Privacy Policy

Last updated: September 4, 2026

Introduction

MySetPlan ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services.

Please read this policy carefully. Where processing depends on your consent, we ask for it separately and you may withdraw it.

1. Information We Collect

Quiz Responses

When you take our fitness quiz, we collect information including your fitness goals, experience level, available equipment, workout schedule preferences, and any physical limitations or injuries you disclose. This information is used to prepare a private plan draft and support Ely's individual review before delivery.

Account Information

When you create an account, we collect your email address and name. If you sign up using a social login provider (Google or Apple, when enabled), we receive basic profile information from that provider.

Payment Information

Payment processing is handled securely by Stripe. We never store your full credit card number, CVV, or other sensitive payment details on our servers. We only receive confirmation of successful payments and basic transaction details.

Usage Data

We keep product activity needed to provide the service, such as workout completions, plan-change requests, and account actions. If you accept optional analytics, we also collect events such as pages visited and features used. We do not need a session recording to deliver your plan.

Marketing Attribution

If you accept optional analytics, we keep a first marketing touch and the most recent non-direct touch in your browser for up to 30 days. This record is limited to campaign labels from UTM parameters, the referring domain, and timestamps. It does not retain the referring URL, landing path, URL query string, or unrecognized query parameters; values that look like an email address, phone number, or URL are rejected. When you begin checkout, we may save a one-time copy with Google Analytics' browser client and session IDs on the private checkout record so a confirmed purchase can be associated with that consented browser session. These fields are not sent to Stripe. For Google Analytics page context, we send only the site origin and path, an external referring domain represented as a root URL or a previous site path, and the five allowed campaign fields. We omit raw query strings and full external referring URLs from that context and do not send your account ID to Google Analytics.

2. How We Use Your Information

We use the information we collect to:

• Prepare and individually review workout plans based on your fitness profile
• Create and manage your account
• Process payments and manage your subscription
• Send transactional emails (plan updates, receipts, account notifications)
• Improve our services and develop new features
• Respond to your inquiries and provide customer support
• Analyze site traffic and optional product-usage events after you consent
• Detect and prevent fraud or abuse

3. Cookies and Tracking

We use cookies and similar technologies to enhance your experience. Here's what we use:

Essential Cookies

• Session cookies: Required for authentication and to keep you logged in
• Consent cookie (mysetplan_consent): Remembers your cookie preference for 365 days

Analytics Cookies (Optional)

• Google Analytics: Measures visits and consented purchase events. Google's tag is blocked until you click "Accept All." A 30-day browser attribution record uses only allowlisted campaign labels, a referrer domain, and timestamps.
• PostHog: Measures selected product events after consent. We use an opaque account ID, do not send your email as an analytics identity, omit URL query strings, and keep session replay disabled for launch.
• Microsoft Clarity: Optional heatmaps/session insights. Clarity is disabled for launch and will remain disabled until it can be isolated from member and reviewer pages with strict masking.

Controlling Cookies

When you first visit our site, you'll see a cookie consent banner. You can choose to accept optional analytics or reject non-essential analytics. You can change that choice at any time below or control cookies through your browser settings. Disabling essential cookies may affect site functionality.

Rejecting or withdrawing optional analytics immediately stops MySetPlan from sending later browser events and clears the browser attribution record. If Google Analytics was already loaded, we first update consent to denied, attempt to save an account-level withdrawal when you are signed in, and reload the page to unload the tag. A checkout snapshot already created while consent was active remains part of your private account and billing history, but a server-recorded withdrawal prevents that older snapshot from authorizing a later Google Analytics purchase event. If you are offline or the request fails, the server cannot know about the withdrawal until a retry succeeds. We retain a retry marker and retry on a later visit or window focus while analytics remains rejected. A purchase event already sent cannot be recalled by this setting. The snapshot remains subject to applicable deletion requests and retention obligations.

4. Third-Party Services

We work with trusted third-party services to operate MySetPlan:

• Stripe: Secure payment processing
• Supabase: Database and user authentication
• Vercel: Website hosting and service-performance monitoring; optional Web Analytics loads after consent
• Google Analytics: Optional site and purchase analytics after consent
• PostHog: Optional event analytics after consent; session replay is disabled for launch
• Microsoft Clarity: Optional session insights, currently disabled pending public-route isolation and strict masking
• Sentry: Error and performance monitoring needed to keep the service reliable. We send an opaque account ID when available, not your email, and disable session replay.
• Resend: Transactional emails
• Cloudflare Turnstile: Essential bot and abuse protection on account-access forms

Each of these services has their own privacy policies governing how they handle data.

5. Data Retention

We retain your personal information for as long as your account is active or as needed to provide you services. If you cancel your subscription, your account data is preserved in case you decide to return. You can request complete deletion of your account and all associated data at any time by contacting us.

After account deletion, we may retain certain information as required by law or for legitimate business purposes (e.g., tax records for 7 years, fraud prevention data).

The consented attribution record in your browser expires after 30 days. Checkout attribution snapshots follow the associated account and billing record retention period and are included in your account data export.

6. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

GDPR Rights (European Users)

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data ("right to be forgotten")
• Portability: Request transfer of your data to another service
• Withdraw Consent: Withdraw consent for consent-based processing
• Object: Object to certain types of processing

CCPA Rights (California Residents)

• Right to Know: Request disclosure of what personal information we collect
• Right to Delete: Request deletion of your personal information
• Right to Opt-Out: Opt out of the "sale" of personal information
• Non-Discrimination: We will not discriminate against you for exercising your rights

Note: We do NOT sell your personal information to third parties.

To exercise any of these rights, please contact us at contact@mysetplan.com.

7. Children's Privacy

Our services are not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16. If we learn we have collected data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.

8. Changes to This Policy

We may update this Privacy Policy from time to time. For material changes, we will notify you via email (to the address associated with your account) before the changes take effect. We encourage you to review this policy periodically. Your continued use of our services after changes constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us:

Email: contact@mysetplan.com
Address: Paramus, New Jersey, United States