Privacy Policy

Prepared to Fight Fire ("PTFF," "we," "us," or "our") — a trade name of Prepared to Dominate Life LLC, a Florida limited liability company, West Palm Beach, Florida.

Effective Date: [EFFECTIVE DATE]

1. Introduction

This Privacy Policy explains how we collect, use, share, and protect information when you use the PTFF mobile application, our website, and related services (the "Service").

When you create an account, you agree to this Privacy Policy and to our Terms of Service by checking the acceptance box on the sign-up screen — the screen where you enter your information for the first time. That box reads: "I am at least 18 years old, and I agree to the PTFF Terms of Service and Privacy Policy." If you do not agree, do not check the box and do not use the Service.

The Service is a fitness and nutrition application built for firefighters, recruits, and firefighter candidates, and is intended for users in the United States. You must be at least 18 years old to use the Service.

2. Information We Collect

Information you provide:

• Account information: email address, password, display name.
• Body and fitness profile: age, biological sex, height, weight, activity level, and fitness goals — used to calculate your nutrition targets.
• Nutrition logs: food entries, calories, macronutrients, and water intake you record.
• Workout data: workouts completed, sets, repetitions, weights, training volume, ratings, and any notes you add.
• Notification preferences.
• Marketing preference: whether you opted in to marketing email at sign-up (see §2A).
• Support requests. If you contact us through the support form on our website, or by email, we collect your first and last name, your email address, the help category you select, the message you write, and any files you attach. Depending on the category you choose, we may also ask where you bought your subscription (the App Store, Google Play, or our website) and, for bug reports, your device, operating system version, and app version. For premium-coaching inquiries only, you may optionally give us a phone number. We use this information to answer you and to keep a record of the request.

Please do not include full payment card numbers, passwords, or medical details in a support message or attachment. We do not need them to help you, and we would rather not receive them.

Information collected automatically:

• Device and usage data — IP address, device identifiers, device type, operating system, and general app-interaction data, collected through Firebase as our service provider.
• Performance data — through Firebase Performance Monitoring, to diagnose slowness and errors.
• Crash diagnostics — through Firebase Crashlytics, to identify and fix crashes.

Purchase and subscription data:

When you subscribe, your purchase is processed by Apple, Google, or Stripe (through RevenueCat) depending on where you buy. We use RevenueCat to keep your subscription status accurate across devices and platforms. We receive confirmation of your subscription status and purchase events — we do not receive or store your payment card details.

Progress photos (planned feature): A future version may let you upload progress photos. If released, such photos will be stored privately by default and used for marketing or promotional purposes only if you give separate, explicit, opt-in consent at the time of upload — consent you may withdraw at any time. [ATTORNEY REVIEW — sensitive body-image data + marketing consent]

2A. Marketing Email — a Separate, Optional Choice

At sign-up you may tick a second, optional box: "Yes — send me PTFF emails about the app, the website, and offers. I can unsubscribe at any time." If you tick it, we add your email address to our marketing list, which is operated for us by Klaviyo, and we may email you about the app, our website, new programs, and offers.

Agreeing to this Policy and the Terms does not opt you in to marketing email. You can use the Service without opting in. You can withdraw this consent at any time using the unsubscribe link in any marketing email or by emailing hello@preparedtofightfire.com; withdrawing it does not affect your account. Messages we must send to operate your account — password resets, receipts, subscription notices, or a notice before an inactive account is deleted — are not marketing and are sent regardless of this choice.

3. How We Use Your Information

To create and manage your account; provide the Service's core features (nutrition calculation and logging, workout programs and tracking); personalize your experience; send reminders you enable; process and manage your subscription and verify your access; send marketing email only if you opted in (§2A); maintain the security, performance, and reliability of the Service; respond to your support and privacy requests and keep a record of them; and comply with legal obligations.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under the California Consumer Privacy Act, as amended). [ATTORNEY REVIEW — confirm this statement holds under each applicable state law given our processors (Firebase, RevenueCat, Google Workspace, Klaviyo); Firebase Analytics is OFF and we run no advertising SDKs.]

