Privacy Policy
Gratefully Active Faithfully Fit ("GAFF")
Effective date: October 31, 2026
Last updated: October 31, 2026
This Privacy Policy explains what information Gratefully Active Faithfully Fit ("GAFF," "we," "us," or "our") collects through gratefullyactivefaithfullyfit.com (the "Site"), including our client portal, how we use and share it, and the choices you have. GAFF is an online fitness and nutrition coaching business based in Tennessee, United States. GAFF is operated as a partnership under the legal name Gratefully Active Faithfully Fit, which is responsible for your information.
By using the Site, you agree to this policy. If you do not agree, please do not use the Site.
1. Summary
- Visitors: The public pages (home, pricing, about, testimonials, FAQ, contact) have no accounts, no advertising, no analytics, and no tracking cookies.
- Clients: Our coaches create client accounts. Inside the portal, you may log health and fitness information (such as weight, sleep, meals, workouts, and notes) and message your coaches. This is sensitive information and is visible to our coaching staff so they can coach you.
- Payments are processed by Stripe; we never see or store your full card details. Clients must be 18 or older.
- We do not sell your personal information, and we do not use it for advertising.
- GAFF is not a medical provider. HIPAA does not apply to the information you share with us, but we protect it as described below.
2. Information we collect
a. Visitors to the public pages
Like nearly all websites, our server and our security and delivery provider (Cloudflare) automatically receive standard technical data your browser sends: your IP address, date and time of the request, pages requested, browser and device type, referring website, and response status. This is used to deliver and secure the Site.
b. Contacting us
- Contact page: The form on our Contact page does not send anything to our servers. When you press "Send," it opens a pre-filled message in your own email application, addressed to [email protected], containing the name, subject, and message you typed. Nothing is sent until you send that email yourself. We receive your email address, name, and message in our email account (Gmail, provided by Google).
- Booking a call: The "Book a FREE Call" buttons link to Calendly, a third-party scheduling service. Information you enter there (such as your name, email address, and any answers you provide) is collected by Calendly and shared with us. See Section 6.
c. Client accounts and portal
Accounts are created by our staff; the Site does not offer public sign-up. For each client account we collect and store:
- Account and identity information: your first and last name, email address (also your username), role, and your password. Your password is stored in a protected (hashed) form. When staff create your account or reset your password, they set a temporary password; this temporary password is stored in our database and visible to our staff until you change it, which you are required to do at your first login.
- Daily log entries you or your coaches enter: date, weight, hours and minutes of sleep, steps, water intake, activity, current mindset, a bowel-movement indicator, and free-text reflections.
- Meal entries: date, meal type (breakfast, lunch, dinner, or snack), snack placement, and a description of what you ate.
- Workout information: workouts and exercises assigned to you, and the sets you log (exercise, set number, weight, and repetitions).
- Messages: the content and timestamps of messages you exchange with our coaching team in the portal chat, and whether they have been read. Messages in your thread are visible to all of our staff and administrators.
- Coach comments: notes and comments our staff write about your logs and meals.
- Shared files: our staff may upload files (such as guides and plans) to a shared library. These files are available to all signed-in users, so please do not expect them to be private to you.
- Technical data: the same server data described in 2(a), plus the cookies described in Section 3.
Some of this is health-related information. You choose what to enter, and entering it is voluntary, but our coaching depends on it. By entering health-related information, you consent to our collecting and using it as described in this policy.
d. Information we do not collect
Payments. Coaching is a subscription that clients pay for through Stripe, a third-party payment processor. Payment and subscription billing take place entirely on Stripe's site, outside our Site and portal. Your card or bank details are entered directly with Stripe and are collected and stored by Stripe, not by us; we do not receive or store your full card or bank account numbers. We receive limited payment information from Stripe, such as your name, email address, the amount and date of payment, and payment status. Stripe's handling of your information is governed by its own privacy policy (stripe.com/privacy).
We do not collect precise location, government identification numbers, or contacts, and we do not use advertising or analytics trackers.
3. Cookies and similar technologies
- Public pages: no cookies are set.
- Sign-in page and portal: the Site uses cookies strictly necessary for security and sign-in: (1) a security cookie that protects forms from forgery (set when you open the sign-in page or any form), and (2) a sign-in cookie that keeps you logged in. If you check "Remember me," the sign-in cookie persists across browser sessions; otherwise it ends when you close your browser. These cookies are not used for advertising or tracking and cannot be turned off without breaking the portal.
- Embedded video: some workout pages embed YouTube videos. When a video loads or plays, YouTube (Google) may set its own cookies and collect data under Google's privacy policy.
- Charts: the Stats pages load a charting library (Chart.js) from the jsDelivr content delivery network, which receives your IP address and browser details when the library loads.
