1. Who we are
First In Physique LLC ("First In Physique," "FIP," "we," "us") operates the First In Physique mobile app and the website at firstinphysique.com (together, the "Service"). We are the business responsible for the personal information described in this policy.
- Address: 2118 Woodland Way, Los Angeles, CA 90068, United States
- Privacy contact: privacy@firstinphysique.com
This policy explains what we collect, why, who we share it with, how long we keep it, and the rights you have over it. Plain language, no games.
2. The short version
| We collect | Your account details, the program you train (pathway + frequency), your workout logs, any body measurements and fitness-test results you record, your nutrition entries, your app settings, and basic technical data needed to run the app. |
| We use it to | Run your program, show your training history, resolve your next workout, process your subscription, support you, and keep the Service secure. |
| We do NOT | Sell your personal information. Share your workout logs, body measurements, fitness-test results, or nutrition data with advertisers. Use your training or health data to target ads. Track your location. Run advertising trackers inside the app. |
| We DO | Use a hashed list of member email addresses with Meta to build advertising audiences — you can opt out at any time (Section 8). |
| You can | Access, correct, export, or delete your data — including deleting your entire account from inside the app, in two taps. |
3. Information we collect
3.1 Information you give us
| Category | Examples |
|---|---|
| Account | Email address, password (stored only as a salted hash — we never see it), display name |
| Program selection | Your pathway (Operator, Warrior, or Sculptor) and your frequency (3, 4, or 5 days), selected independently, plus your pathway-change and frequency-switch history |
| Training data | Workout logs: exercise, sets, reps, weight, RPE, completion status, rest times, the exercise substitutions and additions you make to a session, and your week and phase position |
| Your notes | Personal notes you write on an exercise or on a workout |
| Body measurements | Bodyweight, and the body-circumference measurements you choose to record (for example waist, neck), with the date recorded |
| Fitness-test results | Cardiovascular fitness-test results you choose to record (for example a VO2-max estimate), including the inputs you enter to calculate them, such as age, sex, and heart rate |
| Nutrition data | Calorie and macro entries and nutrition targets |
| Profile settings | Sex (used to calculate fitness-test estimates), weight-unit preference, your equipment and training-environment setup, and notification preferences |
| Support and correspondence | Anything you send us by email, Instagram DM, or a form |
3.2 Information collected automatically
We keep this deliberately small.
- Technical and connection data: IP address, device and operating-system type, and app version, recorded in our server logs when your app talks to our database. We use these to run and secure the Service.
- Push notification token: if you turn on notifications (for example the rest-timer alert), your device gives us an anonymous push token so we can deliver them. It does not identify you personally, and you can turn notifications off at any time in your device settings.
- Approximate location: we may infer a city- or country-level location from your IP address. We do not collect GPS or precise location, and the app never asks for location permission.
- Crash and performance data: if you have chosen to share diagnostics with Apple or Google at the device level, they may pass us anonymized crash reports through App Store Connect or Google Play. This is controlled by your device settings, not by us.
The FIP app does not contain any third-party analytics or advertising SDK. We do not track which screens you view or how long you spend in the app. If we ever add analytics or crash-reporting tooling, we will update this policy and tell you before it takes effect.
3.3 Information from third parties
- Apple / Google / RevenueCat: your subscription and purchase status, purchase and renewal events, and a store-issued transaction identifier. We never receive your full payment card details.
- Stripe: for purchases made on our website — subscription status, billing country, and the last four digits and brand of your card. Stripe holds your card details; we do not.
- Meta / Instagram: if you engage with our ads or DM automations, we may receive engagement and lead information you submitted.
4. Health and fitness data — a specific note
Some of what the app records is health-related information, and we treat it as sensitive. This includes your workout logs, bodyweight, body-circumference measurements, cardiovascular fitness-test results (and the age, sex, and heart-rate inputs used to calculate them), and nutrition entries.
- We do not share this data with advertisers, data brokers, or any third party for marketing. Ever.
- We do not sell it.
- We use it only to operate the Service for you — to show your history, compute your previous-set values, resolve your next workout, advance your program, and calculate the fitness estimates you ask for. Where we look at trends to improve the product, we use aggregated or de-identified data that cannot reasonably identify you.
- The app does not currently read from or write to Apple Health or Google Health Connect. If that changes, we will update this policy and ask your permission first.
- You can delete this data, or your whole account, at any time (Section 10).
