Privacy policy.

Eumorphic is a software service operated by Inexcelsis, LLC (d/b/a NanoScript), a Florida limited liability company. This policy explains what data Eumorphic keeps, why, who it is shared with, and how you delete it. It covers two groups: the trainers who open a workspace, and the people (clients and prospects) who deal with that trainer through Eumorphic.

1. Data we keep

From trainers: name, email, password (a hash only, never the text), phone if you add one, business name and address, the workspace address, logo and colors, and everything you create in the console: clients, workout and meal plans, forms, message templates, packages, and appointments. If you sign in with Google or Microsoft, we keep that account's id, your name, and your email. If you use a passkey, we keep its public key, never the private one.

From the trainer's clients: name, email, phone, goals, level, injuries, training history, measurements, progress photos, workout, food, water, and habit logs, check-ins, form answers, and the messages they exchange with their trainer. Journal entries stay private to the client unless they choose to share one with their trainer.

From prospects who message a connected account: when someone sends a direct message to the Facebook Page, Instagram account, or X account the trainer connected, we keep the text, the id that network gives the sender for that account, and the time.

From connected social accounts: the page or account access token, encrypted, and basic details such as the page name and username. We never receive your Meta or X password.

While you use the service: the IP address and browser of each signed-in session, for account security and rate limiting; an audit log of security actions in the console; and, if you turn on notifications, your browser's push subscription.

On your device: a session cookie that keeps you signed in, a cookie with your chosen language, and in browser storage your language, light or dark theme, and whether you closed notices such as the welcome or the install card. We use no advertising cookies and no third-party analytics.

2. What we use it for

Only to run the service: show the console and the client app, build plans, receive and send direct messages, send account emails and notifications, bill the subscription, and protect accounts. We do not sell data and do not use it to train AI models.

3. Who we share it with

Each provider receives only what its job needs:

• Anthropic: writes meal plans, the optional AI assistant's DM replies, a regenerated workout day when the trainer asks for one, and the macro estimate from a meal photo when a client uses it. It receives the client profile, conversation, or photo that request needs. A trainer who adds their own Anthropic key sends those requests with that key.
• Stripe: bills subscriptions and, through Stripe Connect, clients' payments to the trainer. Card details go straight to Stripe; we never store card numbers.
• Microsoft (Microsoft 365): sends account emails such as verification, password reset, and invitations. Microsoft also handles sign-in when you choose to sign in with Microsoft.
• Google: handles sign-in when you choose to sign in with Google.
• Twilio: sends SMS or WhatsApp messages when the trainer turns them on; it receives the number and the message.
• Meta and X: deliver and send the direct messages of the accounts the trainer connected, within the permissions they granted.
• Cloudflare: DNS, the network that serves the site, trainers' custom domains, and Turnstile, the bot check on the signup and sign-in forms.
• Sentry: receives error reports from the app and the server so they can be fixed, set not to send personal data by default.
• Browser push services (Apple, Google, or Mozilla, depending on your browser): deliver the notifications you turned on.
• Open Food Facts: receives the text you search or the barcode you scan when logging food, with no data about the person.

Files (logos, progress photos, plan PDFs) are kept in object storage on servers we run ourselves.

4. Security

Connections use TLS. Social account tokens and trainers' own AI keys are encrypted with AES-256-GCM before they are stored. Messages Meta sends to Eumorphic are checked against an HMAC-SHA256 signature before they are accepted. Passwords are stored only as a hash.

5. How long we keep it

We keep data while the workspace is active. When an account or business is deleted, there is a 24-hour window to change your mind; after that its sessions end and the name, email, phone, and address are replaced with an anonymous marker. Financial records are kept in anonymized form because tax law requires them.

6. Your choices

From Settings you can download your whole workspace as a JSON file. To delete your account or business, or for any request to access or correct data, email [email protected] from the account's address. Clients can ask their trainer for the same or email us directly.

7. Meta data deletion

If someone removes Eumorphic from their Meta settings, Meta sends a signed request. We check it with HMAC-SHA256 and delete, right then, every conversation and message tied to that person; the confirmation code can be checked on the deletion status page.

8. Children

Eumorphic is not directed to children under 13. If you believe a child opened an account, email us and we will delete it.

9. Changes

When what we keep or who we share it with changes, we update this page and its date. See also the terms of service.

10. Contact

Inexcelsis, LLC (d/b/a NanoScript)
[email protected]
Florida, United States.