StrengthLink Privacy Policy

Effective Date: September 9, 2026

1. Introduction

StrengthLink is provided by Kollossol Technologies, LLC (“Kollossol,” “we,” “us,” or “our”).

This Privacy Policy explains how information is processed, collected, used, disclosed, retained, and protected in connection with the StrengthLink application, related StrengthLink webpages, and communications with Kollossol concerning StrengthLink.

StrengthLink is designed around data minimization and local processing. Most fitness, nutrition, training, and related information entered into StrengthLink is stored and processed on the user's device rather than transmitted to Kollossol.

This Privacy Policy should be read together with any additional privacy notice that applies to a particular type of information or jurisdiction.

2. Scope of This Privacy Policy

This Privacy Policy applies to the StrengthLink application and Kollossol-operated services directly associated with StrengthLink.

It does not govern other Kollossol products or services that are subject to separate privacy policies.

It also does not govern independent third-party services, websites, application marketplaces, operating systems, or other services that may process information under their own privacy practices.

3. Privacy and Data-Minimization Principles

Kollossol seeks to collect and retain only information reasonably necessary to provide, support, secure, and improve StrengthLink and related services.

StrengthLink is designed so that its core fitness records can be maintained locally on the user's device. Kollossol does not receive those locally stored records merely because a user enters, views, modifies, or analyzes them within StrengthLink.

Where information must be transmitted outside the device to provide a user-requested function, StrengthLink seeks to limit that transmission to the information reasonably necessary for that function.

Kollossol does not seek to create advertising profiles from StrengthLink fitness information or monetize personal fitness information through sale to third parties.

4. Information We May Collect

Information Kollossol may receive in connection with StrengthLink includes:

• information a user voluntarily provides when contacting Kollossol for support, privacy requests, legal inquiries, or other communications;
• a user's name, email address, message contents, and attachments when submitted through applicable Kollossol contact channels;
• limited transaction, purchase, or entitlement information made available to Kollossol by an application marketplace or payment provider, where applicable;
• food-search terms, product barcodes, or food identifiers transmitted when a user chooses to use online nutrition lookup;
• limited technical, browser, device, network, security, or abuse-prevention information processed in connection with Kollossol-operated websites or infrastructure; and
• other information a user intentionally provides to Kollossol.

Kollossol does not receive full payment-card information merely because a user purchases StrengthLink through a third-party application marketplace or payment provider.

5. Information Processed Within StrengthLink

StrengthLink allows users to enter and process fitness-related information that may include:

• workout history;
• exercises, sets, repetitions, resistance or weight used, rest periods, and workout duration;
• perceived exertion or similar training-effort information;
• workout notes and session information;
• bodyweight and related body information;
• nutrition records, calories, macronutrients, micronutrients, meals, foods, water intake, and nutrition goals;
• sleep duration;
• step counts and activity goals;
• cardiovascular activity, duration, distance, and effort;
• training goals and scheduled workouts;
• personal records and performance calculations;
• optional profile information such as name, height, age, and profile image; and
• settings and preferences necessary to customize the application.

StrengthLink stores and processes its core user records locally on the user's device.

Information stored locally is not transmitted to Kollossol merely because StrengthLink performs calculations, displays trends, generates summaries, or otherwise uses the information within the application.

StrengthLink may use locally stored information to calculate training statistics, nutrition totals, performance trends, progress metrics, recommendations, scores, or other application features.

Nutrition Lookup

When a user chooses to search an online food database or scan a product barcode, the search term or barcode may be transmitted outside the device to retrieve food information.

Depending on the requested lookup, the search term, barcode, or food identifier may be processed through Kollossol's catalog service hosted by Supabase, USDA FoodData Central, or Open Food Facts. USDA lookups run through Kollossol's Supabase-hosted service. StrengthLink does not use FatSecret in this Commercial release.

These lookup requests are separate from the user's locally maintained meal diary. StrengthLink does not need to transmit the user's complete nutrition history, meal date, or quantity consumed merely to perform a food lookup.

Catalog refresh during catalog use sends catalog version and pagination information to Kollossol's Supabase-hosted service. These requests also expose network metadata, such as Internet Protocol address and user agent, to the services handling them. StrengthLink does not automatically contribute or publish the user's food records to the shared catalog.

Barcode Scanning

StrengthLink may request access to the device camera when the user chooses to scan a food barcode.

Camera access for this function is used to detect the barcode needed for the requested lookup. StrengthLink does not need to transmit photographs or video of the user in order to perform ordinary barcode scanning.

StrengthLink uses Google ML Kit to read barcodes on the device. Camera images are processed on the device. Google may receive scanner diagnostic and usage information, including app and device information, app-installation identifiers, performance measurements, feature events, and maintenance requests, to maintain and improve the service. The detected barcode may then be sent to the food services described above.

