Legal

Privacy Policy

Effective September 12, 2026 · Maximum Capacity, LLC

Maximum Capacity is a personal-training app used by a training business (“Company”, “we”) with its trainers and clients. This policy explains what the app collects, why, who handles it, how long it is kept, and what you can do about it. It is written to be read.

1. Who is responsible

Maximum Capacity, LLC (the training business whose trainers invite you) is the data controller: it decides why and how your data is used. The software developer who builds and operates the app on Company's behalf is a data processor, acting only on Company's instructions under a written agreement. Contact for everything in this policy: support@maxcaptraining.com.

2. What we collect

The app is invitation-only; there is no public sign-up. Everything below exists because your trainer invited you and you accepted.

We do not collect precise location, contacts, calendars, health-platform data (Apple Health, Google Fit, wearables), or payment card details. There is no payment processing in the app.

3. How it is used

• To run your training relationship: showing you and your trainer your credits, schedule, workouts and macros.
• To send notifications you can expect: session reminders, confirmations, credit expiry warnings, announcements from your trainer, and account notices. Reminder categories can be turned off in the app; account and security notices cannot.
• To answer questions you ask the assistant, using only data you can already see in the app (see §4).
• To let Company run its business: a monthly statement of credits sold, an audit trail of staff actions, and a complete export of Company's own data.
• To keep the service secure and within its limits (abuse prevention, daily AI caps).

We do not sell personal data, and we do not use it for advertising or profiling.

4. AI processing — Gemini on Vertex AI

Two features use Google's Gemini models through Vertex AI in Google Cloud, in Company's own Google Cloud project. Google Cloud's terms apply: under Vertex AI's data-governance commitments, prompts and outputs are not used to train Google's models.

Food recognition

When you ask for a nutrition estimate, we send Gemini: the food description you typed and, for barcodes we could not resolve from Open Food Facts, the barcode number (and a photo of the label, only if you chose to attach one). Nothing else — no name, no history. The result is an estimate you confirm before it is saved. The app no longer offers photographing a plate; any plate photos taken with earlier versions are covered by the retention rule below.

The assistant

When you send a message, we send Gemini: your message, the recent turns of that conversation, and — only when the assistant asks for it through defined tools — the specific data needed to answer, such as your current credit balance, upcoming sessions, recent workouts, or today's macro totals. A trainer's assistant can additionally read the data of the trainer's own clients. The assistant cannot change anything itself: it proposes, and you apply. Conversations are stored so you can revisit them and can be cleared by you (clients) or by staff (see §8).

Barcode lookups go to Open Food Facts (a public, non-profit database) with the barcode number only.

5. Processors and where data lives

Each provider acts as a processor or independent service under its own terms. Data is stored in the United States.

6. No analytics, no advertising

The app and this website contain no analytics SDK, no advertising SDK, and no third-party trackers. We do not use cookies on this website. Crash reports are not collected by a third-party service. The only third-party code on this website is Google Fonts and, on the contact form when you focus it, reCAPTCHA Enterprise to stop spam.

7. Retention

• Food photos (label photos, and plate photos from earlier app versions) are deleted automatically 30 days after they are taken. The macro entry (text and numbers) remains.
• Data exports and generated files (e.g. a revenue CSV) are deleted after 1 day.
• Invites expire after 14 days and store only a hash of the code.
• Everything else is kept for as long as your account exists, because it is your training record. It is destroyed when your account is deleted (§8).
• Audit log entries about staff actions are kept as Company's business record; after your account is deleted they reference an identifier, not a live profile.

8. Deleting your account

You can delete your account yourself, in the app, at any time: Profile → Account → Delete account. You will be asked to type a confirmation. Deletion is immediate and cannot be undone. It destroys:

• your profile and sign-in identity (the authentication user is removed last, so a partial failure can be retried);
• your client record, including your credit ledger, scheduled sessions, workouts, macro entries and food photos, and assistant conversations;
• your notification tokens, notification history and AI-usage counters.

Your trainer is notified that the account was deleted. If you are a trainer, you must release or reassign your active clients first; your pending invites are revoked. If you no longer have access to the app, see Delete your account for how to ask us to do it.

9. Your choices and rights

• See and correct your data in the app; your trainer can correct records they entered.
• Notifications: reminder categories are switchable in Profile → Notifications, and at the OS level.
• Assistant: you can clear your conversation history in the assistant's settings; you can simply not use it.
• Sign-in methods: you can link or unlink Google/Apple in Profile → Sign-in methods.
• Delete: §8.
• Depending on where you live you may have statutory rights of access, portability, rectification, erasure, restriction, and objection, and the right to complain to a supervisory authority. Write to support@maxcaptraining.com; we answer within 30 days.

10. Security

Data is encrypted in transit (TLS) and at rest by Google Cloud. Access is enforced by per-document security rules so a client can only read their own record and a trainer only their own clients; privileged actions run in server-side functions and are written to an audit log. Accounts are invitation-only. Email/password accounts must verify their email. No system is perfectly secure; if we learn of a breach affecting you, we will tell you.

11. Age

The service is for adults. You must be 18 or older to hold an account. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and it will be deleted.

12. Changes and contact

If this policy changes materially, we will notify you in the app before the change takes effect. The effective date at the top is the version you are reading.

Maximum Capacity, LLC · support@maxcaptraining.com