ZenithZenith: Fitness & Nutrition

Privacy Policy

Effective date: September 3, 2026

What changed in this version: expanded state privacy rights and added an appeals process; added a separate Consumer Health Data Privacy Policy; added rights and transfer information for the EEA, UK, Canada, Australia, and Brazil; named four service providers not previously listed; and described administrator access in the security section.

This Privacy Policy explains how Zenith: Fitness & Nutrition (“Zenith,” “we,” “us”) collects, uses, and shares your information when you use our mobile app and website. Zenith is operated by J&O Sales LLC, 10153 E Branch Rd, Rochelle, IL 61068, USA. Questions: support@josalesllc.net. We are the data controller for the information described here. This policy works together with our Terms & Conditions, Cookie Policy, and Additional Disclosures.

We do not sell your personal information, and we do not use your health, fitness, or location data for advertising.

1. Information you provide

To provide its features, Zenith stores the information you choose to enter:

  • Account & profile: email, username, first and last name, age, biological sex, height, current and target weight, fitness goal, and an optional profile photo.
  • Nutrition data: foods and meals you log, calories and macros, daily targets, saved meals and recipes, grocery and pantry items, and meal photos.
  • Training data: workouts and exercises you log (sets, reps, weights, distances, durations, calories burned), workout photos, routes, and exercise history.
  • Health & wellness data: water intake, fasting times, body-weight history, steps, sleep, heart rate, progress entries, and goals.
  • Dietary & medical information you choose to provide: allergies, intolerances, medical conditions, health notes, and supplements.
  • Community content: posts, comments, messages, and photos you share in feeds or private communities.

2. Information collected automatically

  • Device & usage data: app version, device type and OS, and basic usage events used to operate, secure, and improve the Service.
  • Push notification identifier: if you enable notifications, a device push identifier (via OneSignal) so we can send the alerts you opt into.
  • Website analytics, session recording & error reports: see Section 6.

3. Apple Health

With your permission, Zenith reads activity data from Apple Health — steps, active energy, sleep, workouts, and body weight — to display your daily activity, power step and sleep challenges, and keep your weight history current. When you log your body weight in Zenith, we write that value back to Apple Health so your records stay in sync. This data is used only to provide these features. It is never used for advertising or data-mining, never sold or shared with third parties, and never stored in iCloud by Zenith. You can revoke access anytime in iOS Settings → Privacy & Security → Health.

4. Location

When you record an outdoor activity (run, walk, or bike), Zenith collects precise GPS location to map your route and calculate distance, pace, and elevation. To keep your route accurate when your screen is off or your phone is in your pocket, Zenith continues collecting location in the background — but only while a workout you started is actively recording, and it stops the moment you end the workout. Zenith never uses GPS or tracks your precise location outside an active workout. This data is not used for advertising or tracking and is not sold or shared. You can revoke access anytime in iOS Settings → Privacy & Security → Location Services. Separately from GPS, and not covered by the location permission above, our analytics and error-reporting providers receive your IP address and derive an approximate location from it — typically your city or region. Section 6 describes which providers these are and when they are used.

5. How we use your information

We use your information to operate the features you request — tracking nutrition and training, generating meal plans, grocery lists, and AI-assisted suggestions, mapping outdoor workouts, displaying progress and challenges, sending notifications you opt into, processing subscriptions, providing support, keeping the Service secure, and complying with law. Where you join a private community, we share the relevant fitness and nutrition information with that community's owner as described in Section 7.

6. Cookies, website analytics & error reporting

Our website uses cookies. Essential cookies are needed for the site to function (e.g., remembering your cookie choice and securing checkout). With your consent, we also use analytics cookies to understand how visitors use the site so we can improve it. On your first visit we show a cookie banner with equal “Accept” and “Reject” options; analytics load only if you accept. If you reject, or before you answer, no analytics provider is loaded and no analytics cookie is set. You can change your choice at any time by clearing the site's stored preference in your browser. The categories we actually load, and what we do not load, are listed in our Cookie Policy.

