Privacy Policy

• Account information: email address, account identifier, authentication information, and information supplied by Google when you choose Google sign-in.
• Health and wellness information: answers about activity, symptoms, pain history, selected exercises, saved workouts, workout completion records, progress, and information you choose to type into the AI coach.
• Subscription information: Stripe customer and subscription identifiers, subscription status, and transaction details. Stripe processes payment-card information; we do not store full card numbers.
• Device and usage information: IP address, browser and device information, pages and features used, approximate location derived from IP address, referring pages, and analytics events.
• Local device data: assessment answers, favorites, saved workouts, reading progress, and similar preferences may be stored in your browser’s local storage.

We use information to:

• provide accounts, personalized educational recommendations, workouts, progress features, subscriptions, and the AI coach;
• authenticate users, process payments, provide customer support, and communicate about the service;
• operate, secure, debug, analyze, and improve the service;
• prevent fraud, abuse, and security incidents; and
• comply with law and enforce our agreements.

We do not use the service to provide medical diagnosis or treatment.

We disclose information only as reasonably necessary to operate the service, including to:

• Supabase for authentication and account-related infrastructure;
• Stripe for checkout, billing, subscription management, and fraud prevention;
• OpenAI to generate AI-coach responses from the conversation you submit;
• Google for optional sign-in and website analytics;
• Vercel and other infrastructure providers for hosting, delivery, and analytics;
• professional advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate misuse, or complete a corporate transaction.

We do not sell personal information for money. We do not disclose health and wellness information to data brokers. Analytics technologies may constitute “sharing” under some privacy laws; applicable opt-out rights are described below.

Messages sent to the AI coach are transmitted to OpenAI along with recent messages needed to preserve conversation context. Back Mechanic requests that OpenAI not store the generated response through the API’s storage setting. We retain limited operational records such as account identifiers, conversation identifiers, token usage, and service cost. The visible conversation is maintained in the active browser session unless another feature states otherwise. Do not include information that is not needed for your request.

We use cookies and similar technologies for authentication, security, preferences, analytics, and purchase measurement. Google Analytics and Vercel Analytics help us understand use of the service. You can limit cookies through your browser, although authentication and other features may stop working. You can clear locally stored assessment and workout information through browser controls or the controls provided in the service.

We retain personal information for as long as reasonably necessary to provide the service, maintain business and security records, resolve disputes, and meet legal obligations. Retention varies by data type and provider. Information stored only in your browser remains there until you or the browser removes it. We use reasonable administrative, technical, and organizational safeguards, but no system is completely secure.

You may update sign-in information through the applicable authentication provider, manage or cancel a subscription through the Stripe customer portal, clear local browser data, and choose not to provide optional information. Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information, and to object to or opt out of certain processing or disclosures. We will not discriminate against you for exercising an applicable privacy right.

Submit a privacy request using the support contact provided with your account or purchase receipt. We may need to verify your identity before completing a request. You may also use an authorized agent where local law permits.

The service is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has provided personal information, contact us so we can review and delete it as appropriate. Minors should use the service only with a parent or legal guardian’s involvement.

We and our providers may process information in the United States and other countries whose privacy laws may differ from those where you live. Where required, we use legally recognized safeguards for international transfers.

We may update this policy as the service or legal requirements change. We will post the new effective date and provide additional notice when required. Questions and privacy requests may be submitted using the support contact associated with your account or purchase receipt.