Privacy Policy

Varsity Stack LLC (“Varsity Stack,” “we,” “us,” or “our”) provides a mobile application, website, and related services that help athletes find certified supplement products, get personalized supplement recommendations, track a personal routine, and, separately, participate in a team or institutional supplement program (collectively, the “Services”).

This Privacy Policy explains what information we collect, where it comes from, how we use and disclose it, how long we retain it, and the choices available to you.

Privacy at a Glance

• The athlete app is free. There is no subscription, no paywall, and no billing or payment processor anywhere in the Services.
• The Personal Experience and the Team Experience are separate products with separate accounts and separate databases. They are not two views of one account, and neither can read the other’s data.
• We removed several categories of sensitive data entirely in July 2026. The AI coach, the insights tab, wearable and Apple Health / Health Connect integration, and blood-work and laboratory values were deleted from the product, and the database tables behind them were dropped. We no longer collect any of it.
• We use AI for two narrow purposes in the Personal Experience: selecting and explaining personalized recommendations, and identifying a product from a privacy-minimized photograph of supplement packaging. Label-scan requests carry the image and fixed instructions only — no athlete name, account or user identifier, school, team, note, recommendation, or health information. The Team Experience uses the same label scan, for product identity only, on its own separate provider project; nothing else in the team product makes an AI request.
• Varsity Stack does not store the label image or train on it. In both experiences the app crops and re-encodes the packaging image and removes its metadata; our backend holds it only in request memory while OpenAI returns the product identity, then discards it. Varsity Stack does not store the raw or processed image or use it to train any model, and our agreement with OpenAI does not permit OpenAI to use it to train its general-purpose models. Every extraction request is sent with store: false. OpenAI may retain the image as part of its safety screening — image inputs sit outside the Zero Data Retention we have enabled, under our agreement with OpenAI. Section 3.6 explains this exactly.
• A team sees only what the Team Participation and Data-Sharing Notice says it sees, shown to you before you join.
• We do not sell personal information or consumer health data, and we do not use health, fitness, or wellness information for targeted advertising.

This summary is provided for convenience. The complete Policy below controls.

1. Scope

This Policy applies to the Varsity Stack mobile application, website, Personal Experience, Team Experience, customer support, and other Services that link to this Policy.

This Policy does not govern a third-party service, app store, retailer, university, athletic program, or website that maintains its own privacy notice. When you use a third-party service, its terms and privacy practices also apply.

2. Two Separate Products, Two Separate Accounts

2.1 The Personal Experience

The Personal Experience is the athlete app, and it is free. It covers five areas: a home screen with personalized supplement recommendations, a personal supplement stack, daily tracking and streaks, a product scanner, and settings. Its purpose is narrow: helping you find products certified by NSF Certified for Sport®, the INFORMED programmes and BSCG, and helping you decide what to take.

The Personal Experience does not include an AI chat assistant, an insights or analytics dashboard, wearable or health-platform integration, laboratory or blood-work entry, or any paid tier. Those features were removed on July 26, 2026 and the data behind them was deleted.

2.2 The Team Experience

The Team Experience is available when an athlete enters a team invitation code, uses an institutional single sign-on, or otherwise elects to join an institution’s Varsity Stack environment. Before joining, the athlete is shown a Team Participation and Data-Sharing Notice identifying the institution, the information the institution may access, the authorized roles that may access it, the purpose, how long sharing continues, and how to stop it.

For information that Varsity Stack processes at an institution’s direction, Varsity Stack acts as the institution’s service provider. The institution’s own privacy notices, policies, and agreements may also apply to copies of information it receives or directs Varsity Stack to maintain.

2.3 The two are separate accounts

A personal account and a team account are different accounts with different logins, stored in different databases operated as separate systems. Joining a team does not convert your personal account, and creating a team account does not create a personal one. Signing in to one does not sign you in to the other.

This has two consequences worth stating plainly. First, information in your Personal Experience is not made available to a team merely because you also have a team account — the team system holds no credential for the personal database. Second, deleting one account does not delete the other. If you hold both, you must delete both. Each deletion tells you, in its confirmation, exactly which account it covered.

3. Information We Collect

We collect only the information reasonably necessary to provide, secure, and improve the applicable experience.

3.1 Account and Identity Information

We may collect:

• name;
• email address;
• account credentials or authentication identifiers, including sign-in through Apple or Google, or an institution’s single sign-on for team accounts;
• age or date of birth, used for eligibility and for age-appropriate supplement filtering;
• team or institution affiliation, for team accounts; and
• account status, consent and notice-acknowledgment records, time zone, and communication preferences.

