App Privacy Policy

Ten Percent Performance — App Privacy Policy Effective date: 4 November 2026 Version: 1.0 Applies to: the Ten Percent Performance app (web app and installed app) and the systems behind it. Does not apply to: the Ten Percent Performance online store at tenpercentperformancenj.com. That is a Shopify storefront, it handles shopping and orders rather than training, and it has its own privacy policy at https://tenpercentperformancenj.com/policies/privacy-policy. The two are separate systems: nothing you buy in the store reaches the app, and nothing in your training record reaches the store. If you only ever shop with us, the store's policy is the one that applies to you. If you are a member using the app, both do — each to its own half. Ten Percent Performance, LLC ("TPP", "we", "us") runs this app for its own members and coaches. This policy says what the app collects, why, who else sees it, and what you can do about it. Everything below describes what the app actually does today. Where a decision has not been made yet, it says so instead of guessing. A note on wording: your member agreement sets the terms of your membership, and this policy describes how your information is handled. The agreement's section 5.5 makes this policy part of the agreement. Section 5 of the agreement was rewritten on 4 November 2026 so that the two documents say the same thing about who sees your information — the earlier wording promised something the system does not do, and we would rather change the promise than leave you holding a contradiction. 1. What we collect, and why Who you are What Why we have it Your name To identify you across the app, on class rosters and on community posts Your phone number It is how you sign in. A code is sent to it by text Your email address To send you a copy of your signed agreement, and for a payment receipt if you ever pay a fee Your home mailing address Only from the signature block of the member agreement. It is never shown back to you in the app Your typed signature, the date, and which version of the agreement you signed So we can prove what you agreed to Your browser or device description at the moment you signed Signature provenance — nothing else uses it A parent or guardian's name and signature Only if a guardian signed on your behalf Your date of birth So we know whether you are an adult, a minor or a child. See section 9 A parent or guardian's name, email and phone Only for members under 18, so we can reach them Whether a guardian consented, when, and how it was verified Only for members under 13. See section 9 On your date of birth. We did not record one until November 2026, and we do not have one for most members yet — a coach asks and enters it. Until yours is on file the app treats you as an adult for everything you can already do, and refuses only cycle tracking, which is the one thing we will not switch on for someone whose age we do not know. There is also a tick box on the agreement confirming you are 18 or older or that a guardian is signing for you; we do not store the tick itself. Your training Workouts and the sets you log — weight, reps, time, distance, how hard it felt (RPE), whether you finished. Your attendance, bookings, waitlist places, packages and credits. Your goals, roadmaps, milestones and badges. Scores and recommendations the app works out from those records, including which programme a coach should look at next. Why: so your coach can programme for you, so the app can suggest a sensible next weight, and so you can see your own history. Your health information This is health information and we treat it as the most sensitive thing in the app. Pain, injury and symptom reports. Which exercise, where it hurt, what it felt like, whether it got worse during the set, whether it was sharp, radiating or unusual, what you could not do afterwards, and how it was the next day. Bodyweight, each time you log it. Nutrition check-ins. Digestion, energy, sleep, adherence, cravings, anything you ate off plan, whether you feel you are doing everything you can, and what help you want. Recovery check-ins. Energy, sleep quality and recovery on a 1-5 scale, symptoms you pick from a list (including cramps, hot flushes, night sweats and mood change) and a free-text note. Menstrual cycle information. One place collects it: Body & Recovery, where you can record whether you are bleeding, whether a period started and the flow. It is off unless you turn it on, turning it off also turns off coach sharing, and while it is off new entries are refused rather than merely hidden. It can only be turned on by a member whose date of birth is on file and who is 18 or over. Until November 2026 there was a second, free-text "Menstrual Cycle (if applicable)" box on the weekly nutrition check-in. It had none of the above — no consent step, no age check, readable by every coach, and read by the automated system described in section 2. It has been removed from the app, nothing writes to that field any more, and the entries made in it before then have been erased. There were 82, across 27 members; they were cleared on 4 November 2026 at TPP's instruction, and no copy was kept. Photographs. Your profile photo, progress or physique photos, food-journal meal photos, and any photo you put on a community post. Notes your coach writes about you, including notes filed under "Pain / Safety". You cannot see these in the app. Why: so a coach can coach you safely, change your programme around an injury, and answer your check-in. Your messages and posts Messages between you and your coach (up to 2,000 characters). Community posts you write, photos on them, and any report you make about someone else's post or any member you block. Your devices and app use Notification registrations for each device you allow notifications on, including the push token or endpoint, a device label, when it was last seen and whether delivery failed. Your notification mute settings. Performance