Privacy Policy

Introduction

Welcome to ZeroPhase ("we," "us," or "our"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you visit our website at https://zerophase.app and use our services.

Information We Collect

We collect the following information when you use ZeroPhase. Some is provided directly by you, and some is collected automatically as you use the app or visit the site.

Information you provide

• Name and email address (when you sign up for an account)
• Physical Screening Test (PST) results: swim, push-ups, sit-ups, pull-ups, and run times
• Per-day workout completions, including times, reps, weights, and free-text notes
• Wrap-up feelings after each training session
• Testimonials and quotes you choose to submit
• Contact messages you send through the contact form (name, email, message)
• Onboarding quiz answers (stored in your browser's local storage until you sign up, then saved to your account)

Information collected automatically

• Landing path, external referrer, and UTM parameters (source, medium, campaign, term, content): stored in a 90-day cookie and linked to your account at sign-up
• Analytics visitor ID, used to attribute conversions to the referring visit
• Billing history: record of plan periods (plan name, start date, end date)

How We Use Your Information

We use the information we collect for the following purposes:

• Generating and managing your daily training plan
• Tracking your PST results and workout history
• Processing purchases and managing plan access
• Communicating with you about your account or our services
• Improving our website and user experience
• Sending training emails you asked for on our public pages
• Writing the welcome email you get after signing up (see “Emails Written For You” below)
• Detecting and preventing abuse (Cloudflare Turnstile)
• Sending you a link to your account if you contact us for support

Emails Written For You

Your welcome email is written for you, not a template. An automated routine runs every hour and writes it with an AI model, and what it writes is your own first step: the level your logged PST puts you at and today's workout, or the PST itself if you have not logged one yet.

To write that, the routine reads your account: your name, your plan, your PST results, your workout history, your trial dates, and what we recorded on your first visit. That is the landing page, the referring site, the campaign tags in the link you followed, and the analytics visitor ID we saved from that visit.

With that visitor ID, the routine asks our analytics provider, DataFast, for that one visitor's record: the pages you viewed on zerophase.app and where you came from (the referring site and campaign tags). It uses the pages you read before signing up to answer what you were reading about. It does not use the location, device or browser in that record.

It does not search for you anywhere else. No web search, no social profile, no data bought from anyone: the routine reads only what is in your ZeroPhase account and the visit data above.

Every email it sends is saved on your account, with the date and the step it chose, so the next one can be written from what worked. The notices about your account (trial ending, trial ended, data deletion, and the subscription thank-you) are fixed templates, and they stay fixed.

Every one of these emails has an unsubscribe link at the bottom: one click stops them. You can also stop them by emailing hello@zerophase.app. An address that has unsubscribed is skipped by every send.

Data Processors

We do not sell your personal information. We share data only with the services that run ZeroPhase, and only for the purposes described below:

• Polar: processes payments as the merchant of record. Stores your payment information; ZeroPhase receives only your plan status and order history, never your full card details.
• MongoDB Atlas: hosts the database (encrypted at rest) that stores all user account data, including your sign-in record (email, hashed password or Google link), workout programs, and PST results.
• Resend: delivers transactional and marketing emails (welcome, reminders, policy updates, training emails).
• DataFast: provides analytics. Your email address goes to it for payment attribution when you make a purchase, and our checkout sends it the visitor and session identifiers from its own cookies, matching the conversion to the referring visit. Not a privacy-friendly analytics service: it receives identifiable data.
• Vercel: hosts the application and stores server logs (URLs, timestamps, IP addresses).
• Cloudflare: provides DNS, email routing, the Turnstile anti-bot check, and DDoS protection, and stores the off-server copy of the nightly database backups. Processes IP addresses and request metadata.
• EchoForm: receives your name and email via SSO to power the in-app feedback board.
• Google (Gmail): email you send to hello@zerophase.app is forwarded by Cloudflare Email Routing to the founder’s Gmail inbox, so Google processes your message and address.

Staff Access

The founder has read-only access to any user account through an admin interface. This is used only for support: to see what you see when you contact us with a problem. It is never used to browse accounts without a reason.

When you sign up or submit a testimonial, the app sends an email notice to the founder with your name and email. Testimonials are reviewed manually before anything reaches the public site.

Cookies and Local Storage

We use cookies and browser local storage for the following purposes:

• _zp_acq (cookie, 90 days): stores the first landing path, external referrer, and UTM parameters. Set on your first visit; never overwritten. Once linked to your account at sign-up, this data is personal.
• __Secure-better-auth.session_token (cookie, 7 days): your sign-in session, keeps you signed in.
• zp_view_as (cookie, 2 hours, admin only): enables the admin to view your account for support. Set only by the admin tool.
• zp_datafast_payment_linked (localStorage, permanent): marks that your purchase has been linked to your analytics visit. Set once after payment; never read on the server.
• Onboarding quiz answers (localStorage, until you sign up): saves your in-progress quiz answers before you sign up. Cleared after sign-up.

Attribution data (_zp_acq) is anonymous in the cookie. Once linked to your account at sign-up, it becomes personal information about where you came from.

Data Retention

We keep your account and training data for as long as you have access. A one-time purchase (Pro or Premium) does not expire. Once your access ends, we keep your data for 30 days so you can pick up where you left off if you come back, then we delete it. This applies when a free trial ends without a purchase, when a subscription is cancelled or not renewed, and when an account was created but never activated a trial or made a purchase.

Deletion covers your account, your training programs, your PST results and your testimonials. It is permanent and cannot be undone. The only thing we keep after deletion is a one-way, irreversible hash of your email address so we know not to give you a second free trial if you sign up again.

If you had unsubscribed from our emails before we deleted your account, we keep the same kind of hash so we can honor that opt-out: we never email that address again, and signing up again with it starts unsubscribed.

Backups. Your data is backed up nightly to an archive of the database. The archive stays encrypted on the server for 14 days, and a copy goes to Cloudflare R2, encrypted at rest, for 30 days. Deleted data may persist in that off-server copy for up to 30 days before it is rotated out. Backups are used only for disaster recovery.

You can ask us to delete your account and data sooner at any time by emailing hello@zerophase.app.

Payment Information

ZeroPhase does not store your full payment card details. All payment processing is handled by Polar, which is the merchant of record. Polar stores your payment information and sends receipts. ZeroPhase receives only your plan status (which plan you are on) and order history: never your card number.

Children's Privacy

Our services are not directed to children under the age of 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately so we can remove that information.

Your Rights

Depending on your jurisdiction, you may have the right to:

• Request access to the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data (email hello@zerophase.app)
• Withdraw consent for marketing emails (click the unsubscribe link in any email)

To exercise any of these rights, email hello@zerophase.app.

Updates to This Policy

We may update this Privacy Policy from time to time. If we make changes that affect you, we will notify you by email. We encourage you to review this policy periodically to stay informed about how we protect your information.

Contact Us

If you have any questions about this Privacy Policy, please contact us at hello@zerophase.app.