Legal

Privacy Policy

What is collected, why, who sees it, and what you can ask us to do about it.

Effective 26 October 2026 Last updated 26 October 2026 Governing law California

This policy describes this website, and the member app at app.flexwithyegi.com that coaching clients sign in to, as they work on the effective date above. The member app is described in Section 02.6. Some of the coaching systems in Section 03 are planned and are not yet in operation. If you pay online, the payment is taken on a checkout page run by Stripe, as described in Sections 02.5 and 07.

The short version.

  • This website is static, with no database behind it. The one thing it does send is the application form: the five answers you type go to the company that hosts this site, so that Yegi receives your application and can reply — see Section 02. Coaching clients also use a separate member app, which does have a database — see Section 02.6.
  • This website sets no tracking or advertising cookies, and it has no analytics, no advertising tags and no tracking of any kind. The member app is separate: when you sign in it sets a sign-in cookie, and it keeps some of what you log on your device so that it can work offline. It has no analytics or advertising tools either. See Section 02.6.
  • Everything the page needs, its typefaces included, is served from the site itself. Opening this website causes your browser to contact no third party at all.
  • If you pay online — through a payment link Yegi sends you, or a payment button on this site if one is offered — you pay on a checkout page run by Stripe. Your card details go to Stripe, not to this website. See Section 02.5.
  • If you are a coaching client, the member app collects what coaching needs: the workouts you log, your weekly check-ins (weight and notes) and, if your coaching includes it, your nutrition plan and daily nutrition ticks and notes. It does not collect progress photos. That information is health-related. It is held in a database run by Cloudflare, Yegi can read it, and SetupAI, the studio that runs the system for us, can reach it technically. See Sections 02.6, 06 and 07.
  • Progress photos are never used in marketing without your separate written consent. Section 06.
  • We do not sell your information, and we never will as this policy stands. Section 08.
01

Who we are and what this covers

This policy explains how Yeganeh Bakhtiari, sole proprietor, trading as Flex with Yegi (“Flex with Yegi”, “we”, “us”) handles personal information. In this policy “you” means anyone who visits the website or applies for or receives coaching.

It covers the Flex with Yegi website at flexwithyegi.com, the coaching application on that site, the member app at app.flexwithyegi.com (the client portal), and the email we send you as part of coaching.

It does not cover anything that happens on someone else’s platform. If you message Yegi on Instagram, Instagram’s privacy policy governs that message. If you pay through Venmo, Zelle or Stripe, those companies handle your payment details under their own policies and we never see your full card or bank details.

We are a small coaching business, not a data company. The honest summary of our approach is that we would rather hold less of your information than more.

02

What this website and the member app do today

This section describes the website, and the member app in Section 02.6, exactly as they are built at the effective date above. Section 03 describes what is planned but not yet in place. We have kept the two apart deliberately, so that nothing here overstates what is actually running.

02.1  What the application form sends, and where

The form in the Apply for Coaching section asks for your name, email address, Instagram handle, primary goal, and a short answer about what has made consistency hard for you before. All five are things you type on purpose, and the form has no other questions. The technical details that travel with any submission are described below.

When you press Submit Application, those five answers are transmitted. The whole route is short, and this is all of it:

  • What is sent. The five answers you type. Like any request to any website, the submission also carries technical details that your browser sends automatically, such as your IP address and browser type, and Netlify stores these with the submission. This site adds no cookie, no tracking identifier, no browsing history and no record of anything you did on the page before submitting.
  • Who receives it. Netlify (netlify.com), the company that hosts this website. Its form-handling service receives the submission and stores it for us. It is listed again in the provider table in Section 07. Netlify screens submissions for spam using a third-party spam filter, Akismet, which is run by Automattic.
  • Why. So that an application actually reaches Yegi and can be answered. That is the only reason it is collected.
  • What happens next. The submission is held in Netlify’s dashboard, which requires our sign-in to open, and a notification is emailed to us so that we see it; that email is kept in our email inbox (Google Workspace; see Sections 07 and 09). We read it and reply to you at the email address you gave.
  • What it is never used for. It is not sold, not shared for advertising, not added to a mailing list, and not used to train any artificial-intelligence model. Sections 05 and 08.

