Privacy Policy

Metriq Body (“KCO Partners LLC,” “we,” “us”) operates https://metriqbody.com, a fitness and nutrition coaching application. You can reach us about anything in this policy at legal@metriqbody.com.

Information you give us directly:

• Assessment inputs — sex, age, height, weight, estimated body fat, goal and target weight, training experience and availability, equipment, dietary pattern and food exclusions, sleep and stress self-reports, injury areas you ask us to train around, and whether you are taking a physician-prescribed GLP-1 medication.
• Account information — your email address and a securely hashed password. We never store your password in readable form.
• Your logs — calories and protein you record, sets, weights and reps you log, completed sessions, weekly check-ins (weight, energy, strength trend), and the streak and score derived from them.
• Feedback you send us— if you use the feedback form, the email address you enter, the category you choose, and whatever you write in the message. We store it so we can read it back and act on it, and we use your address only to reply to you about that message. Please don't include anything you would rather not put in writing — the message is free text, so whatever you type is what we keep.

Information from devices you connect:

• Wearable data — if and only if you connect a device (for example Oura or WHOOP), we read sleep duration and score, readiness or recovery score, heart-rate variability, resting heart rate, respiratory rate, steps, active energy, strain, and workout duration. Access is read-only. We never write to your device and we do not access anything outside these categories.

Information collected automatically:

• Local storage — your protocol and logs are kept in your browser so the app works before you create an account and continues to work offline.
• Session cookie — a single signed, HTTP-only cookie that keeps you logged in.
• Advertising pixel — we run the Reddit advertising pixel on this site so we can tell which ads bring people here. It is a third-party tracker, it may set its own cookies, and Reddit can recognise its own logged-in users through it. It records that a browser opened a page, gave an email at the assessment, or created an account — and nothing else. It is never given your health data — not your goal, weight, body fat, calorie or protein targets, logs, or whether you take a GLP-1 medication. It is not given your email address or your account ID either: we deliberately do not enable Reddit's “advanced matching”, so the conversion it records carries no identifier from us at all. Section 7, “Your rights”, explains how to opt out.
• Server logs — our host records standard request data, including IP address, for security and abuse prevention.
• Aggregate analytics — we use Vercel Web Analytics to count page views and see which pages people visit. It is cookieless, does not follow you across other websites, and is never given your health data, your protocol, or your logs.

• To compute your protocol — calorie and macronutrient targets, meal plans, training splits, and weekly adaptations. This is the core purpose and it cannot be done without your assessment inputs.
• To show you your own history, progress, and score.
• To make recommendations more accurate — connected wearable data replaces estimates with measurements, for example setting your calorie target from measured energy burn instead of a self-reported activity level.
• To operate your account — sign-in, email verification, password reset.
• To process subscriptions, when you purchase one.
• To keep the service secure — rate limiting, abuse prevention, and debugging.
• To contact you about your account and your results.
• To send you reminder and coaching emails based on your own activity — for example if you haven't logged in a few days, or your weekly check-in is overdue. We keep a record of which of these we've sent you so we don't repeat ourselves. Every one of them has a one-click unsubscribe, and unsubscribing never affects account or security emails.

What we must be straight about is the advertising we do run. Since we began advertising on Reddit, this site carries the Reddit advertising pixel described in section 2, and that pixel is a form of cross-context behavioural advertising: Reddit can connect a visit here to its own users and show them our ads elsewhere. We are not going to call that anything else.

The line we hold is what it is allowed to know. It receives three things — a page was opened, an email was given at the assessment, an account was created — and no other detail whatsoever. Not your assessment answers, not your protocol, not your logs, not your GLP-1 status, and not your email address or account ID. Our first-party analytics are held to the same rule, and both are enforced in the code rather than by policy alone.

We use a small number of service providers, each contractually limited to processing data on our instructions:

We may also disclose information if legally required to, or to protect the rights and safety of our users or the public. If we are ever involved in a merger or acquisition, we will notify you before your information becomes subject to a different privacy policy.

• Account and protocol data: for as long as your account is open. You can delete your account yourself at any time from the Account page — deletion is immediate and permanent, removes your marketing records too, and keeps only an audit-log entry recording that the account was deleted, and when.
• Wearable data: retained while the connection is active. Disconnecting stops new data immediately; you can ask us to delete what was already collected.
• Marketing emails captured at the assessment: retained until you unsubscribe or request deletion.
• Feedback you submit: retained while we are still acting on it, and deleted on request.
• Billing records: retained as long as required by tax and accounting law, typically seven years.
• Server and security logs: typically 30 days.

Wherever you live, you can ask us to do the following, and we will respond within 45 days:

• Access — get a copy of the data we hold about you.
• Correct — fix anything inaccurate. Most of your profile is editable in the app.
• Delete — remove your account and associated data.
• Export — receive your data in a portable format.
• Withdraw consent — disconnect a wearable or unsubscribe from email at any time.
• Opt out of sale — we do not sell personal information or health data, so there is nothing to opt out of, but the right stands.
• Opt out of targeted advertising — this one now applies to us. The Reddit pixel described in sections 2 and 4 is targeted advertising, and you can stop it in any of these ways. Blocking it is completely effective: the pixel is an ordinary third-party script, and if it does not load, no event about you is recorded at all.
  • Block it in your browser — a content blocker, or a browser with tracker blocking turned on, prevents it from loading.
  • Turn off ad personalisation in your Reddit account settings, which controls what Reddit does with what it collects.
  • Email us at legal@metriqbody.com and we will confirm what has been recorded against you — which, because we send Reddit no identifier for you, is nothing that names you — and pass on a deletion request.

To exercise any of these, email legal@metriqbody.com. We will not discriminate against you for exercising them. If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority.

Passwords are hashed with bcrypt. Sessions use signed, HTTP-only cookies. Wearable access tokens are stored server-side and are never exposed to your browser. Our database is not reachable from the public internet, and all traffic is encrypted in transit.

No system is perfectly secure. If a breach affects your data, we will notify you and the appropriate regulators as required by law, including the FTC Health Breach Notification Rule where it applies.

Metriq Body is for adults aged 18 and over. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it. If you believe a minor has provided us information, contact us and we will remove it.

We operate in the United States and your data is processed there. If you access the service from outside the US, you are transferring data to the US, which may have different data-protection laws than your country.

If we make a material change to this policy, we will update the date at the top and notify account holders by email before it takes effect. Continuing to use the service after a change means you accept the updated policy.