• Account Information: Name, email address, password hash, date of birth (collected to verify the 18+ age requirement), policy-acceptance timestamps, and account preferences.
• Fitness & Dietary Data: Goals, physical attributes, intake answers, injuries and movement restrictions, allergies and food preferences, calorie and macro targets, logged meals, workout history, check-ins, weight entries, supplement details, and conversation prompts submitted to the AI coach.
• Payment Data: Billing details and credit card processing are handled entirely by our third-party processor, Stripe, Inc. Slammer Fitness LLC does not store or process raw credit card numbers.
• Technical & Device Information: IP address for rate limiting and abuse prevention; Web Push subscription tokens when notifications are enabled; and account identity, browser, device, and product-usage data through PostHog only when analytics consent is granted.

• To provide, personalize, and maintain the KarvedUp AI coaching interface.
• To route relevant intake information, fitness context, and conversation text to DeepSeek to generate coaching responses, plans, workouts, and nutrition content.
• To process subscription payments and enforce rate limits.
• To send transactional emails and PWA Web Push reminders (if opted in).
• To understand product usage and improve the Service through PostHog analytics when analytics consent is granted.

We do not sell your personal data. We share necessary data with trusted third-party sub-processors solely to operate the Service:

• Stripe, Inc.: Payment processing and subscription management.
• DeepSeek: Natural language processing and response generation using relevant prompts, intake answers, and fitness context.
• MailerSend: Password-reset, transactional, and contact-form email delivery.
• PostHog: Optional product analytics enabled only after analytics consent.
• FatSecret: Nutrition lookups for food search, barcodes, scans, and stored food ids, without sending your KarvedUp account identity. Open Food Facts: barcode lookup only when FatSecret has no hit.
• Browser and operating-system push services: Delivery of optional reminders after notifications are enabled.
• Cloud & Database Infrastructure: Secure database hosting and server operations.

We use safeguards that include Argon2 password hashing; signed session tokens stored in HttpOnly cookies, with Secure cookies in production; HTTPS/TLS for production data in transit; server-side input validation; access controls; security headers; and rate limits. However, no electronic transmission, storage system, or internet service is 100% secure.

If you are a California resident, you have the right under the California Consumer Privacy Act (CCPA) to:

• Request disclosure of personal information collected about you.
• Request deletion of your personal data.
• Opt out of any sale or sharing of personal data (Slammer Fitness LLC does not sell consumer data).

To exercise these rights, submit a request to support@karvedup.com.

We may update this Privacy Policy periodically. We will identify changes by updating the "Last Updated" date at the top of this policy and provide additional notice when appropriate.

If you have questions regarding this Privacy Policy, contact:Slammer Fitness LLCEmail: support@karvedup.comState of Formation: California, USA