Privacy Policy
1. Who we are
This Privacy Policy describes how Sunset Binary LLC, an Illinois limited liability company ("Sunset Binary," "we," "us," or "our"), collects, uses, stores, shares, and deletes personal information when you use the True Ascent installed application (the "Service").
Contact for privacy requests, downloads, and legal notices: [email protected]. To delete your account and the data associated with it, email [email protected] from the address on the account, with the subject "Delete my True Ascent account". The steps, and what we delete or keep, are published at https://trueascent.app/delete-account.
2. Our guarantee: we do not sell your data
We do not sell your personal information or consumer health data, including your activity, training logs, intake answers, or account identifiers, for monetary or other valuable consideration. We do not "share" personal information for cross-context behavioral advertising as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We do not disclose your information to advertisers, advertising networks, data brokers, insurers, employers, or analytics vendors. We do not use your information to train third-party artificial-intelligence models.
We do not sell consumer health data. We will not sell it in the future without a separate, signed authorization that the law requires for such a sale, which we do not request and do not intend to request.
3. Information we collect
We collect only what we need to run True Ascent. We do not buy data about you from brokers. Categories:
- Account: email address, hashed password, the language of the last device you confirmed (we write our emails in it), account creation time, and the time you first accepted the Terms.
- Identity display: first name and last name.
- Setup goals: which of calm, fitness, clarity, and consistency you chose the first time you opened the Hub, stored on your profile so the Hub can show the ones you have not set up yet.
- Consumer health and training profile: date of birth (age is derived), biological sex, menopause status, height, body weight, derived BMI (not stored as its own field), clearance answers (heart condition or high blood pressure, other chronic condition, medication for a chronic condition, recent bone/joint/soft-tissue problem, known low bone mass), areas to go easy on, training status, current lifting, and goal.
- Workout plans: plan kind and horizon, aim, muscle emphasis, body weight (stored in grams; shown in lb), optional target weight, fat-loss pace when the aim is Lean Out, pregnancy status and approximate due date, and the equipment, workout minutes, days per week, and region limits stored with that plan.
- Activity: workout titles, status, start and end times, and logged sets (exercise, set index, weight, reps).
- Optional reminders: if you turn on Notify Me for a routine or a fitness plan, we store that choice on your account and schedule an on-device reminder at the time you chose. A routine and a fitness plan both remind you every day. The banner shows the routine name, or Start Working Out. We do not send those reminders through a push vendor or third-party messaging service.
- Technical: an HTTP-only session cookie on the API host to keep you signed in; a second HTTP-only cookie that marks a trusted device (described next); ordinary web-server logs (IP address, date, URL, user agent) generated by hosting the Service; the language your app shows, which follows your device, and the language tag and time zone your device reports (not identifiers), which the app sends so our emails are written in your language and their dates and times read the way your device writes them; we save these on your account when you sign up, when you sign in from a device you already confirmed, and when you confirm a device with the emailed code, replacing the earlier values each time, and keep them until the account is deleted (a password alone, typed on a device we do not yet trust, never changes them); and, on your own device, a local copy of your account details and a few small flags (for example, the time of the last age check) so the app can work.
- Trusted devices: when you confirm a sign-in with the six-digit code we email you, we may remember that device for your account. The device keeps a random token in an HTTP-only cookie named __Host-ta_device, and we store a record with a keyed one-way hash of that token, the platform (iOS, Android, or web), when the record was created, and when the device was last used. A trusted device may skip the emailed code the next time you sign in; it never replaces your password. The cookie and the record last up to 400 days and are renewed while you keep using the device. Changing or resetting your password removes your other trusted devices, and deleting your account removes them all.
- Eligibility and abuse prevention: whether your email address is confirmed; the age range your device or app store reports, if you allow it, which we read when you sign up and periodically while you use the app, use to decide eligibility, and do not store (we keep only the resulting age assurance level and the time of the last check, not the range); a device identifier that the app sends in an X-TA-Device header only when you sign up, when you finish a required sign-up field that was still missing, when you ask us to email you a code (to confirm your address, to sign in on a new device, to reset or change your password, or to change your address), when it asks for the short puzzle that comes before those requests, and when it sends the device signals described here, and never with any other request (on iOS the identifier for vendors of the app, on Android the Android ID), which identifies the app installation on that device and which we keep only as a keyed one-way hash; a device attestation key; and a record of each sign-up attempt. Each sign-up attempt record keeps a risk score, reason codes, the status of each signal (such as unavailable or declined, but not the signal itself), and keyed one-way hashes of the network prefix of your IP address (the first three numbers of an IPv4 address or the first 48 bits of an IPv6 address), the device identifier, and the attestation key. When the attempt created an account, the record also holds that account's internal number, which is cleared if the account is deleted; it holds no email address and no hash of one. A hash cannot be reversed to the original value.
We do not collect payment card numbers, precise geolocation, government ID, biometric identifiers (face geometry, fingerprints, voiceprints, gait, or similar), genetic data, HealthKit or Health Connect feeds, wearable streams, or advertising identifiers for our use. We do not geofence health care facilities.
