Privacy Policy

KineticX ("we," "us," "our") operates a sprint-timing and training platform (the "App") for athletes and coaches. KineticX is operated by Henry Yu, an individual based in Alberta, Canada, doing business as KineticX. KineticX is not yet a separately registered legal entity or trade name; this section will be updated to name that entity once registration is complete.

Contact for privacy questions: yutx888@gmail.com

KineticX is not currently available to residents of Washington State. Washington's My Health My Data Act imposes specific consent requirements around consumer health data that KineticX has not yet built for. If you are a Washington resident, please do not create an account at this time — we plan to support Washington once the required consent flow is in place.

This section reflects what the live product actually collects, verified against KineticX's live database and app code on 2026-10-03, not a generic template list.

Account information:

– Email address (used to create and secure your account)

– First and last name

– Gender and date of birth (optional, used to compare your results against sprint data for your age/gender bracket)

– Height and weight (used for training and performance calculations)

– Unit display preference (metric/imperial) and account role (athlete/coach)

– The invite code you signed up with

– A record of what you agreed to at signup: that you accepted the beta terms, confirmed you are 13 or older, and confirmed you are not a Washington State resident, with the date and time

Workout and performance data:

– Workout session history: what you did, when, and how long it took, including sessions you schedule on the calendar and training programs you start

– Per-exercise and per-set data: reps, load/weight, distance, time, rest periods, and (for sprint/plyometric work) velocity and power output

– Presets, routines and custom exercises you create

– Performance tests you record (for example jump height or reactive strength index) and race results you enter (distance, time, and optionally event name, location, wind and placement)

– Your dashboard display settings (which stats each card shows)

Biometrics you choose to log, entered voluntarily: bodyweight over time, resting heart rate, sleep duration, and joint mobility measurements (currently ankle dorsiflexion, left/right).

Nutrition you choose to log: the foods you add to your meals (food, serving size, meal type, date) and your daily protein, carbohydrate and fat targets. If you scan a barcode, the barcode number is looked up in a public food database (see section 4) and the product's nutrition facts are saved to KineticX's shared food list, which is not linked to you.

Notes: some log entries (biometrics, performance tests) have an optional free-text note. Anything you type there is stored with that entry.

Payment information: if you choose a paid plan, payment is handled by Stripe (see section 4). Your card details go directly to Stripe; KineticX never sees or stores them. We store your plan, your Stripe customer and subscription reference numbers, your subscription status, and when your current billing period ends.

None of the above is inferred automatically; each item is something you entered or chose.

Camera use stays on your device. The barcode scanner and the jump-test recorder use your camera, but the video and images are processed on your device and never uploaded or stored by KineticX. Only the result (the barcode number, or your jump measurement) is saved.

What we still do not collect, even though the underlying database has tables for it: coach-athlete pairing and session-conditions data (readiness score, training surface, temperature, wind) have database tables already built, but neither is wired up to the live app yet. If either goes live, this policy will be updated before that data starts being collected, not after.

We do not collect precise device geolocation, and we do not collect biometric identifiers in the legal sense (fingerprint, face scan, iris scan, voiceprint) — see mvp_compliance_checklist.md for why that distinction matters under Illinois/Texas/Washington biometric statutes.

– To create and secure your account.

– To let you log, track, and review your own training history and performance.

– To power the features you use directly (workout builder, exercise/preset library, calendar, performance stats, nutrition tracking).

– To process payments and manage your subscription if you choose a paid plan.

– We do not sell your personal information, and we do not share it with advertisers, ad networks, or analytics/tracking SDKs for advertising purposes. This is a real product constraint, not just a policy line: KineticX does not embed advertising or ad-tech pixels/SDKs today, and won't add one without updating this policy and the sub-processor list in section 4 first — this is the single most common way comparable health/fitness apps have gotten in legal trouble (see below).

We use a small number of service providers ("sub-processors") to run the App. We don't sell data to them; they process it on our behalf, under their own security and data-handling terms:

– Supabase — our database and authentication provider. All account, workout, biometric and nutrition data described above is stored in Supabase's infrastructure.

– Vercel — our hosting provider, which serves the App itself.

– Vercel Web Analytics — counts page visits so we know which pages are used. It receives the page visited, the referring site, and your browser, device type and country. It does not use cookies and is not used for advertising.

– Stripe — processes payments if you choose a paid plan. Stripe receives your email address, an internal account ID, and the payment details you enter at checkout.

– Open Food Facts — a public food database. When you scan a barcode, only the barcode number is sent to look up the product; nothing that identifies you.

– Google Fonts — supplies the App's typefaces. Like any website loading a file, your browser's request includes your IP address and browser type.

We do not otherwise share, sell, or rent your personal information to third parties.

– Every table in our database has Row Level Security enabled — a database-level rule that restricts which rows a given request is allowed to see or change.

– All client access to data goes through server-side functions we control, not direct database queries from the app — meaning your data isn't reachable by tampering with the app itself.

– KineticX's backend infrastructure is not currently SOC 2 or ISO 27001 certified, and KineticX is not HIPAA compliant. Both are planned future considerations, not a current state — do not claim a security or compliance certification here that isn't real. (BetterHelp's 2023 FTC settlement was partly for claiming "HIPAA compliant" status it didn't have — this is a real, specific mistake to not repeat, not a hypothetical one.)

Depending on where you live, you may have rights to access, correct, or delete your personal information, and to ask what we hold about you. We aim to respond to any such request within 30 days.

– Canada (including Alberta): you have rights under Alberta's Personal Information Protection Act and, where applicable, the federal Personal Information Protection and Electronic Documents Act (PIPEDA), including the right to access your information and challenge its accuracy.

– United States: depending on your state of residence, you may have additional rights under state privacy laws. Washington residents: see §1a — KineticX does not currently serve Washington residents, due to the additional consent requirements under Washington's My Health My Data Act. This will be revisited once that consent flow is built.

– Mexico: you have ARCO rights (Access, Rectification, Cancellation, Opposition) under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares (LFPDPPP).

To exercise any of these rights, contact us at yutx888@gmail.com.

We keep your account and workout data for as long as your account is active. You can request deletion of your account and all associated personal data at any time from Settings within the app. Requests are reviewed before being processed, not instant — we will verify the request and permanently delete your account data within 30 days.

KineticX is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we learn that a user under 13 has created an account, we will take steps to delete that account and the associated data.

We'll update this page when our practices change, and update the "last updated" date above. Material changes apply prospectively only — if we change what we collect or how we use it, that change applies to data collected after the update, not retroactively to data you gave us under the earlier version, unless we get your fresh consent first. Before a material change takes effect, we will email every account holder at least 14 days in advance, at the email address on your account.

yutx888@gmail.com