5. How we use your information
| What we do | Why |
|---|---|
| Create and maintain your account; sign you in | To give you the Service you signed up for |
| Resolve your next workout; advance your program; show previous-set values and training history | Core functionality |
| Store and display your workout logs, body measurements, fitness-test results, and nutrition entries | Core functionality |
| Calculate the fitness estimates you ask for (for example a VO2-max estimate from the inputs you enter) | Core functionality |
| Process subscriptions, renewals, and refunds | To give you the Service |
| Send notifications you have turned on (for example the rest-timer alert) | A feature you control |
| Provide support and respond to you | To give you the Service |
| Fix bugs, prevent fraud and abuse, and keep the Service secure | To run a reliable, safe product |
| Improve the Service using aggregated or de-identified data | To build a better product |
| Send service emails (receipts, security notices, important changes) | Necessary to our relationship with you — these are not marketing and you cannot unsubscribe from them while you hold an account |
| Send marketing emails | Only with your consent; unsubscribe any time |
| Include your hashed email in Meta advertising audiences | To reach people like our members — opt out any time (Section 8) |
| Meet legal, tax, and accounting obligations | Required of us |
6. Who we share it with
We share personal information only with service providers who process it on our instructions, and only for the purposes below.
| Provider | What they receive | Why |
|---|---|---|
| Supabase | Account data, program selection, workout logs, body measurements, fitness-test results, nutrition entries, your notes, and settings | Database, authentication, and hosting |
| RevenueCat | Subscription and purchase status, a store transaction ID, and an app-generated user ID — never your training or health data | Subscription management across the App Store and Google Play |
| Apple / Google | Purchase and subscription data | In-app purchase processing |
| Stripe | Name, email, payment details, billing country | Payment processing (website purchases) |
| Klaviyo | Email address, name, subscription and engagement status | Email delivery |
| ManyChat | Instagram handle and message content, if you DM us | Instagram support and automation |
| Meta | Hashed email addresses only — see Section 8 | Advertising audiences |
| TrainHeroic (legacy) | Email address and program access | Delivering programming to existing members before migration to the FIP app |
We may also disclose information where we are legally required to (subpoena, court order, lawful request), where necessary to establish or defend legal claims or protect someone's safety, or to a successor entity in a merger, acquisition, or sale of assets — in which case we will notify you.
We never share your workout logs, body measurements, fitness-test results, or nutrition data with Meta or any advertising platform.
7. Cookies and the website
Our website uses cookies and similar technologies, including the Meta Pixel, to measure ad performance and understand how visitors use the site.
The FIP mobile app contains no Meta Pixel and no advertising tracker. This applies to the website only.
You can control cookies through your browser settings.
8. Advertising audiences — and how to opt out
We advertise FIP on Meta platforms (Facebook and Instagram). To do that, we may upload a list of member email addresses, hashed before they leave our systems, to Meta so it can build Custom Audiences and Lookalike Audiences — audiences of people who resemble our existing members.
What this means in practice:
- Only your email address is used, and it is hashed before transmission.
- No workout data, body measurements, fitness-test results, nutrition data, or program information is ever included.
- Under California law this may be considered "sharing" for cross-context behavioral advertising, which is why we tell you about it and give you a way out.
To opt out, email privacy@firstinphysique.com with the subject line "Opt out of advertising audiences." We will remove you from all advertising audience lists and exclude you from future ones. Opting out has no effect on your subscription, your access, or anything else.
You can also limit ad tracking on your device (iOS: Settings → Privacy & Security → Tracking; Android: Settings → Google → Ads) and adjust your Meta Ad Preferences.
9. How long we keep it
| Data | Retention |
|---|---|
| Account and profile data | As long as your account is active |
| Workout logs, body measurements, fitness-test results, and nutrition entries | As long as your account is active — this is your training record |
| Everything, after you delete your account | Deleted or irreversibly anonymized within 30 days |
| Purchase and transaction records | Up to 7 years, where required by tax and accounting law |
| Support correspondence | Up to 2 years |
| Marketing contact data | Until you unsubscribe, then suppressed (we keep a minimal record so we don't contact you again by mistake) |
| Encrypted backups | Deleted data may persist in encrypted backups for a short period (currently up to 7 days) before being overwritten |
10. Deleting your account
You can permanently delete your account and your data from inside the app: Profile → Delete Account.
This deletes your account, profile, program selection, workout logs, body measurements, fitness-test results, nutrition entries, your notes, and settings. It is irreversible — export anything you want to keep first.
Deleting your account does not cancel a subscription billed by Apple or Google. Cancel that separately in the App Store or Play Store, or you may continue to be charged.
You can also request deletion by emailing privacy@firstinphysique.com.
11. Your privacy rights
Wherever you live, we extend these rights to every member:
- Access — get a copy of the personal information we hold about you.
