Privacy Policy

Effective November 12, 2026

Who we are

Chalk & Chain is operated by RH LLC, doing business as Chalk & Chain (“we” or “us”). Questions about this policy or your data go to josh@chalkandchain.com. If you need a mailing address, ask at that email and we'll send one.

Using the app without an account

Without an account, your plans, sessions, settings, and log are saved in your browser or the app on your device (local storage). They aren't sent to us. Clearing your browser data or uninstalling the app removes them.

What we collect if you create an account

• Account details: your email address, the name you enter (optional), and your password, which we store only as a one-way hash. We can't read your password.
• Your synced workout log: when you're signed in, a copy of the log on your device (plans, sessions, sets, settings, and any notes you enter, such as a limitation you tell the coach about) is stored with your account so it syncs to your other devices.
• Sign-up record: the date you created your account and the version of these terms and this policy you agreed to, including that you confirmed you're 18 or older.
• Security and server logs: like most websites, our hosting records ordinary request data such as IP address, browser type (user agent), and times of sign-in, so we can keep the service running and stop abuse. To limit repeated sign-in attempts, we keep short-lived counters made from a scrambled (hashed) form of the email or IP address.
• Account emails: we send emails you need to use your account: confirming your email, password resets, a notice when your password changes, and a notice if your account is closed. We don't send marketing email.

We don't ask for your date of birth, location, or health records, and we don't use advertising or analytics trackers on the site. If we add analytics later, we'll update this policy first.

Why we use it

• To create your account, let you sign in, and confirm your email.
• To sync your workout log across your devices.
• To operate, secure, and fix the service, including stopping spam, fake sign-ups, and break-in attempts.
• To reply when you contact us, and to meet legal obligations.

Who else handles it

We use a small number of service providers that process data for us, only to run Chalk & Chain:

• Cloudflare hosts the website and app and stores account data and synced logs in its database service.
• Cloudflare Turnstile checks that sign-up, sign-in, and password-reset requests come from a person and not a bot. It may look at your browser and connection to do that.
• An email delivery service sends account emails on our behalf. It receives your email address and the message.

We don't sell or rent your personal information, and we don't share it for advertising. We don't use your log or server logs to show you ads. We may share information if the law requires it, to protect people's safety, or as part of a sale or reorganization of the business, in which case this policy would still apply to your data.

Chalk & Chain accounts and workout data are kept separate and are not shared with any other RH LLC brand.

Cookies and local storage

When you sign in, we set one secure, HTTP-only cookie that keeps you signed in. The app also uses your device's local storage to save your log and preferences, such as whether you've seen the fitness notice. We don't use advertising cookies.

How long we keep it

• Account details and your synced log: for as long as your account is open.
• Email confirmation links expire after 24 hours and password-reset links after 60 minutes. Each works once.
• Sign-in attempt counters: about 2 days.
• Staff security records (for example, a record that a staff member changed an account's status): up to 12 months. These contain an account ID, not your workout log.
• Hosting logs kept by Cloudflare: for a limited period set by Cloudflare's logging tools.

Your choices: review, correct, delete

• Review or correct: your log is in the app. To see what's stored with your account, or to fix your email or name, email josh@chalkandchain.com.
• Stop syncing: sign out. Syncing stops, and the log stays on your device.
• Close your account: on the Account screen in the app, choose Close account and confirm with your password. Closing signs you out everywhere, turns off sign-in, and stops cloud sync. You can also choose to delete your synced log from our servers right away.
• Delete everything: email josh@chalkandchain.com from the address on the account and we'll delete your remaining account data within 30 days. We keep only what we truly need for security or legal reasons, for the periods listed above.

Depending on where you live, you may have other rights over your data. Email us and we'll help. We won't treat you differently for asking.

Do Not Track

Some browsers send a “Do Not Track” signal. Chalk & Chain doesn't track you across other websites and doesn't let third parties do so, so we treat every visit the same way whether or not the signal is on.

Children

Chalk & Chain is not directed at children under 13, and accounts are for people 18 and older. We don't knowingly collect personal information from children under 13. If you think a child has created an account, email josh@chalkandchain.com and we'll delete it.

Security

We use encrypted connections (HTTPS), hashed passwords, single-use email links, sign-in attempt limits, and human verification. No system is perfectly secure, so use a password you don't use anywhere else.

Where data is processed

Chalk & Chain is run from the United States, and Cloudflare may process data in the United States and other countries where it operates.

Changes to this policy

If we change this policy, we'll update the effective date at the top of this page. For a significant change, we'll also show a notice in the app or email account holders before it takes effect.

Contact

RH LLC, doing business as Chalk & Chain. Email josh@chalkandchain.com. Also see our Terms of Use.