Privacy policy

This site is run by W. Grady, trading as VanityStrong ("we", "us", "our"). For the personal data described here, W. Grady is the data controller — the party that decides what is collected and what it is used for. To make a request, contact info@vanitystrong.com or use the form on our support page.

Each category below lists the purpose and the legal basis we rely on.

• Account details — name, email address, password (stored hashed, never in readable form). Used to create and secure your account and let you sign in. Basis: performance of your contract with us.
• Preferences — units, language, timezone, equipment, workout location, goals, preferred session length, dietary style, and accessibility settings. Used to present programs and plans that fit your life. Basis: contract, and legitimate interests in making the product useful.
• Purchase records — what you bought, when, the amount, and the order reference. Used to grant permanent access, deliver receipts, and handle refunds and disputes. Card details are collected and held by our Merchant of Record, Paddle, not by us. Basis: contract, and legal obligation for tax and accounting records.
• Progress you choose to record — workouts completed, measurements, strength logs, photos, notes. Used to build your charts, milestones, and history. Basis: contract, and your consent where you choose to log sensitive items.
• Health-related answers — only where a tool genuinely needs them to keep a recommendation safe, such as a screening questionnaire. Used for safety screening and to avoid recommending something inappropriate. Basis: explicit consent, which you can withdraw.
• Support messages and quiz answers — whatever you send us. Used to answer you and improve the product. Basis: legitimate interests, and contract where it concerns your order.
• Free guide signups — your email and first name when you take a printable guide, so we can deliver it. Basis: consent.
• Email tips sign-up (optional) — only if you tick the box on a guide form: your email, language, the page you signed up from, the time, the exact consent wording you agreed to, and your subscription status. Nothing is sent until you confirm by clicking the link in a confirmation email. Up to 2 emails per week of training and meal tips plus occasional offers; unsubscribe anytime from any email, without logging in. Unsubscribing never affects guide downloads, receipts or account emails. Basis: consent.
• Technical and usage data — IP address, browser and device type, pages viewed. Used to prevent abuse, diagnose faults, and keep the platform secure. Basis: legitimate interests in security.

This is a hard rule, not an aspiration. Detailed health answers — conditions, medications, allergies, intolerances, and anything similar — are never sent to advertising platforms, marketing pixels, or general analytics tools. Advertising and analytics receive no medical-condition data of any kind.

We only ask for health information where it genuinely changes what we can safely recommend, and we store it separately from ordinary profile data, with restricted access and controlled retention.

• Our Merchant of Record, Paddle — for the sale of the product, checkout and payment processing, tax compliance, invoicing, receipts, refund handling, and any future subscription management.
• Service providers and sub-processors — hosting and database infrastructure, email delivery, support tooling, and analytics, each under contracts that restrict what they may do with your data and prohibit using it for their own purposes.
• Professional advisers — lawyers and accountants, where they need to see it to advise us.
• Authorities and courts — where we are required by law, or to defend or protect legal rights.

We do not sell your personal data, and we do not license it for advertising.

Marketing email is opt-in and every message carries an unsubscribe link. Where we measure performance, we do it with aggregate and non-medical data. Withdrawing marketing consent never affects access to products you have bought.

We are transparent about using AI to assemble and personalise plans from an approved framework, a controlled recipe database, and controlled health-restriction rules. AI does not invent nutrition advice from scratch here, and it is not a doctor or a registered dietitian. Personalised output is generated for you and is not shared with other customers or used for advertising.

Account and preference data is kept while your account is open. Progress records are kept while your account is open and for a short window after a cancellation or deletion request, so you can change your mind. Purchase and transaction records are kept for as long as tax and accounting law requires, which in most regions is five to seven years. Marketing consent data is kept until you withdraw it. When data is no longer needed for any of these purposes, it is deleted or anonymised so it can no longer be linked to you.

You can ask to access your personal data, correct it, export it in a usable format, restrict or pause processing, object to processing, or delete your account and everything in it. Where processing rests on consent, you can withdraw consent at any time. Requests are handled promptly and normally within 30 days, at no charge; occasionally we need to verify who you are first. Deletion is subject only to records we are legally required to retain, such as transaction history. If you are in the UK or the EEA you also have the right to complain to your data protection authority, and we will tell you which one if you ask.

Our infrastructure is hosted in the United States, so personal data is processed there. Where your data is covered by UK or EEA law and leaves that region, we rely on recognised transfer safeguards, such as Standard Contractual Clauses, together with the security measures described below.

We use strictly necessary cookies and local storage so you can sign in and stay signed in, and so your preferences persist between visits. Those cannot be turned off without breaking sign-in. If we add analytics or marketing cookies later, they will be off until you opt in, and this page will say what each one does and how to change your choices.

Data is encrypted in transit and at rest, access is limited to what a person's role actually requires, and health intake is stored separately from ordinary profile data with its own access rules. No system is perfect, but these are the technical and organisational measures we maintain.

VanityStrong is intended for adults. We do not knowingly collect data from anyone under 18.

If this policy changes materially, the date at the top changes and we announce it on the site — and if you have an account, by email.

We use two optional analytics tools, and only if you choose Allow analytics. Until you choose, and if you choose Reject analytics, neither tool is loaded and no data is sent to them.

• Microsoft Clarity (Microsoft) records how pages are used — clicks, scrolling, mouse movement, and page and device details — and can create session replays and heatmaps. It sets its own cookies. Clarity masks sensitive input by default, and we do not send it health or intake answers. See Microsoft's privacy statement at privacy.microsoft.com.
• Ahrefs Web Analytics (Ahrefs) measures visits, pages viewed, referring sites, and approximate country and device type. See ahrefs.com/legal/privacy-policy.

Your choice is stored in your browser. You can change it at any time with the Privacy choices link at the bottom of every page. If you withdraw consent, we tell Clarity that consent is denied, ask it to erase its cookies, and stop loading both tools on later pages. Data already collected is handled under each provider's own retention terms.

We use the Pinterest Tag, a third-party analytics and advertising tool from Pinterest, only if you choose Allow analytics. It is not loaded before you choose, and it stays off if you choose Reject analytics.

When allowed, the Pinterest Tag can record page visits and other interaction or conversion events that we may configure, to help us measure how our Pinterest ads perform, attribute visits and purchases to campaigns, build and reach audiences (including retargeting), and improve campaigns. Pinterest may process identifiers, device, browser and network information, the referring page, the page visited and event details under its own privacy policy: policy.pinterest.com/privacy-policy.

We do not currently use Pinterest Enhanced Match, and we do not send your email address or health or intake answers to Pinterest. You can change your choice at any time with the Privacy choices link at the bottom of every page; after you withdraw consent the tag is no longer loaded on later pages. Data already collected is handled under Pinterest's own terms.

We use the Meta Pixel, a third-party analytics and advertising tool from Meta Platforms (Facebook and Instagram), only if you choose Allow analytics. It is not loaded before you choose, and it stays off if you choose Reject analytics.

When allowed, the Meta Pixel can record page visits and other interaction or conversion events that we may configure, to help us measure how our Facebook and Instagram ads perform, attribute visits and purchases to campaigns, build and reach audiences (including retargeting), and improve campaigns. Meta may process identifiers, cookies, device, browser and network information, the referring page, the page visited and event details under its own privacy policy: www.facebook.com/privacy/policy.

We do not currently use Meta advanced matching, and we do not send your email address or health or intake answers to Meta. You can change your choice at any time with the Privacy choices link at the bottom of every page; after you withdraw consent the pixel stops sending events. Data already collected is handled under Meta's own terms.