Privacy Policy

What this policy covers

This policy applies to the website at fueledbyshirley.com and to the Fueled by Shirley app. It does not cover services you connect to the app, such as Strava, which have their own privacy policies.

Information we collect

Information you give us

• Account details: your name and email address.
• Athlete profile: sex, age, weight, height, body fat percentage (optional), training goal, daily activity level, usual wake and sleep times, sweat rate, and sweat sodium level.
• Training plans: sessions you plan, including date, start time, name, sport, intended intensity, duration and any notes.
• Races: name, event type, date, start time, division, goal time and expected conditions.
• Gut-training answers: how well you tolerate carbohydrate during training and racing, whether you often get gut symptoms, and whether you have a diagnosed gut condition.
• Messages you send us.

Information from services you connect

When you connect Strava, we receive the following for each activity: its name, sport type, start date and time, duration, calories and average heart rate. We request access that includes activities you have marked private in Strava, so that every session you train is fueled. You can disconnect at any time.

When you connect Whoop, we receive for each workout: its sport, start date and time, duration, energy, average heart rate and Whoop’s own strain score. The access we ask Whoop for also covers recovery and body measurements, which Whoop’s consent screen lists when you connect. You can disconnect at any time.

We will update this policy before offering any other connected service.

Information we calculate

From the information above, the app calculates daily nutrition targets (carbohydrate, protein, fat, energy, fluid and sodium), fueling timelines, training-load classifications, estimates of energy availability, estimated energy costs for planned sessions, and a per-sport calibration based on your own history.

Technical information

• A short-lived security cookie while you connect a service, which expires after ten minutes.
• Cookies that keep you signed in.
• Standard request logs kept by our hosting provider, such as IP address, time of request and browser type.

We do not use advertising or analytics cookies.

How we use your information

• To calculate and show you your nutrition targets and fueling guidance.
• To estimate the energy cost of sessions you plan.
• To keep your account and data secure.
• To respond to you when you contact us.
• To meet our legal obligations.

We do not sell your information. We do not share it for advertising, and we do not use it to train artificial intelligence models.

Who can see your information

• You.
• Your dietitian, if you are a client. If you work with Shirley Plotnik as a client, she can see information you enter in the app and your fueling targets. Activity data received from Strava is shown only to you.
• Service providers that run the app for us, only as needed to provide it: hosting (Vercel), database and sign-in (Supabase) and email (Resend).
• When required by law, or to protect the safety of any person.
• In a business transfer, such as a merger or sale, subject to this policy.

How we protect it

Information is encrypted in transit using HTTPS. The access tokens that let the app read from services you connect are encrypted with AES-256-GCM before they are stored, and access to stored information is limited to what running the service requires. No system is perfectly secure; if a breach affects your information, we will notify you as the law requires.

How long we keep it

We keep your information while your account is active. If you delete your account, it goes immediately: deleting the sign-in account removes every row that belongs to it in the same statement, including everything received from services you had connected. If you disconnect a service, we stop receiving information from it.

Your choices and rights

• Access, correct or delete the information we hold about you.
• Receive a copy of your information.
• Disconnect any connected service at any time.
• Withdraw any consent you have given.

To make a request, email hello@fueledbyshirley.com. We respond within 45 days. Depending on where you live, you may have additional rights under local law.

Age requirement

Fueled by Shirley is for adults aged 18 and over. We do not knowingly collect information from anyone younger. If you believe we have, contact us and we will delete it.

Where information is stored

Information is stored and processed in the United States: the app runs in Vercel’s US East region and the database is in US East (us-east-1).

Changes to this policy

When we change this policy we update the date at the top. If a change is significant, we will tell you by email before it takes effect.

Contact

SP Nutrition Group LLC
Florida, United States
hello@fueledbyshirley.com