Privacy

Last updated: 13 October 2026

The short version

• To run your membership we keep your email address, your name if you give it, and your membership and payment status. Payments are handled by Stripe; we never see your full card number.
• In the app, we back up the quest data you log so it comes back on a new phone. Some of it is about your health, so we treat all of it as sensitive. You can switch the backup off.
• We never sell your data, never use it for advertising, and never share it with anyone for their own use.
• The website counts visits without cookies and without building a profile of you. The app has no analytics, no ads and no third-party trackers.
• You can export what you have logged and delete your account at any time.
• New Heroes is for adults 18 and over.

1. Who we are

New Heroes ("New Heroes", "we", "us") runs this website, its membership, the New Heroes community and the New Heroes app. We are responsible for the personal data described here. Contact us about anything in this policy at elon@elonmuscular.com.

2. On this website

• Joining and signing in. When you join or sign in, we keep your email address, your name if you give it, your membership status and where you signed up from (for example which page you joined on). Our website and membership run on Ghost(Pro).
• Payments. Stripe takes your payment and keeps your billing details. We see the payment's status and the last digits of the card, never the full card number.
• Cookies. When you sign in, the site sets a cookie that keeps you signed in. We set no advertising cookies.
• Visitor counts. The site counts page views and where visits come from with Ghost's built-in stats, which use no cookies and build no profile of you.
• Emails from the site (sign-in links and account emails) may record whether they were opened or a link was clicked, so we know they arrive.
• Things the pages load. Pages load fonts from Google Fonts and some site scripts from jsDelivr, and the checkout loads Stripe's script. Like any website, these providers see your IP address when your browser fetches from them.
• Coaching. If you buy coaching, we keep your email, the hours you bought and our booking emails with you, and we write a summary of each hour for you. Tell us only what you want to talk about; you can ask us to delete the summaries at any time.

3. The community

The New Heroes community runs on Circle. When you join, our server gives your email address to Circle so you can get in, and takes your access away if your membership ends. What you post there, and your Circle profile, are covered by the community's house rules and Circle's own policies.

In the app, Share milestones is off until you turn it on. With it on, your Day 7, Day 30 and Day 66 on a quest reach the community and your New Heroes emails, and your class's weekly count ("N men held 5 or more of their 7 days") includes you, as a total, never by name. It never shares the protocol, its subject, your numbers, scores, answers or notes. Turning it off removes the marks.

4. Email

Sign-in codes for the app are sent by Resend. Member emails (welcome, getting started, Day 30 and your next quest) come from our email provider, Kit. The New Heroes letter comes only if you said yes to it. Kit never receives your protocols, log, numbers, scores or anything else about your health. The unsubscribe link in any email stops every email from Kit at once. Sign-in codes still come when you ask for one.

5. In the app

Backed up to our server

When you are signed in and Back up my quest is on (Profile), the app backs up the following so it is safe and follows you to a new phone. It is on from sign-in; turn it off and none of it leaves your phone, and you can delete the copy already on our server.

• the protocols you are running, have finished or have dropped, and the dates;
• the moves you ticked each day, and the days you planned moves for;
• the one daily number each protocol asks you to track, such as a sleep or mood rating;
• your questionnaire totals and their dates (the total score, not your individual answers);
• your progress through guided quests, and your settings;
• which ticks Apple Health or Health Connect made in the last 14 days (the move and the date, not the readings).

The name of a protocol can say something about your health, and questionnaire totals are health information, so we treat all of it as health data. We store it for you and give it back to you. Nothing in it is analysed, used to profile you or used for marketing. The only thing read from it is your count of logged days, and only with Share milestones on (section 3).

Stays on your phone

• Your onboarding answers, including any physical limits you told us about (such as a heart condition, prescription medicine or recent surgery), and your archetype result.
• Your reminder times. Reminders are scheduled by your phone; we hold no device token.
• Apple Health / Health Connect readings. If you connect, the app reads your steps, sleep and workouts on the phone to tick the moves those numbers meet. It reads nothing else and writes nothing. The readings never leave your phone and are never used for advertising, sold or shared.
• Your sign-in token, kept in the phone's secure storage.

Technical data

Our sign-in server uses your IP address for one hour at a time to stop repeated sign-in attempts; those counters are deleted after two hours. Sign-in codes are stored only as a one-way hash, last 10 minutes and are deleted after a day. The app has no analytics, no advertising identifiers, no crash reporting, no location, contacts, photos or microphone access, and no third-party tracking code.

6. Who handles your data for us

A small number of providers run parts of New Heroes. They process data only on our instructions and only to run the service.

We never sell or "share" your personal data (as California law defines those words) and never disclose it for targeted advertising. We may disclose data if the law requires it, to protect someone's safety, or as part of a sale or merger of the business, in which case this policy keeps protecting it. Our providers are mostly in the United States; if you are in the EU or UK, your data may be processed there under the providers' Standard Contractual Clauses.

7. How long we keep it

• Membership and backed-up quest data: until you delete it or your account.
• Sign-in codes: deleted after a day. Sign-in rate-limit counters: deleted after two hours.
• Email lists: while you are a member or subscribed to the letter. After you unsubscribe, your address is kept only as "unsubscribed" so it is never emailed again.
• Consent records (your yes or no to Share milestones and the letter): while the consent stands and for three years after, as proof.
• Billing records: as long as tax and accounting law requires.
• Database backups: deleted data leaves our rolling backups within 30 days.

8. Your rights

Wherever you live, you can:

• Get your data: in the app, Profile, Export my data gives you everything you have logged as a spreadsheet file. For anything else, email us.
• Delete your data only: Profile, Delete my data only. Your membership stays.
• Stop the backup: Profile, Back up my quest, off.
• Delete your account: Profile, Account, Delete my account. This ends your membership and its billing, deletes your backed-up data, signs out every phone and unsubscribes you from every New Heroes email. Within 30 days we also erase you from our email list, our website's member list, the community and our working tools. Billing records stay as tax law requires. If you no longer have the app, email us from the address you joined with and we will delete your account within 30 days.
• Correct your data, withdraw consent or stop emails: fix your logs in the app, turn off Share milestones, use any unsubscribe link, or email us.

EU, UK and EEA: you can also restrict or object to processing and complain to your data protection authority. We answer requests within one month. Our legal bases are the contract you signed up for (your account, backup and member emails), your consent (health data backup, Share milestones and the letter, each withdrawable at any time), our legitimate interest in keeping the service secure, and legal obligations such as billing records.

California and other US states with privacy laws: you can know, delete and correct what we hold, and opt out of sale, sharing and targeted advertising (we do none of them), and limit the use of sensitive information (we use it only to provide the service). We will not treat you differently for using any right. We collect identifiers (email) and sensitive information (health data you log), from you, for the purposes above, and disclose them only to the providers in section 6.

Consumer health data (Washington, Nevada, Connecticut and similar): we collect consumer health data only as listed in section 5, only to provide the service, never sell it and share it only with the providers in section 6. You can see it, withdraw consent and delete it as above.

To use any right, email elon@elonmuscular.com. We will confirm it is you by emailing the address on the account.

9. Security

Data travels encrypted (HTTPS). Sign-in codes are stored only as salted hashes. Our database is closed to the public; only our sign-in server can read it, and our providers encrypt their disks. Your sign-in token is kept in your phone's secure storage. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

10. Adults only

New Heroes is for men 18 and over. We do not knowingly collect data from anyone under 18. If you believe someone under 18 has an account, email us and we will delete it.

11. Not a medical service

New Heroes is general information for self-improvement, not medical advice, and it does not diagnose, treat, cure or prevent any medical condition. See the Terms.

12. Changes

If we change this policy in a way that matters, we will update the date at the top and tell you by email or in the app before the change applies.

13. Contact

New Heroes. Email: elon@elonmuscular.com