Strong Foundation Privacy Policy

1. Scope and operator

Coding House LLC operates Strong Foundation. In this policy, “Strong Foundation,” “we,” “us,” and “our” refer to Coding House LLC and the Strong Foundation services. This policy applies when you use Strong Foundation, visit strongfoundation.dev, create an account, connect another service, participate in community features, contact us, or use Atlas.

Strong Foundation is a wellness and fitness service. It is not a health-care provider, emergency service, diagnostic service, or substitute for professional medical care. This policy does not claim that Strong Foundation is subject to or compliant with the Health Insurance Portability and Accountability Act (HIPAA).

2. Information we handle

Account and profile information

We handle information such as your name, username, password verifier, profile and cover images, biography, date of birth, account creation and modification dates, account status, and last-active information. We use date of birth for age eligibility and features that depend on age. We also handle relationship information, such as accounts you follow, accounts following you, and blocks.

Health, wellness, fitness, and nutrition information

Depending on the features you choose, Strong Foundation may handle:

• Workouts, exercises, routines, sets, repetitions, durations, workout notes, and workout history.
• Activity, steps, exercise sessions, active and total calories, distance, pace, and cardio routes.
• Height, weight, body-fat percentage, waist, hip, and neck measurements, basal metabolic rate, and goals.
• Foods, meals, recipes, dietary preferences, calorie and nutrient intake, hydration, and food barcodes.
• Menstrual-cycle, symptom, pain, flow, pregnancy, pregnancy-note, and pregnancy-outcome information.
• Wellness information you enter into notes, community content, feedback, or Atlas conversations.

Much of this information is stored in local app databases on your device. Information may leave your device when you choose to synchronize it with a connected health service, publish or share content, use an online lookup, submit feedback, or use another feature that requires the Strong Foundation API.

Location, motion, camera, photo, and biometric-related information

• Precise location and route points used to map and measure cardio workouts, including background location when enabled.
• Motion and activity information used to support workout and cardio tracking.
• Photos you choose or capture for profiles, body-composition features, posts, recipes, routines, or other content.
• Camera frames used on the device to recognize supported food barcodes.
• Whether device authentication succeeds when you enable Face ID-protected features.

Apple and the operating system perform Face ID matching. Strong Foundation does not receive or store your facial template or other operating-system biometric template.

Community, communication, and shared content

We handle posts, comments, votes, views, recipes, routines, workouts, images, attachments, tags, publication status, visibility settings, and related author information. If you use messaging, our servers may handle sender and recipient identifiers, conversation identifiers, timestamps, read receipts, device public keys, and per-device encrypted message payloads.

Device, connection, and diagnostic information

We may handle device and app platform, app version and build, operating-system version, language, time zone, device identifier used by Strong Foundation, device public key, push-notification token, network availability, session correlation identifier, feature actions, error and outcome codes, and coarse timing, memory, thermal, and performance measurements. Our servers and service providers also receive ordinary connection information, such as IP address, request time, requested resource, and user-agent information.

Information from connected services and other sources

With your direction and the permissions you grant, Strong Foundation may read from or write to Apple Health, Health Connect, or Fitbit. Spotify provides connection and playback information needed for music controls. Nutrition and recipe providers return food, product, recipe, and meal information in response to your searches. Other people may provide information about you when they interact with your public content or communicate with you.

3. Where information goes

4. How we use information

We use information to:

• Create, authenticate, maintain, secure, and support accounts.
• Provide workout, health tracking, nutrition, recipe, community, messaging, music, and Atlas features.
• Calculate requested fitness, weight, body-composition, nutrition, and progress information.
• Synchronize information with a health or fitness service when you direct us to do so.
• Deliver notifications and communications you request.
• Host, process, scan, transform, and deliver images, attachments, and other content.
• Find and fix failures, monitor reliability, prevent abuse and fraud, and protect users and services.
• Respond to support, privacy, safety, and legal requests.
• Comply with applicable law and enforce our agreements.

We do not sell personal information or consumer health data. We do not share personal information for cross-context behavioral advertising, and we do not use health information for targeted advertising.

5. Atlas and on-device AI

Atlas is Strong Foundation’s local AI-assisted wellness feature. Atlas downloads an approved model to your compatible device. Chat generation, host safety classification, supported analytics, meal-candidate ranking, and workout generation or modification run on the device. Atlas prompts, model responses, hidden instructions, and health or fitness context selected for a conversation are not sent to a cloud AI provider for inference.