4. Sources
We collect personal information from you when you register, complete Getting started, create or replace a fitness plan, log workouts, change account settings, or contact us. We collect technical information from your browser and our servers when you use the Service. We do not collect personal information from third-party data brokers or from connected health platforms.
5. How we use information
We use personal information to: create and secure your account; authenticate sessions; show the app and write our emails in your device's language; match a conservative training profile from your intake answers; store and display your log; operate, debug, and secure the Service; honor download, correction, and deletion requests; provide notice of material policy changes; and comply with law. We do not use consumer health data for advertising, marketing, profiling for third parties, or any purpose not stated here.
6. How we share information
We do not sell or rent your information. We share it only as follows:
- Service operation: the Service is hosted on infrastructure we control. User records live in our PostgreSQL database on that host. We do not send your account, health, or activity data to advertising or analytics companies.
- Email delivery: to send you six-digit verification codes and the account notices described in this Policy (such as deletion confirmations and reminders to confirm your email address), we use a service provider, Resend, that sends the message for us and so receives your email address and the message. It also tells us when a message could not be delivered. We use it only to send you the codes and notices you need to use the Service.
- Device checks: on iOS devices that support it, the app can ask Apple (App Attest) to confirm that the request comes from a genuine copy of True Ascent; that request goes to Apple and is governed by Apple's terms and privacy policy. The equivalent Google Play Integrity check for Android is built but turned off in this version, so Android devices send nothing to Google for this purpose.
- Legal process: we may disclose information if we believe in good faith that disclosure is required by law, a valid legal process, or to protect the rights, safety, or property of Sunset Binary, you, or the public.
- Business transfer: if we transfer the Service in a merger, acquisition, or similar transaction, your information would move with it under this Policy, and we would require the recipient to honor this Policy or give you notice and the download and deletion choices described below.
We have no affiliates with whom we share consumer health data. We do not disclose consumer health data to third parties for their own purposes.
7. Cookies and similar technologies
We use cookies that are necessary to run the Service: a host-only session cookie on the API host so you stay signed in, and a host-only device cookie (__Host-ta_device) that lets a device you already confirmed skip the emailed code for up to 400 days. Your language follows your device and is saved on your account, not in a shared-domain cookie. We do not use third-party advertising cookies, pixels, or fingerprinting for tracking. The device identifier described in Section 3 is used only for eligibility and abuse prevention. You can delete cookies in your browser; doing so will sign you out, and the next time you sign in on that device we may email you a code again.
8. Retention
We keep your account, profile, health intake, and activity for as long as the account exists so we can provide the Service. When you schedule the account for deletion, we delete it 14 days later (signing in during that time cancels the deletion): we delete the user row and cascaded profile, program profile, workouts, and sets. We then keep your email address for up to 7 days, only to send you an email confirming the deletion. Server logs are rotated in the ordinary course of hosting and are not used to rebuild a deleted account. We may retain a minimal record if the law requires it (for example, a record that a deletion request was completed). An account whose email address is never confirmed and that holds no saved workouts, plans, or program answers is deleted 14 days after sign-up; we email you a reminder 3 days before that date (accounts created before email verification also get one 14 days before), and an unconfirmed account that does hold saved data is not deleted for that reason. An account we end for age or automated activity is disabled at once and deleted after 30 days; when the reason is age, the name, date of birth, country, and region saved on its profile are also cleared at once. Until that deletion the account keeps its workouts and the titles and notes written on it, and when the reason is age its program answers and fitness plans are deleted at once as well. Sign-up attempt records, with the hashes they hold, are deleted after 30 days. Trusted device cookies and records last up to 400 days after the device was last used and are deleted with your account. An attestation key record is deleted 180 days after the device last used it. Verification codes are deleted shortly after they expire.
9. Security
We hash passwords, bind sessions to a session version that rotates when you change your password, require authentication for catalog and account APIs, and store user data on the host we operate. No method of transmission or storage is perfectly secure. You are responsible for keeping your password confidential.
10. Your choices and rights
You may access and update certain profile fields in the Service (training answers on Field Profile). You may schedule your account for deletion from Field Profile (current password and the word DELETE). If your email address is confirmed and you are on a device we do not yet recognize, the app first asks for the six-digit code we email you. The account is deleted 14 days later, and signing in before then cancels it. Once deleted, the data is permanently gone.
You may email [email protected] to request access, correction, or a download of your data. To request deletion, email [email protected] from the address on the account, or use https://trueascent.app/delete-account. You may also schedule deletion in Field Profile, as this section describes. We will verify the request against the account and respond within the time the applicable law requires (including 45 days under Washington's consumer health data law, subject to a permitted extension). We will not discriminate against you for exercising these rights.
11. Changes to this Policy
We may revise this Privacy Policy at any time. The version identifier and effective date appear at the top. For a material change, we will post the revised Policy at https://trueascent.app/privacy and the Consumer Health Data Privacy Policy at https://trueascent.app/privacy/health, and show the same text in the app. We may also email the address on your account. Material changes apply on the stated effective date. Continued use after that date is acceptance, except where the law requires a fresh consent for a change in how we use consumer health data. If you do not agree, delete your account from Field Profile, or email [email protected] to request deletion. You may email [email protected] to request a copy of your data before that deletion, instead of continuing.
