connecticut and other states with specific health privacy protections the disclosures those laws require. We do not collect or process your consumer health data without your explicit, separate opt-in consent.
• The App has no accounts and no sign-in, and we run no server that receives your App data.
• The App contains no advertising and no analytics or tracking software. When paid plans are available, we use RevenueCat to manage subscriptions and process purchase-related data, as described in section 4 below. RevenueCat never receives your health information, and it is not started until you have given your consent.
• We never sell your information. Health information is never used for advertising or marketing and is never given to data brokers.
• If you buy a subscription, the app store you bought it from (Apple's App Store or Google Play) and our subscription provider, RevenueCat, process the purchase. They do not receive your health information.
• The Website collects only what you type into its application form or support form.
• Directive is for adults aged 18 and over.

1. The App: information you enter

To work, the App asks for or lets you record:

• Profile: sex, height and date of birth.
• Body data: weight, target weight, and waist, neck and hip measurements, from which the App estimates your body fat.
• Nutrition: the food and drink you log, as calories, protein, carbohydrate, fat, alcohol and fluids.
• Activity and recovery: steps, workouts, resting heart rate and sleep.
• Optional health details: your menstrual cycle start dates, cycle length and period length; your menopause status; and whether you use a GLP-1 or other appetite-modulating medication.
• Preferences and plans: your goal, pace, dietary style, training schedule and planned events.
• A profile photo, if you choose one.

The App uses this information for one purpose: to calculate and show your own figures, such as your weight trend, your calorie and macronutrient targets, and your weekly review.

The App collects and stores this information only on your own device, in the App's own storage. The App does not transmit it to us or to anyone else, and we have no access to it. Your device's own backup may include it, as explained in section 6.

Your consent comes first. Before you can enter any of this, the App shows a separate screen that lists the health information it collects and what it is used for, and asks for your consent. Nothing is entered, imported or started until you tap "I CONSENT". The App records the date of your consent and the version of the Consumer Health Data Privacy Policy you were shown. If that policy changes in a material way, the App asks for your consent again. If you do not consent, the App cannot be used.

The optional health details are optional. You can use the App without entering them, and you can switch cycle tracking off at any time in the App.

2. The App: your device's health service

If you choose to connect your device's health service (Apple Health on iPhone, Health Connect on Android), the App asks your permission to read these, and only these:

• body weight,
• step count,
• sleep,
• resting heart rate,
• workouts.

The App uses them to fill in your daily log so that you do not have to type the figures. They are stored on your device with the rest of your data.

What the App does not do:

• It does not read body fat, lean body mass, body mass index or any other body-composition figure, even if your scale records one.
• It does not write anything to your device's health service.
• It does not send information from the health service to us or to any third party.
• It does not use information from the health service for advertising, marketing or data mining, and it does not sell it.
• The App does not use iCloud or any other cloud service to sync or store your data across devices. Your data, including anything read from your device's health service, is included in your device's own backup (for example, iCloud Backup on an iPhone) if you have that feature turned on. Section 6 explains this and how to turn it off.

A figure you type yourself is never replaced by an imported one.

You choose which of the five types the App may read, on your device's own permission screen. You can change or withdraw that permission at any time in your device's settings for the health service.

If you use a fitness tracker, a smart scale or another product, you may be able to have that product share its data with your device's health service. Directive then receives the data through the health service, under the rules above. That sharing is controlled by you and by those companies, not by us.

3. The App: photos

If you choose a profile photo, the App asks permission to open your photo library. The picture you choose stays on your device. The App does not read your other photos.

4. The App: purchases and RevenueCat

During the beta test, every feature is free and nothing is sold. No purchase information is collected.

When paid plans are available, they are sold through your app store's in-app purchase (Apple's App Store or Google Play). We use a service called RevenueCat to check whether a subscription is active. When you buy or restore a subscription:

• The app store processes the payment. We never receive your payment card details.
• RevenueCat is not started until you have given the consent described in section 1.
• RevenueCat receives a random identifier created for your installation of the App, the product you bought, the dates and status of the subscription, and basic technical information such as your device type, operating system, App version, and language and currency settings. We do not ask RevenueCat to collect an advertising identifier, and it does not receive your name, your email address, your location, your payment details, or any health information. We can see that subscription record.
• Neither the app store's purchase system nor RevenueCat receives the health, fitness or profile information you enter in the App.

