1. Who we are

APEX Performance OS ("APEX", "we", "our", "us") is operated by Nicholas DePietro LLC, a Florida limited liability company. APEX is a performance tracking application for athletes and coaches available at apextracker.co.

By creating an account or using APEX, you agree to this Privacy Policy. If you do not agree, do not use the service.

2. Data we collect

Information you provide directly

• Account information: email address, display name, and password (hashed — we never see it in plaintext).
• Health & performance data: bloodwork lab results, cycle logs (compounds, doses, timing), body weight, body fat percentage, progress photos, workout sessions (exercises, sets, reps, weight), sleep quality scores, and any other data you manually enter.
• Uploaded files: lab PDF reports you upload for AI parsing. These are processed to extract marker values and are not stored as raw files after processing.
• Billing information: subscription and payment details handled entirely by Stripe. We do not store your card number or full payment credentials.
• Communications: messages exchanged with your coach through the APEX platform, and any support inquiries you send us.

Information collected automatically

• Authentication tokens: session tokens to keep you logged in, stored in your browser.
• Push notification subscriptions: browser push endpoint and encryption keys if you enable push notifications. Used only to deliver reminders you explicitly configure.
• Usage metadata: basic server logs (timestamps, errors) used for debugging and security. We do not use third-party analytics trackers inside the app.

Information from coaches (if you are an athlete with a coach)

• If a coach invites you to APEX, they may enter your name and email to send you an invite. That information is used only to send the invitation.
• Once connected, your coach can view the performance data visible in their coaching dashboard (see Section 5).

3. How we use your data

We use your data to:

• Provide and operate the APEX service — display your logs, generate charts, track trends.
• Power AI-generated insights using the data you have logged. AI analysis runs on your data and is returned to you; your data is not used to train external AI models.
• Send injection reminders, onboarding emails, and subscription-related notifications you have opted into.
• Process payments and manage your subscription status through Stripe.
• Enforce our Terms of Service and prevent abuse.
• Respond to support requests.
• Improve the APEX platform (in aggregate and anonymized form only).

We do not sell your data. We do not use your health data for advertising. We do not share your identifiable data with third parties except as described in Section 6.

4. Health & sensitive data

Because APEX handles health-related information, we treat it with heightened care:

• Health data is stored in your account and accessible only by you (and coaches you explicitly connect with — see Section 5).
• We do not use your bloodwork, cycle data, or body composition data to make decisions that affect you outside the app.
• We do not share health data with insurers, employers, government agencies, or any third party for profiling purposes.
• AI processing of your health data (e.g., lab result analysis) is performed using the Claude API (Anthropic). Your data is sent to Anthropic's API solely to generate the response returned to you, subject to Anthropic's privacy policy. Anthropic does not use API inputs to train their models.

5. Coach–athlete data sharing

APEX offers a coaching feature where athletes can connect with a coach. If you are an athlete connected to a coach:

• Your coach can view data visible in their coaching dashboard: recent workouts, bloodwork panels, body comp logs, sleep scores, cycle history, and diet plans you have saved.
• Your coach can send you training programs, diet plans, notes, videos, and files through the platform.
• You connect to a coach voluntarily by using their referral link or entering their code. You may disconnect at any time by contacting support.
• Coaches are prohibited by our Terms of Service from misusing client data.

If you are a coach:

• Client data you view through APEX is subject to this privacy policy and must not be shared outside the platform without your client's consent.
• Invite emails you send on behalf of APEX are delivered via our email service (Resend) using the client email you enter.

6. Third-party services

APEX uses the following sub-processors and third-party services. Each handles your data only as necessary to provide their respective service:

• Supabase (database & authentication) — stores all user data in PostgreSQL databases hosted on AWS. Data is encrypted at rest and in transit. Supabase Privacy Policy
• Stripe (payments) — handles all billing. We receive subscription status and customer ID but never your raw card data. Stripe Privacy Policy
• Anthropic / Claude API (AI analysis) — receives your logged data to generate insights. Not used for model training. Anthropic Privacy Policy
• Resend (transactional email) — sends account, reminder, and onboarding emails to the address you registered with. Resend Privacy Policy
• Web Push (browser-native) — push notifications are delivered through your browser's push service (Google FCM for Chrome, Mozilla's service for Firefox, etc.). The payload is encrypted end-to-end.

We do not use Google Analytics, Facebook Pixel, or any advertising trackers.

7. Data retention & deletion

Active subscribers

Your data is retained for as long as your subscription is active.

After cancellation or lapse

If your subscription lapses or is cancelled:

• Your data is retained for 90 days from the lapse date, giving you time to resubscribe and recover it.
• After 90 days, your data is permanently and irreversibly deleted from our systems.
• We will email you at days 60 and 83 to remind you before deletion occurs.

Free trial

• Trial data is retained for 37 days from your trial start date (7-day trial + 30-day grace period).
• If you subscribe before the grace period ends, your trial data is preserved.

Account deletion

To delete your account and all associated data immediately, email apex.tracker.co@gmail.com with the subject line "Delete my account". We will process your request within 14 days and confirm by email when complete.

Progress photos

Progress photos are subject to additional retention limits based on your plan tier. See the app for current limits. Photos beyond the retention limit are automatically deleted on a rolling basis.

8. Security

We take reasonable technical and organizational measures to protect your data:

• All data transmitted between your browser and our servers uses TLS encryption (HTTPS).
• Data at rest is encrypted by Supabase (AES-256).
• Passwords are hashed by Supabase Auth — we never have access to your plaintext password.
• Row-level security policies restrict database access so users can only read and write their own records.
• Push notification payloads are encrypted end-to-end using the Web Push standard.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at apex.tracker.co@gmail.com.

9. Your rights

Depending on your location, you may have the following rights regarding your personal data:

All users

• Access: request a copy of the data we hold about you.
• Correction: correct inaccurate data through the app or by contacting us.
• Deletion: request deletion of your account and all data (see Section 7).
• Data portability: request an export of your data in a machine-readable format.
• Opt-out of emails: unsubscribe from non-essential emails using the unsubscribe link in any email, or by managing preferences in the app.

California residents (CCPA)

California residents have the right to know what personal information we collect, the right to delete it, and the right to opt out of its sale. We do not sell personal information. To exercise your rights, email apex.tracker.co@gmail.com.

EEA / UK residents (GDPR)

If you are located in the European Economic Area or United Kingdom, your personal data is processed under the following legal bases: contract performance (to provide the service), legitimate interests (security, fraud prevention), and consent (marketing emails). You have the right to lodge a complaint with your local data protection authority. To exercise any GDPR right, contact apex.tracker.co@gmail.com.

We will respond to all rights requests within 30 days.

10. Children's privacy

APEX is intended for users 18 years of age or older. The platform involves tracking of performance-enhancing compounds and medical lab data that is inappropriate for minors. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will terminate their account and delete their data. If you believe a minor has created an account, contact us at apex.tracker.co@gmail.com.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by email (to the address on your account) and update the "Last updated" date at the top of this page. Continued use of APEX after the effective date constitutes acceptance of the updated policy.

12. Contact us

For privacy-related questions, data requests, or concerns:

We aim to respond to all privacy inquiries within 5 business days.