Passwords are handled by our authentication provider, Google Identity Platform, which stores them only in hashed form. Varsity Stack’s own application code never stores your password.

3.2 Athlete Profile, Sport, and Training Information

In the Personal Experience, you provide during onboarding and may later edit:

• age, sex, height, weight, and unit preference;
• sport, event or position, and training environment;
• season or training phase and training days per week;
• whether you are currently injured, and the type of injury;
• diet type and confidence in meeting protein needs;
• your primary goal, your motivation, and the part of supplementation you find hardest; and
• supplements you already take when you sign up.

3.3 Self-Reported Wellness Inputs

The athlete app asks a small set of self-reported questions used to personalize recommendations. These are answered by you in the app; none are measured, imported, or read from a device or health platform:

• typical sleep duration and sleep quality;
• stress level;
• fatigue frequency;
• muscle soreness and cramping;
• caffeine intake; and
• whether you have a history of low iron.

We do not collect sleep tracking, heart rate, heart-rate variability, VO₂ max, steps, calories, training load, recovery scores, workout or route data, menstrual-cycle information, or laboratory values. No such feature exists in the Services and no table exists to hold that data.

3.4 Supplement, Product, and Scanning Information

We may collect:

• the supplements in your stack, including dose and timing, and any items you disable or customize;
• taken or missed doses, adherence records, streaks, experience points, levels, and earned badges;
• product names, brands, barcodes you scan, and the products you confirm;
• NSF Certified for Sport®, INFORMED, BSCG, or other product-certification status associated with a product; and
• reminder settings and notification preferences.

In the Personal Experience, the app instructs you to photograph only the supplement packaging. It crops and re-encodes the image on your device and removes EXIF and other embedded metadata before upload. The processed image travels through the Varsity Stack backend, not directly from the app to OpenAI, and is used only to extract structured label fields. The scan request contains no athlete name, user or account identifier, school, team, notes, recommendations, health information, or other profile context. Barcode-only scans send only the barcode.

The Varsity Stack backend holds a Personal Experience scan image only in request memory and discards it as soon as extraction finishes. Temporary on-device camera and prepared-image cache files are deleted after the result or error. Application code does not write the request body to logs, analytics, or error monitoring, and we deploy the feature only with request-body capture disabled and verified across our hosting, delivery, analytics, and error-monitoring services. We do not retain the raw or processed image. You must review and confirm the extracted fields; only the confirmed structured result — brand, product name, variant, and barcode — may be saved.

In the Team Experience, the label scanner works the same way, for the narrower purpose of identifying a product. The app crops and re-encodes the packaging image, removes its metadata, and sends it through the Varsity Stack team backend to OpenAI, which returns product identity only — brand, product name, variant, and barcode. It does not extract ingredients, and it makes no certification, approval, safety, or eligibility determination. The team deployment uses its own separate AI provider project and credentials, and the request contains the image and fixed instructions and nothing else: no athlete name, user or account identifier, school, team, roster, note, recommendation, or health information reaches OpenAI. The image is held in request memory and discarded when extraction finishes, on the error path as well; it is not written to a database, object storage, cache, queue, or log, and Varsity Stack does not store it. Apart from this scanner, the Team Experience makes no AI request of any kind.

An institution decides whether the team label scanner is on. It is an institution-level setting and has been off by default since August 13, 2026, so an institution turns it on deliberately rather than finding it already on. With it off, the team scan tab offers barcode scanning only and the server rejects any label-scan request from that team, so no packaging image is sent to OpenAI even from an out-of-date app. Turning it off stops future scans; it does not reach anything already processed. An institution that requires an image-free path as a contractual term should have this disabled before its athletes are onboarded.

AI label extraction does not determine whether a product is certified, safe, banned, or approved. Certification and prohibited-substance information comes from third-party registries, not from AI, and any team approval is made by authorized staff.

3.5 Team Enrollment and Team Activity Information

When you join a team, we collect in the team system:

• your name and email address;
• team and institution identifiers, invitation or membership information, and your acknowledgment of the Team Participation and Data-Sharing Notice;
• the enrollment answers shown to you in that Notice: sport, event or position, season phase, age, sex, weight, diet type, and primary goal;
• the products in your team supplement inventory, including brand, name, barcode, any dose or timing your staff sets, and any dose or timing you record yourself;
• products you submit for staff review, and the staff decision and reason;
• supplement recommendations, reminders, and tasks your team staff create for you; and
• a record of your actions in team context, used for the team activity view. This record deliberately stores no athlete name and no staff note text; those are looked up when the view is displayed.