- Security provider: Cloudflare may use a strictly necessary cookie to protect the Site from malicious traffic.
Because we do not track visitors across other websites, the Site responds the same way whether or not your browser sends a "Do Not Track" or Global Privacy Control signal.
4. How we use information
- To provide coaching: creating and managing your account, building your workout and nutrition plans, reviewing your logs, giving feedback, and communicating with you.
- To operate, secure, troubleshoot, and improve the Site.
- To respond to your inquiries and schedule consultations.
- To comply with the law and to protect our rights, clients, and Site.
We do not use your information for advertising, we do not sell it, and we do not use it to make automated decisions about you.
5. Who can see your information
- Our staff. All GAFF coaches and administrators can see client account details, logs, meals, workouts, messages, and comments, because they work with clients as a team.
- Other clients. Clients cannot see other clients' logs, meals, or messages. All signed-in users can see the shared file library.
- Service providers (Section 6), only as needed for them to provide their services.
- Legal and safety. We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of GAFF, our clients, or others.
- Business transfer. If GAFF is sold or merged, client information may be transferred to the new owner, who must honor this policy.
- Testimonials. We publish a client's testimonial only with that client's permission.
We do not sell personal information and do not share it for cross-context behavioral advertising.
6. Service providers and third-party services
| Provider | What it does | Data involved |
|---|---|---|
| Hosting server (virtual private server we administer, located in the United States) | Runs the Site and stores the database and shared files | All data described in Section 2 |
| Cloudflare, Inc. | DNS, content delivery, encryption, and security for the Site | IP address and request details |
| Google (Gmail) | Receives email sent to us, including emails created from the Contact page | Your email address, name, and message |
| Stripe, Inc. | Processes client payments for coaching | Name, email, payment card or bank details (held by Stripe), amount, date, and payment status |
| Calendly | Schedules free consultation calls (if you click through) | Whatever you enter on Calendly |
| YouTube (Google) | Hosts workout videos embedded on portal pages | IP address, device data, cookies when videos load |
| jsDelivr (CDN) | Delivers the Chart.js library used on Stats pages | IP address, browser details |
| NASM Edge | Third-party training app that all plans include access to | Governed by NASM's own account and privacy terms |
| Google Meet | Coaching video calls | Governed by Google's terms and privacy policy; includes your name, email, IP address, and audio/video during the call |
Each of these providers has its own privacy policy, and we do not control how they use information. Links from the Site to other websites (such as Calendly) are not covered by this policy.
7. How long we keep information
- Server access logs: approximately 14 days.
- Client account data (profile, logs, meals, workouts, messages, comments): for as long as your account is active. When your coaching ends, we mark your account inactive; you can no longer sign in, but we hold your data for 2 years in case you return. If your account is reactivated within those 2 years, nothing is deleted. After 2 years of inactivity, your account and all of its data are permanently deleted automatically. You can ask us to delete it sooner at any time (see Section 8).
- Emails: as long as needed to respond and keep business records.
- Backups: we do not currently make separate backups of client data. When data is deleted, it is removed from our live systems.
8. Your choices and rights
- Access, correction, and deletion. Email us at [email protected] to request a copy of your information, to correct it, or to have your account and its data deleted. We may need to verify your identity first. We will respond within 45 days, or sooner if the law requires.
- Change your password any time from the portal's Change Password page.
- Withdraw consent. You may stop entering health information at any time, and ask us to delete what you've entered. Deleting it may limit our ability to coach you.
- State law rights. Residents of some states, including California, Washington, and Nevada, have additional rights regarding personal and consumer health data, such as access, deletion, and withdrawal of consent. We honor these rights to the extent they apply to us. If you make a request, we will not retaliate against you.
- Appeals. If we decline a request, you may reply to our response to ask us to reconsider.
9. Security
We use HTTPS encryption for data in transit, store passwords in hashed form, restrict portal access to signed-in users, and limit administrative functions to authorized staff. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. Please choose a strong, unique password and never share it. If we become aware of a breach affecting your personal information, we will notify you as required by Tennessee law and other applicable laws.
10. Health information disclaimer
GAFF provides fitness and nutrition coaching, not medical care. GAFF is not a "covered entity" under HIPAA, so HIPAA protections do not apply to information you give us, but we treat it as sensitive and protect it as described in this policy. Do not use the chat to report a medical emergency; call 911 or your physician.
11. Children's privacy
Our services are intended for adults 18 and older, and minors cannot be clients. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us and we will delete it.
12. International visitors
The Site is operated in the United States. If you access it from elsewhere, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
13. Changes to this policy
We may update this policy from time to time. We will post the new version on this page with a new "Last updated" date, and for material changes affecting clients we will notify you through the portal or by email.
14. Contact us
Gratefully Active Faithfully Fit
Email: [email protected]
Tennessee, USA