If the submission fails to send — a dropped connection, for instance — the page says so plainly and offers you Instagram as a way to reach Yegi instead. It will not tell you your application was received when it was not.

The form also contains one field that is hidden from view. It is a standard anti-spam device: automated bots fill hidden fields in, people do not, which makes an automated submission easy to spot and throw away. It is not used to collect any information about you, and from a person it always arrives empty.

Apart from this form, no part of this website sends anything you type to anyone. The member app (Section 02.6) is separate.

02.2  Our host keeps routine server records

The site is a set of static files delivered by our hosting provider, Netlify (netlify.com), the same company that receives the application form (Section 02.1). If we ever move the site to a different host, this policy will be updated before that happens. As with any web host, the delivery of a page involves routine request records: IP address, date and time, which file was requested, browser type, and an approximate location (roughly city or region level) derived from the IP address. These exist so that pages can be delivered, and so that attacks and abuse can be detected and blocked.

We do not use these records to identify individual visitors, we do not build profiles from them, and we do not combine them with anything else. How long the host retains them, and what the host does with them, is governed by that provider’s own terms and privacy documentation.

02.3  This website: cookies, analytics and tracking

This website (flexwithyegi.com, not the member app) sets no cookies for analytics, advertising, personalisation or tracking. It stores nothing in your browser’s local storage or session storage. There are no analytics tools, no advertising tags, no social-media pixels, no session-recording or heatmap tools, and no third-party trackers of any kind. This is why you were not shown a cookie banner on this website: there is nothing here that requires your consent.

The member app is separate from this website, and it is different. It sets a sign-in cookie and keeps information on your device, because signing in and working offline need both. Section 02.6 says exactly what.

Our hosting provider may set a strictly necessary cookie for security or bot-protection purposes. A cookie of that kind keeps the site available and is not used for advertising or profiling.

Because we do not sell or share personal information and do not carry out cross-context behavioural advertising, there is no opt-out for a Global Privacy Control signal or a Do Not Track header to act upon. If that ever changes we will honour those signals as the law requires, and we will update this policy before the change takes effect, not after.

02.4  Links that lead off this site

The page links out to Instagram and to SetupAI, the studio that built the site. If a payment button is offered on this site, it links to a checkout page hosted by Stripe (Section 02.5). Following one of those links takes you somewhere we do not control, governed by that site’s own privacy policy, and we receive nothing back when you click. The links on the home page that open the member app are different: they take you to our own app (Section 02.6).

02.5  Online payment is taken on Stripe’s pages

If you pay online — through a payment link Yegi sends you, or a payment button on this site if one is offered — the payment is taken on a checkout page hosted by Stripe, our payment processor. You enter your payment details on Stripe’s page, not on this website, so this website never receives or stores your card number or other payment details.

  • What Stripe collects. The details you enter at checkout, which can include your name, email address and payment details. Stripe handles them under its own privacy policy, which Stripe publishes on its website. Stripe decides which payment methods appear at checkout; if you choose a method provided by another company, that company handles your payment details under its own terms.
  • What we receive. A record of the payment in our Stripe account: the payer’s name and email address as entered at checkout, the amount, what was bought, and whether the payment went through. We do not receive your card number.
  • Why. So that payment can be taken and a record kept of what was paid for (Section 05).
  • How long. We keep payment records for as long as tax and accounting law requires (Section 09).

02.6  The member app, where coaching clients sign in

If you are a coaching client, you use a separate site, the Flex with Yegi member app at app.flexwithyegi.com. The links on the home page that open it lead there. Yegi uses a coach version of the same app. The app is for people Yegi has set up as clients, and for Yegi, and it works differently from this website, so this section says what it holds, where, and what it puts on your device.

