WEIGHT COMMIT PRIVACY POLICY
1. WHO WE ARE
Weight Commit is operated by the company that runs this service. Contact information is available in your account settings and on the Your Privacy Choices page in the legal section.
2. WHAT WE COLLECT
Account information you provide: email, password (stored hashed, never in plain text), display name, age, sex, height, starting weight, goal weight, and other profile data you choose to enter.
Health data you log: body weight, medication name, dose, injection time and site, reported side effects, bloodwork results, sleep duration and quality, food and macro entries, supplement logs, workout details, and optional progress photos.
Technical data automatically collected: IP address, browser type, device info, and log files. Logs are retained for 30 days for security and debugging.
Consent records: which terms and consents you have agreed to, the version and exact text shown, the moment you viewed it, the moment you accepted it, and the IP and user agent.
3. HOW WE USE YOUR DATA
We use your data only to operate the service for your personal use. This includes visualizing your data, calculating macros, computing trends, showing patterns across your logs, and sending you transactional emails (password resets, billing receipts, security alerts, account deletion confirmations). We do not make medical recommendations or substitute for a healthcare provider.
4. WHAT WE DO NOT DO
We do not sell your data. We do not share your data with data brokers. We do not use your data for advertising or behavioral profiling. We do not use your data to train artificial intelligence or machine learning models. We do not share your data with any third party except as required to operate the service for you.
5. WHO HAS ACCESS
Only you have access to your data through your authenticated session. Our infrastructure providers (hosting, database, transactional email, error monitoring, product analytics, DNS) have only the minimum access required to operate the service. They do not have unrestricted access to your account contents. A current, public list of every processor we use, the purpose, and the category of data they touch is published on the Processors page in the legal section.
6. HOW LONG WE KEEP YOUR DATA
We retain your data for as long as your account is active. After you close your account, all your data is permanently deleted within 30 days. We may retain consent records for up to 7 years after account closure to demonstrate regulatory compliance, but those records are anonymized to your hashed user ID and contain no identifying personal information.
7. SECURITY
We use industry-standard encryption: HTTPS in transit and encryption at rest. Your data is segregated by user account at the database level. Sensitive content like progress photos is delivered via short-lived signed URLs that expire within an hour. Direct URL guesses, anonymous reads, and access by other users are blocked at multiple layers.
8. YOUR RIGHTS
You may at any time view all data we hold about you, export a JSON copy of your data from Settings, delete individual entries, delete your entire account, update your profile information, withdraw any consent you previously gave (with disclosed consequences), or contact us with questions.
9. CHILDREN
We do not knowingly collect data from anyone under 18 years of age. If we learn we have inadvertently collected data from a minor, we will delete it as soon as we become aware.
10. CHANGES TO THIS POLICY
We may update this policy from time to time. We will notify you in-app of any material changes. Continued use after notice constitutes acceptance of the updated policy.
11. CONTACT
For questions about this policy or your data, please contact us via the support address shown in your account settings or on the Your Privacy Choices page.
12. CALIFORNIA RESIDENTS (CCPA AND CPRA)
If you are a California resident, you have specific rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act. This section applies in addition to the rest of this policy.
CATEGORIES OF PERSONAL INFORMATION WE COLLECT.
- Identifiers: email address, account identifier, IP address.
- Customer records: profile fields you choose to enter (age, sex, height, starting weight, goal weight).
- Internet or other electronic network activity: pages viewed, features used, log timestamps.
- Sensitive personal information: health data, including body weight, medication name and dose, injection time and site, reported side effects, sleep, food and macro entries, supplement logs, workout details, bloodwork results, and optional progress photos.
CATEGORIES OF SOURCES.
We collect personal information directly from you when you sign up and when you use the service. We also collect technical information automatically from your device (IP address, browser type, log timestamps).
BUSINESS PURPOSES.
We use your personal information solely to operate the service for you: maintain your account, store the data you log, render visualizations, send transactional emails, secure the service against abuse, and comply with legal obligations.
CATEGORIES OF THIRD PARTIES WITH WHOM WE SHARE PERSONAL INFORMATION.
We share information only with the service providers required to operate the service: our hosting provider, our database provider, our transactional email provider, our error-monitoring provider, our product analytics provider, and our DNS provider. The current public list of every processor, the purpose, the category of data they touch, and the jurisdiction is published on the Processors page in the legal section. Each is bound by contract to use your information only on our instructions and to delete it when no longer needed.
NO SALE, NO SHARING FOR CROSS-CONTEXT BEHAVIORAL ADVERTISING.
We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We have not done either of these things in the past twelve months and we do not plan to do so.
LIMITATIONS ON USE OF SENSITIVE PERSONAL INFORMATION.
You have the right to limit our use of your sensitive personal information (your health data) to what is necessary to provide the service you requested. We already restrict our use of your sensitive personal information to that purpose. We do not infer characteristics about you from your sensitive information, do not use it for marketing or advertising, and do not retain it for any purpose other than operating the service.
GLOBAL PRIVACY CONTROL.
Weight Commit honors the Global Privacy Control (GPC) browser signal. If your browser sends a GPC header during signup, we record the signal in your account and treat it as a standing opt-out of any future sale or sharing of your information. We have nothing to opt out of today because we do not sell or share information, but the signal is recorded so that if our practices ever change, you remain opted out automatically.
YOUR RIGHTS UNDER CCPA AND CPRA.
- Right to know what personal information we collect about you, how we use it, and with whom we share it.
- Right to delete your personal information (subject to limited exceptions for legal compliance and service security).
- Right to correct inaccurate personal information.
- Right to opt out of the sale and sharing of personal information (already honored by default).
- Right to limit use of sensitive personal information (already honored by default).
- Right to non-discrimination: we will not charge you more, give you a lesser service, or otherwise penalize you for exercising any of these rights.
HOW TO EXERCISE YOUR RIGHTS.
Visit Your Privacy Choices in the legal section, or open Settings then Privacy. You can export your data, delete individual entries, or close your account from the same place. Account closure deletes all your personal information within 30 days, which satisfies any deletion request.
AUTHORIZED AGENTS.
If you authorize someone else to make a request on your behalf, we will ask the agent to demonstrate written authorization and ask you to verify your identity directly with us before we act on the request.
NO FINANCIAL INCENTIVES.
We do not offer financial incentives in exchange for personal information.
VERIFICATION AND TIMING.
We verify requests by confirming control of the email address on the account. We respond to requests within 45 days, with one 45-day extension if needed and disclosed to you in writing.