diagnostics — which screen you opened, how long it took, whether it failed and the category of failure, plus your platform, rough device class and app build. Server request logs, which record the method, path and status of each request your app makes. What we do not collect No card number. If you ever pay a fee, you type your card on Stripe's own page. Card details never reach us. No third-party analytics, no crash-reporting service, no advertising SDK and no tracking or ad profiling of any kind. There is no Google Analytics, no Firebase, no Meta pixel, no Sentry, nothing of that sort in the app. We do not sell or share your app information for advertising, and we never have. The online store is a different system and does do personalised advertising, through Shopify, using what you browse and buy there — its own policy covers that and offers an opt-out. Nothing from your training, your check-ins, your photographs or your health records is used for it, or reaches the store at all. No location tracking. The app never asks for your location. Photos you upload through the app have their embedded camera data — including any GPS coordinates — stripped out before storage. Older photographs were a different matter, and we fixed it. Of the 141 progress photographs held, 86 had been submitted through a web form before the app's upload path existed and were stored exactly as the phone produced them. We checked every one of them on 4 November 2026: 77 still carried camera data, and 24 carried the GPS coordinates of where the photograph was taken — which, for a physique photograph, is usually somebody's home. All 141 have been rebuilt from their pixels alone so that no camera data survives, and the originals we downloaded in order to do it were destroyed the same day. A separate check against the live records afterwards found no camera data and no coordinates on any photograph. We are telling you the number rather than calling it "a small number", because 24 is not a small number when one of them is yours. No contacts, calendar, microphone or health-app data from your phone. No advertising or analytics cookies. The app stores a sign-in token so you stay signed in, and keeps unsent drafts (a check-in you started, a workout you are part-way through) on your own device until you send them. 2. An automated system reads your nutrition check-ins When you send a weekly nutrition check-in, an automated system reads your answers and writes a short summary for your coach. It runs three times a week, unattended, and it reads every answer you gave. Three things to be clear about: It does not write to you. Until 4 November 2026 it drafted a reply in your coach's voice, which a coach then approved or rewrote. It no longer does. It tells your coach what is in your check-in and whether you need them; the words your coach sends you are your coach's own. It does not read a cycle box, because there isn't one. The free-text menstrual-cycle question was removed from the check-in on 4 November 2026 and the answers already given were erased. Cycle information is now collected in one place only — the app's Body and Recovery feature — behind your own consent, and only from members recorded as 18 or over. It is not a diagnosis and it is not medical advice. See the fitness and health disclaimer. The reader is run by Ten Percent Performance itself, on TPP's own account with Anthropic, whose Claude model does the reading. It is not a separate company and no other business receives your check-in through it. Other automated work in the app: a rules engine suggests next-session weights and reps from your own logged sets, and flags decisions for a coach to review. Separately, a score tells a coach which draft programme to open first. None of this makes a health judgement about you, and a coach can change any of it. 3. Who else sees your information Your coaches and the gym Your coaches, admins and the owner can read your records. Two things are deliberately held back from them: Your recovery check-ins are private to you unless you switch coach sharing on. If you do, they see your fourteen most recent. Your Body & Recovery cycle records are shared only if cycle tracking and coach sharing are both on, and even then the date your last period started is removed before they see it. The free-text menstrual-cycle box on the nutrition check-in is not held back. See section 1. Other members On a class roster, other members booked into that class see your first name and last initial — never your phone number, email or anything else. One-to-one and semi-private appointments are not shown to anybody else at all. On the community feed, your first name and last initial, your post and any photo on it are visible to every member of the gym. The feed showed full names until 4 November 2026; it now matches the class roster and your member agreement. Companies that run parts of the app for us We use outside companies to make the app work. We are not paid by any of them and none of them is an advertising company. What they do What reaches them Sign-in Your phone number, and the session and device information needed to sign you in and keep you signed in Database and file storage Everything in section 1 that is stored: all of it lives in the database, and your photos are served from its file service to your device Text messages (SMS) Your phone number and the full text of any message sent to you by text, plus session reminders and the coach briefs described below Payments Only if you pay a late-cancellation fee: your email address, the amount, and the name of the class. Your card details go to them directly and never through us Push notification delivery The notification's title and body, plus your device's push registration (see section 4) Hosting and server logs Every request your app makes, including the web address of the request. Until 4 November 2026 an error written to those logs could quote the record that failed to save, including health