  • What it holds about you. Your name and email address, and a telephone number or goals if they are entered for you. How you are coached (in person, online or both), your coaching period, the programme Yegi builds for you, and the sessions she schedules with the notes she attaches to them. The workouts you log, including the sets, weights and notes you type. Your weekly check-ins: body weight and your notes. If your coaching includes nutrition, the plan Yegi writes for you and the days you tick off or add a note to. For in-person clients, the session credits Yegi records. Private notes Yegi keeps about you, which you cannot see in the app. If a payment for a programme is recorded, the payment record described in Section 03. Yegi can also record in the app someone who has applied or contacted her but is not yet a client: a name, email address, telephone number and her notes.
  • Where it is held. In a database run by Cloudflare, in a Cloudflare account that belongs to SetupAI, the studio that runs the system for us. Cloudflare also delivers the app itself and runs the server that the app talks to (api.flexwithyegi.com). Cloudflare can technically access what its database stores and, like any host, keeps routine request records of the traffic it handles. We have not switched on the optional request logging for that server (Workers Logs), so we do not keep a request log of our own. Section 07 lists the companies that hold information, and Section 10 the places it sits.
  • Who can see it. You can see your own information in the app, and Yegi can see her clients’ information in her coach version. The app is built so that one client cannot see another client’s information. SetupAI has technical access to the database and to the administration tools, and Cloudflare can technically access what it stores (Section 07). Each week Yegi also receives an email, in her email inbox (Google Workspace), that lists clients by name as having checked in or not, clients who are running low on session credits with their balances, and clients who have asked about another service. That email does not contain any check-in weights or notes.
  • Signing in. There is no password. Yegi sets up your account, or the app does when it records your payment for a programme, and you are emailed an invitation. To sign in, you ask the app to email you a link and a six-digit code. Resend sends these emails for us (Section 07) from hello@updates.flexwithyegi.com. Either one works once, and using one cancels the other. Each stops working after a set time: a sign-in link after 15 minutes and its code after 10, the link and code in an invitation after seven days, and the sign-in link in a weekly check-in email or reminder after seven days.
  • The cookie. When you sign in, the app’s server (api.flexwithyegi.com) sets one cookie in your browser, named __Host-tt_session. It keeps you signed in. It belongs to this service and not to any other company, and it is marked HttpOnly, so the scripts on a page cannot read it. It lasts up to 90 days for a client and 14 days for Yegi, or until you sign out. It is strictly necessary for the app to work, and it is not used for tracking or advertising. The app sets no other cookie of its own. Cloudflare, which delivers the app, may set a strictly necessary security cookie.
  • On your device. So that it can work offline, the app keeps information in your browser’s local storage, for the app’s own address. This includes the workouts you have logged, with their notes and any reply from Yegi; your check-ins; your nutrition ticks and notes; the programmes assigned to you; your settings, such as pounds or kilograms; and a note of which account the device belongs to. It also keeps a small copy of your programme list and upcoming session dates, with no name, email address, nutrition plan, check-ins or workouts in it, and the browser’s cache holds the app’s own files. Anything you log is saved on the device first and sent to the server when you are online; if you are offline it waits on the device. When you sign out, the app removes your information from the device. Signing out needs an internet connection, because it also ends your session on our server. If some changes have not been sent yet, it asks whether to send them, keep them on the device, or discard them. If you do not sign out, your workouts and check-in text stay on that device, and anyone who can open the unlocked app on it can read what you can.
  • Email the app sends. Sign-in and invitation emails and, depending on your coaching, a weekly check-in invitation, a reminder if you have not checked in, and reminders before sessions Yegi has scheduled. Resend delivers them (Section 07), and replies go to Yegi’s email inbox.
  • Renewing. When your coaching period is coming to an end, the app may show a Renew or Keep going button. It opens a Stripe checkout page in a new tab with your email address already filled in (Section 02.5).
  • Your information and the app. The Settings page has a Download my data button, which saves what is stored on your device as a file. It does not contact the server and it does not include everything we hold: to get a copy of that, or to correct or delete your information, see Section 12. Removing a workout in the app hides it on your device; the copy already sent stays on file with Yegi until you ask us to delete it.
  • What the app does not do. It has no analytics, advertising or tracking tools, and it loads nothing from other companies’ servers. It does not collect progress photos. It does not send text messages.
  • Why, and how long. To deliver your coaching (Section 05). Section 09 says how long information is kept, and Section 10 how it is protected.

Section 02.3 describes this website. The member app is separate: it has its own sign-in, and the cookie and the device storage above belong to it.