We use two analytics providers on the website, both only with your consent:

  • Google Analytics — aggregate website statistics: pages viewed, visits, approximate location (country/region), device and browser type, and how you arrived at the site.
  • PostHog — product analytics and session recording. It receives the pages you view, clicks and taps on the site, the steps you take through the pricing and checkout flow, your device and browser type, an approximate location derived from your IP address, and a randomly generated visitor ID. If you are signed in, it also receives your email address, name, and account role, so that your activity on this website and in the Zenith app is recognised as the same account. We remove query strings from the web addresses we send it, so information carried in a link — such as a checkout session reference — is not recorded.

Session recording. With your consent, PostHog records a playback of your visit — the pages, scrolling, and clicks — so we can see where the site is confusing or broken. Everything you type is masked before it leaves your browser. The contents of form fields, including your name, email address, and any message you write to us, are replaced with placeholder characters in the recording and are never transmitted to or stored by PostHog. Payment card details are entered on Stripe’s own pages, which we do not record at all.

Error reporting (Sentry). Separately from analytics, and regardless of your cookie choice, we use Sentry to record technical errors on the website so we can fix them — for example, a checkout button that fails, or a contact form that does not send. An error report contains the error message and the technical location in our code where it happened, the address of the page you were on with its query string removed and replaced by a marker, your browser and operating system as reported by your browser (the User-Agent), the name of the operation that failed, and — because the report is sent over an internet connection — your IP address, from which Sentry derives an approximate location, typically your city or region. In the Zenith mobile app, a report also contains a short code derived from your email address, used only to tell whether several reports came from the same person. It does not contain your name, your email address itself, the contents of any message or form you filled in, your payment details, or a cookie or advertising identifier. Sentry sets no cookie and is not used for analytics, profiling, or advertising. We rely on it under our legitimate interest in keeping the Service secure and working (Section 11); it is not consent-based, because a site that cannot detect its own failures cannot be operated safely. If you would rather it did not run at all, most browser content-blockers will block it, and the website will work normally.

The Zenith mobile app uses the same product-analytics provider (PostHog), also with input masking on session recording, and the same error reporting (Sentry). Neither the app nor the website uses third-party advertising cookies, and we do not use analytics or error data for advertising.

7. How we share information & third parties

We do not sell your data. We share information only with service providers that help us run Zenith, and only as needed:

  • Stripe — payment processing for website subscriptions (handles your card details directly; we don't store them).
  • Apple & Google / RevenueCat — in-app purchases and subscription management on iOS/Android.
  • OneSignal — delivering push notifications you opt into.
  • Google Analytics — website usage analytics (with your consent; Section 6).
  • PostHog — product analytics and session recording for the website and the app (with your consent; Section 6). Recordings are masked so typed input is never transmitted.
  • Sentry — technical error and crash reporting for the website and the app, so we can find and fix failures. Receives error details, a redacted page address, your browser/OS, your IP address (from which it derives an approximate location), and — in the mobile app — a short code derived from your email address; never your name, your email address itself, message contents, or payment details (Section 6).
  • Google (Gemini API) — generates meal plans, food and photo analysis, workout suggestions, and AI-coach responses from the inputs you submit. It receives the content of that request and returns the result. Anthropic (Claude) — used only by us, for drafting replies to support and contact messages; it receives the message you sent us, never your food, workout, health, or location data. Our agreements with both providers require that the data we send is not used to train their models.
  • Apple Health — on-device, with your permission (Section 3).
  • Base44 — our application hosting and database provider. Your account and everything you log is stored in this system, under a contract that permits its use only to provide the Service to us.
  • USDA FoodData Central — the US government nutrition database. When you search for a food, it receives the search term so it can return nutrition figures. It does not receive your identity or your logs.
  • UPCitemdb — a product-barcode database. When you scan a barcode, it receives the barcode number so it can return the product. It does not receive your identity or your logs.
  • Google (Gmail and Google Calendar) — only for coaches, and only if a coach connects their own Google account in the Coach Hub. With that connection, Zenith reads the connected mailbox's message threads and calendar so a coach can manage client correspondence and sessions in one place, and sends a message or creates an event only when the coach approves that specific action. A coach's connected Google data is visible only to that coach, is never used for advertising, and is never used to train any AI model. Disconnecting the account in the Coach Hub ends the access. Zenith's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Clients of a coach are not asked for, and do not give, any Google permission; this applies to coaches only.
  • Stripe Connect — for coaches who choose to take payment through Zenith. Stripe collects the identity, bank, and tax information it needs to pay a coach out and to meet its own legal obligations, directly from that coach; we receive only the resulting account status and payment records. See Section 8 of our Additional Disclosures.
  • Private community owners / coaches — see Section 2 of our Additional Disclosures: when you join a private community, the owner can see the fitness and nutrition information you log, but never your login credentials, password, or payment details. You can leave at any time.

