Privacy Policy

Last updated: October 21, 2026

Zera Fit ("we," "us," "our") respects your privacy. This policy explains what data we collect, how we use it, and your rights.

Who we are

Zera Fit is an online fitness coaching service operated by Gabby, a NASM-Certified Personal Trainer with 15+ years of experience. Our website is zera.fit. You can contact us at support@zera.fit for privacy questions.

What data we collect

Information you provide directly

Email address when you subscribe to our newsletter or submit an application.

Application information when you submit the application to become a client:

• Name, date of birth, phone number, and an emergency contact (their name and phone)
• The U.S. state you select — collected as a coarse region for service availability and program personalization. We never collect precise or GPS location, and we never collect a street or mailing address.
• Fitness goals, movement preferences, schedule, and available equipment
• Health information relevant to safe training: menopause stage, injury history, current medications, a physical-activity-readiness (PAR-Q) screening (heart, chest, surgery/injury, and joint questions), and whether you have doctor clearance
• Any notes you choose to share
• What you do for a living, if you choose to share it on the short application
• How you heard about us, if you choose to answer, and how you first reached our site: the first page you opened, the name of the website that sent you (never the full web address), and any campaign label in the link. We also count how many people open the form and how many finish each part of it, without saving anything that identifies you.

Ongoing coaching data (once you become a client):

• Messages between you and Gabby
• Payment information (processed by Stripe; see below)

Coaching activity (active clients, through the client portal):

• Workout logs — which exercises you completed, how they felt, sets/reps/weight, and any notes, pain flags, or questions you add
• Check-ins — Gabby asks a few short questions on a regular cadence (energy, sleep, mood, pain, wins, struggles); your answers are visible only to her
• Nutrition logs — foods and portions you choose to log, with their macros, including items added by scanning a barcode; visible only to you and Gabby
• Progress tracking — body measurements and energy/sleep/stress notes you choose to record over time, visible on your progress page

All of the above stays between you and Gabby. Every row is protected by row-level security in our database: no other client can see it, and we do not use it for marketing, AI training, or any purpose outside your coaching.

Information collected automatically

• Performance and page-view data: Vercel Speed Insights records page-load timings, and Vercel Web Analytics counts aggregate page views. Both are cookieless and report aggregate statistics. They use no cross-site tracking and create no personal profile. Each Web Analytics page view can store the time of the visit, the page path and its route pattern (for example /learn/[slug]), the referring site or page, an approximate location (country, region and city), your operating system and version, your browser and version, your device type (mobile, tablet or desktop), and the analytics script version. Instead of a cookie, Vercel tells visitors apart with a hash created from the incoming request and discards it after 24 hours. Each Speed Insights measurement can store the page path and route pattern, the page-load timing and the page element it measures, your network speed (for example 4g), your browser, operating system and device type, your country, the measurement library version, and the time Vercel received it. Before either tool sends data, Zera Fit removes query strings and fragments, redacts secret link segments (group invite codes and disclaimer links), and does not send visits to admin pages. Before either tool sends data, Zera Fit also replaces record numbers in portal page addresses with a placeholder. Pages whose address carries a secret (group invites, disclaimer links, sign-in, password-reset, unsubscribe and email-preference links) tell your browser to send no referrer, so their address is never passed on as a referring page.
• Technical data: browser type, device type, and an approximate country/region inferred from your IP address for security and service availability. This is coarse and is never precise or GPS location.
• Authentication: session tokens via Supabase Auth
• Rate limiting: hashed identifiers (never your email or IP address in readable form) stored in Redis (Upstash) to prevent abuse. Each one is deleted automatically, at most 24 hours after the last request or failed attempt that used it.

Information from third parties

We do NOT purchase, rent, or otherwise obtain your data from third parties.

How we use your data

• To provide coaching services: generate your program, communicate with you
• To process payments: via Stripe (we never see your full card details)
• To send transactional emails: welcome messages, application confirmations, coaching communications
• To send newsletters (only if you've subscribed): tips and updates
• To monitor performance and reliability: aggregate diagnostics and page-view statistics
• To comply with legal obligations

Data we do NOT use

• We do not sell your data to third parties, ever
• We do not share your data for advertising purposes

AI and your data

Zera Fit uses AI tools (Anthropic's Claude API) to assist Gabby in drafting coaching communications and generating training program recommendations. Here is exactly how your data is used:

What is shared with the AI:

• Your age, menopause stage, fitness goals, available equipment, injury history, training preferences, and preferred coaching tier
• Free-text notes you provide in your application (presented to the AI as quoted data, not instructions)

What is NOT shared with the AI:

• Your name
• Your email address
• Your phone number
• Your payment information

How the AI is used:

• Gabby personally reviews and adjusts every AI-generated draft before you receive it
• The AI provider (Anthropic) processes your data under their data processing terms and does not retain it for model training
• AI outputs are checked for medical-scope compliance before delivery
• You can request that Gabby generates your program manually instead. Contact support@zera.fit

Where your data is stored

• Database: Supabase (Postgres), encrypted at rest, hosted in the United States
• Email delivery: Resend
• Payments: Stripe (PCI-compliant; we never store card numbers)
• Performance monitoring: Vercel Speed Insights (cookieless, aggregate page-load timings; no cross-site tracking). The fields it stores are listed under "Information collected automatically" above.
• Web analytics: Vercel Web Analytics (cookieless, aggregate page views; no cross-site tracking and no personal profile). The fields it stores, and what Zera Fit removes before data is sent, are listed under "Information collected automatically" above.
• Error monitoring: Sentry. We scrub personally identifiable information (email addresses, IP addresses, authentication tokens, request bodies) from error reports before they are sent to Sentry. Sentry is used for technical debugging only.
• Rate limiting: Upstash Redis (temporary hashed identifiers only, auto-deleted)
• Bot protection: Cloudflare Turnstile (no personal data stored)
• Nutrition lookup: When you search for a food or scan a barcode in the meal log, only the food name you type (or the barcode digits) is sent to our nutrition data providers — FatSecret, Open Food Facts, and the USDA FoodData Central database — to retrieve nutrition facts. No personal information, account identifier, or health data is ever included in these lookups.