03

Coaching systems: live and planned

The member app described in Section 02.6 is in operation, and so is payment on a Stripe checkout page (Section 02.5). The list below shows each part of the coaching systems and whether it is live or still planned. This policy will be updated, with a new effective date, before any planned part starts operating — we are publishing it in advance so that it does not come as a surprise.

Coaching needs a small amount of infrastructure behind it: somewhere to keep client records, a way to book sessions, a way to send email, and a way to handle payment. The arrangement is set out below, with each part marked as live or planned, and the providers are named in Section 07.

  • Applications (live, with a change planned). The form already sends your answers to us today, by the route set out in Section 02.1. What changes later is only where they are filed: instead of sitting in the form provider’s dashboard, an application will create a record in our client records system. The answers collected stay the same five.
  • Booking (partly live). Yegi schedules your coaching sessions in the coach version of the member app, you see them in your app, and the app may email you a reminder before a session. An online scheduling tool (planned provider: Cal.com) is not yet in use for coaching sessions; if one is added, it will need your name, email address and chosen time.
  • Email (live). Sign-in links and codes, invitations, check-in invitations, reminders and service notices are sent through Resend on our behalf, from hello@updates.flexwithyegi.com, an address on the Flex with Yegi domain. Replies go to Yegi’s email inbox (Google Workspace).
  • Client portal (live). The member app (Section 02.6) lets you log workouts, submit check-ins and see your own progress. Signing in works by a one-time link, or a one-time code, sent to your email address — there is no password to create or lose. Once you sign in, our server sets a sign-in cookie in your browser so you stay signed in. That cookie is strictly necessary for the app to function; it is not used for tracking or advertising, and it expires.
  • Progress tracking (live, without photos). Weekly check-ins may include body weight and written notes. The member app does not collect progress photos; if photo upload is ever added, this policy will be updated before it starts. Section 06 covers this in full, because it is the most sensitive information in the whole system.
  • Payment (card payments live; Venmo and Zelle planned). Payments may be made by card via Stripe (processed by Stripe — card data never touches our systems; see Stripe’s privacy policy), or directly via Venmo or Zelle in those apps (we record only that payment was confirmed, plus amount/date/rail). In each case the payment itself happens on the payment provider’s systems. We never see or store your full card number, bank account details or banking login. We keep the record of what was invoiced and whether it was paid, and the records described below. Payment by card on a Stripe checkout page — through a payment link Yegi sends you, or a payment button on this site if one is offered — already works as described in Section 02.5. When Stripe notifies our client records system that a payment for a coaching programme was made, the system records the payer’s name and email address, the amount, the programme, and the reference numbers Stripe attaches to the payment, and it may set up the member app account and email a sign-in invitation. When Stripe notifies it of other payment activity on our Stripe account, it records that without a name or email address, and a refund or dispute notice is recorded the same way, with Stripe’s reference number, the amount, the currency and what happened.
  • Text messages (not enabled). Text messaging is not enabled today. If and only if it is enabled for your coaching in future, same-day session reminders and late-payment reminders may be sent by text. We will ask for your phone number and your agreement first, and you can stop them at any time by replying STOP or by telling us.
04

Information we collect

The table below uses the categories of personal information named in the California Consumer Privacy Act, so that it can be read against the statute. The status column separates what is collected today from what is not collected yet.

Categories of personal information
CategoryWhat that means hereStatus
Identifiers Name, email address, Instagram handle, submitted through the application form. Separately, the IP address stored with each form submission, and the IP address recorded in server logs when a page loads. In the member app: your name and email address, an identifier for your account, and the sign-in cookie that identifies your signed-in session; the IP address your connection presents is handled by Cloudflare, which delivers the app. Today
Customer records Name, email address, telephone number, and records of payments made. (Category defined by Cal. Civ. Code §1798.80.) Today — name and email address in the member app, a telephone number if one is entered, and the payment record for a payment made through Stripe
Commercial information Which coaching programme you bought, invoices raised, and payment history. Today — what you bought and whether it was paid, for a payment made through Stripe; your coaching period and, for in-person clients, the session credits Yegi records Invoices and the rest — when active
Internet or network activity Routine request records kept by our hosts (Netlify for the website, Cloudflare for the member app): pages requested, date and time, browser and device type, referring page. Today
Geolocation Approximate location at roughly city or region level, inferred from IP address. We do not collect precise geolocation. Today
Visual information Progress photos you choose to upload as part of a check-in. The member app does not ask for or accept photos. Not collected today
Health-related information (sensitive) Body weight, body measurements, training and nutrition goals, and anything you choose to tell us about injuries, health conditions or how your body is responding. Treated as sensitive personal information — see Section 06. Today — the goal you pick and whatever you write in the application’s free-text answer In the member app, today — body weight, check-in notes, workout notes, the nutrition plan Yegi writes for you and your daily nutrition ticks and notes, and goals if they are entered
Inferences Coaching assessments drawn from your check-ins — for example a decision to adjust your calorie target or change a lift. Today — the notes Yegi writes about you and the changes she makes to your plan, recorded in the member app