The enrollment answers listed above are collected separately in the team app, under the Notice, and are not copied from a personal account.

3.6 Recommendations and Label-Extraction AI

The athlete app generates a personalized supplement stack. To do this, we send your profile answers, your self-reported wellness answers, your current stack and a summary of your recent adherence, and a list of candidate supplements to our AI provider, OpenAI. Your current stack includes the name, brand, and type of any custom product you typed in. The request does not include your name, email address, or account identifier. OpenAI ranks the candidates and writes a short explanation for each, and the app shows you a short list, currently up to six. We store the resulting recommendations and a record of each run.

We also use OpenAI, in both the Personal and the Team Experience, to identify a product from the privacy-minimized packaging image described in Section 3.4. Each deployment uses its own separate OpenAI project and credentials; the team service does not hold the personal service’s, and neither holds the other’s. For label extraction we use the Responses API with store: false on every request, and we do not use Files, background mode, conversations, web search, or other persistent OpenAI features. The request contains only the processed packaging image and fixed extraction instructions, without the athlete, account, school, team, health, note, or recommendation context described elsewhere in this Policy. The same image is also submitted, on its own, to OpenAI’s moderation service so that unsuitable images can be screened out. OpenAI processes the image only to return the product identity and does not receive who you are, what team you are on, or anything about your health.

There is no AI chat and no stored AI conversation. The label scan is the only AI request the Team Experience makes; it runs on its own provider project and does not touch any other team surface. Our AI provider may process information only to provide services to Varsity Stack and may not use information submitted on our behalf to train its general-purpose models. We do not use your information, including a scanned label image, to train any AI model, and we do not permit our AI provider to do so.

OpenAI has approved Zero Data Retention for both label-extraction projects — the Personal one and the Team one — and we have enabled it. This is a project-level control confirmed with OpenAI on August 7, 2026; it is separate from, and additional to, the store: false we send on every label-extraction request on both deployments. Under it, OpenAI has committed not to store the extracted result after returning it to us.

Zero Data Retention does not extend to the packaging image itself, and we want to be exact about that rather than let the paragraph above imply otherwise. Our written agreement with OpenAI states that modified retention does not apply to inputs that are images or files, which may be retained by OpenAI as part of its safety screening — an automated review of submitted content for safety or security purposes. So the image you photograph sits outside Zero Data Retention by the terms of that agreement, and OpenAI may retain it. This is a limit of OpenAI’s, not ours, and it is the reason the app accepts a photograph of supplement packaging only, strips the metadata, and never opens your photo library.

What remains true regardless: we do not retain the image, we do not use it to train anything, and OpenAI may not use it to train its general-purpose models. An earlier version of this Policy said Zero Data Retention meant OpenAI did not store the packaging image. That was wider than our agreement supports, and this Section was corrected on August 9, 2026.

3.7 Device, Usage, Analytics, and Security Information

We may automatically collect:

• device type, operating system, app version, and language;
• IP address and approximate city or region inferred from IP address;
• login, authentication, and security events;
• feature interactions and app-performance information;
• crash diagnostics; and
• request identifiers used for troubleshooting.

Product analytics and crash reporting identify you only by a pseudonymous identifier, and are never associated with a team account — a team session is never identified to either tool, and neither receives your team, roster, staff notes, recommendations, or health information. In the Personal Experience you can turn off optional analytics in the app; see Section 11. We do not permit analytics or crash-reporting tools to intentionally capture sensitive content, we do not use session replay, and we do not collect precise GPS location anywhere in the Services. A crash that happens during a team session may still produce a diagnostic report, which carries no user identifier.

Cookies and browser storage. Our website does not set advertising or analytics cookies. Website analytics run without cookies or any identifier stored in your browser, and record page views, the referring page, your device type and operating system, and clicks on app-store and invitation links. The team dashboard keeps you signed in, and remembers your preferences and unsent drafts, using your browser’s local and session storage, and sets a short-lived sign-in cookie during institutional single sign-on. Our content delivery and security provider may set cookies that are strictly necessary to protect the Services.

Do Not Track and Global Privacy Control. We do not track you across third-party websites or apps, and we do not sell or share personal information for advertising, so the Services do not change their behavior in response to a browser’s Do Not Track or Global Privacy Control signal. We do not permit third parties to collect information about your activity over time and across different websites through the Services.

