Privacy Policy

Template note: This policy is a defensible starting point. We recommend you have a lawyer customize it for your jurisdiction (US, EU/UK GDPR, California CCPA) before launch.

Who we are

SureShotFatLoss (“we,” “us,” “our”) operates the website at https://www.sureshotfatloss.com (the “Service”). This Privacy Policy describes what information we collect, how we use it, and the choices you have about your data.

Information we collect

Account information

When you create an account, we collect your email address, full name, and a password (stored hashed via our authentication provider, Supabase). For users who sign in via Google OAuth, we receive your email and name from Google's consent screen.

Assessment and tool inputs

When you take the Metabolic Damage Assessment or use the calculators, we collect your responses. For the assessment, this includes answers to 15 questions about diet, sleep, stress, activity, and known health conditions, plus your computed profile. For tools, inputs are stored locally in your browser by default and only transmitted to us if you submit your email to save results.

Daily logs and progress data

If you use the dashboard's daily log, we collect the values you record: weight, sleep hours, energy, mood, and any notes. This data is private to your account and used only to generate your progress charts.

Subscription and payment information

We use Stripe to process payments. We do not store your credit card information. Stripe stores the customer ID and subscription metadata associated with your account; we hold these references but not the card data itself.

Behavioral analytics

We use Plausible Analytics (or PostHog when configured) to measure aggregate site usage — page views, traffic sources, and conversion events. These analytics tools do not track individuals across the web; they collect aggregate, non-identifying data only. You can opt out via the cookie banner.

Email engagement

We use Resend to deliver transactional and newsletter emails. Resend logs delivery success and basic engagement metrics (opens, clicks). We use this aggregate data to improve our content and remove inactive subscribers.

How we use your information

To provide the Service: account access, assessment results, dashboard, program access
To send transactional emails: account confirmation, assessment results, enrollment confirmations, daily-log reminders
To send the weekly newsletter and 2-week onboarding drip series, if you've opted in
To analyze aggregate usage and improve the Service
To respond to support requests sent to our contact email
To detect and prevent abuse of the Service

How we share your information

We share data with the following third parties to operate the Service:

Supabase — database and authentication. Your account, profile, assessment answers, daily logs, and enrollment records are stored on Supabase servers.
Vercel — application hosting. Vercel sees request data including IP addresses and user agents; this is logged for operational and security purposes.
Stripe — payment processing. Card data is processed by Stripe directly; we do not see or store it.
Resend — email delivery. Email addresses and message content are processed through Resend for transactional and newsletter delivery.
Plausible / PostHog — analytics. Aggregate, non-identifying.

We do not sell your personal data. We do not share your data with advertisers. We do not run programmatic ads.

Cookies

We use essential cookies for authentication (your login session) and CSRF protection. We use one analytics cookie via Plausible (or PostHog) when you consent on first visit. You can decline analytics cookies via our cookie banner — the site fully functions without them.

Your rights

Access, correction, and deletion

You can:

Export your data at any time from /dashboard/account — JSON of your profile, logs, and enrollments.
Update your name and email from /dashboard/account.
Delete your account from /dashboard/account — permanent and immediate. Profile, logs, and enrollment records are deleted via cascade.
Unsubscribe from emails via the link in every email footer or by contacting us directly.

GDPR and CCPA rights

If you reside in the EU/UK or California, you have additional rights under GDPR and CCPA: the right to access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, and the right to object. Most of these are accessible directly via the dashboard. For requests we can't handle through the interface, contact privacy@sureshotfatloss.com.

Data retention

We retain your account data while your account is active. When you delete your account, we permanently delete your profile, logs, and enrollment records immediately. We retain anonymized aggregate analytics indefinitely. We retain records required for tax and accounting purposes (e.g., Stripe transaction records) per US legal requirements.

Children's privacy

The Service is not directed to children under 18. We do not knowingly collect information from children. If you believe a child has submitted information to us, contact privacy@sureshotfatloss.com and we will delete it.

Security

We use industry-standard security measures: encrypted database (Supabase), TLS for all traffic, secure session management, and access controls on our backend. Despite our efforts, no method of transmission over the internet or electronic storage is 100% secure; we cannot guarantee absolute security.

Changes to this policy

We may update this policy as the Service evolves. Material changes will be communicated via email to active users. The “last updated” date at the top of this page reflects the most recent revision.

Contact us

For privacy questions or to exercise your rights: privacy@sureshotfatloss.com