information; it now records the error and the name of the field that was rejected, not the value. Our database provider's own error message can occasionally still include a rejected value, so this reduces that exposure rather than ending it Email The coach daily brief, as a PDF, which names members and summarises open pain reports The automated nutrition-check-in reader Your full nutrition check-in answers (section 2) Video hosting (YouTube) Nothing about you. But your device loads exercise thumbnails and videos from YouTube, so YouTube can see your device's IP address and when you looked at your programme Push notifications to Chrome, Android and Safari are encrypted before they leave our server, so the delivery company relays bytes it cannot read. We are putting a signed data-processing agreement in place with each of these companies — the written promise that they use your information only to provide their service to us. That work started on 4 November 2026 and is not finished. We would rather tell you that than imply it is done. We may also disclose information if the law requires it, or to protect someone's safety. Coach briefs Each coach gets a daily brief, to their own phone by text and optionally by email as a PDF. It names members and says things like "2 open pain reports (goblet squat) — review before loading", and can quote a short coach note filed under Pain / Safety. It goes to that coach only; it is never sent to members or to anyone outside TPP. A copy of the text is kept in our database. 4. Notifications and text messages are not private Push notification previews can be read off your lock screen by anyone holding or near your phone. A notification about a message from your coach includes the first 120 characters of what your coach wrote. On some devices the notification's title and body travel to the delivery company in plain text, unencrypted. (On Chrome, Android and Safari they are encrypted first.) Text messages are plain text end to end: our SMS provider, the mobile networks and anyone holding your phone can read them. If that matters to you, turn off the notification categories you do not want in Profile → Notifications. Those settings are enforced on our server, not just hidden on your device. 5. Where your information is stored, and for how long Everything is stored in the United States, in our database provider's systems and on our hosting provider's servers. Most of this is kept for as long as you are a member, because it is what your coaching is built on — a programme written without your training history is a worse programme. Where we have set a period, it is below. Where the period is somebody else's to set, we say so rather than imply we control it. What How long Your training, check-in and health records Until you delete your account, or until you have not been a member for two years, whichever comes first Your signed member agreement Two years after your last session, and kept after you delete your account — see section 7. If you signed as a minor, until you turn 20, because the time limit for an injury claim does not start running until you turn 18. Your address, your email and the device you signed from are erased from it when your account is deleted Coach daily digests 30 days, then deleted automatically Coach briefs we have emailed An email cannot be recalled once sent. The copy in our own system is deleted after 30 days; a copy in a coach's inbox is held under their own email account Performance diagnostics 48 hours, then gone. Not written to disk and not kept across a restart Server logs Held by our hosting provider under its own plan, typically a matter of days. We do not control that period and do not claim to Text messages and payment records at our SMS and payment providers Held under those companies' own retention rules Generated coach briefs saved on a TPP computer Deleted once the week they cover is over The two-year period for records is new on 4 November 2026 and is applied by hand until the app does it automatically. If you want your records gone sooner, section 7 is immediate and you do not have to wait for us. 6. Your choices Things you can do in the app right now: Download everything we hold about you. The app assembles it from the same list of records your deletion would erase, so the two cannot disagree about what we have. Your photographs are listed by name, type and size rather than included as files — you view and save the images in the app, where we can check it is you asking. Notes your coaches wrote about you are listed with a count but not included; ask us and we will provide them. Turn cycle tracking on or off (Profile → Privacy & sharing). It is off unless you turn it on. Turning it off also turns off coach sharing, and while it is off new cycle entries are refused, not merely hidden. Turning it off is never age-restricted: if it should not have been on, you can always stop it. Turn coach sharing of your recovery check-ins on or off. Delete everything you have logged in Body & Recovery, without deleting your account. Delete a single bodyweight entry. Mute any category of notification. Delete your own community post. Report a post, and block another member, so you stop seeing their posts. Delete your account (Profile → Delete my account). See section 7. Remove or change your profile photo. Things you have to ask us for, because the app cannot do them yet: The notes your coaches wrote about you. The download tells you how many there are; it does not include them. They are about you and you can have them, but they are also another person's written observations, so we hand them over on a request rather than automatically. Ask at the address in section 11 and we will send them within seven days. A correction. Tell us what is wrong and we will fix it. Deleting one thing rather than everything — a single photo, a single check-in, a single message. Withdrawing permission to use photographs and video of you, under section 4 of your member