BAD KARMA Privacy Policy Product: bad-karma/core Version: 2.6 Effective: October 18, 2026 1. Scope BAD KARMA is operated by William Mayo LLC, a North Carolina limited liability company. William Mayo LLC is responsible for the personal information described in this policy. This Privacy Policy explains how the BAD KARMA application and related services (the "App") collect, use, store, share, and delete information. The App provides personal fitness, nutrition, and training tracking, optional AI features, and optional Crew features for groups of friends. It is a paid service, described in the Terms of Use. Some information you put in the App is health-related, such as bodyweight, measurements, food logs, and injuries you mention to AI Coach. Our Consumer Health Data Privacy Policy explains how we handle that information and the rights you have over it under Washington, Nevada, Connecticut, and similar state laws. It is linked in the App's Settings and on our website. BAD KARMA is not presented as a HIPAA covered health care provider or health plan. That does not remove other privacy, security, breach-notification, or consumer-protection duties that may apply. 2. Information you provide Account information may include your email address, display name, initials, authentication records, and account identifiers. Private fitness and wellness information may include training sessions, exercise history, Food entries, calorie and macronutrient data, bodyweight and measurements, goals, and related private settings. Food, bodyweight, and training data sync privately to cloud storage for a signed-in account. Medication and hunger tracking are turned off in this release. If your device still holds medication, hunger, or progress-photo records from an earlier version, they stay in local app storage on that device and are not synced to the cloud or shared with Crew. An export you create is controlled by you. Crew and shared information may include Crew membership and roles, display identity, training summaries you choose to share, status, chat messages, reactions, invitations, and other shared activity. Crew content is separate from private account data and is visible to authorized Crew members. If you report a message, post, comment, photo, Heckle, or person, or block another user, we store that report or block so it can be reviewed and enforced, and the app owner can see the report. Blocking someone also files a report about them. Private Heckle media is audio or video you choose to record and send to one Crew member. It is stored in private object storage until it is delivered and then expires. We keep a small delivery record (who sent it, to whom, when, and whether it was delivered, expired, or deleted) so the App can deliver Heckles and we can investigate failures. Text Heckles and Heckle replies are short messages you send to one Crew member. They are stored with Crew chat messages in our cloud database, and the App shows them only to the sender and the recipient. We can access them to run the service and to review reports. An unread text Heckle stops appearing after 72 hours. Expiry hides it; it does not delete the stored text. Replies stay stored. When either person in a text Heckle conversation deletes their account, the whole conversation, including both people's Heckles and replies, is deleted, as described in section 10. Billing information. When you subscribe, we receive your plan, its status, the trial and renewal dates, and the store that billed you. We do not receive or store your full card number. 3. Technical and security information We process information needed to operate and secure the App, such as session and authentication tokens, device or browser attributes, app version, timestamps, network and error metadata, rate-limit data, and pseudonymous security or fraud signals. We keep full private Food, bodyweight, and training data out of routine operational logs. Notifications. If you turn on notifications in the web app, we store a push subscription for your device: an endpoint address and delivery keys issued by your browser or operating system. In the iPhone app, we store an Apple device token instead. Either one identifies your device for delivery only and does not contain your name. It is removed when you turn off notifications or sign out on that device, when the push service reports that it no longer works, or when you delete your account. Lock-screen previews. A notification about a Crew chat message, text Heckle, or Heckle reply can include the first part of the message. Depending on your device settings, that text can appear on your lock screen. You can hide previews in your device's notification settings or turn off notifications in the App. 4. How information is used We use information to authenticate accounts; operate local, private, and Crew features; sync your private data; deliver Heckles and notifications; provide AI features you ask for; process subscriptions and send billing emails; keep the App reliable and secure; diagnose failures; enforce our Terms and review reports; record which Terms and Privacy versions you accepted; delete accounts; and comply with law. We do not sell personal information. We do not use your health, fitness, or nutrition information for advertising, and we do not share it with advertisers or data brokers. 5. Cloud storage, local storage, and backups Some data stays in browser or installed-app storage on your device. Your private Food, bodyweight, and training data syncs to private cloud database records. Shared Crew data is stored in the cloud so authorized Crew members can use it. Private Heckle media is stored in private object storage. To prevent data loss and settle sync conflicts, the App keeps backup copies and earlier versions of your synced data. These copies are deleted with your account. Our database provider also keeps short-term backups of the whole database for disaster recovery. Deleted data can remain in those backups until they are overwritten on the provider's schedule. We do not restore deleted accounts from them. 6. Service providers and disclosures We use service providers to run the App. They process information for us under their agreements with us. Supabase provides authentication (including the emails that carry your sign-in and deletion codes), the cloud database, and private