3.8 What We No Longer Collect

On July 26, 2026 we removed the AI coach, the insights tab, wearable integration, blood work, the paywall, and creator referral codes from the athlete app, and dropped the database tables behind them. As a result the Services no longer collect, store, or process:

• AI conversations, AI-generated insights, or AI usage records;
• laboratory or blood-work values of any kind;
• data from WHOOP, Garmin, Oura, Apple Health, HealthKit, Health Connect, or any other wearable or health platform, including any access token for such a service;
• workout, activity, or route information;
• subscription, entitlement, purchase, or billing information; or
• referral or creator-attribution information.

These are absent from the product, not merely switched off. Reintroducing any of them would be a material change to which Section 16 applies.

4. Sources of Information

We collect information:

• directly from you;
• from your device, for the permissions you grant — camera for scanning and notifications for reminders;
• from an institution when needed to create or administer a team environment, or from an institution’s single sign-on provider when you authenticate that way;
• from app stores and authentication providers when you sign in with Apple or Google; and
• automatically through device, security, analytics, and crash-reporting technologies.

We also use public product-reference sources, including the NIH Dietary Supplement Label Database and USDA FoodData Central, to identify products. Those lookups send a barcode or a product name and no user identifier. Certification status comes from our own copy of the registries that certifiers publish, so looking up a certification sends nothing about you to a certifier.

That copy is taken at a point in time and can be out of date or wrong, and a certifier can withdraw a certification after we last refreshed it. Information that you, team staff, or an institution enter, such as a lot number, is recorded as entered and is not verified by Varsity Stack. The Terms of Use explain the limits of certification, lot, and recall information.

5. How We Use Information

We use information to:

• create, authenticate, and maintain accounts;
• provide the Personal and Team Experiences;
• generate and explain personalized supplement recommendations;
• identify scanned products and display product-certification information;
• maintain your stack, tracking, streaks, and reminders;
• administer team enrollment, team supplement inventories, and staff product review;
• provide notices, support, and service communications;
• detect, investigate, and prevent fraud, misuse, and security incidents;
• troubleshoot, analyze, and improve the Services;
• create aggregated or de-identified statistics that do not reasonably identify an individual;
• comply with law and enforce our agreements; and
• protect users, Varsity Stack, institutions, and others.

Varsity Stack does not use the Services to make medical diagnoses, prescribe treatment, determine athletic eligibility, or replace the judgment of a physician, registered dietitian, athletic trainer, or other qualified professional.

6. What a Team Can See

There is exactly one team product, and it is the data-minimized one. There is no expanded, clinical, or “regulated” tier that an administrator can switch on.

6.1 Shared once you join

Authorized team staff can see:

• your name and email address;
• your sport, event or position, and season phase;
• the enrollment basics you provide when joining: age, sex, weight, diet type, and primary goal;
• the supplements in your team stack and their certification status;
• products you submit for staff review and the staff decisions on them;
• supplement recommendations, reminders, and tasks your team staff create for you; and
• your team activity, such as adding a product or submitting one for review.

6.2 Shared only if your team’s settings allow it

Each of the following is controlled by a setting your institution manages. When one is off, the underlying information is not read by staff-facing screens at all rather than read and hidden. The app shows you the live on/off state for your own team under “What My Team Can See.”

These two are on for a newly created team, and your institution can turn each one off:

• whether you logged your supplements, the time you logged each one (shown in your phone’s time zone), and your adherence over a recent window; and
• notes your team staff write about you, which you can also see.

These are off unless your institution turns them on:

• your weekly check-in answers;
• your name and your position on a team leaderboard ranked by logging streak, which is shown to other athletes on your team. Your institution can set the leaderboard to hide names from other athletes;
• ingredient labels for the products in your team stack, and an aggregate ingredient-exposure view; and
• which specific supplement container you have, by lot number and expiry. This record can come from team staff handing you a container, or from you recording one you hold. It records which batch you had so that a recalled lot can be traced, and it does not record whether you took anything.

A team also controls one setting that is not about sharing: whether its athletes can identify a product by photographing its packaging. Label scanning is off by default. When an institution turns it on, packaging images are sent for product identification as described in Section 3.4. When it is off, the team scan tab accepts barcodes only.

