← Undercore

Privacy Policy

Last updated: November 2, 2026

This policy explains what personal information Undercore ("we", "us"), operated by Undercore Digital, collects and how we use it. We collect as little as possible, and nothing about your health leaves your device.

1. What we collect

• Purchase information. When you buy, PayPal processes the payment. We receive the email address on your PayPal account, the order ID and the amount. We never see your card or bank details.
• Your account. Your email address and a password you choose. We store the password only as a salted, one-way hash (PBKDF2-SHA256), so nobody, including us, can read it. If you ask for a password reset, we store a single-use code that expires after 1 hour and email you the link.
• Where it's kept. Your email, order ID and password hash are kept in Cloudflare Workers KV, the database of our hosting provider, so you can log in on any device and so refunds can be applied. To protect your account we briefly note failed log-in attempts (cleared after 15 minutes). About once a week the app checks that your access is still active.
• Email (optional). If you request free Day 1 access, we store your email address with our email provider so we can send it, along with a small number of follow-up emails. You can unsubscribe at any time.

2. What we don't collect

• Your check answers and training progress stay on your device. The free muscle check and your progress run and are stored in your browser. They are not sent to us or stored on our servers.
• We do not sell or rent your personal information, and we do not use it for advertising profiles.

3. How we use information

We use your information to deliver the Program, verify your access, provide support, process refunds, send emails you asked for, and meet legal and tax obligations.

4. Service providers

We use PayPal for payments, Cloudflare to host this website and keep account records, MailerLite for optional emails, and Resend to deliver password-reset emails. They process data on our behalf under their own privacy terms. Some may store data outside your country, with appropriate safeguards.

5. Cookies and storage on your device

• Essential (always on). A log-in cookie (uc_access) and your browser's local storage keep you logged in and store your training progress, check answers and settings (voice, accessibility, your cookie choice). Apart from the log-in token, which our server checks, none of this leaves your device.
• Payment. When the checkout loads, PayPal sets its own cookies, which it needs to process the payment and prevent fraud.
• Analytics (only if you tap "Accept"). We may use Cloudflare Web Analytics, which counts visits without cookies and without tracking you across websites. If you choose "Essential only", it doesn't load.

We don't use advertising cookies. You can change your choice anytime with "Cookie preferences" at the bottom of every page.

6. Retention

We keep your account (email and password hash) until you ask us to delete it. Password-reset codes expire after 1 hour. We keep purchase records (order ID, amount, date) as long as tax and accounting law requires. We keep email subscriber data until you unsubscribe or ask us to delete it.

7. Your rights, including deleting your data

Depending on where you live (including under the EU and UK GDPR, the California Consumer Privacy Act as amended by the CPRA, and Israel's Privacy Protection Law), you have the right to access, correct, export or delete your personal information, and to object to or restrict its processing.

To delete your account: email support@undercore.app from the address you use to log in. We delete your account record (email and password hash) within 30 days and confirm by email. We keep only the purchase details that tax law requires, with no password attached.

We do not sell or share your personal information as those terms are defined in the CCPA, and we won't treat you differently for using your rights. You can also complain to your local data protection authority.

8. Age

The Program is for adults 18 and over. We don't knowingly collect information from anyone under 18.

9. Changes

If we change this policy, we'll post the update here with a new date.

10. Contact

support@undercore.app

Terms · Privacy · Refund policy · Accessibility · Cookie preferences