Contents
1. Overview
This Privacy Policy describes how Human Hybrid Project, LLC ("we", "us") collects, uses, and protects information about you when you use our website, member portal, programs, and other services (the "Services").
2. Data We Collect
Information you provide directly
- Account data: name, email address, password (stored as a one-way bcrypt hash — never as plaintext)
- Profile data: age, sex, height, current and target weight, training goal, experience level, equipment access, dietary notes
- Wellness data: goals you create, mood check-ins, journal entries
- Communication with the AI Coach: messages you send and the agent's responses
- Payment data: handled directly by our payment processor (Stripe) — we never store full card numbers
Information collected automatically
- Basic technical data: IP address, browser type, device type, pages visited, timestamps
- Authentication cookies (HttpOnly, Secure, SameSite=Strict, 30-day expiry)
3. How We Use Your Data
- To deliver the Services you've requested (coaching, programs, member portal)
- To personalize AI Coach responses based on your profile
- To process payments and provide receipts
- To send account-related emails (verification, password reset, order confirmation)
- To improve the Services (aggregate, de-identified usage data)
- To comply with legal obligations
4. How We Store & Protect Your Data
Your personal data (profile, goals, wellness entries, orders) is stored in our database using envelope encryption:
- A per-user Data-Encrypting Key (DEK) is generated at signup, never reused across users
- Your DEK is itself encrypted with a tenant-level Key-Encrypting Key (KEK) stored in environment variables, not in the database
- Profile, goals, wellness, and order data are stored as AES-256-GCM ciphertext — readable only when both keys are combined at runtime
Passwords are hashed with bcrypt (10 rounds, never reversible). Session tokens are JWTs in HttpOnly Secure SameSite=Strict cookies with a 30-day expiry.
5. Who We Share Data With
We do not sell your personal data. We share data only with the following categories of service providers, strictly to operate the Services:
- Vercel / Upstash: hosting and database (encrypted)
- Stripe: payment processing
- Resend: transactional email delivery
- Anthropic / OpenAI: AI Coach inference (only the messages you send and your profile context are sent at the time of generation; not retained for training)
- Law enforcement: only when legally compelled
6. Your Rights
Depending on your jurisdiction (GDPR for EU residents; CCPA for California residents; similar laws elsewhere), you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data (via your profile page)
- Delete your account and all associated data (one-click via your profile page → "Delete My Account"; this is irreversible)
- Export your data in a machine-readable format (request via the email below)
- Object to certain processing
- Lodge a complaint with your local data-protection authority
To exercise any of these rights, email privacy@humanhybridproject.com.
7. Cookies & Tracking
We use only essential cookies (authentication session). We do not use third-party analytics or advertising cookies at this time. [If/when analytics is added, this section will be updated and consent requested.]
8. Children
The Services are not directed to children under 18. We do not knowingly collect information from anyone under 18. If you believe a minor has provided us data, contact us and we will delete it.
9. International Transfers
Our infrastructure runs primarily in the United States. If you access the Services from outside the U.S., your data will be transferred to and processed there. [Add: Standard Contractual Clauses for EU transfers.]
10. Data Retention
We retain account data for as long as your account is active. When you delete your account, we wipe all associated data within 30 days (with limited exceptions for legal/tax records as required by law).
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or a prominent notice on the Services.
12. Contact
Privacy questions: privacy@humanhybridproject.com
Mailing address: [TBD]