Privacy Policy

1. Introduction

Kopeni One ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our health and fitness tracking application.

By using Kopeni One, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with our policies and practices, please do not use the Service.

2. Information We Collect

2.1 Information You Provide to Us

• Account Information: Name, email address, and password. A phone number may be collected if SMS reminder features become available in the future.
• Profile Information: Date of birth, gender, height, weight, fitness goals, activity level, and fitness experience
• Health and Fitness Data:
  • Peptide injection records (type, dosage, time, site, notes)
  • Supplement intake logs and custom blend recipes
  • Workout sessions, exercise sets, and workout templates
  • Weight entries and body measurements
  • Progress photos (stored in private storage)
  • Health metrics (blood pressure, heart rate, etc.)
  • Side effects and recovery case tracking
  • Health questionnaire responses
  • Coach conversation messages and AI-generated action cards
• Purchase Information: Peptide vendor records, costs, and expiration dates (self-reported)
• Payment Information: Processed by Stripe; we do not store your full card number. We may store a reference to your Stripe customer and subscription for billing management
• Communications: Feedback, support requests, and messages sent through the Service

2.2 Information Collected Automatically

• Usage Data: Pages visited, features used, and interactions within the app
• Device Information: Device type, operating system, and browser type
• Log Data: Error logs and diagnostic data used to maintain the Service
• Cookies and Similar Technologies: We use cookies and similar technologies to maintain sessions and authentication

2.3 Information from Third Parties

• Authentication Providers: If you sign in using third-party authentication (such as Google), we receive basic profile information (name and email) from that provider
• Payment Processor (Stripe): Stripe provides subscription status, billing dates, and payment confirmation
• Food Databases: USDA and Open Food Facts provide nutrition data when you search for foods or scan barcodes; your search queries are sent to these providers

3. How We Use Your Information

We use the information we collect to:

• Provide the Service: Process, store, and display your health and fitness data
• Personalization: Generate AI-powered workout plans, nutrition estimates, and coaching guidance tailored to your profile and history
• Calculations: Compute peptide level timelines, progressive overload suggestions, and readiness scores
• Communication: Send reminders and notifications via email or in-app messages
• Billing: Process payments, manage subscriptions, and send billing notifications through Stripe
• Improvement: Analyze aggregated, anonymized usage patterns to enhance features and user experience
• Security: Detect and prevent fraud, abuse, and security threats
• Legal Compliance: Comply with applicable laws and regulations
• Support: Respond to your inquiries and provide customer service

4. How We Share Your Information

We do NOT sell your personal information. We share your information with third-party service providers as necessary to operate the Service:

• AI Providers: When you use AI-powered features (AI Coach, workout generation, nutrition estimation, and meal photo analysis), your personal data, including your health profile, workout history, and nutrition data, is sent to third-party AI providers to generate personalized recommendations. This data is identified and processed for your personal use, not anonymized or aggregated before sending.
• Payment Processor (Stripe): Stripe processes your payments and manages your subscription; see Stripe's privacy policy for how they handle data
• Food Databases: Your food search queries and barcode lookups are sent to USDA and Open Food Facts to retrieve nutrition information
• Hosting and Infrastructure: Our cloud hosting and database providers store and process your data to deliver the Service, bound by confidentiality obligations
• Business Transfers: If we are acquired or merged, user information may be transferred to the new entity
• Legal Requirements: We may disclose information to comply with law, court orders, or government requests
• Protection: To protect our rights, property, safety, or the safety of users or the public
• With Your Consent: We may share information with your explicit permission

We do NOT share your identified health data with advertisers or for third-party marketing purposes.

5. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Encryption in Transit: Data transmitted between your device and our servers is encrypted using HTTPS/TLS
• Access Controls: Access to user data is restricted and requires authentication; row-level security limits each user's data to that user
• Secure Infrastructure: We rely on our cloud hosting provider's security measures, which include network protections and access management
• Private File Storage: Progress photos and uploaded files are stored in private storage and accessed through time-limited signed URLs, not public links
• Payment Security: Payment data is handled entirely by Stripe; we do not store full card numbers

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

6. Data Retention and Account Deletion

• We retain your personal information for as long as your account is active
• When you delete your account, we delete your structured data records (workouts, logs, entries, profile, and health questionnaire responses) from our application database
• Files you uploaded (such as progress photos and nutrition capture images) are stored separately in private file storage. Our hosting platform does not currently support deleting these stored files, so they may remain in private storage after your account is deleted. They become unreferenced and cannot be accessed or viewed through the app once the database records that link to them are removed
• We record a DeletionLedger entry (accessible only to administrators) that documents which database records were deleted and which uploaded files could not be removed from storage, so the remaining files can be traced and cleaned up if the platform adds file-deletion support
• Partial deletion failures (for example, if a specific record could not be removed) are recorded in the DeletionLedger per entity; an administrator can retry the failed removal
• You must cancel any active subscription through the billing portal before deleting your account; the Service will not delete an account with an active subscription
• We do not guarantee complete or immediate erasure of all copies of your data, including backups retained by our hosting provider under its standard retention policies
• Some information may be retained longer if required by law, for dispute resolution, or for legitimate business purposes such as fraud prevention and billing audit
• Aggregated, anonymized data may be retained indefinitely for analytics
• Billing records maintained by Stripe are subject to Stripe's own retention policies

7. Your Privacy Rights

Depending on your location, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your personal information (subject to the limitations in Section 6)
• Data Portability: Request your data in a machine-readable format
• Opt-Out: Opt out of marketing emails (you will still receive transactional emails such as billing confirmations)
• Withdraw Consent: Withdraw consent for data processing that relies on your consent
• Cookie Preferences: Manage cookies through your browser settings

To exercise these rights, contact us at kopenione@gmail.com or through the Help section within the application. We will respond within 30 days.

8. Children's Privacy

Kopeni One is NOT intended for use by individuals under 18 years of age.

We do not knowingly collect personal information from children under 18. If we become aware that we have collected data from a child under 18, we will take steps to delete it. If you believe a child has provided us with personal information, please contact us at kopenione@gmail.com.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence, including the United States. These countries may have data protection laws that differ from your jurisdiction.

By using the Service, you consent to the transfer of your information to the United States and other countries where our service providers operate.

10. California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information we collect, use, and share
• Right to delete personal information (subject to legal exceptions)
• Right to opt out of the "sale" of personal information (Note: We do NOT sell personal information)
• Right to non-discrimination for exercising your privacy rights

To exercise these rights, contact us at kopenione@gmail.com. We will verify your identity before processing your request.

11. European Privacy Rights (GDPR)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR):

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing
• Right to lodge a complaint with a supervisory authority

Our legal basis for processing your data includes consent, contract performance, legal obligations, and legitimate interests.

12. Health Information Privacy (HIPAA)

IMPORTANT: Kopeni One is NOT a HIPAA-covered entity.

We are not a healthcare provider, health plan, or healthcare clearinghouse. The Health Insurance Portability and Accountability Act (HIPAA) does not apply to our Service. We implement security measures to protect your health-related information, but you should not rely on this Service for the storage of information subject to HIPAA or other medical privacy regulations.

13. Third-Party Links

The Service may contain links to third-party websites or services. We are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies before providing any personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page
• Updating the "Last Updated" date
• Sending an email notification for significant changes

Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

15. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Email: kopenione@gmail.com
• Through the Help section within the application

We will respond to your inquiry within 30 days.