Your privacy is important to us. This policy explains how we collect, use, and protect your information.
When you register for an account, we collect your email address and password (managed via Supabase for authentication). We also ask for your name, birthdate, and gender to personalize your profile. Your username is visible to other users, but it's not used for account authentication.
We use approximate GPS location to track where you do your cold plunge sessions. This data is stored on our private and secure AWS servers. You can disable location services at any time in your device settings, though some features may become unavailable.
We request access to your camera and media library so you can capture and upload pictures or videos of your cold plunge sessions. Uploaded media is stored in our private and secure AWS S3 servers. Public profiles allow all users to view your media, while private profiles restrict viewership to approved friends only.
We send push notifications for session reminders, social updates (e.g., friend/follower requests), and important app feature updates. You can opt out of push notifications via your device settings.
PlungePalz records the wellness sessions you log in the app, including session type, duration, temperature, perceived difficulty, and heart rate data where your connected smartwatch provides it. This data is stored on our private and secure AWS infrastructure.
If you choose to connect an external integration — Garmin, Oura, Apple Health, or Strava — we access data from that platform in accordance with that platform's developer agreement. Retention periods differ by platform and are described in Section 13. Strava data specifically is held only as a transient cache and is never retained longer than seven days.
You may disconnect any integration at any time, which permanently deletes the associated data from our systems.
We collect usage metrics such as how quickly users open notifications and the length of their activity sessions. This data is stored in a NoSQL DynamoDB database on AWS. We do not track specific times of usage.
We collect transaction data when users earn "PlungePoints" (e.g., completing challenges, logging sessions). In-app purchases are tracked via RevenueCat. This helps us update your points balance and reward redemptions.
We use the collected information to:
We rely on trusted partners to operate and improve our Services:
Handles user authentication (email, password)
Hosts our servers, stores your media, and runs backend services
Manages in-app purchase tracking
Provides your Strava activity data for display to you within PlungePalz, and receives PlungePalz sessions you choose to export
Provides activity and wellness data you have authorized
Provides readiness and sleep data you have authorized
Provides health and fitness data you have authorized
These providers have limited access to your data solely to perform tasks on our behalf and are obligated not to disclose or use it for other purposes.
We may share your email address, device and advertising identifiers, and certain PlungePalz usage and conversion data with advertising and attribution partners — including Meta Platforms, Inc. — so that we can measure how people discover PlungePalz and reach other contrast therapy enthusiasts. We may also share your email address with affiliates or marketing partners for co-marketing and promotional activities. Under California law this constitutes "sharing" for cross-context behavioral advertising. You can opt out at any time — see Section 8 for how.
Exclusion of integration data. We do not sell, license, lease, share, transfer, or otherwise disclose any data obtained from the Strava API, Garmin Connect API, Oura API, or Apple Health — or any data derived, aggregated, anonymized, or de-identified from that data — to any advertiser, data broker, AI application provider, model developer, affiliate, marketing partner, or any other third party, for any purpose, including personalized or targeted advertising. This exclusion applies regardless of any consent you may give. This data is used solely to operate the features of PlungePalz you have chosen to enable.
We do not display advertisements on any screen that shows Strava data.
If we are involved in a merger, acquisition, asset sale, or bankruptcy, your personal data may be transferred as part of that transaction.
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
We retain your personal data as long as you have an active account. If your account is inactive for 10 years, we may delete your data. Once you choose to delete your account, we will remove your personal data (including your PlungePoints) within a reasonable timeframe, unless legal obligations require us to retain certain records.
Exception — connected service data. Data obtained from third-party integrations is subject to shorter, stricter retention periods set by those platforms' developer agreements. Strava data is never retained for longer than seven (7) days, is held only as a transient cache, and is permanently deleted upon disconnection or account deletion. See Section 13 for full detail on Strava data retention and deletion.
We use various measures to protect your data:
Secure server infrastructure via AWS
Encryption in transit (SSL/TLS)
Restricted internal access and private API gateways
Important: Despite our best efforts, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.
Our servers are located in the United States. If you access our Services from outside the U.S., your data may be transferred and processed here. By using our Services, you agree to this transfer and processing of your information.
We collect and process your personal data under lawful bases such as consent, contractual necessity, or legitimate interests. You have the right to access, rectify, or erase your data, restrict or object to its processing, and request a copy in a machine-readable format.
If processing is based on consent, you may withdraw consent at any time by contacting us at support@plungepalz.com.
Integration data is never shared. Data obtained from Strava, Garmin Connect, Oura, or Apple Health is excluded from all sharing described above. It is never disclosed to Meta Platforms or to any other advertising, attribution, or analytics partner, under any circumstances, regardless of your opt-out setting.
To exercise these rights, contact us at support@plungepalz.com.
Our Services are intended for users 18 years of age or older. We do not knowingly collect data from anyone under 18. If you believe we have collected personal information from a minor, please contact us at support@plungepalz.com, and we will take steps to delete such information.
You are responsible for the content you upload. By uploading content, you grant us permission to display it under your chosen privacy settings (public or private).