All data is stored on servers in the United States.

Data retention

• Subscribers (non-clients): email retained until you unsubscribe
• Active clients: data retained for the duration of your service
• Canceled clients: personal information (name, email, phone, emergency contact, date of birth, application free-text, message content) is automatically scrubbed 12 months after subscription cancellation. Aggregate non-identifying data (subscription dates, tier, anonymized workout completion patterns) is preserved for analytics. Payment records retained for 7 years for tax compliance.
• You can request deletion at any time (see "Your rights" below)

Automated retention enforcement is in place via a scheduled daily process. Eligible cancellations are processed within 24 hours of crossing the 12-month threshold. The Founder receives a weekly summary of retention events for accountability.

Two months after that 12-month scrub — 14 months total after your subscription ends — we permanently delete your account record from our database, along with all connected records. This step is irreversible. If you want a copy of your data before that window closes, you can download it at any time from your portal settings.

Your rights

Regardless of where you live, you have the right to:

• Access your data (request a summary of what we have)
• Correct inaccurate data
• Delete your data (we will process deletion requests within 30 days, except payment records retained for tax compliance)
• Opt out of marketing communications at any time (every email includes an unsubscribe link)
• Object to processing based on legitimate interest
• Withdraw consent at any time
• Export your data — download a complete copy at any time directly from your portal settings

To exercise any of these rights, email support@zera.fit. We will respond within 30 days.

Your data in your portal: Active clients can act without emailing us. In your portal, go to Settings → Your data. From there you can download your data immediately as a JSON file — your application responses, program history, workout logs, check-ins, messages, and progress metrics. You can also delete your account from the same screen, at any time, instead of waiting for the automatic timeline. Deletion is immediate — there is no waiting period and no request to cancel: the moment you confirm, you're signed out, your personal details are erased, and you won't be able to sign back in. This cannot be undone.

What deletion covers: When you request deletion, we remove your data from our database (application records, client records, subscriber records, email logs, and related records), including any files associated with your account (e.g. message attachments, program documents). We also request removal from third-party processors where applicable, including marketing email lists like our newsletter audience. Some data may persist in encrypted backups for a limited period before automatic rotation.

Deletion record retained: An internal record of the deletion event is retained indefinitely for accountability and audit purposes. It holds only metadata about the deletion event: when it happened, who carried it out (a Zera Fit admin, or you through your portal), a reason category and the length of the admin's note, never the note itself, when an admin carries it out, an internal account number, and the counts and outcomes of each deletion step. When an admin carries it out, the record also keeps that admin's account email, account number, network (IP) address and browser details. It does not contain your email address, your name, or any of your health, coaching, or payment details.

What deletion does not cover: Payment records retained for tax compliance (7 years). Sentry error logs are scrubbed of PII before storage, so they do not contain your personal information.

Service availability

Zera Fit is currently available to US residents only. We do not serve EU customers at this time. If you are accessing our application from outside the United States, we may decline your sign-up to maintain compliance with regional regulations. We will re-evaluate broader availability as we mature.

Additional rights for California residents (CCPA)

• Right to know what categories of personal information are collected
• Right to opt out of the sale of personal information (we do not sell data)
• Right to non-discrimination for exercising your rights

Data security

We use industry-standard security measures:

• All data transmitted over HTTPS with HSTS enforcement
• Content Security Policy headers restricting script and resource origins
• Row-level security on all database tables
• Authentication via password (primary) or a one-time email link/code
• Bot protection on all public forms via Cloudflare Turnstile
• Rate limiting and brute-force protection on login
• Regular security audits via automated testing (500+ tests)
• Incident response plan in place
• PII scrubbed from error monitoring before transmission

If we become aware of a data breach that affects you, we will notify you within 72 hours.

Admin access to your data

Authorized Zera Fit staff (currently the Founder and the Technical Co-founder) may view your information to provide coaching services and to operate the platform. Every such view of sensitive health information is recorded in an append-only audit log for accountability. This log is retained indefinitely and is not editable or deletable — even by the staff who created the entries.

If a client account is removed, the audit-log entries that reference it are preserved as the durable record of who viewed what data and when, with the entity itself shown as deleted on internal admin views.

Cookies

We use minimal cookies:

• Essential cookies for authentication (Supabase session tokens)
• No third-party tracking cookies
• No advertising cookies
• A first-visit note, not a cookie: we keep a small first-visit note in your browser for up to 90 days: the first page you opened on our site, the name of the website that sent you, and any campaign label in the link. It is sent to us only if you apply, and is deleted from your browser when you do. After 90 days we no longer use it, and we delete it the next time you visit.

You can configure your browser to block cookies, but this may affect your ability to sign in.

Children's privacy

Zera Fit is not intended for use by anyone under 18. We do not knowingly collect information from children. If you believe we have inadvertently collected such information, contact us immediately.

Changes to this policy

We will update this policy as needed. The "Last updated" date at the top reflects the most recent change. For material changes, we will notify active clients by email.

Contact

For privacy questions: support@zera.fit