Club 1000 Plus Privacy Policy
Last Updated: September 6, 2026 · Version 2026-09-06
Thank you for using Club 1000 Plus. This Privacy Policy explains what information we collect, how we use it, and the choices you have about your data when you use our website, app, and related services (collectively, the “Services”).
1) Data We Collect
Required account data includes name, email, password hash (for password accounts), account status, email verification metadata, adult attestation and its timestamp, residence state/DC, and the versions and dates of accepted terms and privacy notices. We do not require a birth date or an identity document to attest age.
Optional profile and fitness data includes avatar, date of birth, gender, height, preferences, workouts and sessions, exercises and sets, cardio duration/distance/steps/calories, notes, weight and body measurements, estimated body-fat percentage, photos, video links, routines, favorites, achievements and 1000 Club submissions. BMI, BMR and performance scores are derived estimates.
Social data includes friend requests, invitations, comments, reactions, GIF links and feed activity. Support data includes contact messages, feedback and account emails. Security data includes session identifiers, remembered-token hashes, IP address, browser/device user agent, access times and audit events. We use server-side country and state signals to decide US eligibility, and retain the decision, source and timestamp for up to seven days.
Email/password login is supported. Where Facebook login is enabled, Facebook supplies account ID and permitted profile information, potentially including name, email, birthday and gender. We do not offer Sign in with Apple.
2) Why We Use Data
We use data to authenticate accounts, record fitness activity, calculate estimates and rankings, show social activity, provide support, deliver account and optional activity messages, enforce adult/US eligibility, and investigate abuse or reliability problems. Fitness estimates are informational, not medical advice. The product is not a medical device and does not diagnose, treat, cure or prevent disease.
3) Sharing and Providers
Workouts, names, avatars, achievements and social content may be visible to other members through feeds, profiles and leaderboards. Do not put private medical information in shared notes, comments or photos. Shared exercise definitions may remain without account attribution after deletion.
Hosting/database and email providers process data needed to run the service. The current website is hosted with Hostinger; configured SMTP providers handle account mail. External website resources include Google Fonts and Plotly's CDN. Facebook, when enabled, and YouTube or other media/GIF hosts receive requests when those features or embedded resources are used; these requests can reveal your IP address and browser information. A configured geographic access provider processes request location signals. We do not sell personal data. We may disclose information when necessary to comply with law or protect users.
4) Storage and Retention
Account, consent, fitness and social records remain while the account is active or until you delete them. The native app stores remembered session cookies in platform secure storage when you choose to stay signed in; fitness data is held in app memory during use, and selected photo files remain in your device's photo/file library. Signing out clears app session storage. Website preferences and browser cookies may remain on your device until cleared.
Eligibility decision logs are kept for up to seven days. Application security audit records are kept for up to 30 days. Revoked sessions are purged after one day; inactive sessions after 30 days; remembered tokens expire after 30 days. Support and transactional email correspondence is retained for up to 90 days unless an unresolved request or specific legal obligation requires longer. Restricted hosting backups follow a maximum 30-day rotation and are not used to serve deleted content. Operators must reapply deletions before a restored backup returns to service. A minimal account identifier may be retained for up to 35 days solely to prevent restoring a deleted account.
We use HTTPS for production app/API communication, secure password hashing, and platform secure storage for remembered mobile sessions. Encryption at rest and backup security depend on the configured hosting providers; we do not claim end-to-end encryption. US-only availability does not guarantee that every provider processes data exclusively in the US.
5) Export, Data Wipe and Account Deletion
Export My Data: on the website, open My Profile → Account → Personal Data Controls to download your available profile/fitness export. Contact support for records outside the export, such as support correspondence.
Delete My Data: in the same website area, clear fitness records, body/profile measurements, local photos, routines, favorites, achievements and social relationships/interactions. Your login account, name, email, preferences, consent records and active sessions remain, so you can start again.
Delete Account: visit club1000plus.com/delete-account.php. This public page works without installing the app or an existing signed-in session, including during travel. Enter your account email and current password, then type DELETE. Forgotten-password and Facebook-only users can use website password recovery or request deletion from their account email through support. We verify account ownership before acting on support requests; never send a password by email.
Successful deletion removes the active account, consent/profile data, workouts, check-ins, locally hosted photos, comments, reactions, routines, favorites, friend relationships, achievements, submissions and remembered/server sessions. Rankings are invalidated. Shared exercise definitions remain without account attribution. Account-linked application audit records are removed; other security records expire under the schedule above.
Account records are removed when deletion succeeds. Photo cleanup and a confirmation email are attempted immediately and retried if needed; allow up to 24 hours for confirmation. The retry queue retains only the destination email and cleanup paths needed to finish. If mail cannot be delivered within seven days, the destination email is removed from the queue; contact support for status. Support requests are targeted for completion within 30 days after identity verification. Hosting backups, support correspondence, minimal restore-suppression identifiers and specific legal holds are exceptions described above. We cannot delete copies others saved independently or videos stored in your external accounts; remove those with their provider.
6) Adults Only
People under 18 may not register or use the service. If you believe someone under 18 has supplied personal data, contact us so we can investigate and remove it. Age confirmation is a self-attestation; it is not documentary proof of age.
7) Privacy Requests and Support
Contact david@club1000plus.com to request access, correction or deletion, ask about sensitive fitness/body data, or challenge an eligibility decision. Available rights depend on applicable law. We verify identity proportionately, do not require you to install the app, and do not penalize you for exercising applicable privacy rights.
8) US Availability and Travel
Server-side location checks apply to registration, sign-in and authenticated access. Inaccurate location signals, VPNs or travel can prevent access. Support can review an existing eligible user's travel request and authorize a temporary exception. Legal notices, account recovery, support and deletion remain reachable. Service language is US English; any future monetary prices will use USD. A US-only launch does not promise US-only data residency.
9) Policy Changes
This version adds 18+ registration, US eligibility controls and website account deletion. We update the policy date and provide a website change notice for material changes. Registration records the accepted version; existing accounts are not represented as having accepted this new version without an actual acceptance.
10) Contact
Bechara Solutions, LLC
17 Copley Drive
Methuen, MA 01844
Email: david@club1000plus.com