Privacy Policy

1. Information We Collect

a. Account and profile information:

• First name and last name
• Email address
• Password credential for account access, handled by our authentication provider
• Profile picture, if you upload one
• Timezone and push notification token, if your device provides them

b. Trainer and client activity data:

• Messages between trainers and clients
• Scheduling, session, and request history
• Assigned workouts, habits, questionnaires, nutrition items, and progress history
• Profile details, goals, notes, and uploaded content you choose to provide

c. Payments and communications:

• Payment and subscription information needed to process paid services
• Email and transactional communication data needed to send account or service messages

d. Website, analytics, and advertising information:

• Page visits, button interactions, browser type, device information, IP address, and referrer information
• Cookie and device identifiers, including Meta _fbp and _fbc identifiers
• Advertising click and campaign parameters, including fbclid and approved UTM parameters
• Account registration, subscription-checkout, trial-start, and first-paid-subscription events
• Hashed trainer email, name, and account identifiers used for advertising measurement and matching

2. How We Use Your Information

• To create and manage trainer and client accounts.
• To let trainers and clients communicate and share assigned content.
• To operate workouts, nutrition, habits, questionnaires, scheduling, and progress tracking.
• To process subscriptions, payments, and related receipts where applicable.
• To send account, login, support, and notification messages.
• To maintain security, prevent abuse, and improve the app.
• To measure advertising performance, attribute registrations and trials, create advertising audiences, and improve ad delivery.
• To understand product usage and diagnose problems through analytics and privacy-masked session replay.

3. Information Sharing

a. We do not sell your personal information.

b. Information is shared between trainers and clients only as needed for their use of the BULK app.

c. We may share data with service providers that help us operate BULK, such as hosting, authentication, notifications, email delivery, and payment processors. Those providers may process data only to provide services to BULK.

d. We use Meta Pixel and Meta Conversions API for advertising measurement, attribution, retargeting, and ad delivery; Google Ads for advertising measurement; and PostHog for product analytics and privacy-masked session replay. These providers may receive cookie or device identifiers, network information, generic website or conversion activity, and the limited matching information described above.

e. We may also retain or disclose information where required by law, regulation, legal process, or to protect the safety, rights, or security of BULK and its users.

4. Data Retention

a. We keep account, profile, messaging, scheduling, assignment, progress, and payment-related data for as long as your BULK account remains active and as long as it is needed to provide the app's services to you.

b. If you stop using BULK but do not delete your account, we may continue to retain your data until you delete the account or request deletion, so that you can return to the service and continue using your account.

c. After an account deletion request, we delete or de-identify data from BULK's active systems unless we need to keep limited information for legal, security, fraud prevention, tax, accounting, dispute resolution, or compliance purposes, or where a payment provider is required to retain transaction records under its own legal obligations.

d. Marketing attribution is retained for up to 90 days. IP address and browser user-agent information retained specifically for Meta conversion matching is removed after a confirmed trial event or within 24 hours. Conversion deduplication and delivery records are retained until the associated trainer account is deleted.

5. Data Deletion

a. You can request deletion of your BULK account directly inside the mobile app through the account settings delete flow.

b. If you cannot access the app, you can request deletion by emailing anthony@bulkapp.io.

c. When an account deletion request is completed, BULK deletes the account authentication record, profile image, and associated trainer or client records in our primary database, including related messaging, scheduling, assignments, and other dependent records linked to that account in BULK's systems.

d. We may retain limited records after deletion where necessary for legal compliance, security, fraud prevention, payment recordkeeping, or internal records relating to the deletion request itself.

6. Data Security

a. We use reasonable technical and organizational safeguards designed to protect your data against unauthorized access, disclosure, alteration, and destruction.

b. Communications between the app and our supporting services are encrypted in transit.

7. Advertising Tracking and Your Choices

a. At initial launch, advertising and analytics tracking is enabled by default on approved BULK website and signup surfaces without a separate cookie-consent prompt.

b. You can limit advertising tracking through browser cookie controls, ad-blocking tools, Meta and Google advertising preferences, and device privacy controls. You may also contact us to request that we stop using your personal information for BULK direct-marketing purposes.

c. Meta tracking is deliberately excluded from authenticated product pages containing client, workout, nutrition, message, progress, questionnaire, habit, or similar coaching information.

8. Changes to This Policy

a. We may update this Privacy Policy from time to time. Changes may be communicated in the app or by email.

9. Contact Information

a. For questions, privacy requests, or deletion requests, contact anthony@bulkapp.io.

10. International Processing

BULK and its service providers may process information in Australia, the United States, Europe, and other countries where they operate. Privacy protections and access rights may differ between countries.