4. How We Share Your Information

• Google Firebase — hosts and operates the Service (authentication, database, storage, performance, crash diagnostics), processing your data on our behalf.
• Google Workspace (Gmail) — messages you send us through the support form or by email are delivered to and stored in our Google Workspace inboxes. Google processes that email on our behalf. Support correspondence is not stored in the app or in our app database — it lives only in our email system.
• RevenueCat — manages subscription state across purchase channels. Receives your user identifier and subscription events. No payment card data.
• Apple / Google Play — process in-app subscription purchases under their own terms and privacy policies.
• Stripe — processes web subscription purchases (including Apple Pay and Google Pay). Stripe handles payment information directly.
• Shopify — operates our online storefront for merchandise. Merchandise purchases are governed by Shopify's processing.
• Klaviyo — sends our marketing email, and only to people who have separately opted in to receive it (§2A).
• Trainerize — our optional premium 1-on-1 coaching is delivered through this third-party platform, which requires a separate account governed by its own privacy policy. We encourage you to review it. If we later integrate the Service to share your data directly with Trainerize to facilitate coaching you have requested, we will do so only for that purpose and will update this Policy. [ATTORNEY REVIEW — third-party transfer / future integration language]
• Legal and safety — where required by law, or to protect the rights, safety, or property of PTFF, our users, or others.
• Business transfers — if PTFF is involved in a merger, acquisition, or sale of assets, your information may transfer as part of that transaction.

5. Data Retention and Deletion

We keep your personal information only for as long as it is needed for the purposes described in this Policy, after which we delete or de-identify it.

5.1 Three different things, and what each one does

• Deleting the app from your phone removes the app only. It does not delete your account, does not delete your data, and does not cancel a paid subscription. Your account and data remain, and billing continues until you cancel.
• Cancelling your subscription stops future billing. It does not delete your account or your data. You cancel through the channel you bought from — the Apple App Store, Google Play, or our website (in the app: Profile → Subscription → Manage Membership). Deleting the app or the account does not do this for you.
• Deleting your account permanently erases your data (see 5.3). It does not cancel a paid subscription — cancel first, or billing may continue.

5.2 How long we keep your information

• Account and profile data (email, display name, subscription status, marketing preference): for as long as your account is active.
• Body/fitness profile, nutrition logs, and workout data: for as long as your account is active, so your history and progress remain available to you.
• Inactive accounts: if you do not sign in for 24 consecutive months, we treat your account as inactive and delete it and its associated data. Where reasonably practical, we will attempt to notify you at your account email before deletion. You may delete your account sooner at any time, and you may ask us to delete it immediately (see §7).
• After account deletion — billing, tax and accounting records: we may retain a limited set of records — such as subscription and transaction events and correspondence about a billing dispute — for up to 24 months after deletion, where needed for billing, tax, accounting, fraud-prevention, security, or legal purposes, and only for as long as that purpose requires. These records are not used to restore an account. [ATTORNEY REVIEW — confirm 24 months against Florida and federal tax/accounting minimums; some records may need longer.]
• Support correspondence: messages you send us and any files you attach are kept in our email system for as long as we need them to resolve your request and keep a record of it, and no longer than 24 months after the request is closed. [ATTORNEY REVIEW — confirm; a retention mechanism must exist before publishing — see the implementation gate below.]
• Marketing list: your email address stays on our marketing list until you unsubscribe or delete your account, whichever comes first.
• Diagnostic data (performance and crash reports collected via Firebase): retained on a short rolling basis for troubleshooting — generally no longer than 90 days.
• Backups: residual copies of data in routine backups are overwritten on our provider's standard backup cycle and are not used to restore deleted accounts.
• Purchase and billing records held by Apple, Google, or Stripe are governed by their retention policies and applicable tax and accounting law; we do not control or delete them.

5.3 Deleting your account

You may delete your account at any time from within the app (Profile → Account Settings → Delete Account), or by asking us at hello@preparedtofightfire.com or through the website support form ("Privacy or data request"). When you do, we permanently erase your workout sessions and all associated set and block logs; your nutrition targets and daily nutrition logs; your notification preferences; your profile record; and your sign-in credentials. This deletion runs on our servers and is not reversible. Deleting your account also withdraws the consent you gave at sign-up for us to process your fitness and nutrition data.

Support emails you have sent us are stored separately, in our email system, and are not removed by the in-app deletion. If you want your support correspondence deleted too, tell us and we will delete it. We may retain the limited records described in 5.2 where required for legal, tax, accounting, fraud-prevention, or security purposes, and only for as long as that purpose requires.

Deleting your account does not cancel a paid subscription. Cancel through the channel you subscribed with — our website, the App Store, or Google Play — before deleting your account, or billing may continue.