Atlas network activity

• Model downloads: The download host receives ordinary network information needed to deliver model files, such as IP address, request time, and file requested. Atlas conversation content is not part of a model download request.
• Nutrition lookups: Food names, supported food barcodes, recipe or meal search text, paging, and relevant diet filters may be sent through the Strong Foundation API to our nutrition-data provider. Atlas does not send the whole conversation as the search query.
• Ordinary diagnostics: Atlas may send content-free stage names, outcome and error codes, attempt counts, timings, app/build information, and coarse device, thermal, and memory measurements. Ordinary Atlas telemetry is designed not to contain prompts, generated responses, hidden instructions, selected context values, candidate handles, workout identifiers, file paths, or raw exceptions.
• Feedback you choose to submit: After a separate consent step, Helpful or Not Helpful feedback may transmit the current visible Atlas session, your selected feedback categories, an optional comment, the selected response, content-free diagnostics, and app/build identity. Declining or leaving the consent flow does not submit the feedback transcript.
• Developer debug export: In development builds, an explicit copy or share action may create a local export containing visible prompts and model responses. Strong Foundation does not transmit this export automatically. It leaves the app only when the person using the device deliberately copies or shares it.

Atlas suggestions and writes

Atlas responses and generated workouts are suggestions. A generated or modified workout remains a draft until you review and approve it through the existing editor and save action. Atlas does not receive independent authority to persist workouts or write nutrition information.

Atlas cannot provide emergency assistance, diagnosis, or treatment. If you believe you are experiencing an emergency, stop using Atlas and contact local emergency services.

6. Consumer health data

This section supplements the rest of this policy for consumer health data, including information that identifies or can reasonably be linked to a consumer and that concerns physical or mental health, fitness, nutrition, reproductive or sexual health, bodily measurements, symptoms, or health-related location and activity.

Categories and purposes

The consumer health data categories we may handle are described under Information we handle. We use them to provide the tracking, calculation, personalization, synchronization, safety, support, and user-requested Atlas functions described in this policy. We collect or use a category only when needed to provide a feature you request, when you provide consent where required, or as otherwise permitted by law.

Sources

• You, through information you enter, record, photograph, scan, import, share, or include in feedback.
• Your device, including permitted location, motion, camera, and locally stored app information.
• Health and fitness services you connect, including Apple Health, Health Connect, and Fitbit.
• Your interactions with Strong Foundation features and other people’s interactions with content you share.

Categories shared and recipients

Depending on the feature you request, consumer health data may be shared with:

• A health or fitness platform you direct Strong Foundation to synchronize with.
• Nutrition and recipe-data providers that fulfill food, barcode, recipe, or meal searches.
• Hosting, storage, media-processing, security, and diagnostics service providers acting for Strong Foundation.
• People or the public when you intentionally publish or share health-related content.
• Authorities or other recipients when disclosure is required by law or reasonably necessary to protect rights, safety, and service integrity.

Coding House LLC does not currently share consumer health data with a corporate affiliate. We do not sell consumer health data. If our categories of consumer health data, purposes, or sharing materially change, we will update this policy and request affirmative consent when applicable law requires it.

Washington consumer health rights

Washington consumers may ask whether we collect, share, or sell consumer health data; access that data; obtain a list of third parties and affiliates with whom it was shared or sold; withdraw consent for future collection or sharing; and request deletion. You may also appeal a refusal to act on a request. Submit a request or appeal through the contact method in Contact us, identify it as a “Consumer Health Data Request” or “Consumer Health Data Appeal,” and describe the right you want to exercise. We may take reasonable steps to authenticate your identity and authority before acting on a request.

We will respond without undue delay and within 45 days after receiving a request. We may extend that period once by up to 45 additional days when reasonably necessary and will notify you of the extension and its reason during the initial period. Responses are free up to twice each year unless a request is manifestly unfounded, excessive, or repetitive as permitted by law. We will provide a written appeal decision within 45 days. If we deny an appeal, you may submit a complaint to the Washington State Attorney General.

7. Device permissions and your choices

Strong Foundation requests protected access only when needed for a feature. Depending on your platform, this may include:

• Health data: Read or write authorized activity, workout, body-measurement, nutrition, hydration, and related records.
• Precise and background location: Map, measure, and continue an active cardio workout when the app is not visible.
• Motion and activity: Support activity and cardio measurements.
• Camera: Capture profile or body-composition photos and recognize or photograph food barcodes.
• Photo library or media: Select images you choose to use in Strong Foundation.
• Notifications: Deliver workout, reminder, community, messaging, and service notifications.
• Face ID: Ask the operating system to authenticate access to sensitive app tiles.