Where it comes from

We collect information from four places: directly from you, when you fill in the application, log a workout or submit a check-in; from Yegi, who sets up your member app account and enters your programme, nutrition plan and notes; automatically from your device, when a page is requested and the host logs it; and from service providers acting for us, for example a payment processor confirming that an invoice has been paid.

What we do not collect

We do not collect professional or employment information, education records, or any of the following sensitive categories: Social Security or government identification numbers, driver’s licence details, account passwords (the member app does not use passwords: it uses one-time sign-in links and codes), financial account numbers or access codes, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, the contents of your private messages where we are not the intended recipient, genetic data, biometric information used to identify you, or information about sex life or sexual orientation.

05

How we use information

We use personal information only for the purposes below, all of which are things you would reasonably expect a coach to need.

  • To read a coaching application and reply to it.
  • To schedule, confirm and remind you about sessions.
  • To deliver the coaching itself — building your training and nutrition plan, reviewing your check-ins, and adjusting the plan based on how you are actually responding.
  • To communicate with you about your coaching: check-in prompts, replies, and notices about the service.
  • To invoice you, take payment, chase an unpaid invoice, and keep a record of what was paid.
  • To keep the site and the portal secure, and to detect and prevent abuse and fraud.
  • To meet legal, tax and accounting obligations, and to establish or defend legal claims if we ever have to.

We do not use your information to build advertising profiles, and we do not use your application answers, check-in notes, measurements or progress photos to train machine-learning or artificial-intelligence models, nor do we provide them to anyone else for that purpose.

If we ever want to use your information for a genuinely new purpose that is not compatible with the list above, we will tell you and ask first.

06

Progress photos, measurements and health information

The check-in system in the member app is in operation; the photo part of it is not. The app does not ask for, accept or store progress photos today, and this policy will be updated before it does. This section governs your body weight, notes and other health-related information now, and photos if they are ever added. It also applies to the forms on the website: the goal you select in the application form, and anything about your health or your body you choose to write in its free-text answer, are health-related information, and are held to the same standard as everything else below from the moment you send them.

Body weight, check-in notes and nutrition information are the most personal information in this system, and progress photos would be too if they were ever added. We treat these as sensitive personal information under California law. The rules below are commitments, not aspirations.

They are yours, and they are optional

The member app does not collect progress photos today. If photo upload is added, the following applies. You choose whether to upload progress photos. They are collected only with your explicit consent, given at the point you upload them, and you can stop providing them at any time without giving a reason.

They are never used in marketing without separate written consent

Your progress photos will not appear on this website, on social media, in advertising, in a testimonial, in a before-and-after, or in any promotional material of any kind, unless you give separate, specific, written consent for that particular use. Agreeing to coaching is not agreeing to publication, and being asked once is not standing permission.

Consent to publication is entirely optional and it is not a condition of coaching. You can limit it — for example to a cropped image, with your face excluded, or with your first name only — and you can withdraw it at any time. On withdrawal we will stop all future use and remove the material from the channels we control. We should be straightforward about the limit of that: material that has already been reposted or saved by other people may not be recoverable, which is the honest reason to think carefully before agreeing rather than after.

Who can see them

Your check-ins, workout notes and nutrition information are visible to you and to your coach, Yegi, and the app is built so that other clients cannot see them. They are stored in a database run by Cloudflare, which can technically access what it stores. SetupAI, the studio that runs the system for us, also has technical access, through the tools it uses to operate and repair it (Section 07). Each week Yegi receives an email, in her email inbox (Google Workspace), that lists clients by name as having checked in or not, clients who are running low on session credits with their balances, and clients who have asked about another service; it does not contain any check-in weights or notes.

