Cyber Strength Performance

Privacy Policy

Last updated: September 13, 2026

1. Introduction

Cyber Strength Performance ("we," "us," "our," or "Company") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform, including our website and mobile applications (collectively, the "Service").

2. Information We Collect

Information You Provide Directly

  • •Account registration information (name, email, password)
  • •Profile information (age, weight, height, fitness goals, injury history)
  • •Workout logs, personal records, and performance data
  • •Messages and communications with coaches or other users
  • •Payment and billing information (processed securely through Stripe)

Automatically Collected Information

  • •Device information (IP address, browser type, operating system)
  • •Usage data (pages visited, features used, time spent)
  • •Cookies and similar tracking technologies
  • •Location data (with your permission)

3. How We Use Your Information

  • •Providing, maintaining, and improving the Service
  • •Processing transactions and sending related information
  • •Sending technical notices, security alerts, and support messages
  • •Responding to your inquiries and providing customer support
  • •Personalizing your experience and providing recommendations
  • •Analyzing usage patterns to improve our Service
  • •Complying with legal obligations and protecting our rights

4. Data Security

We implement comprehensive security measures to protect your information, including:

  • •End-to-end encryption for sensitive data (health information, payment data)
  • •Secure HTTPS connections for all data transmissions
  • •Regular security audits and penetration testing
  • •Restricted access to personal information (need-to-know basis)
  • •Employee training and confidentiality agreements

However, no method of transmission over the Internet is 100% secure. We cannot guarantee absolute security.

5. Information Sharing & Disclosure

We do not sell your personal information. We may share your information in the following limited circumstances:

  • •With your consent: When you authorize us to share information with coaches, therapists, or other users
  • •Service providers: Trusted vendors who assist in operating the Service (payment processors, email providers) under strict confidentiality agreements
  • •Legal requirements: When required by law, court order, or government request
  • •Business transfers: In the event of merger, acquisition, or sale of assets
  • •Protect rights: To protect the security, rights, and property of our company, users, and the public

Google User Data Disclosure

Cyber Strength Performance integrates with Google APIs to power calendar scheduling and video sessions for coaches. This section describes, in accordance with Google's API User Data Policy, exactly how our application accesses, uses, stores, and shares Google user data.

Google API Scopes We Request

When a coach connects their Google account, we request the following OAuth scopes:

  • •Google Calendar — read/write events (https://www.googleapis.com/auth/calendar.events): Allows the app to create, view, update, and delete calendar events on the connected coach's primary calendar.
  • •Google Meet — conference data generation: Allows the app to request Google Meet conference data (a joinable video link) when creating or updating a calendar event, so a Meet link is generated for virtual sessions.

We request only the minimum scopes necessary to provide the scheduling and virtual session features. We do not request scopes for Gmail, Google Drive, Google Contacts, or any other Google service for this integration.

What Google Data We Access

  • •Calendar event details (title, date/time, duration, location, description) for events created by the app and, during two-way sync, for events on the coach's calendar.
  • •Attendee email addresses associated with calendar events the app creates (the coach's clients, when invited).
  • •Google Meet conference data (the join URL and conference ID) generated for virtual session events.
  • •The connected Google account's email address (used as the calendar ID for syncing).

How We Use Google Data

  • •Scheduling: Creating calendar events for training sessions booked through the Personal Training Hub so sessions appear on the coach's Google Calendar.
  • •Virtual sessions: Generating Google Meet links for virtual onboarding, check-in, and other video appointments.
  • •Two-way sync: Reflecting sessions booked in the app on the coach's calendar and importing external calendar events back into the app for a unified schedule view.
  • •Notifications: Including the generated Meet link in automated session confirmation and reminder emails sent to the coach and client.

We do not use Google user data for advertising, for training or improving our AI models, or for any purpose unrelated to providing the calendar and virtual session features. We do not transfer Google user data to any other application or use it for our own independent benefit beyond providing the integration.

