Consumer health data privacy policy

What we collect and why

In this release the product holds an account only: your email address, taken at sign-up to run your account, your password in a form that cannot be read back, the time you confirmed that you are 18 or older, the version of the terms you accepted, the consents you gave or withdrew, and, if you sign in with Google, the record of that sign-in method. No health data is collected today.

As each part of the product opens, we will collect these kinds of health data, each only after you agree to it, one kind of data and one use at a time:

• Your profile (name, sport, goals): to address you and to fit the coaching to you.
• Health intake answers and clearances (the pre-screen questionnaire, and a clinician's clearance recorded as its type, date and scope): to decide which training is open to you and which waits.
• Training, food, sleep and session logs that you enter: to plan and adjust your training.
• Training clips that you will upload, with faces blurred on your device before upload: for your coach's review and for form analysis.
• Measurements taken from your clips and your contact and sparring exposure log: to coach you and to hold rest periods.

We will use each kind of data only for the purpose you agreed to. Every time data is used or sent anywhere, the product checks that your consent still stands. If the wording of a consent changes, we ask you again.

Where it comes from

From you: what you type and upload. From your invited coach, when that seat opens: notes, cues, holds and sign-offs. From the device you will upload with: a clip's timing and frame rate. Nothing comes from any other company.

How the data is processed

Your data is held in one database on a server in the United States that Manic Agency LLC rents from Akamai. Its disk is encrypted, and so are the backups. It is handled by Swolski's own software. Where a company named below processes it, that company does so for that purpose and no other.

Who we share it with and why

• Your coach, when you invite one: any of the kinds above that you agree to share, so your coach can review your training, set holds and approve harder work, for as long as the coach's seat is active.
• Resend (Plus Five Five, Inc.), which delivers the mail this product sends you. It receives your email address and the messages sent to it. Its privacy contact is privacy@resend.com.
• Cloudflare, which carries the connection between you and our server, and stores our encrypted backups. It receives everything you send to and receive from the product, on its way, and the backups, which it cannot read. Its privacy contact is privacyquestions@cloudflare.com.
• Akamai Cloud (formerly Linode), which runs the server the product and its database are on. It receives everything the product stores, on the disk of the server it runs. Its privacy contact is https://www.akamai.com/legal/dpr.
• Google Workspace (Google LLC), which hosts the mailbox behind our contact address. It receives the messages you send to our contact address, and our replies. Its privacy contact is https://support.google.com/cloud/contact/dpo.
• Google sign-in (Google LLC), which signs you in with your Google account, if you choose that. It receives that you signed in to this product with your Google account, and when. Its privacy contact is https://support.google.com/cloud/contact/dpo.
• When paid plans open: Stripe (Stripe, Inc.), which takes your payment when you buy a plan. It receives your email address, the amount, a reference to your account that is not your name, and, on its own page, your billing address and card details; with each payment's record Stripe shows us the billing name and address and the card's brand and last digits, which we read and do not keep; the card's number never reaches us. Its privacy contact is privacy@stripe.com.
• AI providers, under written contracts that forbid training on your data: to produce your coaching from the logs and clips you agree to send. None receives anything in this release, and each one is named here, with the kinds it receives, before it does.

We share consumer health data with no affiliate. We do not sell it. We use no advertising or analytics software that can see it.

Your rights and how to use them

You can use each of these rights in your account, or by writing to team@manic.agency from the address of your account.

• See what we hold. The export gives you everything in your account, and names each company that received any of it with its privacy contact.
• Correct something. Write to us and say what is wrong. As each part opens, you will be able to change its entries in your account.
• Withdraw a consent. It takes effect at once, and work that was waiting on it is cancelled.
• Delete your account and data. We ask for your password again, sign you out everywhere, tell each company that keeps records under your address to delete them, and erase your account, within 30 days at the latest and usually within minutes. Before anything is erased we write to you to confirm the request and to say what remains after it and for how long.

What remains after a deletion:

• Resend, which delivers our mail, keeps its delivery record of the messages we sent you for up to 30 days.
• Cloudflare, which carries the connection between you and our server, keeps its own record of that traffic, such as your IP address, under its own privacy policy, which names no fixed period (https://www.cloudflare.com/privacypolicy/).
• Akamai, which runs our server, keeps no copy of your data beside it, so the erasure removes your data there too.
• Google, which hosts the mailbox behind our contact address, holds the messages you sent to that address and our replies until we delete them from the mailbox.
• Google, if you signed in with it, keeps its own record of that sign-in under your Google account, where you can see and remove it.
• Stripe keeps the records of payments you made for as long as its legal duties require.
• Our encrypted backups are kept for 180 days and then destroyed. If we ever restore from a backup, your data is deleted again before the service reopens, and the copy that the restore replaced is destroyed within 7 days.
• Our correspondence with you in the contact mailbox, which we delete within the same 30 days.

We answer every request within 45 days. If we need longer for a request other than a deletion, we tell you why inside those 45 days and finish within 45 more. A deletion is never extended. If you disagree with how we handled a request, write to team@manic.agency: we review it again and answer in writing, with our reasons, within 45 days. If you are still not satisfied, you can file a complaint with the Attorney General of your state: Washington at atg.wa.gov/file-complaint, Nevada at ag.nv.gov.

No tracking across sites

No advertising, analytics or tracking company collects your health data, or any data about you, across sites when you use Swolski. The public pages count visits with analytics software that Manic Agency LLC runs on its own server, as the privacy policy describes. It never runs on a page that asks for or shows health data, and it recognises no one across sites or across days.

Changes to this policy

We email every account holder about a material change at least 30 days before it takes effect, and we ask for your consent again before any new kind of data is collected or used for a new purpose. The version number and the effective date at the top change with each revision. The lines marked "When paid plans open" take effect on a day that will be mailed to account holders at least 30 days ahead.

How to reach us

team@manic.agency. Swolski is operated by Manic Agency LLC, 2831 St Rose Parkway, Suite 200, Henderson, NV 89052, United States.