Deleting them

You can ask us to delete your check-ins, measurements, notes or nutrition information, or your whole record, at any time (Section 12), and we will tell you what we deleted and anything we could not delete (Section 09). Removing a workout in the app hides it on your device; the copy already sent stays on file with Yegi until you ask us to delete it. If photos are ever added, you will be able to ask us to delete them on their own.

This is coaching, not medical care

Flex with Yegi provides fitness and nutrition coaching. It is not a healthcare provider, does not diagnose or treat any condition, and does not bill insurance. The health-related information you share here is therefore not protected health information under HIPAA and we do not hold it as medical records. That is a statement about which law applies, not a lower standard of care: we treat it as sensitive either way. Nothing in the coaching is a substitute for advice from a qualified medical professional.

07

When information is shared

We do not trade in personal information. It is disclosed only to the service providers we need in order to operate, and only in the situations listed at the end of this section.

Service providers
ProviderWhat it handlesStatus
Netlify — hosting Serves the website; keeps routine request and security records. In use today
Form handling — Netlify Forms Receives what you type into the application form, stores the submission for us to read, and emails us to say one has arrived. This is the same company that hosts the site. Along with the five answers described in Section 02.1, it receives the technical details your browser sends with any request, such as IP address and browser type, and stores them with the submission. It screens submissions for spam using a third-party spam filter, Akismet, which is run by Automattic. In use today
Email — Google Workspace Hosts our email inbox. It holds the notification email that arrives for each application (which can include the details you submitted), our replies, the weekly summary email that the member app sends Yegi (which lists clients by name), the replies people send to the member app’s emails, and any other email you send us, such as a privacy request. In use today
SetupAI Builds and operates this website and the member app, and the systems behind them, on our behalf, acting as our service provider. It has technical access to the member app’s database and administration tools in the course of that work, and may take backup copies of the database as files on its own computers. It is restricted to running, securing and repairing the systems. In use today
Client records and member app — Cloudflare Delivers the member app at app.flexwithyegi.com, runs the server it talks to (api.flexwithyegi.com), and runs the database that stores the member app’s records: client accounts, programmes and sessions, logged workouts, check-ins, nutrition plans and logs, session credits, payment records, and what the app needs to sign people in. The account belongs to SetupAI. Cloudflare can technically access what it stores and keeps routine request records. It also provides the domain name (DNS) service for flexwithyegi.com. Progress photos are not stored. In use today
Scheduling Booking, calendar availability and session confirmations. Planned provider: Cal.com. Not yet in use. Planned
Email delivery — Resend Sends the member app’s email for us from hello@updates.flexwithyegi.com: sign-in links and codes, invitations, check-in invitations, reminders and service notices. It receives each recipient’s email address and the content of the message, and keeps its own delivery records under its own privacy policy. In use today
Payment processing — Stripe Hosts the checkout pages where you enter your payment details — reached through a payment link Yegi sends you, or a payment button on this site if one is offered — takes the payment and tells us it was made (Section 02.5). Card and other payment details go to Stripe and not to this website. Stripe can also notify our client records system when a payment is made (Section 03), and the Renew button in the member app opens a Stripe checkout page with your email address already filled in. Invoicing and payment reminders are planned and not yet in use. Checkout pages — in use today Invoicing and reminders — planned
Venmo / Zelle We send you no information through these services and receive none back. A reminder from us tells you the amount and where to send it; you then pay directly, under Venmo’s or Zelle’s own terms and privacy policies. Planned
Text messaging Would send SMS reminders if SMS were enabled. SMS is not enabled today. Not enabled

Before any provider still marked as planned in the table above begins processing your information, we will have a written agreement in place that limits it to processing on our instructions, for the purpose of providing the service to us, and prohibits it from selling your information or using it for its own purposes — which is what the California Consumer Privacy Act requires of a service provider.