The identifier is not your name or your email address, and we do not link it to you.

• Apple's privacy policy: https://www.apple.com/legal/privacy/
• Google's privacy policy: https://policies.google.com/privacy
• RevenueCat's privacy policy: https://www.revenuecat.com/privacy

5. The App: when information leaves your device

Only when you choose to send it. The App can create:

• a backup file holding all of your Directive data,
• a PDF report of your history (in versions labeled for a doctor, a trainer or a nutritionist),
• a spreadsheet (CSV) file of your history,
• a calendar file of your training schedule.

Each opens your device's share sheet. You decide whether to send or save the file, and where. Once you share or save a file, it is governed by the service or the person you gave it to, not by this policy.

About the backup file. It contains everything you have entered or imported, including your health details. It is encrypted with a password you choose when you save it, using AES-256 encryption, and it cannot be read or restored without that password. We do not keep the password and cannot recover it: if you lose it, the backup cannot be opened. Choose a long password, and store the file somewhere only you can open.

About the other files. The PDF report, the spreadsheet and the calendar file are not encrypted: anyone who can open one can read it. Before it creates any of them, the App tells you so and asks you to confirm. Treat these files like any private document.

About cycle information in reports. Cycle information is left out of PDF reports unless you switch it on for that report.

6. The App: your device's own backups

The App's data is included in your device's own backups (for example, iCloud Backup on an iPhone, or a backup to your computer) if you have those turned on. This is what lets your data return when you restore or replace your device. Those backups are made, stored and protected by the company that makes your device and by you, under your own account with them. We have no access to them.

If you would rather your Directive data were not included in your device's cloud backup, you can switch Directive off in your device's backup settings, in the list of apps included in the backup.

7. The App: beta testing

If you take part in the beta, you install the App through your app store's beta testing service (Apple's TestFlight on iPhone). That service collects information about how the beta runs, such as crash reports and how often it is used, and shares it with us so that we can fix problems. If you send feedback or a screenshot through it, we receive it together with the email address you used to join. The service handles this under its own privacy policy. It does not include your health information unless you put it in a screenshot or a message you send us.

8. The Website

Charter applications. If you apply for Charter Access on the Website, we collect your email address and the answers you choose or write. We use them only to manage the Charter intake and to contact you about Directive. They are stored in a private database that only we can access. The application is also sent to us by email.

Support messages. If you use the support form or email us, we receive your email address and your message, and we use them to reply.

Service providers. To run the Website we use Vercel to host it, Supabase to store applications, and Resend to deliver the form emails to us. They process the information above on our behalf and may not use it for their own purposes. Like any website host, Vercel records standard technical information about each visit, such as your IP address, browser type and the time of the request, for security and to keep the site running.

Cookies and tracking. The Website does not use advertising cookies or analytics, and it does not track you across other sites.

How long we keep it. We keep Charter applications until the Charter program ends and for one year after that, or until you ask us to delete yours, whichever comes first. We keep support messages for two years after your request is resolved, so that we have a record of what was asked and answered, unless a longer period is required by law. You can ask us to delete your information at any time, as described in section 12.

9. What we never do

• We never sell your personal information.
• We never share it for advertising, including cross-context behavioral advertising.
• We never give health information to data brokers.
• We never use health information, including anything read from your device's health service, for advertising, marketing or any purpose other than providing the App's features to you.

10. Security

We use reasonable technical and organizational safeguards to protect your information. The information in the App is stored only in the App's private storage on your device, which other apps cannot read, and is protected by the device's built-in encryption when the device is locked with a passcode, Face ID, fingerprint or your device's equivalent. The App does not send your health information anywhere; its only internet connection, for subscriptions once paid plans are available, uses encrypted HTTPS. The backup file the App can create is encrypted with AES-256 and a password you choose (section 5). Because this protection depends on your device being locked, keep it protected with a passcode.