We may also disclose information if required by law, to protect rights and safety, or in connection with a business transfer.

8. Data retention & deletion

You can delete your account and its data at any time:

  • In the app: Profile → Settings → Delete Account.
  • By email: email support@josalesllc.net from your account address; we action requests within 30 days.

Deletion removes your profile and the data you created (food and workout logs, weight and progress history, goals, saved meals, recipes, plans, pantry/grocery lists, dietary and health notes, allergies, supplements, and community posts/comments/messages). We may retain limited records where the law requires — e.g., billing records held by Stripe for tax, accounting, and fraud-prevention — kept only as long as required and not used to re-create your account. Backups are overwritten on a rolling basis and fully purged within 90 days. You can also export your data from within the app (Profile → Export My Data).

9. Your privacy rights

A note first, because it decides most of this page. We do not sell your personal information, and we do not share it for cross-context behavioral advertising. Zenith carries no advertising SDK, runs no ad network, and builds no advertising profile. Several of the rights described below exist to stop a company from doing something we do not do; we describe them anyway so you know they apply.

9.1 Rights everyone has, wherever you live

Regardless of where you live, you can do all of the following, and we will not treat you differently for doing any of it:

  • See and export your data — Profile → Export My Data in the app, at any time.
  • Correct it — every profile and log entry is editable in the app.
  • Delete it — Profile → Settings → Delete Account, or email us.
  • Withdraw a consent — Apple Health and location permissions in your iOS settings, notifications in the app, analytics cookies through the cookie banner on our website.
  • Ask us anything about it — support@josalesllc.net.

9.2 California (CCPA/CPRA)

Notice at collection. We collect the categories of personal information listed in Sections 1 and 2 of this policy. In the statutory vocabulary these are: identifiers (name, username, email, device push identifier); customer records (account details); commercial information (subscription and purchase records); internet or network activity (app and website usage, and, with your consent, analytics and session recordings); geolocation data (precise location during an outdoor workout you record; approximate location derived from your IP address by our analytics and error-reporting providers); visual information (profile, meal, workout, and progress photographs); and sensitive personal information, specifically health and medical information — your weight and body measurements, meals and nutrition, workouts, sleep and heart rate, allergies, intolerances, medical conditions, health notes, supplements, and progress photographs — and precise geolocation during a recorded outdoor workout. We collect each category for the purposes described in Section 5, keep it for the periods described in Section 8, and do not collect categories beyond those listed.

Sensitive personal information — your right to limit. California gives you the right to limit our use of sensitive personal information to what is necessary to perform the service. We already operate at that limit. We use your health and location data only to provide the features you asked for, never to infer characteristics about you, never for advertising, and never for any purpose you would not expect from the feature in front of you. There is therefore no separate “Limit the Use of My Sensitive Personal Information” toggle, because there is no additional use to switch off. If you would like us to stop using a particular category altogether, delete those entries or your account, or write to us and we will do it.

