Privacy & consumer health data

Who controls the information

MMOD, Inc., operating Thirty Wins at thirtywins.com, controls the information described here. Contact hi@thirtywins.com with a privacy request. This policy includes our consumer health data privacy policy for Washington residents and other people protected by applicable consumer health privacy laws.

What we collect

When you consent to the quiz, we collect the answers you choose to provide: goals, age range, plan collection, routine, time and equipment preferences, movement comfort, sleep and energy patterns, and safety-screen answers. These answers, resulting inferences, optional baseline measurements, and health information volunteered in guide messages may be consumer health data.

We also collect your email, an optional phone number, chosen time zone and reminder time, consent records, purchase and subscription records, and account activity. We do not request weight, BMI, medication history, laboratory results, or uploaded progress photos in this version. Optional photos remain on your own device.

We collect limited first-party service and funnel events, such as question step number and purchase status. Campaign and ad-creative identifiers are opaque; their meaning is stored on the server. To count landing visits without an analytics cookie, we store a keyed one-way hash of the day, network address and browser type, so repeat views on the same day count once. A route or opaque identifier can still be linked to a campaign on our server, so we treat this attribution as personal information.

Why we use it and how you consent

Quiz health-data consent is requested before answers are saved. We use your answers to filter movements, construct your schedule, explain your result, apply safety constraints, and maintain your plan. If you choose the guide, we use the information needed for daily messages, safe replies, and plan adjustments. Consent to optional marketing email, guide billing, and automated SMS are separate choices and are not preselected.

We use account and transaction records to authenticate access, process payments and refunds, prevent misuse, maintain security, and respond to support requests. We do not use health answers to select ads. We do not collect precise location or use geofencing around health-care facilities.

Who processes it

Cloudflare provides hosting, encrypted application storage, scheduling, and media services. Stripe processes payments. Enabled email, SMS, and AI processing services receive only the information needed to provide the features you request and act as service processors. In particular, sending SMS requires providing the destination phone number and message text to the SMS provider.

Google Analytics is configured for optional server-side measurement of standard events and transaction value/currency. This integration is disabled at launch. If enabled after the required privacy choices are implemented, Google would receive event-specific opaque identifiers rather than account identifiers, and would not receive answers, plan details, campaign labels, page URLs, email addresses, phone numbers, or browser advertising identifiers. Enhanced Measurement, Google signals, user-provided data collection, advertising personalization, and browser page tracking are disabled. Detailed question drop-off reporting stays in our own system.

Quiz answers, safety flags, baseline measurements, inferred health interests, plan reasons, message contents, and health-related page paths are excluded from advertising and general analytics payloads. Standard advertising conversion events, when enabled, are limited to allowlisted events and transaction value/currency. Automatic advanced matching is disabled. We do not sell or license consumer health data.

Security and retention

Quiz answers, plans, baseline values, phone numbers, and guide-message bodies are encrypted by the application before storage. Sessions use Secure, HttpOnly cookies in production. No system can guarantee absolute security. Avoid putting highly sensitive information into SMS or email.

We retain information needed to provide your account and purchased services until it is deleted or no longer needed. A deletion request also cancels the optional guide. Some information may need to be retained where a legal obligation applies. Contact us for details specific to a request.

Your access, withdrawal, export, and deletion rights

You can export your information and delete your account in /app/account. You can also email hi@thirtywins.com to request access, correction, deletion, withdrawal of consent, or an account of applicable health-data disclosures. We verify control of the account before disclosing or changing private information.

You can withdraw health-data consent by requesting deletion or contacting support; this may prevent us from providing a personalized plan or guide. We do not require marketing consent to provide a purchased plan. Unsubscribe from marketing email using its link, and use STOP or CANCEL for SMS as described in the SMS terms.

Washington residents may appeal a denied consumer-health-data request by replying to our decision and asking for an appeal. We will explain the decision and the route to complain to the Washington Attorney General. Applicable statutory response deadlines and rights continue to apply.

Cookies and browser signals

Essential cookies keep your quiz, sign-in challenge, member session, and opaque campaign and ad-creative assignment connected to your browser. Health answers are stored on the server rather than in browser local storage. We do not put readable health labels into campaign cookies.

We do not load advertising pixels, session replay, or automatic third-party page tracking on the quiz, results, checkout, or member screens. Browser global privacy signals are not used to override a refusal of optional tracking or marketing.

Children, changes, and contact

The service is for adults 18+. Contact us if a child has supplied information so we can address it. If this policy changes materially, we will publish the change and request new consent where required. Send privacy questions to hi@thirtywins.com.