The only other circumstances

  • When you ask us to. For example, if you ask us to send your programme to your physiotherapist.
  • When the law requires it. A valid subpoena, court order or lawful government request. Where we are permitted to tell you, we will.
  • To protect people. Where disclosure is genuinely necessary to protect someone’s safety, or to investigate fraud or a security incident.
  • If the business changes hands. If Flex with Yegi is sold or merged, client records may transfer as part of it. You would be told, and the information would stay subject to a policy at least as protective as this one.
08

We do not sell or share your personal information

We do not sell personal information, and we have not sold personal information in the preceding twelve months. We do not share personal information for cross-context behavioural advertising, and have not in the preceding twelve months. We do not disclose personal information to data brokers, and we do not knowingly sell or share the personal information of anyone under sixteen years of age.

Because we neither sell nor share personal information as those terms are defined by the California Consumer Privacy Act, we do not provide a “Do Not Sell or Share My Personal Information” link. The Act does not require one from a business that does neither. If that ever changed, we would publish the link and update this policy first.

09

How long we keep information

For the website, apart from records of payments, we hold application submissions and the email we exchange about them. A submission sits in the form provider’s dashboard, and a copy of it sits in our email inbox (Google Workspace) as the notification email, alongside any email you send us and our replies. Server records kept by our host are retained on that provider’s schedule. Records of payments made through Stripe are kept in our Stripe account.

The member app’s records are held in a database run by Cloudflare (Section 07). Backup copies of the database may be held by Cloudflare and by SetupAI. Resend keeps its own delivery records of the email it sends, on its own schedule.

We keep your information for as long as we need it for the reasons in this policy: to coach you, to keep the records the law and tax rules require (payment records at least as long as tax and accounting law requires), and to keep the service secure. You can ask us to delete your information at any time (Section 12) and we will delete it from the systems we run, other than records the law requires us to keep; copies held by our providers follow their own schedules, and a copy may remain in a backup for a while.

10

How information is protected

The website and the member app are served over encrypted HTTPS connections, the application form is sent over that same kind of connection, and so is the connection between the member app and its server. The website itself has no database behind it and no account to log into. The member app has both, and the information we hold sits in these places: the applications themselves, in the form provider’s dashboard; the email copy of each application, the weekly summary email the member app sends Yegi, and any email you send us, in our email inbox (Google Workspace); records of payments, in our Stripe account and, where Stripe has notified it, in the member app’s database; the member app’s records, in the database run by Cloudflare; backup copies of that database (Section 09); the sign-in and other emails the member app sends, with Resend, which keeps its own records of them (Section 09); and, on the devices you and Yegi use, what the app and her email show there, including the information the app keeps on your device so that it can work offline (Section 02.6). Access to our accounts with these companies, and to the coach version of the member app, requires a sign-in. Our hosts also keep routine server records (Sections 02.2 and 02.6).

The member app is built to these rules:

  • No credentials in the code your browser runs. The keys that grant access to client records are held by the server (api.flexwithyegi.com), not in the website’s or the app’s code, where any visitor could read them. The app reads and writes stored data through that server, which checks who you are on every request.
  • No passwords to steal. Sign-in works by a one-time link, or a one-time code, sent to your email address. Each works once and stops working after a set time (Section 02.6), and the session it creates also expires. The codes are stored as scrambled values, not as the codes themselves.
  • Browser protections. The member app is served with a content security policy that lets it run code and load files only from itself, and make requests only to itself and to its own server.
  • Each person’s records are kept apart. The server gives your account your own information and not another client’s, and access to Yegi’s coach version is limited to an email address list that we control; removing an address ends that access on the next request.

Two limits are worth knowing. Because sign-in is by email, anyone who can read your email can sign in as you. And because the member app keeps your workouts and check-in text on your device so that it can work offline, anyone who can open the unlocked app on that device can see what you can, until you sign out.

No system is completely secure and it would be dishonest to promise otherwise. We cannot guarantee absolute security, but we can promise that if a breach affects your personal information we will notify you as the law requires and tell you what actually happened.

11

Your California privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the rights below. We do not charge for exercising them and we do not require you to create an account. Section 12 explains how to make a request.