agreement. Tell your coach in any way that reaches them — in person, by text, by email — and we stop using your images in anything new. You can also ask for a particular photo to be taken down, and we will remove it from everything we control. Something already printed, already sent, or already shared on by someone else cannot always be recalled, and we will not pretend otherwise. Whether a law obliges us to do any of this is a separate question from whether we do it. New Jersey's Data Privacy Act applies to businesses handling far more records than a gym with a couple of hundred members, and no other state law reaches us today. So we are not claiming to act under a statute we are not subject to. We give you these rights because they are the right ones to give, and we will handle your request either way. Peter Lopez handles them, and we answer within seven days. 7. Deleting your account Profile → Delete my account. You confirm, then we text a six-digit code to the phone number your account signs in with and you type it back in. Only then does anything get deleted, and it cannot be undone. The code exists because confirming on its own protects nobody: a phone left unlocked on a bench was enough to erase somebody's whole training history, and the first they would know of it is an empty app. The code is good for ten minutes and three attempts. It is the same channel you sign in with rather than a true second factor, and we would rather say that than overstate it — what it reliably stops is somebody using a signed-in session on a device that is not yours. Take a copy first if you want one. Section 6's download is in the app and deletion cannot be reversed, so the order matters. There is also a public page explaining all of this, which you can read without signing in or installing anything: https://tpp-client-app.onrender.com/account-deletion That page explains the process and performs no deletion — we will not delete an account on the word of someone who is not signed in to it. What it deletes: your member record, your photographs, your training history and logged sets, your bookings, attendance and waitlist places, your packages, your goals, roadmaps, milestones and badges, your check-ins, your bodyweight log, your recovery and cycle records, your pain and symptom reports, your messages, your community posts, your notification registrations and your notification settings. Your photo fields are cleared before the record itself goes. It also deletes your sign-in, so your phone number no longer reaches an account here. Removing the sign-in itself depends on a credential being configured on our server; where it is not, your records are still deleted and your phone number no longer resolves to a member, and the sign-in record is removed separately by hand. The app tells you which of the two happened rather than reporting success for both. What we keep, and why: Your signed member agreement, kept for at least a year after you cancel. It is a contract you accepted, and a gym has a real interest in keeping proof of it. This is a deliberate exception, not an oversight. It is cut down to the part that is actually the contract: your name, your typed signature, the date, which version you signed, and a guardian's name and signature if one signed. Your home mailing address, your email address and the description of the device you signed from are erased when you delete your account — none of them is needed to show that you accepted the terms. Records at our other providers. If you ever paid a fee, the payment record stays with our payment provider under their rules. Text messages already sent stay with our SMS provider. Server logs stay with our hosting provider. Coach briefs and digests we already sent, which can name you and summarise your pain reports. Digests are deleted automatically after 30 days, so these disappear on their own shortly after you go. A brief already emailed to a coach sits in that coach's inbox and cannot be recalled. Files a coach already downloaded. A coach can export a report as a spreadsheet to their own computer. Once a file is on someone's laptop we cannot reach it. A small number of other records — some audit and moderation rows, and the weeks and days hanging off a deleted programme — are known not to be removed yet. We are fixing that. The audit rows record that an action happened, not what was in it. 8. How we protect your information Stated plainly, including the limits. What is in place: Traffic between the app and our server uses HTTPS. Signing in needs your phone and a one-time code sent to it. We never store a password. Every request to our server is checked for a valid sign-in, except for a small, listed set of public endpoints. Photos are served through short-lived signed links tied to the person who asked for them. The underlying storage addresses are never handed out. Push notifications to Chrome, Android and Safari are encrypted before they leave our server. Camera metadata, including GPS, is stripped from every photo uploaded through the app. Requests to our server are rate limited. Exports a coach runs are logged. Records are scoped to Ten Percent Performance, so another organisation using the same software would not be able to read them. What is not in place, honestly: There is no two-factor authentication. Because sign-in is your phone number, anyone who takes over your phone number can sign in as you. If you lose control of your number, tell us immediately. Anyone with direct access to our database — rather than to the app — can see member records, because the database itself does not enforce the app's rules. One person holds that access: Peter Lopez, who owns the gym. Coaches do not have it; they see what the app shows them. Access checks are written into each part of the app individually rather than enforced in one place, so a mistake in one of them is possible. We test for it; we do not claim it cannot happen. We have not independently verified that