Privacy policy

This site is run by W. Grady, trading as VanityStrong ("we", "us", "our"). For the personal data described here, W. Grady is the data controller — the party that decides what is collected and what it is used for. To make a request, contact info@vanitystrong.com or use the form on our support page.

Each category below lists the purpose and the legal basis we rely on.

• Account details — name, email address, password (stored hashed, never in readable form). Used to create and secure your account and let you sign in. Basis: performance of your contract with us.
• Preferences — units, language, timezone, equipment, workout location, goals, preferred session length, dietary style, and accessibility settings. Used to present programs and plans that fit your life. Basis: contract, and legitimate interests in making the product useful.
• Purchase records — what you bought, when, the amount, and the order reference. Used to grant permanent access, deliver receipts, and handle refunds and disputes. Card details are collected and held by our Merchant of Record, Paddle, not by us. Basis: contract, and legal obligation for tax and accounting records.
• Progress you choose to record — workouts completed, measurements, strength logs, photos, notes. Used to build your charts, milestones, and history. Basis: contract, and your consent where you choose to log sensitive items.
• Health-related answers — only where a tool genuinely needs them to keep a recommendation safe, such as a screening questionnaire. Used for safety screening and to avoid recommending something inappropriate. Basis: explicit consent, which you can withdraw.
• Support messages and quiz answers — whatever you send us. Used to answer you and improve the product. Basis: legitimate interests, and contract where it concerns your order.
• Free guide signups — your email and first name when you take a printable guide, so we can deliver it and, if you asked, send further emails. Basis: consent.
• Technical and usage data — IP address, browser and device type, pages viewed. Used to prevent abuse, diagnose faults, and keep the platform secure. Basis: legitimate interests in security.

This is a hard rule, not an aspiration. Detailed health answers — conditions, medications, allergies, intolerances, and anything similar — are never sent to advertising platforms, marketing pixels, or general analytics tools. Advertising and analytics receive no medical-condition data of any kind.

We only ask for health information where it genuinely changes what we can safely recommend, and we store it separately from ordinary profile data, with restricted access and controlled retention.

• Our Merchant of Record, Paddle — for the sale of the product, checkout and payment processing, tax compliance, invoicing, receipts, refund handling, and any future subscription management.
• Service providers and sub-processors — hosting and database infrastructure, email delivery, support tooling, and analytics, each under contracts that restrict what they may do with your data and prohibit using it for their own purposes.
• Professional advisers — lawyers and accountants, where they need to see it to advise us.
• Authorities and courts — where we are required by law, or to defend or protect legal rights.

We do not sell your personal data, and we do not license it for advertising.

Marketing email is opt-in and every message carries an unsubscribe link. Where we measure performance, we do it with aggregate and non-medical data. Withdrawing marketing consent never affects access to products you have bought.

We are transparent about using AI to assemble and personalise plans from an approved framework, a controlled recipe database, and controlled health-restriction rules. AI does not invent nutrition advice from scratch here, and it is not a doctor or a registered dietitian. Personalised output is generated for you and is not shared with other customers or used for advertising.

Account and preference data is kept while your account is open. Progress records are kept while your account is open and for a short window after a cancellation or deletion request, so you can change your mind. Purchase and transaction records are kept for as long as tax and accounting law requires, which in most regions is five to seven years. Marketing consent data is kept until you withdraw it. When data is no longer needed for any of these purposes, it is deleted or anonymised so it can no longer be linked to you.

You can ask to access your personal data, correct it, export it in a usable format, restrict or pause processing, object to processing, or delete your account and everything in it. Where processing rests on consent, you can withdraw consent at any time. Requests are handled promptly and normally within 30 days, at no charge; occasionally we need to verify who you are first. Deletion is subject only to records we are legally required to retain, such as transaction history. If you are in the UK or the EEA you also have the right to complain to your data protection authority, and we will tell you which one if you ask.

Our infrastructure is hosted in the United States, so personal data is processed there. Where your data is covered by UK or EEA law and leaves that region, we rely on recognised transfer safeguards, such as Standard Contractual Clauses, together with the security measures described below.

We use strictly necessary cookies and local storage so you can sign in and stay signed in, and so your preferences persist between visits. Those cannot be turned off without breaking sign-in. If we add analytics or marketing cookies later, they will be off until you opt in, and this page will say what each one does and how to change your choices.

Data is encrypted in transit and at rest, access is limited to what a person's role actually requires, and health intake is stored separately from ordinary profile data with its own access rules. No system is perfect, but these are the technical and organisational measures we maintain.

VanityStrong is intended for adults. We do not knowingly collect data from anyone under 18.

If this policy changes materially, the date at the top changes and we announce it on the site — and if you have an account, by email.