Where Google Data Is Stored

We store only the minimum data needed to maintain the integration, in our secure database:

  • •TrainingSession records: The Google Calendar event ID (google_calendar_event_id) and the generated Google Meet join URL (meet_link), so we can update or remove the event if a session is rescheduled or cancelled.
  • •GoogleCalendarSyncState records: A Google Calendar incremental sync token (sync_token), the connected calendar email, and the timestamp of the last sync — used to efficiently detect calendar changes for two-way sync.
  • •OAuth access and refresh tokens, managed securely by the platform's connector infrastructure to maintain the connection.

We do not store the full content of a coach's calendar. We only store the event IDs and Meet links for sessions that originate from our app, plus the sync token required for incremental sync.

Data Retention & Deletion

Google user data is retained for as long as the coach's Google Calendar integration remains connected and their account is active. When a coach disconnects their Google account (via Coach Settings → Integrations, or by removing the app from their Google account), we delete the stored sync token and stop accessing their calendar. Calendar event IDs and Meet links associated with completed or cancelled sessions are retained only as historical references within those session records and are removed when the session records themselves are deleted per our standard retention policy.

Sharing of Google Data

We do not sell, rent, or share Google user data with any third party. Google data accessed through this integration is used solely to provide the calendar and virtual session features to the connected coach. Calendar event details and Meet links are visible to the coach and, where relevant, to the client invited to that session (for example, the Meet link in a confirmation email). We do not disclose Google user data to any other application, advertiser, or external service.

How to Revoke Access

Coaches can revoke our access to their Google data at any time, in two ways:

  • •In the app: Navigate to Coach Settings → Integrations tab and disconnect your Google Calendar. This immediately stops all calendar access and Meet link generation.
  • •In your Google account: Visit myaccount.google.com/permissions (Google Account → Security → Third-party apps with account access), select "Cyber Strength Performance," and click "Remove access."

After revocation, existing calendar events created by the app remain on your calendar (you can delete them directly in Google Calendar), but we will no longer read or modify any Google data.

6. Your Rights & Choices

Depending on your location, you may have the following rights:

  • •Right to access: Request a copy of your personal information
  • •Right to rectification: Correct inaccurate or incomplete information
  • •Right to erasure: Request deletion of your data ("Right to be Forgotten")
  • •Right to portability: Obtain your data in a structured, machine-readable format
  • •Right to opt-out: Opt out of marketing communications and cookies
  • •Right to object: Object to certain data processing activities

To exercise these rights, contact us at privacy@cyberstrengthperformance.com.

7. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes outlined in this Privacy Policy. For most users, this means we retain data while your account is active and for a reasonable period afterward for legal, accounting, and reporting purposes. You can request deletion of your account and associated data at any time via your account settings.

8. GDPR & CCPA Compliance

For EU/EEA Users (GDPR): We process your data on the basis of your consent and legitimate interests. You have the right to withdraw consent at any time. We have appointed a Data Protection Officer (DPO) to oversee data protection compliance.

For California Users (CCPA): You have rights to know, delete, and opt-out of sales of your personal information. Cyber Strength Performance does not sell personal information.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the features we offer. When we make material changes — particularly to how we access, use, store, or share Google user data or other personal information — we will:

  • •Update the "Last updated" date at the top of this page.
  • •Notify users of material changes via in-app notification and/or email before the changes take effect, where reasonably practicable.
  • •Continue to honor the privacy choices you have made unless we obtain your consent to a change that is less protective of your data.

We encourage you to review this page periodically to stay informed about how we protect your information.

9. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact:

Cyber Strength Performance Privacy Team

Email: privacy@cyberstrengthperformance.com

DPO Email: dpo@cyberstrengthperformance.com

Cyber Strength Performance, LLC — An Iowa Limited Liability Company. Contact us at privacy@cyberstrengthperformance.com for our mailing address.