object storage. Cloudflare provides app hosting, network delivery, and the servers that relay some requests described below. Anthropic provides the AI features described in section 7. Sentry receives crash and diagnostic reports, described below. Google Fonts delivers the App's typefaces, so Google receives your device's IP address when fonts load. Spotify provides the embedded player if a Crew adds a playlist, and Spotify's own privacy policy applies to that player. Open-source libraries for barcode scanning and label text reading load from the jsDelivr and Project Naptha content networks, which receive your device's IP address when they load. GIF search. When you search for a GIF or open trending GIFs, the search text is sent to our server, which relays it to Giphy with a fixed PG-13 content rating. Giphy returns results, and GIFs you view or send load from Giphy, which receives your device's IP address. We do not send your name, email, or account ID to Giphy. Food search. When you search for a food, the search text is sent to our server, which relays it to Open Food Facts, an open food database. Barcode lookups and some fallback searches go from your device directly to Open Food Facts, which receives your device's IP address. Generic food nutrition data in the App is based on USDA FoodData Central reference data from the United States Department of Agriculture. We do not send your name, email, or account ID to Open Food Facts or USDA, and we do not store your food search text against your account. Payments on the web. Stripe processes web subscriptions for us. We send Stripe your BAD KARMA account ID, not your name. At checkout you give Stripe your email address and payment details directly, so Stripe can charge you, manage your subscription, and send receipts and billing emails. Stripe handles card details under its own privacy policy. Purchases in the iPhone app. Apple processes App Store purchases under its own terms and privacy policy. We use RevenueCat to confirm Apple purchases and keep your plan status current. RevenueCat receives your BAD KARMA account ID (a random identifier, not your name or email) and the App Store purchase records for this App. When you delete your account, we ask RevenueCat to delete its record of you. Notification delivery. Web notifications are delivered through the push service run by your browser or device maker (for example Apple, Google, or Mozilla). iPhone app notifications are delivered through the Apple Push Notification service. These services receive the device address and the notification content needed to deliver each alert. Crash and diagnostic reports. When the App hits an error, it sends a short report to Sentry, a service we use to find and fix bugs. We also send Sentry a short report when a data backup stalls or keeps failing, and when a barcode scan cannot start the camera or runs too long without a read. A report holds the type of problem, a short message, the part of our code involved, the app version, the screen you were on, and your browser and device type. Reports are built to leave out your name, email, account ID, Crew, food, workouts, weights, messages, photos, and the web address you were on. We filter error text to remove common identifiers such as email addresses, but automatic filtering cannot guarantee that every personal detail is removed. We ask Sentry not to store your IP address. Other disclosures. We may disclose information when required by law, to protect rights or safety, to investigate abuse or security incidents, or as part of a business transfer subject to applicable protections. Crew content is shared with authorized members as directed by the feature and your actions. Private account data does not become Crew content because you belong to a Crew. 7. AI Features AI Coach and AI Food are part of the Core + AI plan and run on Anthropic's Claude API. When you use them, we send Anthropic your request and the app information needed to answer it. What is sent. Your prompts and the earlier messages in that conversation. Coach memory notes you saved. Images you submit to AI Food, after we strip their original metadata. Depending on the feature, the App also adds relevant context such as your training program, workout history, adherence, nutrition and body-composition summaries, recovery information already recorded in the App, and goals. Anything you type, including details about an injury or your health, is sent as you wrote it. What is left out. When the App builds that context automatically, it leaves out medication and hunger records, Crew content (including chat messages and Heckles), progress photos, private notes other than Coach memory notes, email addresses, authentication tokens, internal account identifiers, and billing information. Anthropic keeps API inputs and outputs for a limited time, currently up to 30 days under our account settings, with narrow exceptions for legal, safety, and security reasons under its own policies. Anthropic does not use commercial API data to train its models by default. Anthropic may process requests in the United States or other countries. AI Coach can suggest changes to your training plan. A suggestion changes nothing until you review it and tap Apply, and you can undo it. AI Coach only changes your plan from today forward and never edits past workouts, Food, or Crew data. AI Food produces a proposal that you must review and apply before your nutrition log changes. Coach memory. If you ask AI Coach to remember something, such as a goal, your schedule, your equipment, or something to work around like a sore shoulder, we store that note privately with your account and send it to Anthropic with your AI Coach requests. You can see, edit, and delete these notes in Settings, and they are deleted with your account. Usage records. To enforce the monthly and daily AI limits in the Terms, we keep a record of each AI request's cost and date, tied to a coded version of your account ID rather than your name. 8. Billing records Stripe and Apple hold the payment details for purchases they process. We keep a record of your plan, its status, and its trial, renewal, and end dates so the App knows what access you have. Before a web trial or plan starts, the App shows the plan, the price, the date of the first charge or renewal, and how to cancel. If you subscribe