  • The right to know. You can ask what personal information we have collected about you: the categories, the specific pieces, where it came from, why we collected it, and who we disclosed it to. This covers the twelve months before your request, and you may also ask for information collected on or after 1 January 2022, which we will provide unless doing so proves impossible or would require disproportionate effort — in which case we will explain why.
  • The right to delete. You can ask us to delete the personal information we hold about you. We must keep some of it in limited circumstances the Act allows — for example to complete a transaction you asked for, to detect security incidents, or to comply with a legal obligation such as tax record-keeping. Where we keep something, we will tell you what and why.
  • The right to correct. You can ask us to fix personal information that is inaccurate.
  • The right to portability. You can ask for a copy of your information in a portable, readily usable format. The member app’s Settings page has a Download my data button that saves what is stored on your device as a file; for everything else we hold, email us (Section 12).
  • The right to opt out of sale or sharing. We do not sell or share personal information, so there is nothing here to opt out of. See Section 08.
  • The right to limit the use of sensitive personal information. We use your health-related check-in data and progress photos only to perform the coaching you asked us for, which is a purpose the Act permits without a limitation right attaching. Regardless of that technicality: if you want us to stop using them, tell us and we will stop, and we will delete them if you ask.
  • The right against discrimination. We will not deny you service, charge you a different price, give you a lower standard of service, or suggest that we might, because you exercised a privacy right.

One honest caveat on that last right. If you ask us to delete the information the coaching runs on — your check-ins, measurements or programme history — then we can no longer deliver the part of the service that depends on it. That is a direct consequence of the deletion you asked for, not a penalty for asking, and we will explain the effect before acting so that you can decide.

We do not offer financial incentives in exchange for personal information.

Other states

This policy is written to California law. Several other states now give residents comparable rights over their personal information. If you live in one of them, contact us and we will honour an equivalent request rather than argue about which statute applies.

12

How to make a privacy request

Email yegi@flexwithyegi.com with “Privacy Request” in the subject line, and tell us what you would like us to do. Most coaching is online; some existing clients are coached in person. We deal with you directly, and we take privacy requests by email.

Verifying that it is you

Before we act on a request about specific information we have to be reasonably sure it is coming from you. Normally that means replying from the email address already on your record, or confirming a couple of details we already hold. We will not ask you for a government ID for a routine request, and we will not use anything you send for verification for any other purpose. If we cannot verify a request, we will tell you why rather than simply ignoring it.

How long it takes

We will confirm we have received your request within ten business days, and respond substantively within forty-five calendar days. If a request is genuinely complex we may take one further forty-five days, and we will tell you before doing so, with the reason.

Authorised agents

You can appoint someone to make a request for you. We will ask for written permission signed by you, and we may contact you directly to confirm.

If you are not satisfied

Reply and ask us to look again — the fastest fix for most disagreements is usually a second read. You can also complain to the California Privacy Protection Agency or to the California Attorney General’s office.

13

Children and age requirement

Flex with Yegi coaching is for adults. The service is intended for people aged 18 and over, and the website is not directed at children.

We do not knowingly collect personal information from anyone under that age. If you believe a minor has given us personal information, contact us at the address in Section 16 and we will delete it. As stated in Section 08, we do not sell or share personal information, and therefore do not sell or share the personal information of consumers under sixteen.

14

Where information is processed

We operate in the United States. The companies listed in Section 07 run their own systems and decide where those systems are, so we cannot promise that your information stays in the United States, and some of it may be handled elsewhere. If you access this site or the member app from outside the United States, be aware that your information may be processed in the United States or elsewhere, under laws that may differ from the protections in your own country.

This website and the coaching service are directed at people in the United States and are not offered to people in the European Economic Area or the United Kingdom.

15

Changes to this policy

We will update this policy when what we actually do changes — and, as Sections 02 and 03 make clear, some of it is going to change as coaching systems are switched on. When that happens, the updated policy will be posted here with a new effective date at the top, and the change will be made before the new practice begins, not after.

If a change is material — a new category of information, a new purpose, or a new provider handling your check-ins or photos — we will email active clients before it takes effect, with 14 days’ notice. Continuing to use the service after the effective date means the updated policy applies to you. Ask us and we will send you the previous version.

16

How to contact us

For any question about this policy, about what we hold, or to make a privacy request:

A real person reads that inbox. If your question is about your own information, say so in the subject line and we will treat it as a privacy request under Section 12.