No sale, no sharing. We do not sell personal information and have not sold it in the preceding twelve months. We do not share it for cross-context behavioral advertising and have not done so in the preceding twelve months. We do not sell or share the personal information of anyone we know to be under 16. No “Do Not Sell or Share My Personal Information” link is therefore required, and none is offered — not as a withholding, but because there is nothing behind it.

Your California rights are to know, to access, to a portable copy, to correct, to delete, to limit the use of sensitive personal information, to opt out of sale or sharing, to opt out of automated decision-making, and not to be discriminated or retaliated against for exercising any of them. We do not offer financial incentives for personal information.

Authorized agents. You may use an authorized agent. We will ask for written proof of their authority signed by you, and we may ask you to confirm the request directly with us.

9.3 Other US states

If you live in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Rhode Island, Indiana, Kentucky, or any other state with a comprehensive consumer privacy law, you have the rights that law gives you, which will include most or all of the following:

  • to confirm whether we process your personal data and to access it;
  • to correct inaccuracies;
  • to delete it;
  • to obtain a portable copy in a usable format;
  • to opt out of targeted advertising, of the sale of personal data, and of profiling in furtherance of decisions producing legal or similarly significant effects — we do none of these three, so there is nothing to opt out of;
  • in Oregon and Minnesota, to obtain a list of the specific third parties to whom we have disclosed personal data — write to us and we will provide it;
  • in Minnesota, to question the result of profiling — not applicable, as we do not profile;
  • in Maryland, we additionally do not sell sensitive data at all and collect only what is reasonably necessary to provide the Service you asked for.

Sensitive data consent. Health data and precise geolocation are sensitive data under these laws and we process them only with your consent. You give that consent by choosing to enter health information, by granting Apple Health permission, and by granting location permission for a workout you start — each of which is optional, each of which is separately revocable, and none of which is required to create an account. Zenith's core tracking features are the whole reason the data exists; if you withdraw consent, the features that depend on it stop, and you can delete the data outright.

How to exercise these rights and how fast we answer. Email support@josalesllc.net from the address on your account with Privacy Request in the subject line, or use the in-app controls in Section 9.1. We verify a request by confirming it comes from the account's own email address. We will respond within 45 days. If we need longer we will tell you within those 45 days, explain why, and take no more than a further 45 days.

Appeals. If we refuse a request, we will tell you why and how to appeal. To appeal, reply to that decision or write to support@josalesllc.net with Privacy Appeal in the subject line. Someone who did not make the original decision will review it and we will reply in writing within 45 days with our reasons. If we deny the appeal, we will give you a working method of contacting your state Attorney General to complain — and you may contact them at any time regardless of what we decide.

9.4 Consumer health data (Washington, Nevada, Connecticut)

If you live in Washington, Nevada, or Connecticut, additional rights apply to the health data you keep in Zenith, and they are set out in full in our Consumer Health Data Privacy Policy, which forms part of this policy.

10. If you use Zenith outside the United States

Zenith is built, operated, hosted, and directed to users in the United States. Our pricing is in US dollars, our support is provided from the United States, and we do not market Zenith to, or aim it at, people in any other country. If you use Zenith from outside the United States, you are choosing to send your information to the United States, where it will be stored and processed and where data-protection law differs from your own. The sections below describe how we treat your information if you are covered by one of the laws named, whether or not we are established in that country.

Europe and the United Kingdom (GDPR and UK GDPR). Where the GDPR or UK GDPR applies to you, J&O Sales LLC is the controller of your personal data and our legal bases are these, per purpose: performance of our contract with you for running your account, storing the logs and plans that are the Service, and processing your subscription; your consent for Apple Health data, for precise location during a workout, for push notifications, for website analytics and session recording, and for the health data you choose to enter, which is special-category data under Article 9(2)(a); our legitimate interests in keeping the Service secure and working, for error reporting, abuse prevention, and fraud prevention; and compliance with a legal obligation for tax, accounting, and records we are required to keep. You have the rights of access, rectification, erasure, restriction, objection, portability, and withdrawal of consent at any time without affecting what we did before you withdrew it. Exercise any of them at support@josalesllc.net, or in the app as described in Section 9.1. You also have the right to complain to your national supervisory authority, or to the UK Information Commissioner's Office at ico.org.uk.