Website information is sent over an encrypted connection (HTTPS) and stored with providers that restrict access. No system is completely secure, and we cannot guarantee absolute security. Health information in the App is held only on your device, not by us. If we learn of a security breach affecting personal information we do hold, such as Charter applications or support messages, we will notify you and any authorities as required by applicable law, without unreasonable delay.

11. Keeping and deleting your information

In the App. Your information stays on your device until you delete it. "Delete all my data" in the App's Settings erases everything the App stored on the device, and so does deleting the App. Copies you made yourself (a backup file, a report, a spreadsheet) and your device's own backup are yours to delete. Because we hold no copy of the information in the App, we cannot recover it for you, and there is nothing of it for us to delete on our side.

Subscription records. RevenueCat and the app store keep records of purchases. To ask about or delete a RevenueCat record, email us at privacy@directivefitness.com. We will tell you how to find the identifier for your installation so that we can locate the record.

On the Website. To see, correct or delete your Charter application or a support message, email privacy@directivefitness.com. We will acknowledge your request within 10 business days and respond within 30 days.

12. Your choices and rights

Depending on where you live, you may have the right to know what personal information a business holds about you, to get a copy of it, to correct it, to delete it, and not to be discriminated against for using those rights.

• For information in the App, you can do all of these yourself: view and edit it in the App, export it (the backup file or the spreadsheet), or delete it with "Delete all my data" in the App's Settings or by deleting the App.
• To withdraw your consent to the App handling your health information, use "Withdraw health data consent" in the App's Settings. The App asks whether you also want to delete your data, and you can do both in one step. It then stops and shows the consent screen until you consent again. If you choose to keep your data, it stays on your device until you delete it with "Delete all my data".
• For Website information or a subscription record, email privacy@directivefitness.com. We will acknowledge your request within 10 business days and respond within 30 days. We may need to confirm that the request is from you.

If we decline a request, you may ask us to reconsider by replying to our response. You may also contact the attorney general of your state.

We do not sell or share personal information as those terms are defined in California law, and we do not use sensitive personal information for any purpose other than providing the Service.

13. Age and children's privacy

The App and the Website are intended for use by adults aged 18 and over. The App requests a standardized age-bracket signal from your device's operating system or app store to confirm your age range, asks for a date of birth as a secondary measure, and refuses access to anyone younger than 18. We treat the received age signal as the primary indicator of age for compliance with California privacy laws. The signal is an age range, not your exact age or date of birth. We use it only for this check: we do not store it, and we do not share it with anyone. If your device does not provide a signal, or you choose not to share it, the App relies on the date of birth you enter.

We do not knowingly collect personal information from anyone under 18, including children under 13. If we learn that a child under 13, or anyone under 18, has sent us personal information through the Website, we will delete it promptly and will not retain it. Information entered in the App is stored only on the device and is not held by us; it can be erased with "Delete all my data" in the App's Settings, or by deleting the App.

Parents or guardians with questions, or who wish to review or delete their child's information, may contact us at Directive LLC, 952 Winchester Rd, Unit #308, Lexington, KY 40505, or by email at privacy@directivefitness.com.

14. Not medical advice

Directive is an informational tool designed to assist with personal fitness, nutrition planning, and macro-tracking. It does not provide medical advice, diagnosis, or treatment. Our Terms of Service explain this in full.

15. Where information is processed

We are based in the United States, and the Website's providers process information in the United States. The App is offered in the United States.

16. Features planned for later

We plan to add, in later versions:

• An Android version of the App, reading from Health Connect in the same way the iPhone version reads from Apple Health.
• Direct sign-in to Google Health, so that Fitbit and Google Health data can be read without going through your device's health service. This would involve signing in with your Google account, and Google supplying the data you approve.

Neither exists today. Before either is switched on, we will update this policy and ask for your permission in the App.

17. Changes to this policy

When we change this policy we will update the date at the top. If a change affects how health information is handled, or is otherwise significant, we will tell you in the App or on the Website before it takes effect. If the Consumer Health Data Privacy Policy changes in a material way, the App asks for your consent again before the change applies to you.

18. Contact

Directive LLC952 Winchester Rd, Unit #308, Lexington, KY 40505Privacy questions and requests: privacy@directivefitness.comSupport: support@directivefitness.com, or the support form at directivefitness.com/support