6.3 Never available to a team

The following are not available to team staff under any setting, because the team system has no place to store them and no code to produce them:

• anything from your separate personal account, including your personal stack, personal scan history, and personal recommendations;
• wearable, Apple Health, Health Connect, or other connected-device data — which the Services no longer collect at all;
• sleep, heart-rate, HRV, VO₂ max, training-load, recovery, GPS, or workout data;
• laboratory values, blood work, medical records, diagnoses, medications, or clinical notes;
• injury fields;
• AI conversations, AI-generated insights, notes, recommendations, or health content of any kind. The one exception is deliberate and narrow: the product name a label scan reads off a package, which you review and confirm before it is saved. No AI system writes anything else a team sees;
• athlete-to-athlete comparison features, other than the optional leaderboard described in Section 6.2; and
• subscription or billing information, which does not exist in either product.

Automated checks run on every change to the Services confirm that no table capable of holding these categories has been added to the team system.

6.4 Who at the team can see it

Access is limited to the authorized staff roles identified in the Team Participation and Data-Sharing Notice, and is intended for designated sports-performance nutrition personnel. It is not provided to coaches by default. Your institution administers its own staff roster and roles.

6.5 Leaving a team

You can leave a team at any time from Settings. Your team loses access immediately, and your team stack and the recommendations, reminders, and notes staff created for you are removed. Container and lot records are kept in the team system, where staff can still find them in a lot search, to help the team’s own lot tracing, until you delete your team account or the team’s data is purged. Information already received or independently retained by an institution remains subject to the institution’s obligations and its agreement with Varsity Stack. Leaving a team does not delete your team account; deleting your team account is a separate action, and neither deletes a separate personal account.

6.6 Expanding the team product

Varsity Stack will not make an additional sensitive category available to an institution merely because an administrator changes a setting. Any expansion would require a change to the Services, the required legal agreements and security controls, institutional approval, role restrictions, and athlete-facing notice or consent. We would update this Policy and the applicable Team Participation and Data-Sharing Notice first.

7. How We Disclose Information

7.1 Service Providers

We use service providers for cloud hosting and databases, authentication, application hosting, content delivery and web application firewall, transactional email, push notification and app update delivery, rate limiting, product analytics, crash reporting, product identification, sign-in with Apple or Google, product pricing and purchase links, source-code hosting and scheduled jobs, and the recommendation and label-extraction features described in Section 3.6. These providers may process information only for contracted purposes and must protect it under applicable agreements.

Our primary infrastructure provider is Google Cloud. Since September 24, 2026, the Services’ databases, application servers, file storage, and backups run on Google Cloud in the United States, and sign-in runs on Google Identity Platform. The Personal Experience and the Team Experience run in separate Google Cloud projects. Each has its own database, its own sign-in system, and its own credentials. Before that date, the same functions were provided by Supabase (database and sign-in) and Railway (application hosting). We stopped using Railway on September 27, 2026, when our website also moved to Google Cloud, and deleted our services there. We deleted our Supabase projects, and all the data in them, on September 27, 2026. Neither provider holds or receives any of your data.

There is no payment or billing processor in either product. You can obtain the current, itemized list of the third parties that receive your information, and how to contact each, from Settings → Privacy & Your Data in the app; it is included in your data export. Team accounts receive a list covering only the providers that actually receive team information, which is a shorter list.

7.2 Teams and Institutions

When you join a Team Experience, we disclose only the categories described in the Team Participation and Data-Sharing Notice and Section 6. An institution may use the information only for the authorized team purpose and subject to its agreement with Varsity Stack and applicable law.

An institution and its staff make their own decisions with what they see. Varsity Stack does not control, and is not responsible for, how an institution or its staff use, disclose, or retain information after they have accessed it, or for the accuracy of what they enter. The institution’s own policies and legal obligations govern that.

7.3 Retailers and Affiliate Links

If you tap a retailer or affiliate link, the retailer may receive information ordinarily transmitted through a web request, such as the referring page, device information, and anything you provide directly to the retailer. The retailer’s privacy policy governs its processing.

Varsity Stack may earn a commission from purchases made through affiliate links. Affiliate compensation does not change product-certification rules or team review status, and does not permit a retailer to receive your health, wellness, or team information from Varsity Stack.

7.4 Legal, Safety, and Security Disclosures

We may disclose information when reasonably necessary to comply with law or legal process; enforce our agreements; detect or investigate fraud, abuse, or security incidents; or protect the rights, safety, and property of users, Varsity Stack, institutions, or others.

7.5 Business Transactions

Information may be transferred as part of a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections and applicable law.