You can deny or revoke device permissions in system settings. Some features will not work without their required permission. You can disconnect supported health, fitness, and music integrations through Strong Foundation or the connected provider, subject to the controls each service offers.

8. Sharing, service providers, and public content

We may disclose information to the following categories of recipients for the purposes described in this policy:

• Cloud hosting, database, storage, content-delivery, media-processing, and security providers.
• Application diagnostics and reliability providers.
• Push-notification and device-platform providers.
• Nutrition, recipe, health, fitness, and music services you choose to use.
• Professional advisers, authorities, or transaction participants when reasonably necessary for legal, safety, security, or corporate purposes.

These providers receive information needed to perform their services. Information you send to Apple Health, Health Connect, Fitbit, Spotify, or another connected service is also governed by that service’s privacy policy.

Profiles, posts, comments, images, recipes, routines, workouts, and other content may be visible to other users or the public when you publish them. Search engines and other people may copy public content. Review the feature’s visibility choices before publishing sensitive information. Private communications are intended for their participants, but communication metadata is processed by Strong Foundation to operate the feature.

9. Security

We use administrative, technical, and organizational safeguards designed for the nature of the information we handle. These include encrypted network transport, password hashing, platform-provided secure storage, authenticated service access, permission controls, content and file validation, and per-device message encryption mechanisms. No storage or transmission method is completely secure, so we cannot guarantee absolute security.

If an incident affects information covered by a breach-notification law, we will provide notices as required by applicable law.

10. Retention and deletion

We retain information for as long as reasonably necessary to provide the feature for which it was collected, maintain security and service integrity, comply with legal obligations, resolve disputes, and enforce agreements. Retention depends on the data and feature; we do not apply one fixed period to every category.

• On-device information: Local databases, settings, Atlas sessions, and downloaded model files generally remain until you remove them through available controls, clear app data, or uninstall the app. Device or cloud backups controlled by you or the platform may preserve copies under the platform’s rules.
• Server information: Account, shared content, communication, asset, and diagnostic information may remain while your account or the relevant feature is active and afterward when needed for the purposes above. Backup removal may occur on a delayed cycle.
• Connected services: Disconnecting a provider stops future access through Strong Foundation but does not automatically delete information already held by that provider.

The current in-app account-deletion action removes the core account record and its Strong Foundation social-list record. It may not automatically remove every post, comment, message, device registration, image, shared workout, recipe, routine, diagnostic event, backup, or other associated record. Some shared content and communications may also need to remain to preserve other users’ content or conversations. To request access to or deletion of additional personal or consumer health data, contact us as described below. We will evaluate and respond to the request under applicable law, including any permitted exceptions and identity-verification requirements.

11. Your privacy rights

Depending on where you live and the law that applies to us, you may have rights to know or access the information we hold about you, obtain information about its sources and recipients, correct inaccurate information, delete information, receive a portable copy, withdraw consent, limit certain uses of sensitive information, or appeal a denied request. We will not unlawfully discriminate against you for exercising a privacy right.

California

If the California Consumer Privacy Act applies to our relationship with you, California residents may exercise the rights to know, access, correct, or delete covered personal information; receive information about categories of collection, use, and disclosure; limit certain uses of sensitive personal information; and receive equal service when exercising those rights. We do not sell personal information or share it for cross-context behavioral advertising, so Strong Foundation does not provide a sale or advertising-sharing opt-out link.

Submitting a request

Email trejon.house@codinghouse.dev with “Privacy Request” in the subject line and describe your request. Include only the information reasonably needed for us to identify the relevant account or records. We may ask you to authenticate your account or provide additional information to verify your identity. An authorized agent may submit a request when permitted by law, subject to proof of authority and identity verification.

12. Children

Strong Foundation is not directed to children under 13, and account registration is designed to reject a date of birth indicating an age under 13. We do not knowingly collect personal information from a child under 13. If you believe a child under 13 has provided information to us, contact us so we can investigate and take appropriate action.

People between 13 and 17 may use Strong Foundation where permitted. They should review privacy and sharing choices with a parent or guardian before publishing content, connecting another service, or providing sensitive health information.

13. Changes to this policy

We may update this policy as Strong Foundation, Atlas, our service providers, or applicable requirements change. We will post the revised policy at this URL and update the “Last updated” date. When a change is material, we may also provide an in-app notice or another notice appropriate to the change. If applicable law requires consent for a new collection, use, or sharing of consumer health data, we will request that consent before the new practice begins.

14. Contact us

For privacy questions, consumer health data requests, appeals, or other rights requests, contact:

Please do not include passwords, access tokens, full Atlas debug exports, or more health information than is reasonably necessary to explain your request.