Privacy Policy
Last updated: August 4, 2026
This policy explains how StrengthCode handles personal information when you visit our website, create an account, purchase or use a program, use coaching, nutrition or artificial-intelligence features, or otherwise interact with our services.
1. Who we are and the scope of this policy
STRENGTH AND CONDITIONING FACTORY LTD, doing business as StrengthCode ("StrengthCode", "we", "us" or "our"), is the controller of personal information described in this policy unless stated otherwise.
Our address is 71–75 Shelton Street, London, England, WC2H 9JQ, United Kingdom. Privacy questions and requests may be sent to [email protected].
This policy applies to strengthcode.co, our web application, coaching and program services, and related support communications. Our services are intended for adults aged 18 and over.
2. Personal information we collect
| Category | Examples | Primary source |
|---|---|---|
| Identity, contact and account | Name, email address, username, account identifiers, authentication records, contact preferences and account status. | You; authentication providers. |
| Demographic and body profile | Date of birth or age, sex, height, weight, activity level and body-related profile information. | You. |
| Wellness and consumer-health information | Menstrual-cycle information, allergies, dietary restrictions, nutrition goals and other wellness information you choose to provide. | You. |
| Nutrition information | Food logs, meals, calorie and macronutrient targets, likes, dislikes and nutrition preferences. | You; calculations and recommendations generated from your inputs. |
| Training and progress | Programs, workouts, exercises, sets, repetitions, loads, exertion ratings, notes, goals, progress and activity history. | You; your use of the services. |
| Purchases and subscriptions | Products purchased, subscription status, transaction references, billing contact information and payment status. Complete payment-card details are handled by Stripe rather than stored by us. | You; Stripe. |
| Communications and content | Support requests, coaching messages, scheduling information, feedback, uploaded files and other content you send. | You; coaches or support personnel. |
| Preferences and local application data | Favourites, display settings, cart contents, drafts, notification preferences and privacy choices. | You; your browser or device. |
| Device, log and usage information | IP address, browser and device type, operating system, approximate country, pages requested, timestamps, referrer, security events and diagnostic records. | Your browser, device and infrastructure providers. |
| Cookies and similar technologies | Your cookie choices, analytics identifiers, session-recording data and advertising identifiers where allowed by your settings and location. | Your browser; Google, Microsoft and Meta where active. |
| AI feature information | Inputs, candidate data, preferences and outputs used when an AI-supported feature is requested. | You; our application; OpenAI. |
| Derived and inferred information | BMI, BMR, calorie and macronutrient targets, progress indicators, program recommendations and other personalization derived from information above. | Our calculations and service logic. |
| Connected services and notifications | Google OAuth identifiers, calendar events and availability where connected; browser push-notification endpoints and delivery status. | You; Google; your browser or push service. |
We do not intentionally collect precise GPS location, government identification numbers, genetic information or biometric identifiers through the ordinary operation of the services. Please do not include unnecessary sensitive information in free-text fields or attachments.
3. Sensitive and consumer-health information
Certain profile, menstrual-cycle, allergy, dietary, nutrition, fitness and body information may be treated as health, consumer-health or otherwise sensitive information under applicable law. We use this information to provide the features you request, personalize nutrition or training experiences, maintain safety and preferences, and support your account.
Cookie Settings only controls non-essential cookies and similar technologies. It does not delete or change information you choose to add to your account.
We do not use account health information for targeted advertising or sell consumer-health information.
We generally process this information because it is necessary to provide a feature you request. Where applicable law requires a separate consent for a particular sensitive-data use, we will request that consent before that use. You may withdraw consent, subject to lawful limits, by deleting the information, discontinuing the feature or contacting us. Withdrawal does not affect processing that was lawful before withdrawal.
Washington residents should also read our Consumer Health Data Privacy Policy.