Our Services may feature articles or links related to health or wellness (e.g., "Should you cold plunge before or after a workout?"). Such content is provided for informational purposes only; we disclaim any liability for actions taken based on third-party advice.
Always consult a qualified professional before making health-related decisions. We are not responsible for the content or privacy practices of external websites or services linked to within our platform.
We may update this policy from time to time to reflect changes in our practices or for legal reasons. The "Last Updated" date at the top indicates the most recent revision. For significant updates, we will notify you via email before they take effect.
You may delete your account at any time, which will remove all your personal data and forfeit any remaining PlungePoints.
You can unsubscribe from marketing or promotional emails by clicking the "unsubscribe" link or by contacting us directly.
If you wish to access, correct, or delete your personal information, or if you have any questions about your rights, email us at support@plungepalz.com.
California residents may opt out of the sharing of personal information for cross-context behavioral advertising. See Section 8 for details and opt-out methods.
PlungePalz optionally integrates with the Garmin Connect Developer API, the Oura API, Apple Health, and the Strava API. Connecting any of these integrations is entirely optional and fully within your control. You are not required to connect any external data source in order to access or use PlungePalz, including the PlungePalz AI Advisor, which is fully functional using only the session data you record directly within PlungePalz.
You may disconnect any integration at any time from within the PlungePalz app, and PlungePalz does not charge any fee for connecting to or using any integration.
Our use of each external data source is governed by the respective developer program agreement for that platform. By connecting an integration, your data from that platform is handled in compliance with:
Where any conflict exists between this Privacy Policy and the Strava Privacy Policy, the Strava Privacy Policy controls with respect to Strava data.
Effective July 30, 2026, Strava-sourced data is no longer read, ingested, or used by the PlungePalz AI Advisor or the PlungePalz Wellness Score in any form.
This change was made to comply with Section 5.3 of the Strava API Policy, which prohibits the use of Strava data, directly or indirectly, in connection with the development, training, evaluation, or operation of any AI application.
Specifically, Strava-sourced data is not:
Strava data is used for exactly one purpose in PlungePalz: displaying your own Strava activities back to you, in a single read-only view within the app. It is never displayed to any other user, never included in social feeds, club feeds, leaderboards, challenges, or notifications, and never made visible to anyone other than the Strava account holder.
The PlungePalz AI Advisor continues to operate using your PlungePalz session data and, where you have chosen to connect them, your Garmin, Oura, and Apple Health data — each of which is permitted under those platforms' respective developer agreements.
When you connect your Strava account, we collect the following via the Strava API v3:
How it is collected: through OAuth 2.0 authorization that you initiate and approve on Strava's own website, followed by authenticated requests to the Strava REST API and receipt of Strava webhook events. We never ask for or store your Strava username or password.
Where it is processed: exclusively within PlungePalz's private AWS infrastructure in the United States. Access tokens are encrypted at rest using AWS Key Management Service.
What we send to Strava: if you enable activity export, PlungePalz creates a corresponding activity in your Strava account for wellness sessions you record in PlungePalz. You control this and may disable it at any time.
In accordance with Section 6.2 of the Strava API Policy, we do not retain Strava data for longer than seven (7) days. Strava data is held only as a transient cache to render your activity view, and is automatically expired. We do not maintain any permanent archive, database, search index, vector store, or other persistent index of Strava data or data derived from it.
If you delete an activity on Strava, that deletion is reflected in PlungePalz within forty-eight (48) hours.
You may withdraw your consent and disconnect Strava at any time, by either method:
Either method immediately revokes PlungePalz's access token and triggers permanent deletion of all Strava data and all personal data derived from Strava data from every system, database, and server under our control. Deletion is completed promptly and in all cases within thirty (30) days. The same deletion occurs automatically if you delete your Strava account or your PlungePalz account.
Confirmation of deletion: once deletion is complete, we will send written confirmation to the email address associated with your PlungePalz account. You may also request confirmation at any time by emailing support@plungepalz.com.
You may request a copy of any Strava-sourced data we hold about you at any time by emailing support@plungepalz.com. Separately, Strava provides every athlete with a free Bulk Data Export tool for their complete Strava data, available directly from your Strava account settings.
Strava may monitor and collect usage data relating to PlungePalz's use of the Strava API, and may use that usage data for any business purpose, whether internal or external — including providing enhancements to the Strava API or the Strava platform, providing developer or user support, and ensuring compliance with its developer agreements.
Amazon Web Services (AWS) is the only subprocessor that processes Strava data on our behalf. AWS provides the hosting, compute, storage, and database infrastructure on which PlungePalz operates, located in the United States.
No other service provider receives Strava data. Strava-sourced data is never transmitted to our search provider, our messaging provider, our subscription management provider, any analytics or attribution provider, any advertising platform, or any other third party.
We are responsible for the acts and omissions of our subprocessors, and each is bound by data protection obligations no less protective than those described in this policy. We will provide a current subprocessor list on request.
If you have any questions about this Privacy Policy or our data practices, please contact us at: