Privacy Policy

This Privacy Policy explains how Candyblocks Inc, 250 - 997 Seymour St, Vancouver, BC, Canada V6B 3M1 (“we”, “us”) collects, uses, and shares personal information when you use this website, take the quiz, buy a plan, or use the Military Fit iOS app (together, the “Service”). It also explains the choices you have. By using the Service you agree to this policy.

Information you provide

• Quiz answers. Your age range, sex, goals, current and target body type, focus areas, injuries and conditions you tell us about, lifestyle and activity answers, fitness level, schedule preferences, height, weight, target weight, and an optional event date. Some of these are health-related; see Section 3.
• Checkout details. Your email address and the plan you buy. Your card details are entered directly with our payment processor, Stripe, and never reach our servers.
• Support messages. Anything you send to support@candyblocks.com.

Information collected automatically

• A random identifier we create on your first click (see Section 6), which links your quiz to your purchase and to the app.
• Device and usage data: IP address, browser or device type, operating system, the pages and screens you visit, the time and date of your visit, and how you move through the quiz and the app.
• In the app, crash reports and performance data.

Information from others

• Purchase and subscription status from RevenueCat, Stripe, and Apple, such as the product bought, price, currency, renewal date, and whether a subscription is active. Apple does not share your payment details with us.
• Ad interaction data from Meta when you arrive from one of our ads, via Meta's cookies (see Section 5).

We do not collect precise location data, and we do not ask for your name or phone number on this website.

Your height, weight, target weight, body type, injuries, and similar quiz answers are information about your health. We collect them only to build and adjust your plan and to show you your assessment and projections. By entering them you consent to us processing them for that purpose.

We do not sell health-related information, and we do not share it with advertising platforms. The events we send to Meta (Section 5) contain only the fact that a page was viewed or a purchase was made, the product, and the price. You can withdraw consent and have this information deleted at any time by emailing support@candyblocks.com.

• To build your personalized plan and deliver it in the app.
• To process purchases, activate your plan, send receipts and activation links, and manage subscriptions and refunds.
• To answer support requests.
• To understand how the quiz and app are used, fix problems, and improve the Service.
• To measure and improve our advertising, subject to your choices in Section 5.
• To send you service messages, and marketing emails where you have agreed to receive them. You can unsubscribe at any time.
• To detect fraud and abuse, enforce our Terms, and comply with law.

Where the law of your region requires a legal basis, we rely on the performance of our contract with you, your consent (for health-related information and for marketing), and our legitimate interests in operating, securing, and promoting the Service.

Meta

This website uses the Meta Pixel and Meta's Conversions API to measure our Facebook and Instagram ads. When you view a page, reach the checkout, or complete a purchase, we send Meta an event with the page address, the product and price, Meta's cookie identifiers, your IP address and browser type, and a hashed version of the random identifier described in Section 6. Meta uses this to attribute purchases to ads and to build audiences, as described in Meta's Data Policy. In some regions this counts as “sharing” or “targeted advertising”.

You can turn this off for your browser at any time on our Privacy Settings page. Turning it off stops the Meta Pixel from loading and stops the server-side events. You can also manage ad preferences in your Meta account settings.

Analytics and diagnostics

We use analytics tools to record which quiz steps and app screens you visit and where you drop off, tied to the random identifier, so that we can improve the flow. The app also uses crash and error reporting. These providers process data on our behalf and are listed in Section 7.

This website uses a small number of cookies and browser storage entries:

• rc_app_user_id: a random identifier set on your first click, kept for 30 days, so that your quiz, purchase, and app activation link together. Essential.
• _fbp and _fbc: set by Meta when the Pixel is enabled, to attribute visits and purchases to ads. Advertising; off when you opt out.
• Browser storage holding your quiz answers so you can resume, your purchase confirmation for the success page, and your privacy setting. Essential; stays on your device and is not sent to us until you buy a plan.

You can clear these in your browser settings. Clearing the identifier before you finish checkout will start a new quiz.

We share personal information only with providers who process it for us under contract, and as required by law. We do not sell personal information.

• Vercel: hosts this website and its server functions.
• RevenueCat: web checkout, subscription management, activation links, and receipt emails; also manages in-app purchases.
• Stripe: payment processing for web purchases.
• Apple: App Store purchases and subscriptions.
• Meta: ad measurement, as described in Section 5.
• Amplitude: product analytics for the app and website.
• Sentry, Google Firebase and Crashlytics, Expo: app infrastructure, crash reporting, and diagnostics.

We may also disclose information when required by law or legal process, to protect our rights or the safety of any person, to investigate fraud, or as part of a merger, acquisition, or sale of our business, in which case this policy will continue to apply to your information.

We keep your quiz answers and plan for as long as you use the Service and for a reasonable period afterwards so that you can resume or reactivate. We keep purchase records for as long as required for tax, accounting, and dispute purposes. Advertising event data is retained by Meta under its own policy. You can ask us to delete your information at any time (Section 9).

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, to object to or restrict certain processing, to withdraw consent, and to complain to a privacy regulator. To exercise any of these, email support@candyblocks.com from the address you used at checkout. We will verify your request and respond within the time the law requires. We will not treat you differently for exercising your rights.

Opting out of advertising

Use the Privacy Settings page. This is our “Do Not Sell or Share My Personal Information” and “opt out of targeted advertising” control for residents of California and other US states with similar laws.

Canada

We are based in British Columbia and handle personal information under the Personal Information Protection and Electronic Documents Act and applicable provincial law. Quebec residents may also exercise their rights under Law 25 by contacting us.

EU, EEA, UK and Switzerland

You have the rights described above under the GDPR and UK GDPR. Our legal bases are listed in Section 4. Where we rely on consent, you may withdraw it at any time without affecting earlier processing.

Marketing email

Every marketing email includes an unsubscribe link. Service emails such as receipts and activation links are sent regardless.

We and our providers process information in Canada, the United States, and other countries where they operate. Those countries may have different data protection laws than yours. Where required, we use contractual safeguards such as standard contractual clauses for these transfers.

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact support@candyblocks.com and we will delete it.

We use physical, technical, and organizational safeguards to protect the information we hold, including encryption in transit and access controls. Card details are handled entirely by Stripe. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

We may update this policy from time to time. We will post the new version on this page and update the effective date, and where a change is material we will give reasonable notice by email or in the app. Continued use of the Service after a change means you accept the updated policy.

Candyblocks Inc, 250 - 997 Seymour St, Vancouver, BC, Canada V6B 3M1. Email: support@candyblocks.com.