4. Why we use personal information and our legal bases
| Purpose | Information used | Legal basis where required |
|---|---|---|
| Create and administer accounts; authenticate users; provide purchased programs, subscriptions and requested features. | Identity, account, transaction, preferences and service-use information. | Performance of a contract; steps requested before entering a contract. |
| Personalize training, nutrition, wellness and coaching experiences. | Profile, wellness, nutrition, training, progress and derived information. | Contract; consent or explicit consent where sensitive-data rules require it. |
| Process payments, maintain transaction records and prevent fraud. | Identity, billing, transaction, device and security information. | Contract; legal obligation; legitimate interests in payment security. |
| Provide support, coaching communications, scheduling, email and push notifications. | Contact, communications, calendar, device and notification information. | Contract; consent for optional notifications; legitimate interests in customer service. |
| Operate AI-supported features requested by users. | Relevant feature inputs, allowed candidates, preferences and generated outputs. | Contract or consent, depending on the feature and jurisdiction. |
| Protect users, investigate misuse, secure systems, diagnose failures and enforce terms. | Account, device, log, security and communications information. | Legitimate interests; legal obligations; establishment or defence of legal claims. |
| Understand how our platform is used and improve usability. | Cookie, device, page and interaction information across our platform. | Your consent where required; legitimate interests or an opt-out model where law permits. |
| Measure advertising performance and create audiences. | Advertising identifiers and public-site activity. | Your consent where required; opt-out rights elsewhere. We honour Global Privacy Control. |
| Comply with tax, accounting, regulatory, court and law-enforcement obligations. | Information relevant to the obligation or request. | Legal obligation; public interest; legal claims. |
Where we rely on legitimate interests, we assess whether the processing is necessary, proportionate and compatible with your reasonable expectations. You may object as described below. We do not rely on consent where the service cannot reasonably be provided without the processing and another legal basis applies.
5. Personalization and automated processing
We use rules and calculations to derive information such as BMI, BMR, calorie targets, macronutrient targets, training progress and recommendations. AI-supported nutrition features may rank or explain options from an approved set of candidates. These processes support personalization and do not make decisions that produce legal or similarly significant effects about you.
Outputs are informational and may be inaccurate. StrengthCode is not a healthcare provider, and the services do not provide medical diagnosis or treatment. Seek qualified medical advice for health concerns or before making decisions that may affect your health.
8. International transfers
We are established in the United Kingdom, and our providers may process information in the United Kingdom, European Economic Area, United States and other countries where they operate. Those countries may have different privacy laws.
Where required, we use recognised safeguards such as adequacy regulations or decisions, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, and contractual, technical and organisational protections. Contact us for information about safeguards relevant to your data.
9. Retention
| Information | General retention approach |
|---|---|
| Account, profile, wellness, nutrition, training, coaching and preference information | While the account is active and as needed to provide the services. Account deletion is normally scheduled after the application’s 14-day cancellation period, subject to lawful exceptions and provider backup cycles. |
| Purchases, subscriptions, tax and accounting records | For the period required by tax, accounting, payment, fraud-prevention and legal-claims rules. |
| Security, access and diagnostic records | For a limited period appropriate to security, incident response, audit and legal-claim needs. |
| Support and transactional communications | For as long as needed to resolve the matter, administer the relationship and meet legal obligations. |
| Cookie choices | Reject all is stored for 12 hours. Accept all and saved preferences remain until you change your choice, clear browser storage or a material consent update requires a new choice. |
| Third-party analytics and advertising information | Retention depends on the category you allow, our settings and the provider durations described in the Cookie Notice. |
We may retain a limited record after deletion where required for legal compliance, fraud prevention, dispute resolution or enforcement. When information is no longer required, we delete it, anonymise it or isolate it until deletion from backups is completed.
10. Security
We use administrative, technical and organisational safeguards appropriate to the nature of the information, including access controls, encrypted network transport, restricted service credentials, authentication controls, logging and provider security measures. No online service can guarantee absolute security. Keep your credentials confidential and contact us promptly if you believe your account has been compromised.