Device Sharing and Exports

Where StrengthLink allows a user to create, print, export, or share information or reports, the user may intentionally direct information to another application, service, person, or destination through device-provided sharing functionality.

Once information is intentionally shared outside StrengthLink, its handling may also be governed by the privacy practices of the recipient, operating system, application, or service selected by the user.

6. How We Use Personal Information

Kollossol may use information it actually receives to:

• provide and support StrengthLink;
• respond to support requests and communications;
• perform user-requested nutrition searches or food database functions;
• process purchases, licenses, or entitlements where applicable;
• maintain security and prevent fraud, spam, abuse, or malicious activity;
• diagnose technical or operational issues;
• comply with legal obligations;
• establish, exercise, or defend legal rights; and
• maintain and improve the reliability of StrengthLink and associated services.

Kollossol does not use locally stored StrengthLink fitness records for unrelated purposes when those records have not been transmitted to Kollossol.

7. Sensitive Personal Information

Some information processed within StrengthLink may relate to an individual's physical activity, body measurements, nutrition, sleep, or other fitness information and may be considered sensitive, health-related, or consumer health data under applicable law.

StrengthLink processes this information to provide the fitness and tracking functionality requested by the user.

Kollossol does not sell StrengthLink health or fitness information.

Kollossol does not use StrengthLink health or fitness information for targeted advertising, determining creditworthiness, insurance eligibility, employment eligibility, or unrelated profiling.

StrengthLink is a fitness and information-management application. It is not intended to provide medical diagnosis, emergency medical services, or individualized medical treatment.

8. Service Providers and Third Parties

Kollossol may use service providers where reasonably necessary to operate StrengthLink, its website, support systems, infrastructure, communications, application distribution, or other supporting services.

Depending on the function requested by a user, relevant third parties may include:

• application marketplaces and payment providers;
• infrastructure, hosting, security, or abuse-prevention providers;
• email and communications providers;
• Supabase;
• USDA FoodData Central;
• Open Food Facts;
• Google Play and Google ML Kit; and
• other providers used to perform a specific user-requested function.

Service providers may process information only to the extent necessary for their applicable role and subject to their contractual obligations, applicable law, and their own service architecture.

Kollossol seeks to avoid providing service providers with personal information they do not reasonably need.

9. Data Sharing and Disclosure

Kollossol does not sell personal information obtained through StrengthLink.

Kollossol may disclose information it possesses:

• to service providers performing services on Kollossol's behalf;
• when a user intentionally directs or authorizes disclosure;
• when reasonably necessary to complete a service requested by the user;
• when required by applicable law, legal process, court order, or lawful governmental request;
• when reasonably necessary to investigate fraud, security incidents, abuse, or threats to persons, systems, or property;
• to establish, exercise, or defend legal rights; or
• as part of a merger, acquisition, financing, reorganization, sale of assets, or similar business transaction, subject to applicable legal requirements.

Information that exists only on a user's device and has never been received by Kollossol cannot be disclosed by Kollossol because Kollossol does not possess it.

10. Website Technologies, Cookies, and Security

Kollossol seeks to minimize unnecessary tracking on its corporate and product websites.

Our websites and their infrastructure providers may use technologies necessary to deliver pages, maintain security, prevent abuse, manage traffic, remember essential preferences, verify legitimate users, or perform other functions necessary for reliable website operation.

Security and abuse-prevention technologies may process limited browser, device, and network signals, such as Internet Protocol address, user agent, browser characteristics, device or operating-system information, and similar technical information necessary to distinguish legitimate traffic from automated, malicious, or abusive activity.

Kollossol does not currently intend its corporate or StrengthLink webpages to function as behavioral advertising or profiling systems.

If Kollossol introduces non-essential cookies, analytics technologies, advertising technologies, or other tracking mechanisms that require additional disclosure or consent under applicable law, we will update our disclosures and provide appropriate user controls where required.

11. Data Retention

Kollossol retains personal information only for as long as reasonably necessary for the purpose for which it was collected, to satisfy legitimate operational or security requirements, or to comply with applicable law.

Where information is processed through a service provider, certain operational records may also be retained according to that provider's applicable service and retention practices.

Information that remains exclusively on a user's device and is never received by Kollossol has no Kollossol retention period because Kollossol does not possess that information.

Users generally control the continued presence of locally maintained StrengthLink records through the application and their device. Device backups, operating-system services, exported files, or copies intentionally shared by a user may be subject to separate retention behavior outside Kollossol's control.

When information is no longer reasonably necessary for its applicable purpose and no legal or legitimate operational reason requires continued retention, Kollossol may delete, destroy, anonymize, or otherwise remove the information from ordinary use.

Certain information may need to be retained for longer periods when required for tax, accounting, contractual, security, regulatory, dispute-resolution, fraud-prevention, legal, or other legitimate purposes.