7.6 At Your Direction

We may disclose information when you request or affirmatively consent to the disclosure.

7.7 Friends

In the Personal Experience you can follow other athletes and keep a Friend Streak with them. Someone who follows you sees your first name, your @username, your streak, whether you logged today, your level, and your awards. They never see your stack, your doses, or the products you take.

Your invite link, varsitystack.com/add/<your username>, shows your first name and initials to anyone who opens it, and nothing else. You choose who can follow you, and you can set it to No one; the invite link then names no one. Blocking someone removes the follow in both directions.

Contact matching is off by default and uses email addresses only. Others can find you from their contacts only if you turn on Let contacts find me. When you look for friends in your contacts, your phone turns each email address into a SHA-256 hash before anything is sent. Our server compares those hashes with the accounts that turned that setting on, and keeps no contacts and no hashes.

Nudges and other friend notifications are push notifications, delivered through Expo, the push notification provider the app already uses (Section 7.1). No new provider is involved.

8. No Sale, Targeted Advertising, or Data Brokerage

Varsity Stack does not:

• sell personal information or consumer health data;
• share personal information for cross-context behavioral or targeted advertising;
• use health, fitness, or wellness information for advertising;
• disclose identifiable personal information to data brokers; or
• permit third parties to build advertising profiles from your information.

9. Data Retention

We retain information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Services, maintain security, comply with law, resolve disputes, and enforce agreements.

Our retention framework is:

• Supplement label scan images, in both the Personal and the Team Experience: held by the backend only in request memory while the product is identified, and discarded immediately after a result or error. Temporary on-device camera and prepared-image cache files are then deleted. Varsity Stack does not retain the raw or processed image at all — it is never written to a database, object storage, cache, retry queue, or log — and only the fields you confirm are retained. OpenAI’s own retention is governed by our agreement with it and by its data controls for the dedicated project; note in particular that the image sits outside Zero Data Retention and may be retained by OpenAI, as Section 3.6 describes.
• Account and content: retained while the account is active. Account deletion starts immediately when you confirm it. It is reported as a success only when every part of the erasure completed: if any part fails, the deletion is reported to you as incomplete, your account stays active, and you can run it again or contact us to finish it.
• Other verified deletion requests: completed within 30 days unless a shorter period is required by law.
• Team data after a team ends: when an institution’s team is archived, all associated team data is purged 60 days later, unless the institution has placed a documented legal hold or law requires retention.
• Unaccepted staff invitations: purged 90 days after expiry.
• Reminder delivery records: 180 days.
• Retention-job audit trail: 730 days.
• Membership-lifetime data: roster membership, enrollment answers, team supplement inventory, adherence and awards, product-review outcomes, staff recommendations, tasks, reminders and notes, the team activity record, check-in answers, and the team audit log are retained for the life of the membership or the team and are removed by account deletion or team purge. Container and lot records are retained after you leave a team, until account deletion or team purge.
• Backups: deleted information stays in encrypted automated database backups until those backups rotate out. Personal Experience backups rotate out within 14 days and Team Experience backups within 30 days. The recovery log used to restore a database to an exact moment keeps 7 days. Backups are used only to recover from a failure. In every case, backup copies are deleted no later than six months after the deletion request is authenticated, where consumer-health law requires it. The copy held by our former database provider, described in Section 7.1, was deleted on September 27, 2026.
• Consent, audit, privacy-request, and security records: retained for the period reasonably necessary to document compliance and meet legal obligations. Records that prove a deletion occurred are retained rather than deleted; they are keyed to a one-way hash of your internal account identifier, not to your name or email address.
• Aggregated or de-identified information: may be retained when it cannot reasonably be used to identify an individual, and we commit not to attempt re-identification.

When we direct a processor to delete consumer health data, we also instruct applicable recipients to honor the request as required by law. Copies independently retained by an institution are governed by the institution’s obligations and policies.

10. Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, encryption at rest for our databases, backups, and file storage, access controls, authentication, role-based permissions, database row-level security, separation of the personal and team systems into distinct databases, distinct deployments, and distinct Google Cloud projects, secrets kept in a managed secret store, request logging and tracing, rate limiting, automated daily backups with point-in-time recovery, and automated checks that run on every change to the Services.

The separation described in Section 2.3 is itself a security control: the team system holds no credential for the personal system and the personal system holds no credential for the team system, and each refuses to start if it is pointed at the other’s sign-in system.