International transfers. Your data is processed in the United States, for which the European Commission has issued an adequacy decision only for organizations certified under the EU-US Data Privacy Framework — we are not certified under it. Where we transfer personal data out of the EEA, the UK, or Switzerland, we rely on the European Commission's Standard Contractual Clauses, and for the UK on the UK International Data Transfer Addendum, as the transfer mechanism in our agreements with the service providers listed in Section 7, together with the additional safeguards described in Section 11. You can ask us for information about the mechanism relied on for a particular provider at support@josalesllc.net.

EU/UK representative. Because Zenith is directed to users in the United States and is not offered to or aimed at people in the EEA or the United Kingdom, we have not appointed an Article 27 representative. If that changes, we will appoint one and name them here before it does.

Canada (PIPEDA). If you are in Canada, we collect, use, and disclose your personal information only for the purposes identified in this policy and with your knowledge and consent, which you may withdraw at any time subject to legal or contractual restrictions and reasonable notice. You may request access to the personal information we hold about you and challenge its accuracy or completeness by writing to support@josalesllc.net, and we will respond within 30 days. Your information is stored and processed in the United States and is subject to lawful access requests there. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Australia (Privacy Act 1988). If you are in Australia, we handle your personal information in accordance with the Australian Privacy Principles. We collect health information only with your consent and only where it is necessary for the Service you have asked for. You may request access to, or correction of, your personal information by writing to support@josalesllc.net, and we will respond within a reasonable period. Your information is disclosed to the overseas recipients listed in Section 7 and is stored in the United States; by using Zenith from Australia you consent to that disclosure. If you believe we have breached the Australian Privacy Principles, write to us first at support@josalesllc.net; if you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Brazil (LGPD). If you are in Brazil, J&O Sales LLC is the controlador of your personal data. Our legal bases are the execution of our contract with you, your consent for health data (dados pessoais sensíveis) and for the optional permissions described above, our legitimate interests in operating and securing the Service, and compliance with legal obligations. You have the rights to confirmation of processing, access, correction, anonymization or deletion of unnecessary or excessive data, portability, information about the parties with whom we share data, information about the consequences of refusing consent, and revocation of consent — exercisable at support@josalesllc.net. International transfers of your data to the United States are made under the standard contractual clauses in our agreements with the providers in Section 7 and, where applicable, with your specific consent. You may complain to the Autoridade Nacional de Proteção de Dados at gov.br/anpd.

11. Security, staff access, and breaches

We protect your information with encryption in transit, access controls, and per-account data isolation: our systems are configured so that an account can read only its own records. Two exceptions exist and you should know about both. A member of our staff acting as an administrator can access records where it is necessary to provide support you have asked for, to investigate a fault or a safety or security problem, or to comply with the law — this access is limited to those purposes. And a coach or private community owner you have chosen to join can see the fitness and nutrition information you log, as described in Section 7 and in our Additional Disclosures. No method of transmission or storage is completely secure, but we work to protect your data and to limit who can reach it. If a breach affects your personal information, we will notify you and the relevant authorities as and when the law requires.

12. Children

You must be at least 13 to use Zenith. Zenith is not intended for children under 13, and we do not knowingly collect their information. If we learn we have, we will delete it. Users aged 13–18 (or the age of majority where they live) should use Zenith only with a parent or guardian's involvement.

13. Changes to this policy

We may update this policy from time to time. We will revise the “Effective date” above and, for material changes, provide additional notice. Continued use of Zenith after an update means you accept the revised policy.

14. Contact

Questions or requests: support@josalesllc.net.

J&O Sales LLC — 10153 E Branch Rd, Rochelle, IL 61068, USA — support@josalesllc.net

We use analytics cookies to understand how visitors use our site. Privacy Policy · Cookie Policy.