Information may also persist temporarily in backups, security records, or service-provider systems after deletion from an active system. Such information may remain subject to the applicable backup rotation, technical deletion processes, or retention obligations of the system involved.

Kollossol does not retain personal information merely because continued retention is technically possible.

12. Security and Data Protection

Kollossol uses reasonable administrative, technical, and organizational measures appropriate to the nature of information under its control and the systems involved.

StrengthLink's locally stored application information is protected in part by the security architecture of the user's device and operating system. Users should maintain appropriate device protections, including device authentication, operating-system updates, and other security controls appropriate to their circumstances.

No storage or transmission method can be guaranteed to be completely secure.

Kollossol does not represent that every category of locally stored StrengthLink information is protected by application-level encryption unless that protection is specifically implemented for the applicable data.

13. Privacy by Design

StrengthLink is designed to minimize unnecessary transmission and centralized retention of user information.

Where a feature can reasonably operate using local information without transferring the user's underlying fitness history to Kollossol, the application is intended to favor local processing.

Kollossol evaluates privacy considerations alongside functionality, security, reliability, and user experience when designing and modifying StrengthLink.

14. Artificial Intelligence and Automated Processing

StrengthLink may perform automated calculations, scoring, recommendations, trend analysis, or similar processing based on information entered into the application.

Such processing may include mathematical or algorithmic evaluation of training, nutrition, recovery, performance, or progress information.

StrengthLink does not use these automated functions to make decisions producing legal or similarly significant effects concerning employment, insurance, credit, housing, education, or comparable matters.

Where automated processing occurs locally on the device, the underlying local records are not transmitted to Kollossol merely because the calculation is performed.

15. Your Privacy Rights

Depending on where a user resides and which laws apply, the user may have rights concerning personal information that Kollossol possesses, including rights to:

• request access to personal information;
• request correction of inaccurate information;
• request deletion;
• obtain certain information in a portable format;
• obtain information concerning categories of processing or disclosure;
• withdraw consent where processing depends upon consent;
• object to or restrict certain processing;
• opt out of certain uses where applicable law provides such a right; and
• appeal certain decisions concerning a privacy request.

These rights may be subject to legal limitations, exceptions, authentication requirements, and applicability thresholds.

Locally stored information that Kollossol does not possess ordinarily must be accessed, modified, exported, or deleted through StrengthLink or the user's device rather than through a request for Kollossol to retrieve data it does not have.

16. How to Exercise Your Privacy Rights

Privacy requests may be submitted to:

privacy@kollossol.com

Please describe the request with sufficient detail for Kollossol to understand and respond appropriately.

Kollossol may request information reasonably necessary to authenticate a request and protect against unauthorized access or deletion.

Kollossol will not require a user to provide information that is disproportionate to the request merely for verification.

Where applicable law provides a right to appeal a denied privacy request, an appeal may be submitted through the same contact address and should identify the previous request.

17. European Economic Area and European Privacy Rights

Where the European Union General Data Protection Regulation, United Kingdom GDPR, or similar European privacy law applies, Kollossol processes personal information only where an appropriate legal basis exists.

Depending on the circumstances, such bases may include:

• performance of a contract or steps requested before entering a contract;
• legitimate interests that are not overridden by applicable individual rights;
• compliance with legal obligations; or
• consent.

Individuals may have rights including access, correction, erasure, restriction, portability, objection, withdrawal of consent, and the right to lodge a complaint with an applicable supervisory authority.

Where StrengthLink information remains exclusively on the user's device and is not received by Kollossol, Kollossol may not be capable of accessing or acting upon that local information.

18. California Privacy Rights

California residents may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, where those laws apply to Kollossol and the applicable processing.

Such rights may include rights to know, access, correct, delete, and obtain information concerning certain disclosures or uses of personal information.

Kollossol does not sell StrengthLink personal information and does not use StrengthLink health or fitness information for cross-context behavioral advertising.

Kollossol will honor applicable California privacy rights when legally required.

19. Iowa and Other United States Privacy Laws

Kollossol is based in Iowa and seeks to comply with applicable United States federal and state privacy laws.

Depending on the jurisdiction, users may have rights concerning access, deletion, correction, portability, consent, sensitive information, targeted advertising, sale of information, profiling, or other processing.

Some state privacy statutes apply only after specified legal thresholds are satisfied. Kollossol will provide rights required under laws applicable to its operations and the particular information involved.

Additional laws governing consumer health data may provide rights or impose requirements beyond general state privacy statutes.

20. Canada

Where Canadian privacy law applies, Kollossol will process personal information in accordance with applicable federal or provincial requirements.

Users may have rights to request access to and correction of personal information held by Kollossol and may contact Kollossol regarding questions concerning its privacy practices.

21. International Data Transfers

Kollossol is based in the United States.

