PLATEBORN · YOUR PRIVACY

Your record.
Your choice.

Privacy notice · Updated 7 November 2026

1. Information stored on your device

Plateborn stores workouts, sets and weights, plans, meals, measurements, goals, coach conversations, preferences and an unfinished workout draft in this browser’s storage. Other people with access to your device or browser profile may be able to view them. Browser cleanup or device changes can remove local records. Export a backup regularly if you want your own copy.

Offline app files are stored separately from your fitness records. Installing or updating those files does not create a cloud backup of your record.

2. Sign-in and optional cloud sync

Creating a customer account stores your email address, a randomly salted password verifier and the terms/age confirmation you submit. Passwords are not stored in plaintext. A separate password-protection secret stays on the server. The server assigns your account identifier and uses a pseudonymous account key for lifecycle and usage controls; this does not make your account anonymous.

Email ownership is recorded only after a valid single-use confirmation or recovery link is used. Account verification and password-reset delivery stay disabled until the operator configures a verified sender and server-side delivery credentials. The login page states when delivery is unavailable. Public access or live billing configuration requires verified email for protected connected actions. While signed in, you can change your password by confirming the current password. Login passwords, recovery tokens and session cookies are not attached to AI-coaching requests.

Configured account email contains the recipient address and a security link, not fitness or coach content. The delivery adapter uses Resend when enabled; see Resend’s privacy policy. Security tokens are random, purpose-bound and stored only as digests. Confirmation links expire in 24 hours and reset links in 30 minutes; a new link supersedes older links of the same kind. Resetting a password invalidates every older session and does not automatically sign you in.

A necessary HttpOnly session cookie keeps you signed in for up to 30 days. It is sent only over HTTPS on the hosted app and ends when it expires, you sign out, or a password change revokes sessions. Short-window sign-in/signup controls store server-secret HMAC markers rather than plaintext email/IP values; expired markers are removed during subsequent account requests.

If you enable cloud sync, the app uploads your full Plateborn backup record, including any saved conversations and measurements, to its Cloudflare D1 storage. Sync is separate from AI context sharing. The hosting services also process requests and service information according to their own policies.

3. Live AI coaching

When you explicitly send a live message, Plateborn sends it, a bounded recent conversation and the relevant context you have chosen to share through the server to OpenAI. Initial plan customization sends selected intake preferences and approved library choices. Plan adjustments, workout reflections, daily check-ins and weekly reviews send the selected, bounded information needed for that request.

Training, nutrition and saved-memory sharing have separate controls. Private journal notes and body measurements are not automatically attached to ordinary coach chat. Information you type directly into a message is still part of that message. Do not include information you do not want the AI provider to process.

Requests use store: false. That setting does not promise zero provider retention; provider safety, legal and service retention can still apply. See OpenAI’s API data controls. Practice/simulated replies do not call OpenAI.

4. Response reports and usage controls

An AI response report includes the output you review and submit, response provider/type, reason and optional explanation, linked to your pseudonymous account key. Opening the report form sends nothing. A report does not automatically include your original prompt, workouts, diary or memory.

The AI usage ledger records pseudonymous account/request identifiers, dates, model, request kind, completion status, prompt version, token counts and estimated cost. It stores no prompt, response, workout or nutrition content. Live chat, plan generation, AI adjustments and reviews use this ledger. Manual logging and submitting a report do not call the model.

5. Trials, subscriptions and payments

Trial eligibility and start/end information are stored against the account so the trial cannot be restarted by clearing browser data or deleting and recreating a fitness record. Coaching usage is checked by the server.

When checkout is enabled, Stripe handles payment details on its hosted checkout and billing portal. Plateborn keeps the customer/subscription references and status needed to verify access and manage billing. Workout, nutrition and coach-chat content are not needed for checkout and should not be included in payment metadata. See Stripe’s privacy policy.

Billing records are separate from fitness records. Deleting your fitness data does not itself cancel a subscription or erase Stripe’s financial records. Manage billing first using the billing portal. Payments are being tested. Test checkout does not make real charges.

6. Purposes and service providers

Data is used to provide requested training tools, save or sync your record, personalize the coaching you request, secure accounts, enforce usage limits, investigate reviewed reports and administer subscriptions. Service providers include the hosting services, Cloudflare for app infrastructure, OpenAI for live AI and Stripe for enabled checkout.

Provider processing may occur outside your country. Their contractual, legal and service obligations also apply. This release includes no advertising or analytics SDK, and no advertising tracking pixel. Fitness or coach-chat content is not sent to an advertising network by this release. Hosting services may still process operational logs.

7. How long information remains

• Login account: your email and password verifier remain until login-account closure. The separate fitness-data deletion action retains the login. Closing the login removes the email, verifier, sessions, cloud fitness record and AI reports after ownership and payment-state checks; minimal pseudonymous security, billing and usage records remain separately.
• Session and sign-in controls: sessions stop authorizing requests after expiry, sign-out, password change/reset or account closure. Digests of closed sessions expire with their previous session so reconnected devices can recognize closure; they cannot authenticate. Expired sessions, closed-session markers and rate-limit rows are pruned during subsequent login or closure activity. Expired recovery tokens are pruned when new account links are requested.
• Local records: remain until you remove them, browser/device cleanup removes them, or account controls clear this browser’s copy.
• Synced fitness records: remain until you delete the cloud copy or Plateborn account data, or the operator removes them as part of service administration.
• AI response reports: remain until account-data deletion unless the operator removes them earlier.
• AI usage: current-month and recent seven-day usage is retained for cost, allowance and trial enforcement. Account-data deletion removes older usage outside those windows. Periodic cleanup outside deletion requires operator maintenance.
• Deletion markers and trial eligibility: minimal account-linked deletion, trial eligibility, initial-plan and completed-feedback allowance markers, and terms-consent records remain to block stale devices and repeat trials, and record the terms accepted. Feedback markers use a hashed workout identifier or a day/week key. They do not contain your exercise, meal or conversation details.
• Billing and provider records: remain separately as needed to administer the subscription and meet provider, accounting or legal requirements. This includes provider records that Plateborn cannot erase directly.

Downloaded backups and copies on offline devices are outside server deletion. A fixed automatic expiry for cloud fitness records and AI reports is not implemented in this beta.

8. Your choices and requests

You can change sharing preferences, turn cloud sync off, export a backup, remove the cloud copy, delete only fitness data, or close your first-party Plateborn login in the app. Full closure requires your current password, current account session and explicit CLOSE PLATEBORN confirmation. Active or scheduled web billing can be canceled during closure only through a separate, unchecked-by-default consent after current-password confirmation. Ownership and the configured Plateborn product are checked first; unknown or unverified records keep the login open. Immediate cancellation ends remaining web Plus access without an automatic refund, final invoice or proration request. Apple subscriptions remain separate. Read the deletion guide for the distinction between these actions.

Contact Support contact pending to ask about access, correction, deletion or another privacy request. Verification may be needed to protect your account. Rights and available remedies depend on the laws that apply to you. Avoid emailing a full fitness backup, payment-card details or identity documents unless a secure, necessary process has been agreed.

9. Adults, security and updates

Plateborn’s beta is intended for adults 18 and over. It is not designed for children. If a child’s data was provided, contact the operator for help removing it.

The service uses account access checks, salted password verifiers, a server-only password secret, protected session cookies and request throttling. Existing records under an earlier sign-in method remain separate; accounts are not merged merely because their email addresses match. No system or device storage can be guaranteed completely secure. This notice will be updated when the released service’s practices change; material changes should be reviewed before continuing to share information.