Our Trust Center lists each of these controls individually, along with the subprocessors that receive data, the documents we provide for an institutional security review, and the limits we do not claim to have exceeded.

No method of transmission or storage is completely secure. We cannot guarantee absolute security, and you should protect your credentials and notify us promptly of suspected unauthorized access. If we learn of a security incident that affects your information, we will notify you and the relevant authorities as the law requires.

11. Your Rights and Choices

Depending on your location and the information involved, you may have the right to:

• access or obtain a copy of your information;
• correct inaccurate information;
• delete your account and information;
• confirm whether we collect, share, or sell consumer health data;
• obtain a list of third parties with whom consumer health data has been shared;
• withdraw consent to future collection or sharing of optional information;
• leave a team and stop future team sharing;
• opt out of optional analytics;
• unsubscribe from marketing communications; and
• appeal a refusal to act on a privacy request.

In the app, Settings → Privacy & Your Data lets you download a copy of your information as a file, turn optional analytics off, and submit a privacy request — including correcting your information, withdrawing consent, confirming what we collect, and requesting the list of third parties. Team accounts have the same export and request controls in the team app and dashboard.

Your export tells you if any part of it could not be produced, so a partial export is never presented to you as a complete one.

You may also email support@varsitystack.com. We log every request we receive and respond within the period required by law. We may take reasonable steps to verify your identity and authority. You do not need to create a new account to make a request. An authorized agent may submit a request where permitted by law; we may require proof of authorization and may ask you to verify the request directly.

Withdrawing consent or deleting information may disable features that depend on that information. We will not discriminate against you for exercising a privacy right.

California and Nevada residents. We do not disclose personal information to third parties for their own direct marketing purposes, and we do not sell personal information as those terms are defined under California or Nevada law. If you are under 18, you can remove content you have entered by editing it or deleting your account.

If you hold both a personal and a team account, deleting one does not delete the other. Each deletion states in its confirmation which account it covered.

12. U.S. Consumer Health Data Privacy Notice

This Section 12 is Varsity Stack’s Consumer Health Data Privacy Notice. It supplements the rest of this Policy and applies to “consumer health data” as defined by applicable U.S. state law.

12.1 Categories of Consumer Health Data We May Collect

Consumer health data we may collect is limited to:

• your supplement stack, dose and timing, adherence, streaks, and caffeine intake;
• age, sex, height, weight, diet type, and protein-intake confidence;
• self-reported sleep duration and quality, stress, fatigue, muscle soreness, cramping, and history of low iron;
• injury status and injury type, in the athlete app;
• weekly check-in answers, in the team app, where your team has enabled check-ins;
• supplement health goals and the recommendations and explanations generated from the information above; and
• in both the Personal and the Team Experience, a transient, metadata-stripped photograph of supplement packaging, and the product-identity fields you confirm from it. The photograph is not retained by Varsity Stack.

We do not collect laboratory values, wearable or connected-device measurements, workout or route data, menstrual-cycle information, diagnoses, medications, or medical records. These categories do not exist in the Services.

12.2 Sources

We collect consumer health data:

• directly from you;
• from calculations or inferences generated to provide a feature you requested; and
• from your device’s camera when you scan a product, in either experience, after the app crops and re-encodes the packaging image and removes embedded metadata.

12.3 Purposes

We use consumer health data to:

• provide the feature you requested;
• generate and explain personalized supplement recommendations;
• show you your own trends, tracking, and streaks;
• support your team’s supplement program, within the limits of Section 6;
• maintain security and prevent fraud or misuse;
• comply with law; and
• create aggregated or de-identified statistics that do not reasonably identify an individual.

We do not use consumer health data for advertising, marketing profiles, data brokerage, or general-purpose model training.

12.4 Consumer Health Data We Share

We share only the consumer health data reasonably necessary with:

• our cloud database, hosting, and infrastructure providers, which process it on our behalf;
• our AI provider, OpenAI, for the recommendation feature in the Personal Experience only, and for label scanning and its image screening in both experiences — and for label scanning it receives only the processed packaging image and fixed instructions, without athlete, account, school, team, health, note, or recommendation context, as described in Section 3.6; and
• an institution, only where the information is expressly listed in the applicable Team Participation and Data-Sharing Notice and permitted under Section 6.

Product analytics and crash reporting are never identified to a team account, as Section 3.7 describes. Label-extraction requests carry no athlete, account, school, team, health, note, or recommendation context on either deployment, and on the team side they are the team product’s only AI requests. We do not have an affiliate with which we share consumer health data. We do not sell consumer health data, and we do not permit any provider to use consumer health data, including a scanned label image, for model training.