Information transmitted to Kollossol or its service providers may therefore be processed in the United States or other jurisdictions in which an applicable provider operates.

Where applicable law requires safeguards for an international transfer of personal information, Kollossol will use an appropriate lawful mechanism.

Information that remains exclusively on the user's device is not transferred internationally by Kollossol merely because the user uses StrengthLink while located in another jurisdiction.

22. Children and Minors

StrengthLink is intended for adults aged 18 and older and is not directed to children.

Kollossol does not knowingly seek to collect personal information from children under 13 through StrengthLink in circumstances requiring parental consent under the Children's Online Privacy Protection Act.

If Kollossol learns that it has received personal information from a child in violation of applicable law, Kollossol will take reasonable steps to address the information as required.

Other jurisdictions may impose different age or parental-consent requirements, which will be followed where applicable.

23. Law Enforcement and Government Requests

Kollossol may respond to valid legal process or government requests when required by applicable law.

Kollossol will disclose only information it possesses and that is responsive to the applicable legal requirement.

Because core StrengthLink records are designed to remain on the user's device, Kollossol may not possess the user's workout, nutrition, sleep, bodyweight, or other locally maintained records and therefore may be unable to produce such information.

Nothing in this Policy is intended to create a duty to retain information that Kollossol would not otherwise retain.

24. Security Incidents and Data Breaches

Kollossol maintains processes appropriate to its operations for evaluating suspected security incidents involving systems or personal information under its control.

Where Kollossol determines that a security incident triggers a legal notification obligation, Kollossol will provide required notifications in accordance with applicable law.

An incident affecting information stored solely on a user's device may be outside Kollossol's possession and control.

25. De-Identified and Aggregated Information

Kollossol may use information that has been lawfully de-identified or aggregated so that it is not reasonably linkable to an identifiable individual, subject to applicable law.

Where a law requires particular safeguards for de-identified data, Kollossol will apply those safeguards.

Kollossol does not represent locally stored StrengthLink records as aggregated or de-identified information available to Kollossol when those records have never been transmitted to Kollossol.

26. Communications

Kollossol may communicate with users in response to support, privacy, legal, account, transaction, security, or other requests initiated by the user.

Kollossol may also send communications necessary to administer a transaction, service, security matter, or legal obligation.

StrengthLink may provide local device notifications, such as reminders associated with scheduled workouts, when the user enables applicable notification permissions.

Any promotional communications sent by Kollossol will be subject to applicable consent and opt-out requirements.

27. Changes to Our Privacy Practices

Kollossol may modify its systems, providers, or privacy practices as StrengthLink changes.

Before materially changing how personal information is processed, Kollossol will evaluate whether additional notice, consent, user controls, or other actions are required by applicable law.

A future feature is not covered merely because it could theoretically be developed. Privacy disclosures will be updated when actual functionality or data practices require them.

28. Changes to This Privacy Policy

Kollossol may update this Privacy Policy periodically to reflect changes in StrengthLink, legal requirements, operational practices, or privacy considerations.

When the Policy is updated, Kollossol will revise the effective date.

Where applicable law requires additional notice or consent for a material change, Kollossol will provide it.

Continued availability of an updated Policy does not override any separate consent requirement imposed by law.

29. Product-Specific Privacy Policies

This Privacy Policy applies specifically to StrengthLink.

Other Kollossol products and services may operate under different architectures and may have separate privacy policies appropriate to their functionality.

Where a separate notice governing a particular category of StrengthLink information is required by applicable law, that notice supplements this Privacy Policy and controls with respect to matters specifically addressed by it.

30. Applicable Privacy Laws

StrengthLink may be subject to different privacy requirements depending upon the location of the user, the nature of information being processed, and the applicability of particular statutes.

This may include general privacy laws as well as laws specifically governing consumer health data.

Kollossol seeks to apply the protections and user rights required by laws applicable to its processing rather than representing every privacy statute as applicable in every circumstance.

31. Contact Kollossol Technologies

Questions, concerns, or requests concerning this Privacy Policy or StrengthLink privacy practices may be directed to:

Kollossol Technologies, LLC

Privacy: privacy@kollossol.com

Product support: support.strengthlink@kollossol.com

When contacting Kollossol regarding a privacy request, please avoid sending sensitive fitness, health, financial, identification, or other information that is not reasonably necessary for Kollossol to understand the request.

32. Closing Privacy Commitment

StrengthLink is designed around a straightforward principle: information does not need to be centrally collected merely because software can collect it.

Kollossol seeks to keep StrengthLink's core fitness information under the user's control, minimize unnecessary transmission and retention, clearly disclose the circumstances in which information does leave the device, and avoid uses of personal information that are unrelated to providing and supporting the product.

As StrengthLink changes, Kollossol intends to reevaluate its privacy disclosures and safeguards so that this Policy continues to describe the product users actually receive.