12. Children
The Service is for adults 18 and older. We ask for your date of birth when you register and may use signals from your device or app store to check it. We do not knowingly collect personal information from anyone under 18, and we do not direct the Service to children under 13. If we learn that someone under 18 has an account, we disable it at once and clear the name, date of birth, country, and region saved on its profile, delete the health answers and fitness plans it holds, and delete the rest of the account after 30 days (until then its workouts and notes stay). If you believe a minor has created an account, email [email protected] and we will delete it.
13. Additional U.S. state disclosures
California. We do not sell or share personal information as defined by the CCPA/CPRA. We use sensitive personal information (account login, health and fitness intake, sex) only to provide the Service you requested, which is a permitted purpose. You may request to know, access, delete, and correct personal information, and to limit use of sensitive personal information, by deleting your account in Field Profile, by emailing [email protected] to request deletion, or by emailing [email protected]. We honor those requests whether or not we are otherwise above a statutory threshold.
Nevada. We do not sell covered information as defined in NRS Chapter 603A. You may email [email protected] with the subject "Nevada Do Not Sell Request."
Washington and other consumer health data laws. A standalone Consumer Health Data Privacy Policy is published at https://trueascent.app/privacy/health. It is the notice required for consumer health data (including fitness, menopause status, and clearance answers). We collect that data to provide the Service you request. We do not sell it. We do not geofence health care facilities.
14. HIPAA, breach notice, and Illinois law
Sunset Binary is not a "covered entity" or "business associate" under HIPAA. This Policy is not a HIPAA Notice of Privacy Practices, and the Service is not a substitute for a medical record system.
If unsecured identifiable health information is acquired without authorization, including an unauthorized disclosure that the FTC Health Breach Notification Rule treats as a breach of security, we will notify affected individuals, the Federal Trade Commission, and, where required, the media, in the manner and time that Rule requires. We will also follow the Illinois Personal Information Protection Act and any other breach-notice law that applies.
We do not collect biometric identifiers or biometric information as defined by the Illinois Biometric Information Privacy Act.
15. Where data is processed
The Service is operated from the United States. If you use it from another country, you understand that your information is processed in the United States, where laws may differ from those in your country. We do not currently target the Service at the European Economic Area as a separate offering; if you are in a jurisdiction that requires a further transfer mechanism or representative, email [email protected] and we will address your request, including deletion.
16. Contact
Sunset Binary LLC. Privacy and legal: [email protected]. Account deletion: [email protected] or https://trueascent.app/delete-account. Privacy Policy: https://trueascent.app/privacy. Consumer Health Data Privacy Policy: https://trueascent.app/privacy/health. Terms of Service: https://trueascent.app/tos. Service: the True Ascent iOS and Android application (app.trueascent.mobile).
Consumer Health Data Privacy Policy
1. Scope
This Consumer Health Data Privacy Policy is published by Sunset Binary LLC ("we," "us") for True Ascent. It applies to consumer health data we collect in connection with the Service. It is a standalone notice. The general Privacy Policy at https://trueascent.app/privacy describes personal information more broadly. Contact: [email protected].
2. Categories of consumer health data we collect and why
We collect the following categories, from you, to provide True Ascent (account, conservative program matching, and your workout log), to secure the Service, and to honor your requests. We do not collect these categories for advertising.
- Physical and mental health status and fitness: workouts and sets; fitness plans (kind, horizon, aim, emphasis, body weight, target weight, fat-loss pace, equipment, workout minutes, days per week, region limits); height; latest body weight; derived BMI; training status; current lifting; goal; areas to go easy on.
- Reproductive and related status: menopause status (when provided); pregnancy status and approximate due date (when provided on a plan).
- Clearance and condition flags you choose: heart condition or high blood pressure; other diagnosed chronic condition; medication for a chronic condition; recent musculoskeletal problem; known low bone mass.
- Identifiers linked to that data: account email, names, date of birth (age derived), biological sex.
3. Sources
Consumer health data is collected from you when you complete Getting started, edit that intake, create or replace a fitness plan, and log workouts. We do not collect consumer health data from data brokers, health systems, HealthKit, Health Connect, or wearables.
4. Categories we share; third parties and affiliates
We do not sell consumer health data. We do not share consumer health data with third parties for their own purposes, including advertising. We have no affiliates with whom we share consumer health data. Typefaces are self-hosted; we do not send consumer health data to font CDNs. We may disclose consumer health data if required by valid legal process.
5. Your rights
You may request to confirm whether we are collecting, sharing, or selling consumer health data about you; to access that data; to delete it; and to withdraw consent. We do not sell this data, so there is no sale to opt out of. Withdrawal and deletion are carried out by scheduling the account for deletion in Field Profile (the data is deleted 14 days later) or by emailing [email protected] as described at https://trueascent.app/delete-account. Access and a copy of your data are available by emailing [email protected]. We will respond within 45 days, or a permitted extension, after we verify the request. We do not geofence health care facilities.