Privacy Notice

1. Who We Are

IronClad Fitness is operated by Jordan Stevens, trading as IronClad Fitness. For the purposes of data protection law, Jordan Stevens is the data controller of the personal data collected through this service.

2. What We Collect

• Application details — name, email, phone number, age, current and target weight, training experience, goals, medical and lifestyle notes you choose to share.
• Account data — login credentials (stored securely by our authentication provider), account status.
• Coaching data — meal logs and photos, front/side/back check-in photos, sharing-consent choices, check-in notes, messages with your coach, consultation bookings.
• Usage data — basic device identifiers, IP address, and how you use the app.

Payment card details are collected and processed directly by Stripe, our payment processor — we never see or store your full card number.

3. Why We Use It

• Providing the service — building and adjusting your meal and workout plans, running check-ins, scheduling consultations (legal basis: performance of our contract with you).
• Account administration — creating your account after approval, managing your membership (legal basis: contract performance).
• Security and fraud prevention — protecting accounts and the service (legal basis: legitimate interests).
• Product improvement — understanding how the app is used so we can improve it (legal basis: legitimate interests).
• Customer support — responding to your messages and refund requests (legal basis: contract performance and legitimate interests).
• Legal obligations — records we must keep for tax and accounting (legal basis: legal obligation).

4. Who We Share It With

• Service providers — hosting, database, authentication, and analytics providers that process data on our behalf under contract.
• Stripe (payment processor) — for membership billing, subscription management, payment processing, and tax calculation. Stripe handles payment-related data under its own privacy policy.
• Google Ads (advertising measurement) — when you arrive from one of our Google ads and submit an application, Google receives a measurement signal (such as an advertising cookie or click identifier) so we can tell which ads lead to applications. Visitors in regions that require consent are not tracked. See Google's privacy information.
• Professional advisers — legal and accounting advisers where needed.
• Authorities — where required by law.

We do not sell your personal data.

Progress photos are private to you and your coach. Sharing them on social media requires your separate approval after upload. Declining does not prevent check-ins or coaching, and you can change your choice in the app.

5. How Long We Keep It

We keep your data for as long as your account is active and as needed to provide the service. When data is no longer needed — for example after your membership ends and any legal retention periods pass — it is deleted or anonymised.

6. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion of your data.
• Restrict or object to certain processing.
• Receive a portable copy of your data.
• Withdraw consent where processing is based on consent.
• Complain to your local data protection authority.

To exercise any of these rights, message your coach through the app. We respond within one month.

7. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, and access controls limiting who can view client information.

8. Cookies

We use essential cookies and local storage to keep you signed in and remember your session. We also use Google Ads measurement cookies to understand which adverts lead to coaching applications; these are not set for visitors in regions that require consent. You can clear cookies in your browser settings, but the app won't stay signed in without the essential ones.

9. Changes

We may update this notice from time to time. The "last updated" date at the top shows the current version, and continued use of the service after changes means you accept the updated notice.