12.5 Consumer Health Data Rights

Subject to applicable law, you may:

• confirm whether Varsity Stack collects, shares, or sells consumer health data;
• access your consumer health data;
• obtain a list of third parties with whom it has been shared and a way to contact them;
• withdraw consent to future collection or sharing; and
• request deletion from Varsity Stack and applicable processors or other recipients.

Submit a request or appeal using the in-app privacy controls or by emailing support@varsitystack.com. We will authenticate and respond as required by law. Where Washington law applies, we will generally respond within 45 days and may extend once by an additional 45 days when reasonably necessary and after providing notice. Requests are free up to the frequency required by law.

If we deny a request, you may appeal by replying to the decision or emailing support@varsitystack.com with the subject line “Privacy Appeal.” If an appeal is denied, we will provide information about how to contact the appropriate regulator when required.

12.6 Changes to Consumer Health Data Practices

We will not collect, use, or share an additional category of consumer health data, or use consumer health data for a materially new purpose, without updating this Notice and obtaining affirmative consent when required by law.

Varsity Stack does not use a geofence around a facility that provides in-person health services to identify, track, collect data from, or send messages or advertisements to a person concerning consumer health data.

13. Children and Teen Users

The Services are not directed to children under 13, and Varsity Stack does not knowingly collect personal information from a child under 13. If we learn that we collected such information without legally sufficient authorization, we will delete it.

Users ages 13 through 17 may use the Personal Experience only with the permission of a parent or legal guardian where required by law. A Team Experience account is available only to users who are at least 18. A school or team invitation does not replace parental consent when parental consent is legally required.

A parent or legal guardian who believes a child has given us personal information without the required permission can email support@varsitystack.com, and we will delete it after verifying the request.

If Varsity Stack offers a program to users under 13 in the future, we will first implement a separate children’s privacy notice, verifiable parental-consent process, and age-appropriate controls.

14. HIPAA, FERPA, and Institution-Directed Information

Health-related information is not automatically Protected Health Information under HIPAA merely because a user enters it into a consumer app. HIPAA status depends on who creates, receives, maintains, or transmits the information and on whose behalf.

Information Varsity Stack processes for a school may be an education record protected by the Family Educational Rights and Privacy Act (“FERPA”) or applicable state student-privacy law. If Varsity Stack processes Protected Health Information on behalf of a HIPAA covered entity or business associate, Varsity Stack will do so only under the applicable Business Associate Agreement and required HIPAA safeguards.

Varsity Stack has signed a Business Associate Agreement with Google Cloud, our infrastructure provider, and the team system runs on Google Cloud services that agreement covers. That agreement is between Varsity Stack and Google. It does not make Varsity Stack a business associate of any school or team, and it does not mean the Services are designed to process Protected Health Information. It is also not a claim that Varsity Stack is certified under or compliant with HIPAA.

This Policy is not a HIPAA Notice of Privacy Practices. The team product is designed to exclude medical records, laboratory values, diagnoses, medications, injuries, connected-device data, and AI-generated health content from staff-facing access, and the underlying data categories do not exist in the team system. The institution must classify its own workflow under applicable law.

The Services accept free text in staff recommendations, tasks, reminders, product-review notes, and, where enabled, staff notes. Every such field is length-limited. The Services do not validate what is typed into these fields, and institutions are responsible for instructing staff on what they may record.

15. International Data Transfers

Varsity Stack is based in the United States. Our databases, application servers, and backups are hosted by Google Cloud in the United States. The Personal Experience database runs in Northern Virginia and the Team Experience database in Oregon, and their backups are kept in Google Cloud’s United States storage. Some service providers, such as content delivery, email, and push-notification providers, may process information in the United States and other countries where they operate. These locations may have different data-protection laws. Where required, we use appropriate safeguards for international transfers.

16. Changes to This Policy

We may update this Policy to reflect changes in the Services, law, or our practices. We will post the updated Policy with a revised “Last Updated” date. If a change materially expands how we collect, use, or disclose sensitive information — including reintroducing any category listed in Section 3.8 — we will provide additional notice and obtain affirmative consent when required.

17. Contact Us

Questions, privacy requests, or complaints may be sent to:

Varsity Stack LLC
Email: support@varsitystack.com
Website: www.varsitystack.com
Mailing Address: 6650 Rivers Avenue, North Charleston, SC 29406
Telephone: 904-465-6804