every company we use encrypts your information while it sits on their disks, so we do not claim that they do. No system is perfectly secure, and we do not promise one. 9. Children and members under 18 TPP coaches people under 18, and some are under 13. This section says what we do about that, including the part that is not finished. We now record age, and until recently did not Until November 2026 the app stored no date of birth and no age anywhere. A twelve-year-old could hold their own phone-and-SMS account while the app collected their bodyweight, their photographs and their pain reports, and nothing in the system knew. That was not a policy choice; it was a gap. There is now a date of birth on the member record, and a coach asks for it and enters it. Most members do not have one on file yet. Until a member's is recorded the app treats them as an adult for everything they can already do, and refuses only newly sensitive collection. We are working through the roster; the number of members without a date of birth is visible to coaches and is meant to reach zero. Stated plainly, because it is the honest position: between now and the roster being complete, a child whose age nobody has recorded is treated by the app as an adult. The alternative — locking every member out until someone asks them their age — would be worse. Under 13 For a member under 13 we ask for a parent or guardian's consent and we record how that consent was verified, not merely that someone said yes. A guardian's name on a signed liability waiver is not consent to collect a child's information; those are two different agreements and we treat them as such. How we verify consent. One of these, chosen by the parent or guardian, and recorded against the child's record along with the date: a consent form signed in person, with photo ID; a signed consent form returned to us by post or as a scan; a phone call with a coach; a video call with a coach; verification through a payment card. The date on that record is taken from our own server at the moment the consent is given. It is never supplied by whoever is entering it, because a consent record whose date the requester chose is not evidence of anything. What a parent is told before they consent. That we coach their child in person; that we record the child's name, date of birth, phone number, training history and logged sets, attendance, any goals, and any pain or injury the child reports to a coach; that this is used to write and adjust the child's programme and to run the gym's bookings, and for nothing else; that the companies in section 3 see it in order to run the app; that the features listed below are turned off for anyone under 18; that they may see what we hold, ask us to delete it, and withdraw their consent at any time by contacting us at the address in section 11; and that withdrawing consent means we stop collecting and delete what we have, which ends the child's membership, because we cannot coach a child whose training we may not record. What a member under 18 cannot do Cycle tracking is only available to members recorded as 18 or over. It is refused for a member recorded as under 18, and refused for a member whose date of birth is not on file — the one place in the app where an unknown age restricts anything. If a date of birth is entered that shows a member is under 18 and cycle tracking was already on, it is switched off, made unavailable, and coach sharing of it is withdrawn at the same moment. Accounts still belong to whoever holds the phone There is no parent-managed account. Sign-in is a phone number, so a minor's account is theirs to use, even where a guardian signed the agreement and consented. A guardian's phone number on the record does not give them access to the child's account, and we have not built a way for a parent to view or manage their child's account from their own. We have not built guardian-managed accounts, and we are not pretending the app covers this. A parent's right to see what we hold about their child, to have it deleted, and to withdraw consent is real and we honour it — by asking us, at the address in section 11, within the same seven days as any other request. It is a person doing it, not a button. If we have a child's information and should not Contact us at the address in section 11 and we will delete it. A parent or guardian may ask us what we hold about their child, ask us to delete it, and withdraw consent; withdrawing consent means we stop collecting and delete what we have. 10. Changes to this policy If we change this policy we will update the version and effective date at the top, post the new version at the address below, and — for a change that affects what we collect, who we share it with or how long we keep it — tell members in the app and by email before it takes effect, with at least 14 days' notice, by email and by text message. In-app notice alone is not enough for a change like that, because not everyone opens the app every week. We will not apply a materially different use to information we already hold without asking you first. 11. Contact Privacy questions, access requests, corrections and complaints: info@tenpercentperformancenj.com Ten Percent Performance, LLC 1 Springfield Avenue Cranford, NJ 07016 The app's Help & support link pointed at info@tenpercentperformance.com — a domain that does not resolve at all, so every message sent through it was undeliverable. Confirmed and corrected on 4 November 2026. The published copy of this policy will live at https://tenpercentperformancenj.com/pages/app-privacy-policy, and the app's Privacy policy link points there. It is a separate page from the store's policy at https://tenpercentperformancenj.com/policies/privacy-policy, which stays where it is. That one is Shopify's and covers shopping, orders and store advertising; this one covers the app. Replacing one with the other would leave a real gap either way, so there are two, and each says where the other lives.