[ATTORNEY REVIEW — confirm the 24-month inactivity period, the 24-month post-deletion records period, the 24-month support-correspondence period, the 90-day diagnostic window, and the backup expiry cycle. ⚠️ IMPLEMENTATION GATES, unchanged: (1) the automated 24-month inactive-account purge must be live before this policy is published (BUILT, currently DRY-RUN); (2) the 24-month support-correspondence period has no mechanism behind it — a Google Workspace retention rule (Vault is not on the current tier), a scheduled mailbox trim, or softer wording is required before publishing.]

6. Security

We use industry-standard measures, including Firebase's security infrastructure. Access to your data is restricted by authentication and server-side security rules so that you can access only your own information, and your subscription status can only be written by our servers — never claimed by a client device. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

In the event of a data breach affecting your personal information, we will notify affected users and any regulators as required by applicable law. [ATTORNEY REVIEW — conform breach-notification commitments to the Florida Information Protection Act (FIPA) and any other applicable state breach-notification statutes; confirm notification timelines.]

7. Your Rights and Choices (U.S. State Privacy Laws)

You can access, review, and update certain account information directly within the App. You may also delete your account at any time. When you request account deletion, we will delete your personal information and user-generated content, including workout history, progress data, and uploaded photos, subject to any legal, security, fraud prevention, or recordkeeping obligations that require us to retain certain information for a limited period.

Depending on your state of residence, including California and other states with applicable privacy laws, you may have additional rights regarding your personal information. These rights may include the right to:

• Know what personal information we collect, use, disclose, and retain;
• Access and obtain a copy of your personal information;
• Correct inaccurate personal information;
• Request deletion of your personal information (the "right to erasure");
• Limit or opt out of certain uses or disclosures of personal information; and
• Be free from discrimination for exercising your privacy rights.

To exercise any of these rights, please contact us at hello@preparedtofightfire.com, or use the support form on our website and choose the "Privacy or data request" category — both reach the same place. Tell us which right you are exercising and the email address on your account. We may need to verify your identity before processing your request. We will respond in accordance with applicable law.

Categories of personal information we collect (for CCPA/CPRA disclosure):

We do not collect precise geolocation, biometric identifiers, or payment card numbers. [ATTORNEY REVIEW — confirm this categories table satisfies CCPA/CPRA notice requirements (categories, sources, purposes, third parties) and add any state-specific rights/appeal language required.]

8. Consumer Health Data

Some information you provide — such as your weight, body measurements, nutrition intake, and exercise activity — may be considered "consumer health data" under certain state laws, including the Washington My Health My Data Act. We collect this information only to provide the fitness and nutrition features you request, we do not sell it, and we rely on the consent you give by agreeing to this Policy at sign-up. You may withdraw that consent at any time by deleting your account in the app, or by asking us to erase your data under §7.

This can also apply to what you tell us in a support message. If you describe an injury, a health condition, or a symptom, or attach a photo of one, that information is handled the same way as the rest of your support correspondence: stored in our email system, used only to answer you, never sold, and deleted on request. Please share only what we need in order to help.

[ATTORNEY REVIEW — the Washington My Health My Data Act (and similar laws in Nevada and Connecticut) may require a separate, standalone consumer-health-data privacy notice, a distinct consent mechanism, and specific rights (access, deletion, appeal). Confirm applicability based on where users are located and add the required standalone notice and consent flow if needed. Also confirm whether consumer health data volunteered in a free-text support message is covered by the sign-up consent. This remains the highest-priority legal item.]

9. Children's Privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it. If you believe a minor has provided us information, contact us at hello@preparedtofightfire.com.

10. Scope; Location of Processing

The Service is intended for and operated from the United States. We do not offer or target the Service to users in the European Union or the United Kingdom. If you access the Service from outside the United States, your information will be processed in the U.S., where data-protection laws may differ from those in your country.

11. Changes to This Policy

We may update this Policy. We will post the updated version with a revised Effective Date and, where appropriate, notify you in the Service or by email.

12. Contact Us

---

Open items for the attorney (v6)

1. §8 — consumer health data (WA/NV/CT): standalone notice and consent flow, unchanged and still highest priority.
2. §5.2 — the 24-month post-deletion retention of billing/tax records (new in v6); the 24-month inactive-account period; the 24-month support-correspondence period.
3. §7 — your recommended text is adopted verbatim; confirm the categories table and any state-specific appeal language.
4. §3 — "do not sell or share" with Klaviyo added as a processor for opted-in marketing.
5. §6 — FIPA breach-notification timelines, unchanged.