11. Your privacy rights
Depending on where you live, you may have rights to:
- be informed about processing and obtain access to personal information;
- correct inaccurate or incomplete information;
- request deletion, restriction, anonymisation or portability;
- object to processing based on legitimate interests or direct marketing;
- withdraw consent without affecting earlier lawful processing;
- opt out of sale, sharing, targeted advertising or certain profiling;
- limit the use or disclosure of sensitive personal information where applicable;
- appeal a refusal of a qualifying request; and
- complain to a privacy or data-protection authority.
You may update many account fields directly in the service. For other requests, email [email protected]. We may verify your identity and may decline or limit a request where the law permits. Authorised agents may submit requests where recognised by applicable law.
You will not receive discriminatory treatment for exercising a privacy right.
12. Regional disclosures
United Kingdom, European Economic Area and Switzerland
You may exercise the rights described above and complain to the supervisory authority where you live or work. In the United Kingdom, the authority is the Information Commissioner’s Office. Where applicable, sensitive information is processed under an appropriate special-category condition in addition to an Article 6 legal basis. We ask for consent before optional tracking is enabled.
United States
During the preceding 12 months, we may have collected the categories described in Section 2, including identifiers, customer-record information, characteristics such as age and sex, commercial information, internet or electronic activity, approximate geolocation, account credentials, sensitive or consumer-health information, communications and inferences. We disclose relevant categories to the service providers listed in Section 6 for business purposes.
We do not knowingly sell personal information for money. Sharing information for optional advertising may be considered a sale, sharing or targeted advertising under certain state laws. You can opt out through Cookie Settings or Global Privacy Control. We do not knowingly sell or share personal information of people under 18.
Residents of states providing an appeal right may appeal a decision by replying to our response or emailing us with the subject “Privacy Appeal”. California residents may also request information concerning categories collected, sources, purposes, categories of recipients, and specific pieces of personal information, subject to legal limits.
Canada
You may request access and correction, withdraw consent subject to lawful limits, and challenge our compliance. We use express consent where required for sensitive information and optional tracking.
Brazil
Where Brazil’s LGPD applies, you may request confirmation, access, correction, anonymisation, blocking, deletion, portability, information about recipients and consent consequences, and review of qualifying automated decisions. You may contact Brazil’s National Data Protection Authority where applicable.
Australia and New Zealand
You may request access and correction and complain about our handling of personal information. Australian complaints may be escalated to the Office of the Australian Information Commissioner; New Zealand complaints may be escalated to the Office of the Privacy Commissioner.
Jordan, Saudi Arabia and the United Arab Emirates
Where the applicable law provides, you may request information, access, correction, deletion or destruction, restriction, portability, objection and withdrawal of consent. We provide information about purposes, recipients and international transfers and use explicit consent where it is the applicable basis for sensitive information or optional tracking.
India
Where India’s Digital Personal Data Protection framework applies, you may request access to processing information, correction, completion, updating, erasure and grievance handling, and may withdraw consent as easily as it was given, subject to phased commencement and lawful retention.
China, Japan and South Korea
Where applicable, we provide required notices about purposes, recipients and international processing and obtain separate or additional consent for sensitive information, third-party disclosure or cross-border transfers where required. Local-language or representative information will be provided where legally required for a market we actively serve.
South Africa and other jurisdictions
You may have rights of access, correction, deletion, objection and complaint under local law. We will apply locally required notices, safeguards, representatives and transfer mechanisms when we actively offer services in a jurisdiction that requires them.
13. Children
The services are not directed to anyone under 18, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided information, contact us so we can investigate and take appropriate action.
14. Changes to this policy
We may update this policy to reflect changes in the services, providers, practices or law. We will revise the date above and provide additional notice where required. If a change materially affects a consent-based purpose, we will request a new choice where required.
15. Contact us
Email: [email protected]
STRENGTH AND CONDITIONING FACTORY LTD
71–75 Shelton Street
London, England, WC2H 9JQ
United Kingdom