on the web, Stripe sends you emails for us: a reminder before a free trial ends, a reminder before an annual plan renews, and a receipt for each payment. Apple sends receipts for purchases made in the iPhone app. 9. Retention We keep information for as long as your account is open and you need it for the App, then as follows: Billing and tax records: 7 years after the transaction, because tax and accounting law requires it. Security, fraud, and abuse-report records, including a copy of the reported content: 12 months after the event or the end of the investigation, even if the reported person deletes their account. The record that confirms an account deletion finished: 30 days. Records of which Terms and Privacy versions you accepted, and when: kept after your account is deleted as proof of what you agreed to, linked to a coded identifier instead of your name, email, or account. Database disaster-recovery backups: until overwritten on our provider's schedule, as described in section 5. Technical records about our database structure that do not identify anyone may be kept indefinitely. Local data on your device stays until you reset it, import replacement data, clear app storage, or lose that storage. 10. Account deletion and device reset Reset this device removes or replaces local app state according to the screen shown before you confirm. It does not delete your account or your cloud data, backups, Crew content, or private media. Cloud data may sync back after you sign in again. Export anything you need before resetting. You can delete your account in the App: Settings, Account & privacy, Delete account. You confirm with a code sent to your email and by typing DELETE. Deletion signs you out everywhere and deletes: your login and profile; your private cloud data, including synced food, bodyweight, and training data and their backup copies; Coach memory notes and AI conversation history stored with your account; your Crew posts (shared workouts, PRs, cardio, rolls, and activities, with their captions, photos, and the comments and reactions on them) and every comment you wrote; your Crew chat messages, text Heckles, and Heckle replies, and every text Heckle conversation you were part of, including the other person's Heckles and replies; your photos, videos, and voice Heckles, which are removed from storage; your karma, reactions, votes, blocks, the reports you filed, notification settings, device tokens, and Crew memberships. If you own a Crew, ownership passes to the member who has been in it longest. A Crew with no other members is deleted. Results already recorded for past weeks and finished seasons keep their placements without your name or account link, and the current week is recalculated without you. We keep only what the law requires or allows us to keep after deletion: billing and tax records; security and abuse-report records, including reports other users filed about your content and a copy of that content so we can act on them; records of the Terms and Privacy versions you accepted; and the deletion confirmation record, for the periods in section 9. We also ask RevenueCat to delete its record of you. Subscriptions. Deleting your account cancels a web subscription billed through Stripe, without a refund for the rest of the paid period. You do not need to cancel it first. If a renewal is charged after you delete your account but before the cancellation reaches Stripe, we refund that charge. It does not cancel a subscription bought through Apple. To stop Apple charges, cancel in your iPhone Settings, under your name, then Subscriptions. 11. Your choices and rights You can view the current Terms and Privacy versions in Settings, export your app data, change optional settings, turn notifications on or off, sign out, reset this device, and delete your account. You choose whether to share specific Crew content and whether to send a Heckle. You choose whether to use AI features. The in-app export covers app data stored on your device. A self-serve export of cloud-synced data is not yet available. You can request a copy of your cloud-synced data or the Crew content you posted by emailing us. Depending on where you live, you may have the right to know what personal information we hold, to get a copy of it, to correct it, to delete it, and to withdraw consent you gave. Washington, Nevada, and Connecticut residents have specific rights over consumer health data, explained in our Consumer Health Data Privacy Policy. To make a request, email us from the address on your account. We may need to confirm your identity before acting. We answer within 45 days, and we will tell you if we need more time. If we decline your request, you can appeal by replying to our answer. We will not treat you differently for using these rights. If you believe someone under 18 is using the App, or that we have information about a child, email us. We will look into it and delete the account and its data if we confirm it. 12. Security We use access controls, private storage, database rules that limit each person to their own records, minimized server privileges, and other safeguards appropriate to the service. No storage or transmission method is completely secure. If a security breach affects your personal information, we will notify you, and regulators where required, as the law requires. That includes notice under the FTC Health Breach Notification Rule if it applies. 13. Children The App is for adults only. You must be at least 18 years old, or the age of majority where you live if higher. We do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we delete it. 14. Where information is processed We and our service providers may process information in the United States and other countries, which may have different data protection laws than where you live. We use providers that protect information under their agreements with us and applicable law. 15. Changes to this policy When we make a material change to this policy or the Terms, we publish a new version number and ask you to accept it in the App before you continue. The App records which version you accepted and when. Continuing to use the App, or having accepted an earlier version, does not count as accepting a new one. 16. Contact William Mayo LLC. Questions and privacy requests can be sent to support@badkarmatraining.com.