- Correction — have inaccurate information fixed.
- Deletion — have your information erased.
- Portability — receive your data in a structured, machine-readable format.
- Opt out of marketing — unsubscribe from any marketing email, or email us.
- Opt out of advertising audiences — see Section 8.
- Withdraw consent — at any time, without affecting what we did before you withdrew it.
- Non-discrimination — we will not charge you more, give you less, or treat you worse for exercising any of these rights.
How to exercise them: email privacy@firstinphysique.com. We respond within 30 days (we will tell you if we need longer, where the law allows an extension). We may need to verify your identity first — usually just confirming you control the account email.
We do not sell your personal information, and we do not use it for automated decision-making or profiling that produces legal or similarly significant effects.
12. California privacy rights
If you are a California resident, this section is for you.
Categories we collect
| CCPA / CPRA category | Do we collect it? | Source |
|---|---|---|
| Identifiers (email, name, IP address, device ID) | Yes | You; automatically |
| Commercial information (subscription and purchase records) | Yes | You; Apple, Google, Stripe, RevenueCat |
| Internet or network activity (server logs) | Limited — connection logs only. No behavioral or app-usage tracking. | Automatically |
| Health-related information (workout logs, bodyweight, body-circumference measurements, cardiovascular fitness-test results and their inputs, nutrition entries) | Yes | You |
| Sensitive personal information — account log-in credentials; the health-related information listed above | Yes | You |
| Geolocation | No precise location. Approximate city/country inferred from IP only. | Automatically |
| Biometric information, audio/visual, professional or education information, protected classifications, inferences for profiling | No | — |
Sensitive personal information
We use your sensitive personal information only for the purposes permitted under Cal. Code Regs. tit. 11, § 7027(m) — to perform the service you asked for, to keep it secure, and to maintain its quality. We do not use it to infer characteristics about you. Because our use is limited to those permitted purposes, the right to limit the use of sensitive personal information does not apply — but you can still delete this data, or your entire account, at any time (Section 10).
Selling and sharing
- We do not sell personal information, and we have not sold it in the preceding 12 months.
- We do share hashed email addresses with Meta for cross-context behavioral advertising (Section 8). You have the right to opt out, and you can do so at any time by emailing privacy@firstinphysique.com with the subject line "Opt out of advertising audiences." We honor Global Privacy Control (GPC) signals on our website.
- We have not sold or shared the personal information of anyone we know to be under 16.
Shine the Light
Under California Civil Code § 1798.83, California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. Email privacy@firstinphysique.com with the subject line "Shine the Light."
Authorized agents
You may use an authorized agent to submit a request on your behalf. We will ask for proof of authorization and may ask you to verify your identity directly.
13. If you are in the UK or EU
The Service is designed for a United States audience, but if you use it from the UK or EU, the following applies.
Legal bases. We process your data to perform our contract with you (running your account, your program, and your subscription); on our legitimate interests (security, fraud prevention, product improvement); to meet a legal obligation (tax, accounting); and on your consent for marketing emails, advertising audiences, and health-related data.
Health data is special-category data. We process your workout logs, body measurements, fitness-test results, and nutrition entries on the basis of your explicit consent, which you give by choosing to record them. Withdraw it at any time by deleting the data or your account.
Your additional rights include restriction of processing, objection to processing based on legitimate interests, and the right to lodge a complaint with a supervisory authority — the ICO (ico.org.uk) in the UK, or your national authority in the EU. We would appreciate the chance to fix it first.
International transfers. Your data will be processed in the United States. Where we transfer personal information out of the UK or EEA, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
14. Where your data lives
Our database is hosted by Supabase in the United States (AWS US East, N. Virginia). Our other service providers (Stripe, Klaviyo, RevenueCat, Meta) process data in the United States and, in some cases, elsewhere, under contractual data-protection commitments.
15. Security
- All data is encrypted in transit (TLS) and at rest.
- Passwords are never stored in plain text — they are salted and hashed. We cannot read your password.
- Database access is protected by row-level security: a member can only ever read and write their own data.
- Subscription entitlements are written server-side only and cannot be modified from a device.
- Access to production systems is restricted to the people who need it.
No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and the relevant regulator where the law requires it.
16. Children
The Service is for adults. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, email privacy@firstinphysique.com and we will delete it.
17. Changes to this policy
We may update this policy. If a change is material, we will notify you by email and/or in-app before it takes effect. The "Last updated" date at the top always reflects the current version.
18. Contact
First In Physique LLC 2118 Woodland Way, Los Angeles, CA 90068, United States privacy@firstinphysique.com firstinphysique.com · @firstinphysique