Privacy Policy

1. Who this policy covers

• Individuals who track their own weight and progress (including on our one-time Light plan and our Individual subscription).
• Trainers who manage clients through the Service.
• Clients who are invited by and linked to a trainer.
• Waitlist and marketing contacts who give us their email before or after launch.

2. Information we collect

Account and authentication data. When you create an account, we collect your email address, authentication credentials, and basic profile details. Authentication is handled through Better Auth.

Health and wellness data. The core of the Service involves data you choose to log, which may include your body weight, calorie intake, fasting periods, campaign goals and target weights, and the dates and history of your entries. We treat this as sensitive information and handle it with additional care (see Section 6).

Subscription and billing data. Payments and subscriptions are processed through Polar. We receive records of your plan, subscription status, and billing history from Polar. We do not store your full payment card details; those are handled by Polar and its payment processors.

Waitlist and marketing data. If you join a launch waitlist or subscribe to updates, we collect your email address to send product and launch communications through Resend. Waitlist submissions are protected with Cloudflare Turnstile, a bot-detection service that may process technical signals (such as IP address and browser characteristics) and set cookies or similar technologies as described in Section 10.

Technical data. We collect standard technical information such as log data, device and browser type, and information needed to operate and secure the Service, including through our hosting provider, Railway, and security providers such as Cloudflare Turnstile.

3. How we use your information

We use personal data to:

• Provide, maintain, and operate the Service, including logging entries, generating weekly averages, change, pace, and projections, and running campaigns.
• Enable the trainer–client relationship where you have chosen to use it (see Section 4).
• Process payments, manage subscriptions, and send transactional messages such as notices when a Light campaign ends.
• Send product updates and marketing to waitlist and subscribed contacts, from which you can opt out at any time.
• Secure the Service, prevent abuse, and comply with legal obligations.

We do not sell your personal data.

4. The trainer–client relationship

Stackweight lets a client link to a trainer. If you are a client linked to a trainer, your logged data — including your weight, calorie, fasting, and campaign progress — is visible to your linked trainer , who can view your progress and view, create, or edit campaigns on your behalf. Trainers can only access data for clients actively linked to them.

If you do not want a trainer to see your data, do not accept a trainer link, or end the link (see Section 8 for what happens to access when a link or subscription ends).

Trainers are responsible for handling their clients' data lawfully and only for legitimate training purposes.

5. Who we share information with

We share personal data only with service providers that help us run Stackweight:

• Better Auth — authentication and account management.
• Polar — payment processing and subscription management.
• Resend — transactional and marketing email delivery.
• Railway — application hosting and database infrastructure.
• Cloudflare Turnstile — bot protection on forms such as the launch waitlist. Cloudflare may receive technical data from your browser and set cookies or similar technologies solely to operate the challenge. See Cloudflare's Privacy Policy and Turnstile privacy documentation.
• PostHog — product analytics on our marketing site (and, over time, our apps) to understand usage, such as page views and feature adoption. PostHog may collect device and browser information, IP-derived approximate location, and pages or events you interact with, and may set cookies or similar technologies. See PostHog's Privacy Policy.

We may also disclose information if required by law, to protect our rights or users' safety, or in connection with a business transfer. Each provider processes data on our behalf under its own terms.

6. How we handle sensitive health data

Weight, calorie, and fasting information is sensitive. We:

• Use it only to provide the Service's tracking, analysis, and training features.
• Do not sell it and do not share it for advertising.
• Restrict access to your data to you, any trainer you have chosen to link with, and the limited personnel or processors needed to operate the Service.

Artificial intelligence features. We may introduce AI-assisted analysis in the future. If and when we do, we will describe in this policy how your data is used for those features before you use them, and we will not use your personal health data to train third-party AI models without disclosing it to you.

7. Where your data is stored and how long we keep it

Your data is stored in databases hosted with Railway. Account and authentication data, and your tracking and campaign data, are maintained in separate systems.

We retain your personal data for as long as your account is active or as needed to provide the Service, and afterward only as required for legal, accounting, or legitimate operational reasons. Completed Light campaigns may remain on your account in read-only form until you delete them or your account.

8. Access changes when links or subscriptions end

• When a Light campaign ends, its data becomes read-only on your account. It remains stored until you delete it or upgrade.
• When a trainer's subscription ends or is cancelled, linked clients keep full access through the trainer's paid-through date, then have 30 days of read-only access before needing their own plan to continue. A trainer loses the ability to view a client's data when the link or their subscription ends.

9. Your rights and choices

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your data ("right to erasure").
• Export or receive a copy of your data.
• Opt out of marketing emails at any time using the unsubscribe link.
• Object to or restrict certain processing.

To exercise any of these, contact Aberrant Engineering LLC at [email protected]. We will respond within the timeframe required by applicable law. If you are in the EEA or UK, our processing of your health data is based on your explicit consent, which you may withdraw at any time by deleting the data or your account.

10. Cookies and similar technologies

We and our service providers use cookies and similar technologies where needed to run and secure the Service.

• Essential / security. Cloudflare Turnstile may set cookies or use local storage and similar technologies to distinguish humans from bots when you use protected forms (including the waitlist). These are used for security and abuse prevention, not advertising.
• Analytics. PostHog may set cookies or use local storage to measure how people use the marketing site (for example page views). We use this for product improvement, not for third-party advertising networks.
• Authentication. When you sign in to the apps, session cookies or equivalent credentials keep you logged in.

You can control cookies through your browser settings; blocking essential security cookies may prevent some forms from working, and blocking analytics cookies limits what we can learn about site usage.

11. Children's privacy

Stackweight is not intended for children under 16, and we do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the Service evolves — including when we launch AI features. We will post the updated policy here and update the "Last updated" date. Material changes will be communicated where required.

13. Contact

Aberrant Engineering LLC
[email protected]